# -----------------------------------------------------------------------------
# Security headers, kept in one file and `include`d into every location.
#
# Why an include rather than declaring these once at server level: nginx's
# add_header is *replacing*, not additive - the moment a location block
# declares any add_header of its own (a Cache-Control, say), every header
# inherited from the enclosing server block is silently dropped.  That is easy
# to miss precisely because nothing fails: the page still loads, just without
# its protections.  Including the same snippet everywhere makes each location
# self-contained, so adding a Cache-Control to a block can no longer disarm it.
#
# Note there is deliberately no Content-Security-Policy here: the SPA and the
# API documentation need different policies, so each location sets its own.
# -----------------------------------------------------------------------------
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;