Useful skeleton for splitting static files from proxied app routes. The ops detail I always pin down is try_files versus proxy_pass on the same location — mixing them without a clear fallback sends API paths into the filesystem root and looks like random 404s after a deploy.

For static I serve with an explicit root/alias and long cache headers only on fingerprinted assets; for the app I keep a dedicated location with proxy_set_header Host and X-Forwarded-Proto, proxy_http_version 1.1, and a short proxy_read_timeout until latency is measured. After reload I hit a known static path and a known API path separately so a bad root does not get blamed on upstream. nginx -t before reload still catches more outages than any dashboard.