<% @asset_pipeline_prefixes.each do |prefix| %>
  location ^~ /<%= prefix %>/ {
    # Set expires headers for assets
    # Assets with a digest (32+ char hex string in filename) get max expires
    # Non-digest assets get 30 mins
    expires 30m;
    add_header Cache-Control public;
    gzip_static on;

    location ~ "-[0-9a-f]{32,}\." {
      expires max;
      add_header Cache-Control "public, immutable";
    }
  }
<% end %>

<%= @nginx_extra_config %>

<% @asset_pipeline_prefixes.each do |prefix| %>
  location ^~ /<%= prefix %>/ {
    # Set expires headers for assets
    # Assets with a digest (32+ char hex string in filename) get max expires
    # Non-digest assets get 30 mins
    expires 30m;
    add_header Cache-Control public;
    gzip_static on;

    location ~ "-[0-9a-f]{32,}\." {
      expires max;
      add_header Cache-Control "public, immutable";

      # Set CORS allow origin for fonts only
      location ~* \.(eot|otf|ttf|woff|woff2)$ {
        add_header Access-Control-Allow-Origin "*";
        add_header Access-Control-Allow-Methods "GET, OPTIONS";
        add_header Access-Control-Allow-Headers "origin, authorization";
      }
    }

  }
<% end %>

<%= @nginx_extra_config %>

Set cross origin headers on font files only
Set cross origin headers on font files only

Previously, when embedding assets using the
assets.publishing.service.gov.uk, domain we were setting every single
asset with CORS headers to allow them to be used anywhere. In RFC 115
[1] these were identified as only needed for fonts. I believe they are
actually only needed at all for fonts so that developers can run static
as part of their development environment so there's a reasonable chance
this rule could be removed if we're able to retire static.

As we're only serving fonts from the asset pipeline I have not
duplicated this rule to be for assets that aren't fingerprinted. I don't
expect anyone would need it and (if my Nginx understanding is correct) will
require duplication.

I'm not convinced we need to be setting some of these cache headers too
as I imagine Rails is already serving these in most cases.

[1] https://github.com/alphagov/govuk-rfcs/blob/45e09c088bfde6c1d4dfb68f9bc1c635f63c9a39/rfc-115-enabling-http2-on-govuk.md#must
