add_header Content-Security-Policy "
    default-src: 'none';
    font-src data: https://yastatic.net;";