shiny-server.conf

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

upstream shinysurvey {
    server 0.0.0.0:$R_PORT;
}

server {
    listen $PORT;

    server_name $HOSTNAME;

    if ($http_x_forwarded_proto != 'https') {
        return 301 https://$host$request_uri;
    }

    location / {
        proxy_pass http://shinysurvey;

        add_header Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src 'self'; upgrade-insecure-requests; block-all-mixed-content; reflected-xss block; base-uri https://$host;" always;
        add_header Strict-Transport-Security  "max-age=63072000; includeSubDomains; preload" always;
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options deny always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "no-referrer";
    }

    location /websocket {
        proxy_pass http://shinysurvey;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}