server {
    listen       8080;
    server_name  _;

    root  /usr/share/nginx/html;
    index index.html;

    # Coolify/Traefik terminates TLS upstream; trust its forwarded scheme only.
    absolute_redirect off;

    gzip              on;
    gzip_vary         on;
    gzip_min_length   1024;
    gzip_proxied      any;
    gzip_types        text/plain text/css application/javascript application/json
                      image/svg+xml font/woff2 application/wasm;

    location = /healthz {
        access_log off;
        add_header Content-Type text/plain;
        return 200 "ok\n";
    }

    # Vite emits content-hashed filenames here -> cache hard.
    location /assets/ {
        try_files $uri =404;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }

    location /fonts/ {
        try_files $uri =404;
        add_header Cache-Control "public, max-age=2592000";
    }

    # Never cache the shell: it points at the hashed bundles.
    location = /index.html {
        add_header Cache-Control "no-store";
    }

    # SPA fallback, mirrors vercel.json rewrites.
    location / {
        try_files $uri $uri/ /index.html;
    }
}