Cache-Control response header includes "private"
This is caused by symfony. private is added via vendor/symfony/http-foundation/ResponseHeaderBag.php and as far as I understand it's not possible to not have it when system.performance:cache.page.max_age is set to 0:

protected function computeCacheControlValue() {
  // ...
  if (!isset($this-&gt;cacheControl['s-maxage'])) {
    return $header.', private';
  }


Since I don't want to hack symfony, I can remove private via apache mod_header:

Header edit Cache-Control "(, )?private" ""