server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    charset utf-8;

    gzip on;
    gzip_types text/plain text/css text/javascript application/javascript application/json application/xml image/svg+xml;
    gzip_min_length 1024;
    gzip_comp_level 6;
    gzip_vary on;

    # Security headers
    add_header X-Frame-Options SAMEORIGIN always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    # Vendored libs — versioned, cache hard
    location /vendor/ {
        expires 365d;
        add_header Cache-Control "public, immutable";
    }

    # Images/fonts — long cache
    location ~* \.(png|jpg|jpeg|gif|webp|avif|svg|ico|woff2?|ttf)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }

    # App JS/CSS — short cache so edits show fast
    location ~* \.(css|js)$ {
        expires 10m;
        add_header Cache-Control "public, must-revalidate";
    }

    # Never index build sources or patch scripts
    location ~* \.(jsx|py)$ { return 404; }
    location /scripts/ { return 404; }

    location = /robots.txt  { default_type text/plain; }
    location = /llms.txt    { default_type text/plain; }
    location = /sitemap.xml { default_type application/xml; }

    # HTML — no stale cache
    location = /index.html {
        add_header Cache-Control "no-cache, must-revalidate";
    }

    # SPA fallback (routing via location.hash)
    location / {
        try_files $uri $uri/ /index.html;
    }
}