diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf
index f428ba9fdb62cac0a123ea3c6832ab5d29d1c4e3..2f0ef982123bb9d0b9cfad0571b9a3f929456b4e 100644
--- a/nginx/conf.d/default.conf
+++ b/nginx/conf.d/default.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
server {
listen 80 default_server;
listen [::]:80 default_server;
diff --git a/nginx/conf.d/global.conf b/nginx/conf.d/global.conf
index 608fe8de67213f080cf2736ceceab71c26117be1..b3623a9bd31dfaa99a94b789919279b270d784e9 100644
--- a/nginx/conf.d/global.conf
+++ b/nginx/conf.d/global.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
# The resolver for the Docker network.
resolver 127.0.0.11 valid=30s;
gzip on;
diff --git a/nginx/conf.d/status.conf b/nginx/conf.d/status.conf
index 6ecb7d85dd156109d327ee8d4b3e0ba39ce1681d..22dab122ec9302633834aaa13aab766acaa6d0c4 100644
--- a/nginx/conf.d/status.conf
+++ b/nginx/conf.d/status.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
server {
listen 80;
listen [::]:80;
diff --git a/nginx/snippets/ads-txt.conf b/nginx/snippets/ads-txt.conf
index b074c08328eef2bc8a18f41937ff787ceacbe6ba..acd9b93d8e3ad2e701666313fb3a6effbbda276e 100644
--- a/nginx/snippets/ads-txt.conf
+++ b/nginx/snippets/ads-txt.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
location = /ads.txt {
if ($scheme = http) {
return 301 https://$host$request_uri;
diff --git a/nginx/snippets/allow-ns1.conf b/nginx/snippets/allow-ns1.conf
index bdadb248d461af214acec72962ed6f45b9ac4651..6cdf88b43ceef1915719a9a1c03814bf6970bcd8 100644
--- a/nginx/snippets/allow-ns1.conf
+++ b/nginx/snippets/allow-ns1.conf
@@ -1 +1,2 @@
+# vim: ft=nginx
allow 62.219.131.121; # ns1.shore.co.il
diff --git a/nginx/snippets/allow-ns4.conf b/nginx/snippets/allow-ns4.conf
index 5e39f4028d30aa2529179de757b07a19d4039ff6..395de013f0c148010514fb5333f3833fe8a84cfb 100644
--- a/nginx/snippets/allow-ns4.conf
+++ b/nginx/snippets/allow-ns4.conf
@@ -1 +1,2 @@
+# vim: ft=nginx
allow 163.172.74.36; # ns4.shore.co.il
diff --git a/nginx/snippets/allow-private-ips.conf b/nginx/snippets/allow-private-ips.conf
index 154262aa4070edf80c878a8fba8cdf6a9f03030a..5e798a0a9bc45123a556f296019018c3ef33a29a 100644
--- a/nginx/snippets/allow-private-ips.conf
+++ b/nginx/snippets/allow-private-ips.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
allow 127.0.0.0/8;
allow 10.0.0.0/8;
allow 192.168.0.0/16;
diff --git a/nginx/snippets/allow-shore-ips.conf b/nginx/snippets/allow-shore-ips.conf
index 709b549d2e1c5e15fa5cd4c8d671a509181f6a0f..8fed4103de8e79c3168b2020656c25f53b764f6d 100644
--- a/nginx/snippets/allow-shore-ips.conf
+++ b/nginx/snippets/allow-shore-ips.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
include snippets/allow-ns1.conf;
include snippets/allow-ns4.conf;
include snippets/allow-private-ips.conf;
diff --git a/nginx/snippets/common-headers.conf b/nginx/snippets/common-headers.conf
index e97cb6890f107423095a68af45db2c4662ecc482..22a7e891e80bb258e9be4fd3eacd78b75f2f50ef 100644
--- a/nginx/snippets/common-headers.conf
+++ b/nginx/snippets/common-headers.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
# add_headers are inherited from previous level if and only if there are no
# add_header directives defined on the current level. So any time there's an
# add_header directive there should be an `include snippets/common-headers.conf`
diff --git a/nginx/snippets/ldap-auth.conf b/nginx/snippets/ldap-auth.conf
index 822c4407093249d3d77133c9e93b86374b2afae9..0c0966952e5457e0d610363cdbc8d380dd07c96d 100644
--- a/nginx/snippets/ldap-auth.conf
+++ b/nginx/snippets/ldap-auth.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
auth_request /validate;
location = /validate {
diff --git a/nginx/snippets/proxy-headers.conf b/nginx/snippets/proxy-headers.conf
index e1420368822afd1ec4d574b95a2403909fe2a439..19fe814d5363f07c152df8f903c728ce7df4e9a2 100644
--- a/nginx/snippets/proxy-headers.conf
+++ b/nginx/snippets/proxy-headers.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
diff --git a/nginx/snippets/proxy-ssl.conf b/nginx/snippets/proxy-ssl.conf
index b83886af06e69be66442d924d1ca1c2f58c88125..b09e3bf8c1fd6ec8b48cd592837dddf94769c463 100644
--- a/nginx/snippets/proxy-ssl.conf
+++ b/nginx/snippets/proxy-ssl.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
proxy_ssl_verify on;
proxy_ssl_verify_depth 3;
proxy_ssl_name auth.shore.co.il;
diff --git a/nginx/snippets/redirect-https.conf b/nginx/snippets/redirect-https.conf
index 991d5934ea26fdf1596be7731bca044be57e1a21..28f510ea7029be57c3e42ec34f05e8c73866c839 100644
--- a/nginx/snippets/redirect-https.conf
+++ b/nginx/snippets/redirect-https.conf
@@ -1 +1,2 @@
+# vim: ft=nginx
location / { return 301 https://$host$request_uri; }
diff --git a/nginx/snippets/redirect-www.conf b/nginx/snippets/redirect-www.conf
index 2d89d75e34296121d630cd90330793dff97ff19d..53940625def0c8651f127577300b0e2ded22e710 100644
--- a/nginx/snippets/redirect-www.conf
+++ b/nginx/snippets/redirect-www.conf
@@ -1 +1,2 @@
+# vim: ft=nginx
location / { return 301 https://www.$host$request_uri; }
diff --git a/nginx/snippets/robots-allow-all.conf b/nginx/snippets/robots-allow-all.conf
index 627aee5db300861870c3dc70c82016a4abd676c2..81fdd7cec33021a4e519c6e1acf8c7d471ac753b 100644
--- a/nginx/snippets/robots-allow-all.conf
+++ b/nginx/snippets/robots-allow-all.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
location = /robots.txt {
add_header Content-Type "text/plain; charset=utf-8";
return 200 "User-agent: *\nDisallow:\n";
diff --git a/nginx/snippets/robots-disallow-all.conf b/nginx/snippets/robots-disallow-all.conf
index 03d50312dfd4108ef9758ff8d65f4d090d0a4c1c..c5001aab541e070b0200d210cf1c4d9c702c8ab9 100644
--- a/nginx/snippets/robots-disallow-all.conf
+++ b/nginx/snippets/robots-disallow-all.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
location = /robots.txt {
add_header Content-Type "text/plain; charset=utf-8";
return 200 "User-agent: *\nDisallow: *\n";
diff --git a/nginx/snippets/security-txt.conf b/nginx/snippets/security-txt.conf
index c1f0d219b5dc1f4fe2537633a0c2ed58f05f10b3..5ce6a55c2a491368559a14597403c9d0aa005673 100644
--- a/nginx/snippets/security-txt.conf
+++ b/nginx/snippets/security-txt.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
location = /.well-known/security.txt {
if ($scheme = http) {
return 301 https://$host$request_uri;
diff --git a/nginx/snippets/ssl.conf b/nginx/snippets/ssl.conf
index cb1f77f67c32f78cacdde5ed8f5f0d74b346ac2c..14805f96e4f5d3f87137841317a3cc2079e1ce91 100644
--- a/nginx/snippets/ssl.conf
+++ b/nginx/snippets/ssl.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header Expect-CT "max-age=86400, enforce, report-uri=\"https://www.shore.co.il/about\"";
include snippets/common-headers.conf;
diff --git a/nginx/snippets/upgrade-secure.conf b/nginx/snippets/upgrade-secure.conf
index 2abc805d48d6d33d67fa70967ac85fc7075dc65c..3d1b4e60da85fab4408bdb8ca92c82738d962f36 100644
--- a/nginx/snippets/upgrade-secure.conf
+++ b/nginx/snippets/upgrade-secure.conf
@@ -1 +1,2 @@
+# vim: ft=nginx
if ($http_Upgrade-Insecure-Requests = 1) { return 301 https://$host$request_uri; }
diff --git a/nginx/snippets/vouch.conf b/nginx/snippets/vouch.conf
index 9571b80c28f366b99b57096ab7c23afacf61b46d..c731657446fedf7f8a5e8eebd2af103bde22b517 100644
--- a/nginx/snippets/vouch.conf
+++ b/nginx/snippets/vouch.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
# send all requests to the `/validate` endpoint for authorization
auth_request /validate;
diff --git a/nginx/snippets/websockets.conf b/nginx/snippets/websockets.conf
index 64b7e3736a33c2d1e6621b4b0d64076030759251..0f494e9801e74e1c1568fc052d99979e963b0474 100644
--- a/nginx/snippets/websockets.conf
+++ b/nginx/snippets/websockets.conf
@@ -1,3 +1,4 @@
+# vim: ft=nginx
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_read_timeout 36000s;
diff --git a/nginx/snippets/www-acme-challenge.conf b/nginx/snippets/www-acme-challenge.conf
index ba3c0b7117cdc522b64ab5593b5d888e72e8a7df..db17b301a17ce9bb3df3d8cee668299cc8cc040e 100644
--- a/nginx/snippets/www-acme-challenge.conf
+++ b/nginx/snippets/www-acme-challenge.conf
@@ -1 +1,2 @@
+# vim: ft=nginx
location /.well-known/acme-challenge/ { root /var/www/www.shore.co.il; }