server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Docker's embedded DNS. Without re-resolving at request time, nginx caches the
    # api container's IP from startup and keeps returning 502 ("no live upstreams")
    # after the api container restarts with a new IP.
    resolver 127.0.0.11 valid=10s ipv6=off;

    location ^~ /api/uploads/ {
        set $api_upstream http://goldbank-api:3000;
        proxy_pass $api_upstream$request_uri;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /api/ {
        set $api_upstream http://goldbank-api:3000;
        proxy_pass $api_upstream$request_uri;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Uploaded files (product images, category icons, ...) are served by the
    # API's own static handler (main.ts useStaticAssets), not stored here —
    # without this the ProductImage.url values the admin panel renders
    # (/uploads/<file>) 404 through this nginx instead of reaching the API.
    # ^~ beats the static-file regex so /uploads/*.png is not served from html root.
    location ^~ /uploads/ {
        set $api_upstream http://goldbank-api:3000;
        proxy_pass $api_upstream$request_uri;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # The files that say which release is live are never cached: index.html
    # (it names the hashed bundles), sw.js (a stale service worker keeps serving
    # the old precache) and version.json (the update gate polls it). They used
    # to fall under the 6-month rule below, which could pin a browser to an old
    # release. Exact matches win over that regex.
    location = /index.html {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        try_files $uri =404;
    }
    location = /sw.js {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        try_files $uri =404;
    }
    location = /version.json {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        try_files $uri =404;
    }
    location = /manifest.webmanifest {
        add_header Cache-Control "no-cache" always;
        try_files $uri =404;
    }

    location / {
        try_files $uri $uri/ /index.html;
    }

    location ~* \.(?:ico|css|js|gif|jpe?g|png|woff2?|eot|ttf|svg)$ {
        expires 6M;
        access_log off;
        add_header Cache-Control "public";
    }
}