I would probably set this in the web front-end (apache, etc) This is
where I do expires stuff. I have to be careful though since most of
the examples I've seen literally say to set it globally, but Rails
uses the public directory for caching as well.
For max age, I'd consider having Apache set it, so it will also be set
for cached files, if you use any caching.