server {
    listen 5173;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    gzip on;
    gzip_types text/plain text/css application/json application/javascript image/svg+xml;
    gzip_min_length 1024;

    # Immutable fingerprinted assets
    location /assets/ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # The service worker must never be cached, or the PWA can never update
    location = /sw.js {
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }

    # Runtime config — never cached. It is how the API base is changed without a
    # rebuild, and a cached copy would silently pin the old URL for every browser
    # that has already loaded the app, with no way to tell from the server side.
    location = /config.js {
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }

    # The API, same-origin. The bundle is built with VITE_UDYAM_API_BASE_URL set
    # to the relative /api/v1/udyam, so it carries no hostname at all and the
    # same dist/ serves from any domain. That also puts the API on the UI's own
    # origin, which means CORS never enters the picture — the single largest
    # source of "works locally, fails deployed" in a split deployment.
    #
    # The backend's context-path is already /api/v1/udyam, so the prefix is
    # passed through unchanged rather than rewritten.
    location /api/ {
        proxy_pass http://127.0.0.1:8082;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Ingestion and the three-year backfill are long-running admin calls;
        # the default 60s read timeout cuts them off mid-run and reports a
        # gateway error over a job that is still working.
        proxy_connect_timeout 30s;
        proxy_send_timeout    300s;
        proxy_read_timeout    300s;
    }

    # SPA fallback — React Router owns the paths
    location / {
        try_files $uri $uri/ /index.html;
    }
}