nginx: slightly improve etag, cors and cache-control handling again

hagrid-routes.conf

@@ -19,6 +19,8 @@ location /502 {
 location /keys {
     internal;
     add_header 'Access-Control-Allow-Origin' '*' always;
+    add_header 'Cache-Control' 'no-cache' always;
+    etag off;
 }
 
 location /vks/v1/upload {
@@ -30,8 +32,6 @@ location /vks/v1/request-verify {
 }
 
 location /vks/v1/ {
-    etag off;
-
     location ~ ^/vks/v1/by-fingerprint/(?:0x)?([^/][^/])([^/][^/])(..*)$ {
         limit_req zone=search_fpr_keyid burst=30;
 
@@ -40,6 +40,7 @@ location /vks/v1/ {
         add_header Content-Disposition 'attachment; filename="$1$2$3.asc"';
         add_header 'Access-Control-Allow-Origin' '*' always;
         add_header 'Cache-Control' 'no-cache' always;
+        etag off;
         try_files /keys/links/by-fpr/$1/$2/$3 =404;
     }
 
@@ -52,6 +53,7 @@ location /vks/v1/ {
         add_header Content-Disposition 'attachment; filename="$1$2$3.asc"';
         add_header 'Access-Control-Allow-Origin' '*' always;
         add_header 'Cache-Control' 'no-cache' always;
+        etag off;
         try_files /keys/links/by-keyid/$1/$2/$3 =404;
     }
 
@@ -62,6 +64,7 @@ location /vks/v1/ {
         set $args "";
         add_header 'Access-Control-Allow-Origin' '*' always;
         add_header 'Cache-Control' 'no-cache' always;
+        etag off;
         proxy_pass http://127.0.0.1:8080;
 
         # we have some trouble with uri encoding here. just route through
@@ -73,6 +76,8 @@ location /vks/v1/ {
     }
 
     add_header 'Access-Control-Allow-Origin' '*' always;
+    add_header 'Cache-Control' 'no-cache' always;
+    etag off;
     error_page 400 /errors-static/400-vks-invalid.htm;
     return 400;
 }
@@ -80,12 +85,10 @@ location /vks/v1/ {
 # Common HKP requests.
 location /pks/lookup {
     if ($arg_op !~ "^index|get$") {
-        add_header 'Access-Control-Allow-Origin' '*' always;
         error_page 400 /errors-static/400-pks-invalid.htm;
         return 400;
     }
     if ($arg_search = '') {
-        add_header 'Access-Control-Allow-Origin' '*' always;
         error_page 400 /errors-static/400-pks-invalid.htm;
         return 400;
     }
@@ -100,8 +103,6 @@ location /pks/lookup {
 
 # WKD requests
 location /.well-known/openpgpkey {
-    etag off;
-
     location ~ "^/.well-known/openpgpkey/([^/]+)/hu/([^/][^/])([^/][^/])(.*)" {
         limit_req zone=search_email burst=50 nodelay;
         error_page 429 /errors-static/429-rate-limit-vks-email.htm;
@@ -111,6 +112,7 @@ location /.well-known/openpgpkey {
         add_header Content-Disposition 'attachment; filename="$2$3$4.asc"';
         add_header 'Access-Control-Allow-Origin' '*' always;
         add_header 'Cache-Control' 'no-cache' always;
+        etag off;
         try_files /keys/links/wkd/$1/$2/$3/$4 =404;
     }
 
@@ -118,10 +120,13 @@ location /.well-known/openpgpkey {
         default_type text/plain;
         add_header 'Access-Control-Allow-Origin' '*' always;
         add_header 'Cache-Control' 'no-cache' always;
+        etag off;
         return 200 '';
     }
 
     add_header 'Access-Control-Allow-Origin' '*' always;
+    add_header 'Cache-Control' 'no-cache' always;
+    etag off;
     error_page 400 /errors-static/400-wkd-invalid.htm;
     return 400;
 }
@@ -159,6 +164,8 @@ location /pks/internal {
 
         set $args "";
         add_header 'Access-Control-Allow-Origin' '*' always;
+        add_header 'Cache-Control' 'no-cache' always;
+        etag off;
         proxy_pass http://127.0.0.1:8080;
     }
 
@@ -171,6 +178,8 @@ location /pks/internal {
 
         set $args "";
         add_header 'Access-Control-Allow-Origin' '*' always;
+        add_header 'Cache-Control' 'no-cache' always;
+        etag off;
         proxy_pass http://127.0.0.1:8080;
     }
 
@@ -183,16 +192,23 @@ location /pks/internal {
 
         set $args "";
         add_header 'Access-Control-Allow-Origin' '*' always;
+        add_header 'Cache-Control' 'no-cache' always;
+        etag off;
         proxy_pass http://127.0.0.1:8080;
     }
 
     add_header 'Access-Control-Allow-Origin' '*' always;
+    add_header 'Cache-Control' 'no-cache' always;
+    etag off;
     error_page 400 /errors-static/400-pks-invalid.htm;
     return 400;
 }
 
 location /errors-static {
     internal;
+    add_header 'Access-Control-Allow-Origin' '*' always;
+    add_header 'Cache-Control' 'no-cache' always;
+    etag off;
 }
 
 location /errors {