redirect bare /app and keep hsts on console responses

add_header in a location drops the server-level hsts header, and index.html was never revalidated after a deploy.

Author: pulk17

install/nginx.conf

@@ -47,20 +47,28 @@ server {
     # Web console: a static build served straight off disk. Everything it
     # talks to is under /api on this same host, so no CORS is involved.
     #
+    location = /app {
+        return 301 /app/;
+    }
+
     # The directory is named to match the URL so plain root resolution
     # applies. "alias" with try_files appends the whole URI to the alias
     # rather than the remainder, which silently breaks the SPA fallback.
     location ^~ /app/ {
         include  /etc/nginx/mime.types;
         root NGINX_DIR/web;
         try_files $uri $uri/ /app/index.html;
+        # index.html names the hashed bundles, so it must be revalidated or a
+        # browser keeps loading the previous build after a deploy. "expires"
+        # rather than add_header: any add_header here would stop the server
+        # block's HSTS header being inherited.
+        expires -1;
     }
 
     location ^~ /app/assets/ {
         include  /etc/nginx/mime.types;
         root NGINX_DIR/web;
-        expires 30d;                      # hashed filenames
-        add_header Cache-Control "public, immutable";
+        expires max;                      # hashed filenames
     }
 
     location / {