From 498231c160f99cb81682ded350516ee6134c136b Mon Sep 17 00:00:00 2001 From: ahmzaa Date: Sat, 25 Jul 2026 01:09:42 +0100 Subject: [PATCH] Tune SWS config for running behind a reverse proxy The site sits behind a reverse proxy that already handles compression and security headers. Disable those in SWS to avoid redundant work and duplicate/conflicting headers, letting each layer own one concern. - compression / compression-static: off (proxy compresses) - security-headers: off (proxy sets them) - cache-control-headers, page-fallback, health: kept (origin concerns) --- sws.toml | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/sws.toml b/sws.toml index da50e69..61798ec 100644 --- a/sws.toml +++ b/sws.toml @@ -17,15 +17,16 @@ log-level = "info" #### Performance / caching -# On-the-fly gzip, brotli and zstd compression (replaces nginx `gzip on`) -compression = true - -# Serve pre-compressed .gz/.br/.zst files from disk when present -compression-static = true +# Compression is handled by the upstream reverse proxy, so it is disabled +# here to avoid doing the work twice (wasted CPU per request). Re-enable if +# SWS is ever exposed directly without a compressing proxy in front. +compression = false +compression-static = false # Emit Cache-Control + ETag headers with sensible per-content-type defaults. -# SWS applies long-lived caching to static assets (images, css, js, fonts) -# and short/no-cache to HTML, replacing the manual nginx `expires 1y` blocks. +# The origin is the correct place to declare cacheability; the proxy/CDN +# passes these through. SWS applies long-lived caching to static assets +# (images, css, js, fonts) and short/no-cache to HTML. cache-control-headers = true #### Routing @@ -36,8 +37,10 @@ page-fallback = "/public/index.html" #### Security -# Opinionated security headers (safe defaults for a static site) -security-headers = true +# Security headers are set by the upstream reverse proxy, so they are +# disabled here to avoid duplicate/conflicting headers. Let one layer own +# the security posture. Re-enable if SWS is exposed without such a proxy. +security-headers = false # Health endpoint at /health for container/K8s liveness probes health = true