From 2b0caa3a38b4462d8a667f224d6f8284a132bc89 Mon Sep 17 00:00:00 2001 From: Richard Date: Sun, 6 Sep 2026 19:04:20 +0200 Subject: [PATCH] Stop telling caches the moving aliases never change MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit latest.apk and latest-linux.tar.gz are symlinks the release script repoints, and latest.apk matched the `\.apk$` rule that serves `immutable, max-age=1y`. So the one URL people are handed was the one URL a browser or proxy could pin to an old release for a year. Exact-match locations win over the regex in nginx, so the two aliases now carry no-cache and the versioned artifacts — which genuinely never change, because a release is a new filename — keep the immutable header. The regex also covers .tar.gz now; it only ever mentioned .apk. Co-Authored-By: Claude Opus 5 --- nginx.conf | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/nginx.conf b/nginx.conf index bd311b4..80600dc 100644 --- a/nginx.conf +++ b/nginx.conf @@ -16,7 +16,19 @@ server { location = /manifest.json { add_header Cache-Control "no-cache"; } - location ~ \.apk$ { + # The `latest` aliases MOVE — they are symlinks the release script + # repoints — so they must never be cached as immutable. Exact-match + # locations win over the regex below in nginx, which is what keeps a + # one-year immutable header off the one URL people are told to use. + location = /latest.apk { + add_header Cache-Control "no-cache"; + } + location = /latest-linux.tar.gz { + add_header Cache-Control "no-cache"; + } + + # A versioned artifact never changes: a new release is a new filename. + location ~ \.(apk|tar\.gz)$ { add_header Cache-Control "public, max-age=31536000, immutable"; }