server {
    listen       80;
    server_name  _;
    root   /usr/share/nginx/html;
    index  index.html;

    # Hash-routed SPA: unknown paths fall back to the app shell.
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Content-hashed build output — safe to cache forever.
    location /assets/ {
        expires    1y;
        add_header  Cache-Control "public, immutable";
        access_log  off;
    }

    # Entry point and service worker must always be revalidated.
    location = /index.html {
        add_header Cache-Control "no-cache";
    }
    location = /sw.js {
        add_header Cache-Control "no-cache";
    }
    location = /manifest.webmanifest {
        default_type application/manifest+json;
        add_header   Cache-Control "no-cache";
    }

    gzip             on;
    gzip_comp_level  5;
    gzip_min_length  1024;
    gzip_types       text/css application/javascript application/json
                     image/svg+xml application/manifest+json;
}