server {
    listen 3000;
    root /usr/share/nginx/html;
    index index.html;

    # Security-audit remediation (M-3): baseline browser security headers,
    # absent entirely before this. HSTS/nosniff/frame-options/referrer-
    # policy/permissions-policy carry no functional risk to this app and
    # are unconditionally safe to add.
    #
    # CSP is the one directive that needed real care rather than a
    # copy-pasted strict default: adapter-static's own build output
    # (web/build/index.html) genuinely contains two inline <script>
    # blocks -- SvelteKit's own hydration bootstrap and the dark-mode-
    # before-paint snippet -- so a naive `script-src 'self'` would break
    # every page load, not just XSS. Hash-pinning those two scripts
    # instead was considered and rejected: nginx.conf is a static file
    # this Docker image ships unmodified, with nothing in the build
    # pipeline that regenerates it per build, and SvelteKit's bootstrap
    # script embeds a build-specific identifier -- a hardcoded hash here
    # would silently start blocking the app's own hydration script on the
    # next unrelated rebuild, a far worse outcome than the gap this is
    # closing. `script-src`/`style-src` therefore keep `'unsafe-inline'`
    # (inline style attributes are also genuinely used, e.g. the Hosts
    # page's dynamic bar-width styling) -- this CSP is not a script-
    # injection defense by itself (the codebase already has no known XSS
    # vector to defend against -- see the security audit's "verified
    # clean" section), it's the other directives doing real work:
    # `object-src none` (no plugin-embed vector), `frame-ancestors none`
    # (clickjacking, redundant with X-Frame-Options but cheap insurance),
    # `base-uri self` (blocks base-tag hijacking), `form-action self`.
    # `connect-src *` stays permissive rather than enumerating this
    # deployment's actual api/alerting/enterprise-auth hosts, since those
    # are configured per-deployment via VITE_*_BASE_URL build args (see
    # web/Dockerfile) and a static nginx.conf has no way to know them.
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src *; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;

    location / {
        # adapter-static writes prerendered routes as flat <route>.html
        # files (e.g. /dashboards -> dashboards.html, confirmed by
        # actually inspecting the build output), not <route>/index.html --
        # $uri.html has to be in this chain or a request for exactly
        # "/dashboards" falls straight through to the SPA fallback and
        # skips the prerendered page it should be serving. 200.html (not
        # index.html) is the fallback shell for genuinely dynamic routes
        # (dashboards/[id] etc.) -- named differently so it doesn't
        # collide with "/" -> index.html, which really is prerendered.
        try_files $uri $uri.html $uri/ /200.html;
    }
}