nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

    gzip  on;

    server {
        listen       80;
        server_name  localhost;

        #access_log  /var/log/nginx/host.access.log  main;

        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }


        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }

        error_page   404  /404.html;
        location = /404.html {
            root   /usr/share/nginx/html;
        }

        # Rewrite for old url's
        location ~ ^/liwo/(.*) {
            return 301 /$1;
            absolute_redirect off;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }

# Allow to load from this website, from data: url's and from known sites.
# Allow eval() because that's used by the build system (webpack).
# Allow inline styling, which is also used by the  build system.
# Allow connections to rijkswaterstaat (for the backend) and deltares (during testing), to appspot (for the hydro-engine-service) and to earthengine at Google.
# Don't allow this site to be put in an iframe.
# Don't allow the content type to be determined by the content of the file.
# Allow geolocation, which could be used by the map to center on the current location.


# default-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl;
# form-action 'self';
# script-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl 'unsafe-eval';
# connect-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl *.deltares.nl *.deltares.nl:8080 *.appspot.com *.openstreetmap.org *.nationaalgeoregister.nl earthengine.googleapis.com *.toegankelijkheidsverklaring.nl *.pdok.nl;
# img-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl *.deltares.nl *.deltares.nl:8080 *.appspot.com *.openstreetmap.org *.nationaalgeoregister.nl earthengine.googleapis.com *.toegankelijkheidsverklaring.nl *.pdok.nl;
# style-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl 'unsafe-inline';
# frame-ancestors 'self';

    add_header Content-Security-Policy "default-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl; form-action 'self'; script-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl 'unsafe-eval'; connect-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl *.deltares.nl *.deltares.nl:8080 *.appspot.com *.openstreetmap.org *.nationaalgeoregister.nl earthengine.googleapis.com *.toegankelijkheidsverklaring.nl *.pdok.nl; img-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl *.deltares.nl *.deltares.nl:8080 *.appspot.com *.openstreetmap.org *.nationaalgeoregister.nl earthengine.googleapis.com *.toegankelijkheidsverklaring.nl *.pdok.nl; style-src 'self' data: *.rijkswaterstaat.nl *.rijksoverheid.nl 'unsafe-inline'; frame-ancestors 'self';";
    # don't allow iframing
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    # strip detailed information about the origin
    add_header Referrer-Policy "origin";
    # allow for the map to move to the current location
    add_header Feature-Policy "geolocation 'self'";

    # hide version numbers
    server_tokens off;

    # TODO: This needs to be tested
    error_page    404 /404.html;
    error_page    403 /403.html;

}