server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # Always open, no auth — this is what Docker's own HEALTHCHECK and any
    # external uptime monitor hit, and it returns nothing but {"status":"ok"}.
    # docker-entrypoint.d/20-basic-auth.sh writes basic-auth.conf; without an
    # explicit "auth_basic off" here this location would inherit whatever it
    # sets below and healthchecks would start failing with 401.
    location = /api/health {
        auth_basic off;
        proxy_pass http://backend:8000/api/health;
        proxy_set_header Host $host;
    }

    # Reverse proxy to the FastAPI backend container. basic-auth.conf is
    # generated at container start (empty if AURUM_BASIC_AUTH_USER/PASSWORD
    # aren't set, so this is a no-op by default) — see docker-entrypoint.d/.
    location /api/ {
        include /etc/nginx/basic-auth.conf;
        proxy_pass http://backend:8000/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # SPA fallback — client-side routing handles the rest. Deliberately NOT
    # behind auth_basic: this is just the built HTML/JS/CSS shell, no
    # financial data lives in it. The app's own branded login screen
    # (frontend/src/components/auth/LoginGate.tsx) is what actually gates
    # entry, by requiring a valid Authorization header on every /api/ call
    # above — the real protection stays exactly where it was.
    location / {
        try_files $uri $uri/ /index.html;
    }

    gzip on;
    gzip_types text/css application/javascript application/json image/svg+xml;
}