ci: deploy 550392aa17 [skip ci]

The full fontsource import also declared math/symbols subsets, so the homepage's single
arrow glyph pulled ~77 KB of extra font files. The arrow now renders in the system font.

deploy/nginx.conf

@@ -19,8 +19,24 @@ server {
 
   error_page 404 /404.html;
 
-  location ~* \.(?:css|js|jpg|jpeg|png|webp|svg|ico|woff2)$ {
+  # NOTE: an add_header inside a location drops ALL server-level add_headers, so each block below
+  # repeats the security headers.
+
+  # Content-hashed file names (Astro bundles, scripts/optimize-images.mjs output): a changed file
+  # gets a new URL, so these can be cached forever.
+  location ~* ^/(?:_astro|assets/opt)/ {
     try_files $uri =404;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Cache-Control "public, max-age=31536000, immutable";
   }
+
+  # Other static files keep a fixed URL when replaced (favicon, original JPEGs, logo), so cache
+  # them for a week, not forever.
+  location ~* \.(?:css|js|jpg|jpeg|png|webp|avif|svg|ico|woff2)$ {
+    try_files $uri =404;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Cache-Control "public, max-age=604800";
+  }
 }

k8s/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
 - name: git.7tl-homelab.com/bmr_bluecap/bcs-website
   newName: git.7tl-homelab.com/bmr_bluecap/bcs-website
-  newTag: 04e0c4d9cded
+  newTag: 550392aa17c5

src/layouts/BaseLayout.astro

@@ -7,7 +7,7 @@ import { assetUrl, canonical } from "@utils/url";
 import { organizationSchema, websiteSchema } from "@utils/schema";
 // Self-hosted fonts (no external requests): Work Sans headings, Open Sans body — matching the original.
 import "@fontsource-variable/work-sans";
-import "@fontsource-variable/open-sans";
+import "../styles/fonts.css";
 import "../styles/global.css";
 
 type Props = {

src/styles/fonts.css

@@ -0,0 +1,26 @@
+/*
+ * Open Sans Variable, Latin + Latin Extended only. Replaces `import "@fontsource-variable/open-sans"`,
+ * whose index.css also declares math and symbols subsets: a single "→" on the homepage made browsers
+ * download ~77 KB of those font files. Characters outside these ranges now render in the system
+ * fallback font. Rules copied from @fontsource-variable/open-sans/index.css (re-copy after upgrades).
+ */
+
+/* open-sans-latin-ext-wght-normal */
+@font-face {
+  font-family: 'Open Sans Variable';
+  font-style: normal;
+  font-display: swap;
+  font-weight: 300 800;
+  src: url(@fontsource-variable/open-sans/files/open-sans-latin-ext-wght-normal.woff2) format('woff2-variations');
+  unicode-range: U+0100-02BA,U+02BD-02C5,U+02C7-02CC,U+02CE-02D7,U+02DD-02FF,U+0304,U+0308,U+0329,U+1D00-1DBF,U+1E00-1E9F,U+1EF2-1EFF,U+2020,U+20A0-20AB,U+20AD-20C0,U+2113,U+2C60-2C7F,U+A720-A7FF;
+}
+
+/* open-sans-latin-wght-normal */
+@font-face {
+  font-family: 'Open Sans Variable';
+  font-style: normal;
+  font-display: swap;
+  font-weight: 300 800;
+  src: url(@fontsource-variable/open-sans/files/open-sans-latin-wght-normal.woff2) format('woff2-variations');
+  unicode-range: U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,U+0308,U+0329,U+2000-206F,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD;
+}