diff --git a/docker/nginx.conf b/docker/nginx.conf
index 750c0ff..7d5e759 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -1,11 +1,38 @@
 server {
     listen 80;
+    # Declare IPv6 explicitly ourselves - the stock nginx image otherwise
+    # tries to inject this line into default.conf on startup
+    # (10-listen-on-ipv6-by-default.sh), which fails with a "read-only file
+    # system?" message because we mount this file read-only. Harmless, but
+    # noisy; setting it here avoids the entrypoint script touching the file
+    # at all.
+    listen [::]:80;
     server_name _;
 
-    root /data/repo;
-    autoindex on;
+    # Small landing response at the root so a bare hit doesn't 404.
+    location = / {
+        default_type text/plain;
+        return 200 "RPM mirror - browse /repo/\n";
+    }
 
-    location / {
-        try_files $uri $uri/ =404;
+    # The actual mirrored repos (one subdirectory per source name) and the
+    # generated client .repo files under /repo/client-repos/.
+    location /repo/ {
+        alias /usr/share/nginx/html/repo/;
+        autoindex on;
+        autoindex_exact_size off;
+        autoindex_localtime on;
+
+        # repomd.xml is what dnf checks first to see if a repo changed -
+        # keep it uncached so clients notice updates immediately. Everything
+        # else (rpms, *.xml.gz) is content-addressed enough to cache freely.
+        if ($request_uri ~* /repodata/repomd\.xml$) {
+            add_header Cache-Control "no-cache";
+        }
+    }
+
+    location /healthz {
+        default_type text/plain;
+        return 200 "ok\n";
     }
 }
\ No newline at end of file