server {
    listen 80;
    server_name localhost;
    root /usr/share/nginx/html;

    location /api/auth/ {
        proxy_pass http://10.10.10.101:3001/api/auth/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        add_header Cache-Control "no-store";
    }

    location /notices/ {
        proxy_pass http://10.10.10.112:3080/notices/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # Kuma assets and websocket — must come before /monitor/ to match first
    location /monitor/assets/ {
        proxy_pass http://10.10.10.105:3002/assets/;
        proxy_set_header Host $host;
    }
    location /monitor/socket.io/ {
        proxy_pass http://10.10.10.105:3002/socket.io/;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_http_version 1.1;
    }
    location /monitor/ {
        proxy_pass http://10.10.10.105:3002/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_http_version 1.1;
        # Rewrite Kuma's absolute /assets/ and /socket.io/ refs to /monitor/*
        proxy_set_header Accept-Encoding "";
        sub_filter '"/assets/' '"/monitor/assets/';
        sub_filter '"/socket.io/' '"/monitor/socket.io/';
        sub_filter_once off;
    }

    location /deploy/ {
        proxy_pass http://10.10.10.105:9000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location = /sw.js {
        add_header Cache-Control "no-store, no-cache, must-revalidate";
        try_files $uri =404;
    }

    location ~* \.(js|css|png|ico|svg|woff2?)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    location / {
        add_header Cache-Control "no-cache" always;
        try_files $uri $uri/ /index.html;
    }
}