diff --git a/roles/frontend/templates/cdn.j2 b/roles/frontend/templates/cdn.j2
index 95e69ef..88f2c46 100644
--- a/roles/frontend/templates/cdn.j2
+++ b/roles/frontend/templates/cdn.j2
@@ -12,7 +12,7 @@ log_format files_cache '$remote_addr - $upstream_cache_status [$time_local]  '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent"';
 
-proxy_cache_path /data/nginx/cache keys_zone=mycache:50m inactive=3d;
+proxy_cache_path /data/nginx/cache keys_zone=mycache:50m inactive=7d;
 
 server {
   listen 443 ssl http2;
@@ -25,8 +25,8 @@ server {
   ssl_certificate     /etc/nginx/ssl/cdn.fullchain.pem;
   ssl_certificate_key /etc/nginx/ssl/cdn.privkey.pem;
 
-  access_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.access.log files_cache;
-  error_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.error.log;
+  access_log /var/log/nginx/cdn.access.log files_cache;
+  error_log /var/log/nginx/cdn.error.log;
 
   proxy_cache mycache;
   keepalive_timeout 30;
diff --git a/roles/frontend/templates/mastodon.j2 b/roles/frontend/templates/mastodon.j2
index 0c61d56..d5125b8 100644
--- a/roles/frontend/templates/mastodon.j2
+++ b/roles/frontend/templates/mastodon.j2
@@ -63,8 +63,11 @@ server {
   location = / {
     rewrite / https://{{ PREFERRED_ALT_DOMAIN }}/ redirect;
   }
-{% endif %}
+  location ~ ^/@(.+)?$ {
+    rewrite ^/(@.*) https://{{ PREFERRED_ALT_DOMAIN }}/$1 permanent;
+  }
 
+{% endif %}
   location / {
     try_files $uri @proxy;
   }