# WKD-server (advanced method). Alleen /.well-known/openpgpkey/ heeft inhoud.
server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    server_tokens off;
    access_log off;                       # sleutelopvragingen niet loggen (geen adres-sporen)

    location = / {
        default_type text/plain;
        return 200 "OpenPGP Web Key Directory (advanced method). Zie /.well-known/openpgpkey/<domein>/policy\n";
    }

    location /.well-known/openpgpkey/ {
        # spec: sleutel binair als application/octet-stream; CORS-* voor browser-clients (Mailvelope e.d.)
        types { }
        default_type application/octet-stream;
        add_header Access-Control-Allow-Origin "*" always;
        add_header Cache-Control "public, max-age=3600" always;
        autoindex off;
        try_files $uri =404;              # ?l=<local-part> wordt genegeerd (statisch bestand)
    }

    location / { return 404; }
}