worker_processes auto;
pid /tmp/nginx.pid;

events {
  worker_connections 1024;
}

http {
  include /etc/nginx/mime.types;
  default_type application/octet-stream;
  access_log /dev/stdout;
  error_log /dev/stderr warn;
  sendfile on;
  server_tokens off;

  client_body_temp_path /tmp/client_temp;
  proxy_temp_path /tmp/proxy_temp;
  fastcgi_temp_path /tmp/fastcgi_temp;
  uwsgi_temp_path /tmp/uwsgi_temp;
  scgi_temp_path /tmp/scgi_temp;

  server {
    listen 3000;
    root /usr/share/nginx/html;

    location = /healthz {
      access_log off;
      default_type text/plain;
      return 200 "ok\n";
    }

    # These paths are owned by the Go workload. Ingress routes them there;
    # reject them here as defense in depth if Web is reached directly.
    location ~ ^/(api|uploads|generated-results)(?:/|$) {
      return 404;
    }

    location /_next/static/ {
      expires 1y;
      add_header Cache-Control "public, max-age=31536000, immutable";
      try_files $uri =404;
    }

    location / {
      add_header Cache-Control "no-cache, no-store, must-revalidate" always;
      add_header Pragma "no-cache" always;
      add_header Expires "0" always;
      try_files $uri $uri.html $uri/ /index.html;
    }
  }
}