server {
  listen 80;
  server_name _;
  root /app;
  index index.html;

  location / {
    root   /app;
    index  index.html index.htm;
    try_files $uri $uri/ /index.html =404;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection 1;
  }
  
  location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {
    expires      30d;
  }

  location ~* \.(ini|sql|conf|bak)$ {
    return 404;
  }

  location ~* ^/(themes|images|logs|data|demo|wap_themes)/.*\.(php|php5)$ {
    deny all;
  }

  location ~ /\.(svn|git|)/ {
    deny all;
  }

  location ~ .*\.(js|css)?$ {
    expires      1h;
  }
}