# HTTP bootstrap for a new host. Replace the domain, then add TLS.
# This file belongs inside nginx's http context, e.g. /etc/nginx/conf.d/.
server {
    listen 80;
    listen [::]:80;
    server_name tilde.example.net;
    root /usr/share/nginx/html;
    index index.html;

    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;

    location ^~ /.well-known/acme-challenge/ {
        root /var/lib/letsencrypt;
        default_type text/plain;
        try_files $uri =404;
    }

    # These precede the userdir regex so private files are denied there too.
    location ~ (^|/)\. {
        return 404;
    }

    # A static-only host must not download executable script source as text.
    location ~* \.(?:php[0-9]*|phtml|phar|cgi|pl|py|sh|lua)(?:/|$) {
        return 404;
    }

    location ~ "^/(?:~|u/)(?<tilde_user>[a-z_][a-z0-9_-]{0,31})(?<tilde_path>/.*)?$" {
        alias /home/$tilde_user/public_html$tilde_path;
        index index.html index.htm;
        autoindex off;
        disable_symlinks on;
    }

    location / {
        try_files $uri $uri/ =404;
    }
}