server {
    listen 80;
    server_name _;

    root /srv/files;
    charset utf-8;

    # Security — no execution, no sniffing
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options SAMEORIGIN;
    add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:;";

    # Serve diagrams, research, images, public with directory listings
    location / {
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
        try_files $uri $uri/ =404;
    }

    # Serve HTML files with correct content type (for visual-explainer output)
    location ~* \.html?$ {
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options SAMEORIGIN;
        add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: https://cdn.jsdelivr.net https://cdnjs.cloudflare.com;";
    }

    # Don't expose sensitive files
    location ~ /\. {
        deny all;
    }
    location ~* \.(env|sh|py|jsonl|json)$ {
        deny all;
    }
}
