server {
  listen 80;
  server_name _;
  root /usr/share/nginx/html;
  index index.html;

  # Reverse-proxy /api to the demo backend so live mode works
  # same-origin without CORS gymnastics. Backend is reached via the
  # cluster-internal service rewritten by the ingress to demo.flow-master.ai.
  location /api/ {
    proxy_pass https://demo.flow-master.ai;
    proxy_set_header Host demo.flow-master.ai;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-Host $host;
    proxy_ssl_server_name on;
    proxy_http_version 1.1;
    proxy_read_timeout 30s;
  }

  # SPA: everything else falls back to index.html.
  location / {
    try_files $uri $uri/ /index.html;
    add_header Cache-Control "no-cache";
  }

  # Static assets with content hashes in their filenames cache forever.
  location /assets/ {
    try_files $uri =404;
    add_header Cache-Control "public, max-age=31536000, immutable";
  }
}