server {
    listen        80;
    server_name   _;
    root          /usr/share/nginx/html;
    index         index.html;

    # Sicherheits-Header
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Kompression
    gzip              on;
    gzip_vary         on;
    gzip_min_length   1024;
    gzip_types        text/plain text/css application/javascript application/json
                      image/svg+xml application/xml application/rss+xml
                      font/woff2 application/font-woff;

    # Statische Assets lange cachen (CSS/JS sind fingerprinted)
    location ~* \.(?:css|js|woff2?|ttf|otf|eot|svg|png|jpe?g|gif|webp|ico)$ {
        expires 30d;
        add_header Cache-Control "public, max-age=2592000, immutable";
        access_log off;
        try_files $uri =404;
    }

    # HTML nicht cachen, damit Inhaltsänderungen sofort sichtbar sind
    location ~* \.html?$ {
        add_header Cache-Control "no-cache";
        try_files $uri =404;
    }

    # Pretty-URLs: /pfad/ -> /pfad/index.html
    location / {
        try_files $uri $uri/ =404;
    }

    # Gebrandete 404-Seite
    error_page 404 /404.html;
}