server {
  listen 80;
  server_name _;

  client_max_body_size 256m;

  # Resolve upstream hostnames via Docker's embedded DNS on every request —
  # container IPs change on restart, and nginx otherwise caches the
  # startup-time resolution forever (stale upstream → 502).
  resolver 127.0.0.11 valid=10s ipv6=off;

  location /api/ {
    set $upstream http://backend:8080;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /auth/ {
    set $upstream http://auth:3001;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location = /auth-health {
    set $upstream http://auth:3001;
    rewrite ^/auth-health$ /health break;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /mailpit/ {
    set $upstream http://mailpit:8025;
    rewrite ^/mailpit/?(.*)$ /$1 break;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location / {
    set $upstream http://frontend:80;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}