server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # long cache for hashed/static assets
    location ~* \.(?:png|ico|svg|woff2?|css|js)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
    location / {
        try_files $uri $uri/ /index.html;
    }
    # TLS + security headers are handled by Traefik at the edge.
}