There's a small list of endpoints on the Postgrest server. Requests for anything other than those will 404 so we should do that as soon as possible, in nginx, without bothering the server.
A naive approach is to add some extra filter conditions so nginx will block requests for:
- .txt
- .(jpg|png|ico)
- anything that's more than one level deep in the path
If we want to go further, we could have the server report what endpoints are valid and nginx only sends them on to the server. No idea if or how this is possible.