location /serve_uploads {
    internal;
    include /etc/nginx/zulip-include/api_headers;
    add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
    include /etc/nginx/zulip-include/uploads.types;
    alias /home/zulip/uploads/files;
}

location /user_avatars {
    include /etc/nginx/zulip-include/headers;
    add_header Content-Security-Policy "default-src 'none' img-src 'self'";
    include /etc/nginx/zulip-include/uploads.types;
    alias /home/zulip/uploads/avatars;
}
