# Included inside each `server { }` for CyberLux onion vhosts.
# Installed to /etc/nginx/cyberlux-server-common.inc by install-tor-onion.sh
# Requires /etc/nginx/conf.d/cyberlux-ddos-zones.conf in nginx `http { }`.

server_tokens off;

client_body_timeout 12s;
client_header_timeout 12s;
keepalive_timeout 65s;
send_timeout 30s;
reset_timedout_connection on;

error_page 429 = @cyberlux_rate_limited;

location @cyberlux_rate_limited {
    default_type text/plain;
    add_header Retry-After "10" always;
    add_header X-Cyberlux-Shield "rate-limited" always;
    return 429 "CyberLux onion shield: request rate limited. Retry shortly.\n";
}

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header X-Cyberlux-Shield "onion-edge" always;