server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # The bootstrap installer: served as a shell script, never cached, so
    # `curl … | sudo bash` always gets the current one.
    location = /install.sh {
        default_type text/x-shellscript;
        add_header Cache-Control "no-cache, must-revalidate";
    }

    # Channel manifests change every release — don't cache.
    location ~ /latest\.json$ {
        default_type application/json;
        add_header Cache-Control "no-cache, must-revalidate";
    }

    # Release artifacts are immutable (version-pinned names) — cache hard.
    location ~ \.tar\.gz$ { default_type application/gzip; add_header Cache-Control "public, max-age=31536000, immutable"; }
    location ~ \.sha256$  { default_type text/plain;       add_header Cache-Control "public, max-age=31536000, immutable"; }
    location ~ \.minisig$ { default_type text/plain;       add_header Cache-Control "public, max-age=31536000, immutable"; }

    # The static website.
    location / { try_files $uri $uri/ =404; }
}