user  nginx;
worker_processes auto;
pid /var/run/nginx.pid;
events { worker_connections 1024; }

http {
  sendfile on;
  tcp_nopush on;
  tcp_nodelay on;

  # health
  server {
    listen 8090;
    location = /healthz { return 200 "ok\n"; add_header Content-Type text/plain; }
  }

  # public HTTP entrypoint (host will terminate TLS and proxy here)
  server {
    listen 8080;

    # frontend default
    location / {
      proxy_pass http://127.0.0.1:${PROD_FRONTEND_PORT};
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

    # backend API
    location /api/ {
      proxy_pass http://127.0.0.1:${PROD_BACKEND_PORT}/;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
  }
}