Leveraging Nginx reverse proxy and Cloudflare cache with OpenMage

[kamzata]

My OpenMage installation is served behind Nginx reverse proxy and Cloudflare CDN. I'd like to leverage both Nginx and Cloudflare cache but I noticed all the pages contain these headers:

• an old header pragma: no-cache
• cache-control: no-store, no-cache, must-revalidate

which prevents all the pages to be cached.

Here are all headers:

kamzata@pc ~> curl -I https://www.example.com
HTTP/2 200
date: Mon, 17 Nov 2025 16:06:41 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
front-end-https: on
content-security-policy: upgrade-insecure-requests
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
x-proxy-cache: MISS
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
speculation-rules: "/cdn-cgi/speculation"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=e9%2Ba8ZET4mrX5vB8h3aCX23BWszL2d60MyMJAIV5aIllib72H9mx89Hst5cmXSH7aT61PpQLrP5hZwRFVOXpCvDnkx3srlPsw1F5VlgPlQyMhWhkCiTewz1zR70%3D"}]}
set-cookie: om_frontend=2qq7e7t094mjekp2pok2ch8nln; HttpOnly; Secure; Path=/; Domain=www.example.com; Max-Age=3600; Expires=Mon, 17 Nov 2025 17:06:41 GMT
cf-ray: 9a007a0bdf5b5183-MXP

However, I'm using RWD theme and, if I disable those headers the minicart on the header (e.g.) is cached too providing the same content for all users.

Any hint?

[loekvangool]

To fix the minicart you will need hole punching.

[kamzata]

How does it work?

[colinmollenhour]

You might look at https://github.com/colinmollenhour/Cm_Diehard - it specifically supports using a CDN with revalidation and hole punching.