nginx.conf

load_module modules/ngx_http_brotli_filter_module.so;
load_module modules/ngx_http_brotli_static_module.so;

user nginx;
worker_processes auto;
error_log /dev/stderr warn;
pid /run/nginx/nginx.pid;

events {
    worker_connections 2048;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    sendfile on;
    tcp_nopush on;
    server_tokens off;

    log_format main '$remote_addr "$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent"';
    access_log /dev/stdout main;

    # Serve the .br/.gz files scripts/precompress.mjs produced. Nothing is
    # compressed per request, so we get brotli quality 11 for free -- on-the-fly
    # compression settles for a much lower level and costs ~200KB per cold load.
    brotli_static on;
    gzip_static on;
    gzip_vary on;

    # If this sits behind another proxy in the compose stack, the real client
    # address arrives in X-Forwarded-For. Without this, limit_req below would
    # see only the proxy's address and throttle every visitor as one client.
    # Narrow these to the actual proxy address if you can.
    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 172.16.0.0/12;
    set_real_ip_from 192.168.0.0/16;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

    # Crawlers walking distinct /nevent1... URLs all land on the SPA fallback.
    # Assets are deliberately exempt: they're shared across every visitor and
    # already cached, so throttling them would only hurt real page loads.
    limit_req_zone $binary_remote_addr zone=shell:10m rate=10r/s;
    limit_req_status 429;

    server {
        listen 80;
        listen [::]:80;
        server_name _;

        root /usr/share/nginx/html;
        index index.html;

        add_header X-Content-Type-Options nosniff always;

        # Fingerprinted by vite -- the name changes whenever the bytes do
        location /assets/ {
            add_header Cache-Control "public, max-age=31536000, immutable" always;
            add_header X-Content-Type-Options nosniff always;
            try_files $uri =404;
        }

        # Not fingerprinted, so rename the file if you ever replace one
        location /fonts/ {
            add_header Cache-Control "public, max-age=31536000, immutable" always;
            add_header X-Content-Type-Options nosniff always;
            try_files $uri =404;
        }

        location /icons/ {
            add_header Cache-Control "public, max-age=2592000" always;
            try_files $uri =404;
        }

        location /images/ {
            add_header Cache-Control "public, max-age=2592000" always;
            try_files $uri =404;
        }

        # These must stay fresh or clients pin themselves to a stale build
        location = /sw.js {
            add_header Cache-Control "public, max-age=0, must-revalidate" always;
        }

        location = /registerSW.js {
            add_header Cache-Control "public, max-age=0, must-revalidate" always;
        }

        location = /manifest.webmanifest {
            default_type application/manifest+json;
            add_header Cache-Control "public, max-age=0, must-revalidate" always;
        }

        # Client-side routes (/nevent1..., /npub1...) resolve to the app shell
        location / {
            limit_req zone=shell burst=20 nodelay;
            add_header Cache-Control "public, max-age=0, must-revalidate" always;
            add_header X-Content-Type-Options nosniff always;
            try_files $uri $uri/ /index.html;
        }
    }
}