# Optional top-level reverse proxy fronting both the SPA and the API on port 80.
upstream api_upstream { server api:8080; }
upstream frontend_upstream { server frontend:80; }

server {
    listen 80;
    server_name _;

    location /api/ {
        proxy_pass http://api_upstream;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header Cookie $http_cookie;
    }

    # Google OAuth2 callback + sign-out -> backend (same-origin session).
    location ~ ^/(signin-google|signout-google) {
        proxy_pass http://api_upstream;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header Cookie $http_cookie;
    }

    location / {
        proxy_pass http://frontend_upstream;
        proxy_set_header Host $http_host;
    }
}