nginx.conf

server {
    listen 8080;
    server_name localhost;
    root /usr/share/nginx/html;
    index index.html;

    # Hide NGINX version from response headers and error pages
    server_tokens off;

    # ---------------------------------------------------------------------------
    # Gzip compression — ~3.5x transfer reduction (357 KB raw -> ~102 KB gzipped)
    # ---------------------------------------------------------------------------
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        application/json
        application/javascript
        text/xml
        application/xml
        image/svg+xml;

    # ---------------------------------------------------------------------------
    # Security headers (server level)
    #
    # These act as a safety net — if a future location block omits its own
    # add_header directives, these will still apply. Every current location block
    # below includes the shared snippet (see note on NGINX inheritance).
    # ---------------------------------------------------------------------------
    include /etc/nginx/conf.d/security-headers.conf;

    # Angular CSR shell serves the glitch NotFoundComponent on unknown routes
    error_page 404 /404.html;

    # ---------------------------------------------------------------------------
    # NGINX add_header inheritance rule:
    #
    # When ANY location block defines its own add_header directive, ALL parent
    # (server-level) add_header directives are dropped for that location.
    # Security headers MUST therefore be included in every location block below
    # via the shared security-headers.conf snippet.
    # ---------------------------------------------------------------------------

    # Custom 404 page — internal prevents direct browser access to /404.html
    location = /404.html {
        internal;
        include /etc/nginx/conf.d/security-headers.conf;
        add_header Cache-Control "no-cache" always;
    }

    # Content-hashed JS/CSS (e.g. main-M2HGYNUP.js, styles-IU7IDGHC.css)
    # Safe to cache forever — the hash changes when content changes.
    location ~* \.(js|css)$ {
        include /etc/nginx/conf.d/security-headers.conf;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        try_files $uri =404;
    }

    # Web fonts — immutable, 1 year cache
    location ~* \.(woff2?|ttf|eot)$ {
        include /etc/nginx/conf.d/security-headers.conf;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        try_files $uri =404;
    }

    # Images — 1 year cache, no immutable (images are not content-hashed)
    location ~* \.(png|jpg|jpeg|gif|ico|webp|svg)$ {
        include /etc/nginx/conf.d/security-headers.conf;
        add_header Cache-Control "public, max-age=31536000" always;
        try_files $uri =404;
    }

    # Mutable metadata — must always revalidate so deployments propagate instantly.
    # Includes the service-worker entry + manifest so updates roll out in real time,
    # plus the build-time version.json that AppUpdateService polls to detect "stale
    # client, fresh server" cases the SwUpdate path misses.
    location ~* ^/(assets/blog/posts\.json|version\.json|site\.webmanifest|sitemap\.xml|robots\.txt|feed\.xml|ngsw-worker\.js|ngsw\.json|safety-worker\.js|worker-basic\.min\.js)$ {
        include /etc/nginx/conf.d/security-headers.conf;
        add_header Cache-Control "no-cache" always;
        try_files $uri =404;
    }

    # Health check endpoint for Docker HEALTHCHECK and orchestrator probes
    location = /healthz {
        access_log off;
        return 200;
    }

    # SSG-aware default routing
    # $uri          — exact file match (e.g. /favicon.ico)
    # $uri/index.html — prerendered route directory (e.g. /about -> /about/index.html)
    # =404          — triggers error_page 404 -> /404.html (Angular CSR glitch 404)
    location / {
        include /etc/nginx/conf.d/security-headers.conf;
        add_header Cache-Control "no-cache" always;
        try_files $uri $uri/index.html =404;
    }
}