# Static server for the Boojee Cafe ordering SPA (Vite/React).
# - SPA try_files fallback so ?outlet=&table= deep links never 404.
# - Long cache for hashed /assets/*; no-cache for index.html.
# - /aiw-cafe-widget.js served same-origin (vendored in public/), CORS-open so
#   it can also be embedded on other hosts if needed; not long-cached (the
#   bundle filename is not content-hashed).

server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;
    server_tokens off;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy        "strict-origin-when-cross-origin" always;

    location ~ \.map$ {
        return 404;
        access_log off;
    }

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_types text/plain text/css text/javascript application/javascript application/json image/svg+xml;

    # Content-hashed Vite assets - cache hard.
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header X-Content-Type-Options "nosniff" always;
        try_files $uri =404;
    }

    # The cafe widget bundle (not hashed) - short cache, CORS-open.
    location = /aiw-cafe-widget.js {
        add_header Cache-Control "public, max-age=300";
        add_header Access-Control-Allow-Origin "*";
        add_header X-Content-Type-Options "nosniff" always;
        try_files $uri =404;
    }

    location = /index.html {
        add_header Cache-Control "no-store, no-cache, must-revalidate";
        add_header X-Content-Type-Options "nosniff" always;
        try_files $uri =404;
    }

    location / {
        try_files $uri $uri/ /index.html;
    }

    location = /_health {
        access_log off;
        return 200 "ok\n";
        add_header Content-Type text/plain;
    }
}