nginx.conf adjustments for Statamic +v3 deployed to Digitalocean using Laravel Forge

statamic-nginx.conf

# Forge > Site > Domains > Edit Nginx Configuration > General Site configuration
# 1. snippets/security-headers.conf — single source of truth 
# Append ` always` to each `add_header` ahead of the line-ending `;`

# 2. gzip & cache-control
# Add to bottom (after `location ~ /\.(?!well-known).* { ... }`

# Enable gzip compression
gzip on;
gzip_vary on;
gzip_min_length 1100;
gzip_proxied any;
gzip_types text/plain text/css text/xml text/javascript
           application/javascript application/json application/xml
           application/rss+xml image/svg+xml;
# text/html is always gzipped. Don't list woff2/jpg/png — already compressed.

# Content-hashed build output — genuinely immutable.
# Security headers repeated deliberately: any add_header inside a
# location cancels inheritance of the server-level ones (all-or-nothing).
location ^~ /build/ {
    expires 1y;
    access_log off;
    add_header Cache-Control "public, immutable" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
}

# Loose static assets — replaceable in place, so keep the TTL short.
# Same repetition, same reason.
location ~* \.(?:jpg|jpeg|png|gif|webp|avif|ico|svg|mp4|webm|woff2|css|js)$ {
    try_files $uri /index.php?$query_string;
    expires 7d;
    access_log off;
    add_header Cache-Control "public" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
}