# Replace mirwal.pk below with the real domain before deploying.
#
# TLS is deliberately not configured here — it belongs to the DNS/certificate
# step in DEPLOYMENT.md, not to the reproducibility step this file is part
# of. Terminate TLS in front of this (a certbot-managed 443 server block
# added here, or a load balancer) before this ever serves real traffic.
server {
    listen 80;
    server_name mirwal.pk www.mirwal.pk;
    root /usr/share/nginx/html/storefront;
    index index.html;

    gzip on;
    gzip_types text/plain text/css application/javascript application/json image/svg+xml;

    # Hashed filenames (main-abc123.js) are safe to cache forever; index.html
    # never is, or a deploy stops reaching anyone with the old page cached.
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Product and store images are returned by the API as relative /media/...
    # paths (server/src/lib/media.js), not as absolute URLs. On one shared
    # origin that resolves fine; once the frontend and the API sit on
    # separate domains, an <img src="/media/...">, rendered on this page,
    # resolves against THIS origin and 404s. Proxying the same path here
    # makes it resolve correctly without an application change.
    location /media/ {
        proxy_pass http://api:4000;
        proxy_set_header Host $host;
    }

    # Every unknown path falls through to index.html so client-side routing
    # survives a hard refresh on a deep link (a product page, /cart, an
    # order confirmation) — without this, that refresh 404s before React
    # ever loads.
    location / {
        try_files $uri $uri/ /index.html;
    }
}