The rule I settled on: fingerprinted assets are cached forever, HTML is never cached.
location ~* \.(css|js|svg|woff2)$ {
add_header Cache-Control "public, max-age=31536000, immutable";
}
location / {
add_header Cache-Control "no-cache";
try_files $uri $uri/ =404;
}
The foot-gun: add_header inside a location replaces every header inherited from the server block, including security headers. Either repeat them or move them into an include file.