map $arg_download $media_disposition {
    default "";
    "1"     "attachment";
}

server {
    listen 80;
    server_name _;

    location /static/ {
        alias /app/staticfiles/;
        expires 30d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location ^~ /media/branding/ {
        alias /app/media/branding/;
        expires 7d;
        add_header X-Content-Type-Options nosniff always;
        access_log off;
    }

    location /protected-media/ {
        alias /app/media/;
        secure_link $arg_md5,$arg_expires;
        secure_link_md5 "$secure_link_expires$uri ${MEDIA_SIGNING_SECRET}";
        if ($secure_link = "") { return 403; }
        if ($secure_link = "0") { return 410; }
        add_header Content-Disposition $media_disposition always;
        add_header X-Content-Type-Options nosniff always;
        expires -1;
    }

    location = /healthz/ {
        default_type application/json;
        return 200 '{"status":"ok"}';
    }

    location / {
        return 404;
    }
}