diff --git a/Dockerfile b/Dockerfile
index 5cca212..70c4857 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,7 +22,7 @@ RUN echo "daemon off;" >> /etc/nginx/nginx.conf
 COPY default /etc/nginx/sites-available/default
 
 # Install pisg stuff for log generation
-RUN su -c 'mkdir /home/znc/pisg /home/znc/pisg/cache /home/znc/pisg/output' znc
+RUN su -c 'mkdir /home/znc/pisg /home/znc/pisg/cache /home/znc/pisg/output /home/znc/pisg/output/.pub' znc
 COPY pisg.py /home/znc/pisg/
 RUN chmod +x /home/znc/pisg/pisg.py
 
diff --git a/README.md b/README.md
index fa8ceb3..ff187e5 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,8 @@ This container creates [pisg]-style channel statistics ([example]) for any ZNC u
 
 The channel information is private, nginx is configured with HTTP basic authentication; the password is prompted for during setup.
 
+Individual channel statistic files can be made public by symlinking each, for example, to /home/znc/pisg/output/.pub/mychannel.html, which is public at http://server-ip/pub/mychannel.html. Directory listing for /pub/ is disabled.
+
 TODO
 ====
 
diff --git a/default b/default
index a766e04..3a45a1d 100644
--- a/default
+++ b/default
@@ -1,14 +1,18 @@
 server {
     listen 80 default_server;
     listen [::]:80 default_server ipv6only=on;
-        root /home/znc/pisg/output;
+    root /home/znc/pisg/output;
     index index.html index.htm;
     server_name localhost;
-    auth_basic "Restricted";
-    auth_basic_user_file /etc/nginx/htpasswd;
     location / {
         autoindex on;
         try_files $uri $uri/ =404;
+        auth_basic "Restricted";
+        auth_basic_user_file /etc/nginx/htpasswd;
+    }
+    location /pub/ {
+        autoindex off;
+        alias /home/znc/pisg/output/.pub/;
     }
     location /gfx/ {
         alias /usr/share/pisg/gfx/;