# Visigine — serves the static React build and reverse-proxies API to the
# `backend` service over the docker network. Browser sees one origin, so no
# CORS handshake is needed for /api/* calls.

server {
  listen 80 default_server;
  server_name _;

  client_max_body_size 1m;

  root /usr/share/nginx/html;
  index index.html;

  # SPA fallback so /admin, /impressum, /datenschutz hit React Router.
  location / {
    try_files $uri $uri/ /index.html;
  }

  # Cache hashed assets aggressively (Vite emits content-hashed filenames).
  location ~* \.(?:js|css|woff2?|svg|png|jpg|jpeg|gif|webp|ico)$ {
    try_files $uri =404;
    expires 30d;
    add_header Cache-Control "public, immutable";
  }

  # API → backend container.
  location /api/ {
    proxy_pass http://backend:3001;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    # Strip browser Origin so the backend treats this as same-origin and
    # skips its CORS allow-list check (we are the only ingress here).
    proxy_set_header Origin "";

    # Analyses can take up to ~10s (fetcher timeout + Mistral call).
    proxy_read_timeout 30s;
    proxy_send_timeout 30s;
  }

  # Pass-through health probe so `docker compose ps` shows useful state.
  location = /health {
    proxy_pass http://backend:3001/health;
    proxy_set_header Origin "";
    access_log off;
  }
}