So, finally, I managed to fix this problem, with the help of @Philip (see above) and this post (Nginix server config) by natropo.
Here my nginx configuration (note that the order of directives is important!)
# removes trailing slashes (prevents SEO duplicate content issues)
if (!-d $request_filename) {
rewrite ^/(.+)/$ /$1 permanent;
}
# Don't hint these as folders
rewrite ^/(content|kirby|site|vendor)\/?$ /error last;
# Block content
rewrite ^/content/(.*).(txt|md|mdown|markdown)$ /error last;
# Block all files inside these folders from being accessed directly
rewrite ^/(kirby|site|vendor)/(.*)$ /error last;
# Block files in root;
rewrite ^/(\.env|\.env\.example|composer\.json|composer\.lock|package.json|yarn.lock|mix-manifest\.json|webpack.mix.json|tailwind.js|readme\.md)$ /error last;
#enable leverage caching
location ~* ^/(assets|media|content)/.+.(jpe?g|gif|png|css|js|ico|xml|svg|woff2?)(?|$) {
expires 30d;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
}
location / {
try_files $uri $uri/ /index.php?$query_string;
}
#needed to avoid leverage caching causing problems in panel
location ~ /media/ {
try_files $uri $uri/ /index.php?$query_string;
}
#needed to avoid leverage caching causing problems in panel
location ~ /api/ {
try_files $uri $uri/ /index.php?$query_string;
}
and here my gzip config in the main nginx.conf (not needed for this problem, but just adding it in case)
gzip on;
gzip_disable "msie6";
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_types text/plain text/css text/xml text/javascript application/json application/x-javascript application/xml application/xml+rss application/javascript image/svg+xml application/x-font-ttf font/opentype;