nginx.conf

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events { worker_connections  1024; }

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    tcp_nopush    on;
    tcp_nodelay   on;
    keepalive_timeout  65;
    server_tokens off;

    # gzip
    gzip on;
    gzip_comp_level 5;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;
    gzip_vary on;

    # Strong caching for immutable assets; override for HTML
    map $sent_http_content_type $cache_control_header {
        default                         "public, max-age=31536000, immutable";
        ~*text/html                     "no-cache";
    }

    server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        server_name  _;
        root         /usr/share/nginx/html;
        index        index.html;

        # Security headers
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options SAMEORIGIN always;
        add_header Referrer-Policy strict-origin-when-cross-origin always;
        add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
        add_header Cross-Origin-Opener-Policy same-origin always;
        add_header Cross-Origin-Resource-Policy same-origin always;

        # Serve static files
        location / {
            try_files $uri $uri/ /index.html;
        }

        # Set cache headers
        location ~* \.(?:css|js|mjs|json|png|jpe?g|gif|ico|svg|webp|ttf|otf|woff2?)$ {
            add_header Cache-Control $cache_control_header always;
            try_files $uri =404;
        }

        # HTML: no-cache
        location ~* \.(?:html)$ {
            add_header Cache-Control "no-cache" always;
            try_files $uri =404;
        }

        # Healthcheck
        location = /healthz { return 200 'ok'; add_header Content-Type text/plain; }
    }
}