# prepare for letsencrypt
    # https://community.centminmod.com/posts/17774/
    location ~ /.well-known {
    	location ~ /.well-known/acme-challenge/(.*) {
    		more_set_headers    "Content-Type: text/plain";
        }
    }

    location ~* \.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso)$ {
	gzip_static off;
  #add_header Pragma public;
  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;
  add_header Access-Control-Allow-Origin *;
  add_header Cache-Control "public, must-revalidate, proxy-revalidate";
	access_log off;
	expires 30d;
	break;
        }

    location ~* \.(js)$ {
  #add_header Pragma public;
  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;
  add_header Access-Control-Allow-Origin *;
  add_header Cache-Control "public, must-revalidate, proxy-revalidate";
	access_log off;
	expires 30d;
	break;
        }

    location ~* \.(css)$ {
  #add_header Pragma public;
  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;
  add_header Access-Control-Allow-Origin *;
  add_header Cache-Control "public, must-revalidate, proxy-revalidate";
	access_log off;
	expires 30d;
	break;
        }

    location ~* \.(html|htm|txt)$ {
    if ($server_https = 'on') {
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    }
  #add_header Pragma public;
  add_header Cache-Control "public, must-revalidate, proxy-revalidate";
  access_log off;
  expires 30m;
  break;
        }

    location ~* \.(eot|svg|ttf|woff|woff2)$ {
  #add_header Pragma public;
  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;
  add_header Access-Control-Allow-Origin *;
  add_header Cache-Control "public, must-revalidate, proxy-revalidate";
	access_log off;
	expires 30d;
	break;
        }