From dbd77b3bb5eb3b8ba47293202ed713653cc83961 Mon Sep 17 00:00:00 2001 From: Brad Rodgers Date: Fri, 23 Oct 2026 17:03:38 -0400 Subject: [PATCH] nginx: immutable cache only for hashed assets; 7d for fixed-URL files; add avif Also repeats the security headers inside each location, since a location-level add_header drops the server-level ones. --- deploy/nginx.conf | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/deploy/nginx.conf b/deploy/nginx.conf index 3d92e38..6202206 100644 --- a/deploy/nginx.conf +++ b/deploy/nginx.conf @@ -19,8 +19,24 @@ server { error_page 404 /404.html; - location ~* \.(?:css|js|jpg|jpeg|png|webp|svg|ico|woff2)$ { + # NOTE: an add_header inside a location drops ALL server-level add_headers, so each block below + # repeats the security headers. + + # Content-hashed file names (Astro bundles, scripts/optimize-images.mjs output): a changed file + # gets a new URL, so these can be cached forever. + location ~* ^/(?:_astro|assets/opt)/ { try_files $uri =404; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Cache-Control "public, max-age=31536000, immutable"; } + + # Other static files keep a fixed URL when replaced (favicon, original JPEGs, logo), so cache + # them for a week, not forever. + location ~* \.(?:css|js|jpg|jpeg|png|webp|avif|svg|ico|woff2)$ { + try_files $uri =404; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Cache-Control "public, max-age=604800"; + } }