A local proxy cache only helps when the cache key matches the Vary you actually care about and authenticated or cookie-personalised responses never enter the zone. I key on scheme, host, and URI by default, fold in any routing dimension that changes the body, set short proxy_cache_valid for HTML, and bypass on Authorization or Set-Cookie so one user cannot poison the slab for everyone else. Expose an X-Cache-Status style header from $upstream_cache_status so HIT, MISS, and BYPASS are visible without a packet capture.

Ops check after every deploy or purge: hit the same path twice and expect MISS then HIT, confirm Cache-Control / s-maxage from origin still describe what the edge stores, and watch inactive= eviction so a quiet path does not look like a logic bug when the slab simply aged out. If a stale private page appears for another client, wipe or rename the cache zone first, then tighten bypass rules before raising TTL — lengthening TTL on a polluted key only makes the incident last longer.