server {
  listen 80;
  server_name _;
  root /usr/share/nginx/html;
  index index.html;

  # Resolve the BFF via Docker's embedded DNS at request time (variable proxy_pass), so nginx starts
  # even before the BFF is up and picks up restarts — instead of failing to load the config.
  resolver 127.0.0.11 ipv6=off valid=30s;

  # Same-origin API: proxy the BFF endpoint groups to the bff service. The api-client uses relative
  # URLs, so the browser calls this origin and nginx forwards to the BFF — no CORS, and the DigiD
  # token (same-origin) is attached by the app's interceptor (S-08d/ADR-0010).
  location /self-service/ {
    set $bff http://bff:8080;
    proxy_pass $bff;
    proxy_set_header Host $host;
  }
  location /openbaar/ {
    set $bff http://bff:8080;
    proxy_pass $bff;
    proxy_set_header Host $host;
  }

  # SPA fallback — Angular client-side routing.
  location / {
    try_files $uri $uri/ /index.html;
  }
}