nginx.conf

server {
    listen 80;
    server_name map.minecuna.co.uk;
    return 301 https://$server_name$request_uri;
}
server {
    listen 443 ssl;
    server_name  map.minecuna.co.uk;

    root  /var/www/map;
    index index.html;

    ssl_certificate /etc/letsencrypt/live/map.minecuna.co.uk/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/map.minecuna.co.uk/privkey.pem;

    ssl_prefer_server_ciphers Off;
    ssl_protocols TLSv1.2;
    ssl_ciphers ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1;

    ssl_dhparam /etc/ssl/private/dhparams.pem;

    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    # ssl_session_tickets off; # Requires nginx >= 1.5.9
    ssl_stapling on;
    ssl_stapling_verify on;

    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    server_tokens off;

    add_header Content-Security-Policy "default-src 'self'; img-src 'self' 'unsafe-inline' https://crafatar.com https://maps.gstatic.com https://google-maps-icons.googlecode.com; font-src https://fonts.gstatic.com; script-src 'self' 'unsafe-inline' https://map.minecuna.co.uk https://maps.google.com https://maps.googleapis.com https://ajax.googleapis.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;";
    add_header Referrer-Policy "no-referrer";
    add_header Strict-Transport-Security "max-age=63072000";
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Feature-Policy "camera 'none'; fullscreen 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; notifications 'none'; payment 'none'; push 'none'; speaker 'none'; sync-xhr 'none'; vibrate 'none';";

    location /.well-known/acme-challenge {
        root /var/www/letsencrypt;
    }

    location ~* .(jpg|jpeg|png|gif|ico|css|js)$ {
        expires 365d;
    }
}