server {
    listen 8080;
    server_name _;

    access_log off;
    server_tokens off;

    location = /.well-known/webfinger {
        default_type application/jrd+json;
        add_header Cache-Control "no-store" always;
        add_header X-Content-Type-Options "nosniff" always;

        return 200 '{"subject":"acct:rafal@tailscale.ulfrx.dev","links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://auth.ulfrx.dev/application/o/tailscale/"}]}';
    }

    location / {
        return 404;
    }
}