server {
  listen 80;
  server_name _;

  # 1. Central auth proxy
  location /forecasting/api/auth/ {
    proxy_pass http://10.10.10.101:3001/api/auth/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }

  # 2. App backend (Python FastAPI on port 8000)
  location /forecasting/api/ {
    proxy_pass http://backend:8000/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Cookie $http_cookie;
    proxy_read_timeout 300s;
    proxy_connect_timeout 30s;
    client_max_body_size 50M;
  }

  # 3. Health (slugged for browser use + bare for management monitor)
  location /forecasting/health {
    proxy_pass http://backend:8000/health;
  }

  location = /health {
    proxy_pass http://backend:8000/health;
  }

  # 4. SPA fallback
  location /forecasting/ {
    root /usr/share/nginx/html;
    try_files $uri $uri/ /forecasting/index.html;
  }
}