server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name app.example.com;

    root /var/www/app.example.com/public;
    index index.html;
    autoindex off;

    include /etc/nginx/snippets/tls-example.conf;
    include /etc/nginx/snippets/security-headers.conf;
    include /etc/nginx/snippets/hsts.conf;
    include /etc/nginx/snippets/deny-sensitive-files.conf;

    location / {
        limit_except GET HEAD { deny all; }
        try_files $uri $uri/ /index.html;
    }

    location ~* "/assets/.+\.[0-9a-f]{8,}\.(?:css|js|png|jpe?g|svg|webp|woff2?)$" {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        include /etc/nginx/snippets/security-headers.conf;
    }
}
