server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # Always open, no auth — this is what Docker's own HEALTHCHECK and any
    # external uptime monitor hit, and it returns nothing but {"status":"ok"}.
    # docker-entrypoint.d/20-basic-auth.sh writes basic-auth.conf; without an
    # explicit "auth_basic off" here this location would inherit whatever it
    # sets below and healthchecks would start failing with 401.
    location = /api/health {
        auth_basic off;
        proxy_pass http://backend:8000/api/health;
        proxy_set_header Host $host;
    }

    # Reverse proxy to the FastAPI backend container. basic-auth.conf is
    # generated at container start (empty if AURUM_BASIC_AUTH_USER/PASSWORD
    # aren't set, so this is a no-op by default) — see docker-entrypoint.d/.
    location /api/ {
        include /etc/nginx/basic-auth.conf;
        proxy_pass http://backend:8000/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # SPA fallback — client-side routing handles the rest.
    location / {
        include /etc/nginx/basic-auth.conf;
        try_files $uri $uri/ /index.html;
    }

    gzip on;
    gzip_types text/css application/javascript application/json image/svg+xml;
}