pid /tmp/nginx.pid;
error_log /dev/stderr warn;
events { worker_connections 256; }
http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    access_log /dev/stdout;
    sendfile on;
    client_body_temp_path /tmp/client_temp;
    proxy_temp_path /tmp/proxy_temp;
    fastcgi_temp_path /tmp/fastcgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    scgi_temp_path /tmp/scgi_temp;
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

server {
    listen 8080;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header Content-Security-Policy "default-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'" always;
    add_header Permissions-Policy "camera=(), geolocation=(), microphone=(), payment=()" always;
    # Defence-in-depth per SECURITY_THREAT_MODEL.md §4 ("HSTS when HTTPS
    # deployment is stable"). TLS terminates at the external Nginx Proxy
    # Manager (ADR-0010); this container only ever serves plain HTTP on
    # 8080. Browsers ignore Strict-Transport-Security on a non-HTTPS
    # response, so emitting it here unconditionally is safe even before/if
    # this service is ever reached directly over HTTP, and it still reaches
    # the browser once NPM proxies the HTTPS response through unless NPM is
    # configured to strip it (verify during deployment smoke test, see
    # docs/operations/DEPLOYMENT_UNRAID.md §7). `includeSubDomains` is set;
    # `preload` is intentionally omitted because preload-list submission is
    # effectively irreversible and should only be added once the HTTPS/DNS
    # setup at the NPM edge has been stable in production for a while.
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location = /healthz {
        access_log off;
        default_type text/plain;
        return 200 "ok\n";
    }
    # Never let conventional internal-observability paths fall through to the
    # SPA with a misleading HTTP 200. Pulse exposes bounded authenticated
    # diagnostics below /api/v1/system/*; raw metrics/debug handlers are not a
    # public web contract.
    location = /metrics { access_log off; return 404; }
    location ^~ /debug/ { access_log off; return 404; }
    # Dependency-aware readiness must reach the API. Without this exact route,
    # SPA fallback returns index.html with HTTP 200 and monitoring falsely sees
    # a ready backend even when PostgreSQL or migrations are unavailable.
    location = /readyz {
        proxy_pass http://pulse-api:8081;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location /api/ {
        proxy_pass http://pulse-api:8081;
        proxy_http_version 1.1;
        # Preserve a non-default deployment port. The WebSocket library's
        # same-origin check compares Origin against Host and correctly rejects
        # a port-stripped Host header.
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_read_timeout 65s;
    }
    location ~ ^/(auth|session)/ {
        proxy_pass http://pulse-api:8081;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location / { try_files $uri $uri/ /index.html; }
}
}