server {
  listen 80;
  server_name _;

  client_max_body_size 256m;

  # Resolve upstream hostnames via Docker's embedded DNS on every request —
  # container IPs change on restart, and nginx otherwise caches the
  # startup-time resolution forever (stale upstream → 502).
  resolver 127.0.0.11 valid=10s ipv6=off;

  # Baseline security headers on every response, API included.
  add_header X-Frame-Options "DENY" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
  add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), microphone=(), usb=()" always;

  location = /nginx-health {
    return 204;
  }

  location /api/ {
    set $upstream http://backend:8080;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /auth/ {
    set $upstream http://auth:3001;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location = /auth-health {
    set $upstream http://auth:3001;
    rewrite ^/auth-health$ /health break;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  # Dev-only location blocks (mailpit) are dropped in here by
  # docker-compose.dev.yml. A glob with no matches is legal, so production
  # simply includes nothing.
  include /etc/nginx/primora-extra/*.conf;

  location / {
    # Any add_header inside a location replaces ALL inherited add_headers —
    # so the baseline four must be repeated here next to the SPA-only CSP.
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), microphone=(), usb=()" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self'; manifest-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" always;
    set $upstream http://frontend:80;
    proxy_pass $upstream;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}