server {
    listen 80;
    listen [::]:80;
    server_name static.example.com;
    include /etc/nginx/snippets/acme-challenge.conf;
    location / { return 308 https://static.example.com$request_uri; }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name static.example.com;

    root /var/www/static.example.com/public;
    index index.html;
    autoindex off;

    include /etc/nginx/snippets/tls-example.conf;
    include /etc/nginx/snippets/security-headers.conf;
    include /etc/nginx/snippets/hsts.conf;
    include /etc/nginx/snippets/deny-sensitive-files.conf;

    limit_conn conn_per_ip 50;
    limit_req zone=static_per_ip burst=200 nodelay;

    location / {
        limit_except GET HEAD { deny all; }
        try_files $uri $uri/ =404;
    }

    location ~* \.(?:css|gif|ico|jpe?g|js|png|svg|webp|woff2?)$ {
        limit_except GET HEAD { deny all; }
        try_files $uri =404;
        expires 7d;
        add_header Cache-Control "public, max-age=604800" always;
        include /etc/nginx/snippets/security-headers.conf;
    }

    location ~* "/assets/.+\.[0-9a-f]{8,}\.(?:css|js|png|jpe?g|svg|webp|woff2?)$" {
        limit_except GET HEAD { deny all; }
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        include /etc/nginx/snippets/security-headers.conf;
    }
}
