server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Public menu site assets (Next.js)
    location ^~ /_next/ {
        proxy_pass https://dmenu.danakcorp.com/_next/;
        proxy_ssl_server_name on;
        proxy_set_header Host dmenu.danakcorp.com;
        proxy_hide_header X-Frame-Options;
        proxy_hide_header Content-Security-Policy;
    }

    location ^~ /icons/ {
        proxy_pass https://dmenu.danakcorp.com/icons/;
        proxy_ssl_server_name on;
        proxy_set_header Host dmenu.danakcorp.com;
        proxy_hide_header X-Frame-Options;
        proxy_hide_header Content-Security-Policy;
    }

    location ^~ /assets/fonts/ {
        proxy_pass https://dmenu.danakcorp.com/assets/fonts/;
        proxy_ssl_server_name on;
        proxy_set_header Host dmenu.danakcorp.com;
        proxy_hide_header X-Frame-Options;
        proxy_hide_header Content-Security-Policy;
    }

    location ^~ /assets/images/ {
        proxy_pass https://dmenu.danakcorp.com/assets/images/;
        proxy_ssl_server_name on;
        proxy_set_header Host dmenu.danakcorp.com;
        proxy_hide_header X-Frame-Options;
        proxy_hide_header Content-Security-Policy;
    }

    # Vite build outputs to /assets by default
    location ^~ /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    # Admin SPA routes
    location ^~ /auth/ {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    location = /dashboard {
        try_files $uri /index.html;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    location = /setting {
        try_files $uri /index.html;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    location = /statistics {
        try_files $uri /index.html;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    location ~ ^/(foods|orders|customers|schedule|payment_methods|discounts|announcements|reports|comments|roles|admins|shipment_methods|coupons|reviews|pagers|notifications|wallet)/ {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    # Restaurant menu preview (same-origin iframe; strips X-Frame-Options from upstream)
    location ~ ^/(?!auth|dashboard|setting|statistics|foods|orders|customers|schedule|payment_methods|discounts|announcements|reports|comments|roles|admins|shipment_methods|coupons|reviews|pagers|notifications|wallet|assets|icons|_next)([a-zA-Z0-9][a-zA-Z0-9_-]*)(/.*)?$ {
        proxy_pass https://dmenu.danakcorp.com/$1$2$is_args$args;
        proxy_ssl_server_name on;
        proxy_set_header Host dmenu.danakcorp.com;
        proxy_hide_header X-Frame-Options;
        proxy_hide_header Content-Security-Policy;
        proxy_hide_header Cache-Control;
        proxy_hide_header ETag;
        proxy_hide_header Last-Modified;
        proxy_hide_header Expires;
        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header Expires "0" always;
    }

    # SPA fallback
    location / {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    # optional: favicon (avoid noisy logs if missing)
    location = /favicon.ico {
        try_files $uri =204;
        access_log off;
        log_not_found off;
    }
}