fix: nginx security headers inheritance in location blocks

Author: nikolay-e

nginx.conf

@@ -13,12 +13,6 @@ server {
     listen 80;
     server_name _;
 
-    # Security headers
-    add_header X-Frame-Options "DENY" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-
     # Gzip compression
     gzip on;
     gzip_vary on;
@@ -32,7 +26,7 @@ server {
     location /health {
         access_log off;
         return 200 "healthy\n";
-        add_header Content-Type text/plain;
+        default_type text/plain;
     }
 
     # WebSocket endpoint (proxy to backend)
@@ -101,24 +95,25 @@ server {
         root /usr/share/nginx/html;
         try_files $uri $uri/ /index.html;
 
-        # Cache static assets
-        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
-            expires 1y;
-            add_header Cache-Control "public, immutable";
-        }
-
-        # No cache for index.html
-        location = /index.html {
-            add_header Cache-Control "no-store, no-cache, must-revalidate";
-        }
+        # Security headers
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     }
 
-    # Assets directory (compiled JS/CSS)
+    # Assets directory (compiled JS/CSS with long cache)
     location /assets/ {
         root /usr/share/nginx/html;
         expires 1y;
-        add_header Cache-Control "public, immutable";
         access_log off;
+
+        # Security + caching headers
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Cache-Control "public, immutable" always;
     }
 
     # Deny access to hidden files