worker_processes 1;

events {
  worker_connections 1024;
}

http {
  include       mime.types;
  default_type  application/octet-stream;
  sendfile      on;

  server {
    listen 80;

    location /api/ {
      proxy_pass http://new-backend:8080/api/;
      proxy_set_header Host $host;
      proxy_set_header X-Demo-User $http_x_demo_user;
    }

    # Legacy.Web's own routes are "/legacy" and "/legacy/aanvraag/{id}/...",
    # so the prefix is forwarded as-is (no trailing slash on proxy_pass,
    # and no trailing slash on the location so a bare "/legacy" matches too).
    location /legacy {
      proxy_pass http://legacy-frontend:8080;
      proxy_set_header Host $host;
    }

    # Session 2's Angular portal, kept alongside the Session 1 placeholder
    # at "/" for side-by-side comparison. The trailing slash on both the
    # location and proxy_pass strips the /portal prefix (same shape as the
    # "/" -> new-frontend block below); the bare-path redirect below only
    # exists to catch "/portal" (no trailing slash), which wouldn't match
    # "location /portal/" and would otherwise silently fall through to "/".
    # $http_host (not $host) is used explicitly so the Location header keeps
    # the client-facing port (e.g. :8080) - nginx's own implicit redirect
    # construction uses its internal `listen` port instead, which silently
    # drops the port the host actually published this container under.
    location = /portal {
      return 301 $scheme://$http_host/portal/;
    }

    location /portal/ {
      proxy_pass http://portal-frontend:80/;
      proxy_set_header Host $host;
    }

    location / {
      proxy_pass http://new-frontend:80/;
      proxy_set_header Host $host;
    }
  }
}