add basic encryption. note that keys are publicly available

the intent is just to prevent dragnet snooping

1 files changed, 6 insertions, 0 deletions

diff --git a/etc/nginx/sites-available/yummers.dev b/etc/nginx/sites-available/yummers.dev
index c1162a6..5eb4fef 100644
--- a/etc/nginx/sites-available/yummers.dev
+++ b/etc/nginx/sites-available/yummers.dev
@@ -51,6 +51,12 @@ server {
       add_header Access-Control-Allow-Origin "*" always;
     }
 
+    # Key files must never be cached client-side
+    location ~ \.key$ {
+      add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+      add_header Access-Control-Allow-Origin "*" always;
+    }
+
     # Segment files (.ts) can be cached - they're immutable
     location ~ \.ts$ {
       add_header Cache-Control "public, max-age=30" always;