Tune SWS config for running behind a reverse proxy

The site sits behind a reverse proxy that already handles compression
and security headers. Disable those in SWS to avoid redundant work and
duplicate/conflicting headers, letting each layer own one concern.

- compression / compression-static: off (proxy compresses)
- security-headers: off (proxy sets them)
- cache-control-headers, page-fallback, health: kept (origin concerns)

sws.toml

@@ -17,15 +17,16 @@ log-level = "info"
 
 #### Performance / caching
 
-# On-the-fly gzip, brotli and zstd compression (replaces nginx `gzip on`)
-compression = true
-
-# Serve pre-compressed .gz/.br/.zst files from disk when present
-compression-static = true
+# Compression is handled by the upstream reverse proxy, so it is disabled
+# here to avoid doing the work twice (wasted CPU per request). Re-enable if
+# SWS is ever exposed directly without a compressing proxy in front.
+compression = false
+compression-static = false
 
 # Emit Cache-Control + ETag headers with sensible per-content-type defaults.
-# SWS applies long-lived caching to static assets (images, css, js, fonts)
-# and short/no-cache to HTML, replacing the manual nginx `expires 1y` blocks.
+# The origin is the correct place to declare cacheability; the proxy/CDN
+# passes these through. SWS applies long-lived caching to static assets
+# (images, css, js, fonts) and short/no-cache to HTML.
 cache-control-headers = true
 
 #### Routing
@@ -36,8 +37,10 @@ page-fallback = "/public/index.html"
 
 #### Security
 
-# Opinionated security headers (safe defaults for a static site)
-security-headers = true
+# Security headers are set by the upstream reverse proxy, so they are
+# disabled here to avoid duplicate/conflicting headers. Let one layer own
+# the security posture. Re-enable if SWS is exposed without such a proxy.
+security-headers = false
 
 # Health endpoint at /health for container/K8s liveness probes
 health = true