Precompress ExifTool WASM with Brotli and serve via nginx brotli_static.

Tor first loads drop from ~25 MB raw to ~5 MB on the wire; prod build writes .wasm.br sidecars and Alpine nginx serves them under /assets with long-lived cache.

nginx/Dockerfile.prod

@@ -29,11 +29,14 @@ ENV VITE_API_BASE_URL=$VITE_API_BASE_URL \
     VITE_VALIDATION_UPLOAD_MAX_VIEWS_MAX=$VITE_VALIDATION_UPLOAD_MAX_VIEWS_MAX \
     VITE_VALIDATION_UPLOAD_MAX_IMAGE_BYTES=$VITE_VALIDATION_UPLOAD_MAX_IMAGE_BYTES
 
-RUN npm run build
+RUN npm run build && node scripts/optimize-dist-wasm.mjs
 
-FROM nginx:1.29.4-alpine
+FROM alpine:3.23
 
-RUN apk add --no-cache gettext
+RUN apk add --no-cache \
+    nginx=1.28.3-r7 \
+    nginx-mod-http-brotli=1.28.3-r7 \
+    gettext
 
 COPY --from=frontend-builder /frontend/dist /usr/share/nginx/html
 

nginx/docker-entrypoint.sh

@@ -37,7 +37,7 @@ render_server() {
 mkdir -p /etc/nginx/snippets
 
 render_locations
-render_server /etc/nginx/templates/conf.d/clearnet.conf.template /etc/nginx/conf.d/clearnet.conf clearnet
-render_server /etc/nginx/templates/conf.d/onion.conf.template /etc/nginx/conf.d/onion.conf onion
+render_server /etc/nginx/templates/conf.d/clearnet.conf.template /etc/nginx/http.d/clearnet.conf clearnet
+render_server /etc/nginx/templates/conf.d/onion.conf.template /etc/nginx/http.d/onion.conf onion
 
 exec nginx -g 'daemon off;'

nginx/snippets/private-image-locations.conf.template

@@ -39,6 +39,14 @@ location /pgadmin {
     proxy_redirect off;
 }
 
+location ^~ /assets/ {
+    root /usr/share/nginx/html;
+
+    brotli_static on;
+
+    add_header Cache-Control "public, max-age=31536000, immutable" always;
+}
+
 location / {
     ${ONION_LOCATION_HEADER}
     add_header Referrer-Policy "no-referrer" always;