server {
    listen 80;
    listen [::]:80;
    server_name code.monzero.org;

    client_max_body_size 1m;

    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Referrer-Policy no-referrer always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    location /assets/ {
        alias /usr/share/cgit/;
        expires 1d;
    }

    # Read-only smart HTTP cloning. Deliberately no git-receive-pack route.
    location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
        fastcgi_param GIT_PROJECT_ROOT /srv/git;
        fastcgi_param GIT_HTTP_EXPORT_ALL "";
        fastcgi_param PATH_INFO /$1/$2;
        fastcgi_pass unix:/run/fcgiwrap.socket;
    }

    location / {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
        fastcgi_param PATH_INFO $uri;
        fastcgi_param QUERY_STRING $args;
        fastcgi_pass unix:/run/fcgiwrap.socket;
    }
}