server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name downloads.example.com;

    root /srv/downloads;
    autoindex off;

    include /etc/nginx/snippets/tls-example.conf;
    include /etc/nginx/snippets/security-headers.conf;
    include /etc/nginx/snippets/hsts.conf;
    include /etc/nginx/snippets/deny-sensitive-files.conf;

    limit_conn conn_per_ip 10;

    location / {
        limit_except GET HEAD { deny all; }
        try_files $uri =404;
        sendfile on;
        aio threads;
        directio 8m;
        add_header Content-Disposition "attachment" always;
        add_header X-Content-Type-Options "nosniff" always;
    }
}
