# Target: product

map $http_cf_ipcountry $is_blocked {
    default 0;
}

map $request_uri $ignore_path_block {
    default 0;
    /sitemap.xml 1;
    /robots.txt 1;
}

server {
    listen 80 default_server;

    add_header X-Frame-Options "DENY";
    add_header Content-Security-Policy "frame-ancestors 'self' https://*.clevernt.com https://*.cleverwebserver.com https://*.cleverhttp.com;";
    add_header X-XSS-Protection "1; mode=block";

    access_log /var/log/nginx/host.access.log;
    error_log /var/log/nginx/host.error.log debug;

    server_tokens off;
    client_max_body_size 10M;

    location = / {
        add_header X-Frame-Options "DENY";
        add_header Content-Security-Policy "frame-ancestors 'self' https://*.clevernt.com https://*.cleverwebserver.com https://*.cleverhttp.com;";
        add_header X-XSS-Protection "1; mode=block";
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    location / {
        set $blocked 0;

        if ($is_blocked ~ 1) {
            set $blocked 1;
        }

        if ($ignore_path_block ~ 1) {
            set $blocked 0;
        }
        
        root   /usr/share/nginx/html;
        index  index.html index.htm;
        try_files $uri /index.html =404;

        location ~* ^/resources/crash_.*(atlas|png|json) {
            add_header X-Frame-Options "DENY";
            add_header Content-Security-Policy "frame-ancestors 'none';";
            add_header X-XSS-Protection "1; mode=block";
            add_header Cache-Control "no-store, no-cache, must-revalidate";
            proxy_no_cache 1;
            try_files $uri $uri/ =404;
        }

        location ~* \.(?:ico|css|js|gif|jpe?g|png|svg|woff|ttf|eot|json|atlas)$ {
            try_files $uri $uri/ =404;
        }
    }

    location ~* \.(jpg|jpeg|png|gif|ico|css|js|pdf)$ {
        expires 7d;
        add_header Cache-Control "public";
    }
}
