server {
    listen 80 default;
    #server_name  localhost;
    #server_name_in_redirect on;

    access_log  /dev/stdout;
    error_log  /dev/stdout;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Frame-Options SAMEORIGIN;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

    # Cluster DNS, so the variable upstream below is resolved at request time (not at
    # startup) — the pod won't crash-loop if the host-shell Service is briefly absent.
    # __CLUSTER_DNS__ is substituted at container start by entrypoint.sh from the pod's
    # /etc/resolv.conf nameserver(s), so the same image is portable across clusters
    # (EKS/GKE/kubeadm) whose CoreDNS ClusterIP differs by service CIDR.
    resolver __CLUSTER_DNS__ valid=30s ipv6=off;

    # MFE readiness + VERSION marker for the host shell's aggregated health check
    # (arya GET /mfe_navigations/health fans out to this per remote). This is NOT a
    # K8s probe — remotes keep default TCP readiness; this endpoint exists only for
    # the arya aggregation.
    #
    # It serves build.json, which the CI writes ONLY for the MFE release, e.g.:
    #   { "mfe": true, "build": "<git-sha-or-build-id>" }
    # so the response is VERSION-AWARE. The previous `-f remoteEntry.js` check is
    # NOT usable here: remoteEntry.js is emitted on EVERY build (base webpack config),
    # so it returns 200 on the OLD pod too and can't distinguish the new MFE build.
    # Pre-MFE builds don't produce build.json → this returns 404 (= not the new build).
    location = /audience-manager/mfe-health {
      default_type application/json;
      root /var/www/capillary;
      try_files /audience-manager/build.json =404;
    }

    # MFE split (done in THIS pod because the live data plane for the host is the
    # Gateway-API gateway, which routes all /audience-manager/* here and cannot split
    # by file extension). Static assets (remoteEntry.js + chunks/css/fonts/…) are
    # served locally from this pod; everything else is a navigation/document/deep-link/
    # refresh request and is handed to the host shell (infinity-ui-app), which renders
    # the MFE shell and then loads this remote's remoteEntry.js (served locally below).
    # This pod no longer boots standalone.
    location ~ ^/audience-manager/.+\.(js|mjs|css|map|json|csv|png|jpe?g|gif|svg|ico|webp|avif|woff2?|ttf|eot|mp4|wasm|txt)$ {
      gzip_static on;
      root /var/www/capillary;
      try_files $uri =404;
    }

    location ~ ^/audience-manager/ {
      set $host_shell "infinity-ui-app.default.svc.cluster.local";
      proxy_pass http://$host_shell:80;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
}