server {
  listen 80;
  server_name _;

  root /usr/share/nginx/html;
  index index.html;

  # Same-origin proxy to the api container — deliberately, not an
  # absolute cross-origin URL. Pointing the client straight at the api
  # container's own origin broke CORS during local dev (no CORS headers
  # on the server, and adding them would be more moving parts than just
  # not needing them).
  location /api/ {
    proxy_pass http://api:3010;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  # Hash-based client routing (#/host, #/play/CODE, ...) — the fragment
  # never reaches the server, so plain static serving is enough; no SPA
  # history-API rewrite rule needed for any route, including the guest
  # OAuth callback (?code=... lands on the root path itself).
  location / {
    try_files $uri $uri/ /index.html;
  }
}