بهینه‌سازی nginx: gzip، کش و هدرهای امنیتی

sudo nano /etc/nginx/conf.d/gzip.conf

gzip on;
gzip_comp_level 5;
gzip_min_length 256;
gzip_vary on;
gzip_proxied any;
gzip_types
    text/plain
    text/css
    text/xml
    application/json
    application/javascript
    application/xml
    application/rss+xml
    image/svg+xml
    font/ttf
    font/otf;

    location ~* \.(?:css|js|mjs|woff2?|ttf|otf|svg|png|jpe?g|gif|webp|avif|ico)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # صفحات HTML هرگز طولانی کش نشوند
    location ~* \.html$ {
        add_header Cache-Control "no-cache";
    }

    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# در بلوک http
server_tokens off;

sudo nginx -t && sudo systemctl reload nginx

# gzip فعال است؟ (باید Content-Encoding: gzip ببینید)
curl -sI -H "Accept-Encoding: gzip" https://example.com/main.css | grep -i -E 'content-encoding|cache-control'

# هدرهای امنیتی
curl -sI https://example.com | grep -i -E 'strict-transport|x-frame|x-content-type|referrer'

curl -s -o /dev/null -w "%{size_download} bytes\n" -H "Accept-Encoding: gzip" https://example.com/
curl -s -o /dev/null -w "%{size_download} bytes\n" https://example.com/