diff --git a/default_nginx_site b/default_nginx_site
index e7f52a3..5825fae 100755
--- a/default_nginx_site
+++ b/default_nginx_site
@@ -2,55 +2,86 @@ server {
     listen 80 default_server;
     listen [::]:80 default_server;
 
-    root /var/www/html;
-    index index.html index.htm index.nginx-debian.html;
     server_name _;
 
-    # CORS (required for video players)
+    root /var/www/html;
+    index index.html index.htm;
+
+    # Performance
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Global CORS
     add_header Access-Control-Allow-Origin "*" always;
-    add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+    add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
     add_header Access-Control-Allow-Headers "*" always;
+    add_header Access-Control-Expose-Headers "Content-Length,Content-Range" always;
 
-    # Handle OPTIONS requests
-    if ($request_method = OPTIONS) {
-        add_header Access-Control-Allow-Origin "*" always;
-        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-        return 204;
-    }
-
-    # Default static
+    # OPTIONS requests
     location / {
+        if ($request_method = OPTIONS) {
+            return 204;
+        }
+
+        autoindex on;
         try_files $uri $uri/ =404;
     }
 
-    # HLS streaming
+    # =========================
+    # HLS
+    # =========================
     location /hls/ {
+
         types {
             application/vnd.apple.mpegurl m3u8;
             video/mp2t ts;
         }
 
-        try_files $uri =404;
-
-        add_header Cache-Control no-cache;
+        add_header Cache-Control "no-cache";
+        add_header Accept-Ranges bytes;
         add_header Content-Disposition inline;
+
+        gzip off;
+
+        try_files $uri =404;
     }
 
-    # DASH streaming
+    # =========================
+    # DASH
+    # =========================
     location /dash/ {
+
         types {
             application/dash+xml mpd;
             video/mp4 mp4 m4s;
         }
 
-        try_files $uri =404;
-
-        add_header Cache-Control no-cache;
+        add_header Cache-Control "no-cache";
+        add_header Accept-Ranges bytes;
         add_header Content-Disposition inline;
+
+        gzip off;
+
+        try_files $uri =404;
     }
 
-    # Block .htaccess
-    location ~ /\.ht {
-        deny all;
+    # gzip only manifests
+    location ~* \.(m3u8|mpd)$ {
+        gzip on;
+        gzip_types application/vnd.apple.mpegurl application/dash+xml;
     }
+
+    # Security
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
 }
\ No newline at end of file
diff --git a/encoder/firmware.php b/encoder/firmware.php
index b0a93a1..12c0ca2 100755
--- a/encoder/firmware.php
+++ b/encoder/firmware.php
@@ -9,7 +9,7 @@ https://github.com/shreebhattji/Urmi/blob/main/licence.md
 */
 
 exec("sudo chmod 444 /sys/class/dmi/id/product_uuid");
-$version = "12.22";
+$version = "12.23";
 
 function fail(string $msg): never
 {