Render the header inside location / so it is not dropped by other location headers; remove the ineffective server-level directive.
Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.
nobswebdev