server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # Static site; long cache on immutable assets, short on the document so
    # a dictated edit goes live on the next deploy without a purge.
    location = / { add_header Cache-Control "public, max-age=300"; try_files /index.html =404; }
    location ~* \.(woff2|svg|png|ico)$ { add_header Cache-Control "public, max-age=31536000, immutable"; }
    location ~* \.css$ { add_header Cache-Control "public, max-age=3600"; }

    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options DENY always;
    add_header Referrer-Policy no-referrer always;

    location / { try_files $uri $uri/ =404; }
}