server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # The bootstrap installer: served as a shell script, never cached, so
    # `curl … | sudo bash` always gets the current one.
    location = /install.sh {
        default_type text/x-shellscript;
        add_header Cache-Control "no-cache, must-revalidate";
    }

    # The signed catalog + channel manifests move on every publish — no cache.
    location ~ /index\.json(\.minisig)?$ {
        default_type application/json;
        add_header Cache-Control "no-cache, must-revalidate";
    }
    location ~ /latest\.json$ {
        default_type application/json;
        add_header Cache-Control "no-cache, must-revalidate";
    }

    # Payloads keep their name across re-publishes (same-id upsert), so they
    # are NOT immutable — short revalidating cache; boxes verify the sha256
    # pinned in the fresh index anyway.
    location ~ /payloads/ {
        add_header Cache-Control "public, max-age=300, must-revalidate";
    }

    # Version-pinned release artifacts never change — cache hard.
    location ~ \.tar\.gz$ { default_type application/gzip; add_header Cache-Control "public, max-age=31536000, immutable"; }
    location ~ \.sha256$  { default_type text/plain;       add_header Cache-Control "public, max-age=31536000, immutable"; }
    location ~ \.minisig$ { default_type text/plain;       add_header Cache-Control "public, max-age=31536000, immutable"; }

    # The browse UI.
    location / { try_files $uri $uri/ =404; }
}