sps-nginx.example.conf

server {
    listen      443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/ssl/example.com/privkey.pem;

    add_header Referrer-Policy "same-origin" always;
    add_header X-Permitted-Cross-Domain-Policies none;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Content-Security-Policy "base-uri 'none'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self' https://hcaptcha.com https://newassets.hcaptcha.com; img-src https: 'self'; manifest-src 'self'; script-src 'self' https://hcaptcha.com https://newassets.hcaptcha.com ; style-src 'self' 'unsafe-inline';" always;

    if ($request_method !~ ^(GET|HEAD|POST)$ ) {
        return 405;
    }

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;
        proxy_pass http://127.0.0.1:8000;
    }

    location /media {
        root /home/user/simple-personal-site/static_serve;
        try_files $uri =404;
        expires 1M;
    }

    location /static {
        root /home/user/simple-personal-site/static_serve;
        try_files $uri =404;
        expires 1M;
    }

    location = /robots.txt {
        alias /home/user/simple-personal-site/static_serve/static/robots.txt;
    }
}