# Copiar a /etc/nginx/snippets/acampada26s-hub.conf
# OASIS escuchando en 127.0.0.1:3000 (node backend.js --public --no-open --host=127.0.0.1)
limit_except GET HEAD { deny all; }
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         "";
proxy_set_header X-Forwarded-For   "";
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 120s;
proxy_buffering on;
# add_header en location anula los del server: se repiten aquí todos menos la CSP.
add_header Strict-Transport-Security "max-age=63072000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Frame-Options "DENY" always;