server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;

    # Block internal inter-app endpoints from the public internet
    location /kds/api/internal/ {
        return 403;
    }

    # Central auth proxy (must come before the general /api/ block)
    location /kds/api/auth/ {
        proxy_pass http://10.10.10.101:3001/api/auth/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # KDS backend API (preserves /api/ prefix: /kds/api/kds/tickets → backend:8000/api/kds/tickets)
    location /kds/api/ {
        proxy_pass http://backend:8000/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Cookie $http_cookie;
        # SSE requires these headers
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 86400s;
    }

    # Health check
    location /kds/health {
        proxy_pass http://backend:8000/health;
    }

    # SPA fallback — all other /kds/* paths serve the React app
    location /kds/ {
        try_files $uri $uri/ /kds/index.html;
    }
}