cdn-headers.nginx.conf

# StellarEscrow — Nginx CDN & Cache Headers Configuration
# Include this file in your server block:
#   include /etc/nginx/conf.d/cdn-headers.conf;

# ── Immutable hashed assets (JS/CSS with content hash in filename) ────────────
location ~* \.[0-9a-f]{8,}\.(js|css)$ {
    add_header Cache-Control "public, max-age=31536000, immutable";
    add_header Vary "Accept-Encoding";
    add_header X-Cache-Status $upstream_cache_status;
    gzip_static on;
}

# ── Static assets (images, fonts, icons) ─────────────────────────────────────
location ~* \.(png|jpg|jpeg|gif|webp|svg|ico|woff2?|ttf|eot)$ {
    add_header Cache-Control "public, max-age=86400, stale-while-revalidate=3600";
    add_header Vary "Accept-Encoding";
    add_header X-Cache-Status $upstream_cache_status;
}

# ── App shell & manifest (short TTL, revalidate) ──────────────────────────────
location ~* \.(html|json|webmanifest)$ {
    add_header Cache-Control "public, max-age=300, stale-while-revalidate=60";
    add_header Vary "Accept-Encoding";
    add_header X-Cache-Status $upstream_cache_status;
}

# ── Service worker (never cache — must always be fresh) ───────────────────────
location = /sw.js {
    add_header Cache-Control "no-store, no-cache, must-revalidate";
    add_header Service-Worker-Allowed "/";
}

# ── API responses ─────────────────────────────────────────────────────────────
location /api/ {
    add_header Cache-Control "no-store";
    add_header X-Cache-Status $upstream_cache_status;
    # CDN purge token validation (set via CDN provider dashboard)
    # add_header Surrogate-Key $upstream_http_surrogate_key;
}

# ── CDN health probe endpoint ─────────────────────────────────────────────────
location = /health {
    add_header Cache-Control "no-store";
    add_header X-Region $hostname;
    return 200 '{"status":"ok"}';
    default_type application/json;
}