# /etc/nginx/snippets/security-headers.conf
#
# nginx's add_header inheritance is all-or-nothing: a location that sets any
# add_header of its own silently discards every header inherited from the
# server block. `/` resolves through try_files to `location = /index.html`,
# which sets Cache-Control — so without re-including this snippet there, HTML
# pages ship with no security headers at all.
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options    nosniff              always;
add_header X-Frame-Options           SAMEORIGIN           always;
add_header Referrer-Policy           strict-origin-when-cross-origin always;