Nginx Cheatsheet 09 — Static Sites and CDN

server {
    listen 80;
    server_name static.example.com;
    root /var/www/static;
    index index.html;
    
    location / {
        try_files $uri $uri/ /index.html;     # SPA fallback
    }
    
    location ~* \.(css|js|woff2|woff|svg|webp|jpg|jpeg|png|gif)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }
    
    location = /service-worker.js {
        expires -1;
        add_header Cache-Control "no-cache";
    }
    
    location = /robots.txt { log_not_found off; access_log off; }
    location = /favicon.ico { log_not_found off; access_log off; }
}

location ~* \.[a-f0-9]{6,}\.(js|css|woff2|png|webp)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}

location = /index.html {
    expires -1;
    add_header Cache-Control "no-cache, must-revalidate";
}

location / {
    try_files $uri /index.html;
}

gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types
    text/plain
    text/css
    text/xml
    application/javascript
    application/json
    application/xml
    application/rss+xml
    image/svg+xml
    application/wasm
    application/manifest+json;
gzip_min_length 256;

brotli on;
brotli_comp_level 6;
brotli_types
    text/plain text/css application/javascript application/json image/svg+xml;

gzip_static on;
brotli_static on;

sendfile on;
tcp_nopush on;
sendfile_max_chunk 1m;

open_file_cache max=10000 inactive=60s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;

location ~* \.(woff|woff2|ttf|otf|eot)$ {
    add_header Access-Control-Allow-Origin "*" always;
    expires 1y;
}

real_ip_header CF-Connecting-IP;            # Cloudflare
real_ip_header X-Forwarded-For;
set_real_ip_from 173.245.48.0/20;           # CF range
# ... add all CF ranges
real_ip_recursive on;

etag on;
if_modified_since exact;

add_header Server-Timing "nginx;dur=$request_time" always;

location = /sw.js {
    add_header Cache-Control "public, max-age=0, must-revalidate";
    add_header Service-Worker-Allowed "/";
    expires off;
}

location ~ \.webmanifest$ {
    types { application/manifest+json webmanifest; }
    add_header Cache-Control "public, max-age=3600";
}

map $http_accept $webp_suffix {
    default "";
    ~*image/webp ".webp";
}

location ~* \.(jpg|png)$ {
    try_files $uri$webp_suffix $uri =404;
    add_header Vary Accept;
}

# Only allow CDN IPs to origin
allow 173.245.48.0/20;     # Cloudflare
allow 103.21.244.0/22;
deny all;

add_header Cache-Control "public, max-age=31536000, s-maxage=31536000, immutable";
add_header CDN-Cache-Control "max-age=31536000";   # Cloudflare-specific
add_header Surrogate-Control "max-age=31536000";   # Fastly

location ~* \.(mp4|webm)$ {
    mp4;                                  # nginx-mp4 module
}

aio threads;
sendfile off;