server {
  listen 80;
  server_name _;

  # Resolver для динамического k8s service DNS (proxy_pass с переменной).
  # 169.254.25.10 — nodelocal-dns на kubespray-кластерах (cluster.265 и .264).
  resolver 169.254.25.10 1.1.1.1 valid=30s ipv6=off;

  # Real client IP behind ingress-nginx.
  set_real_ip_from 0.0.0.0/0;
  real_ip_header X-Forwarded-For;
  real_ip_recursive on;

  root /usr/share/nginx/html;
  index index.html;

  # GET → read-api, мутирующие → writer.
  location /api/v1/ {
    set $backend "ordinis-read-api";
    if ($request_method ~ ^(POST|PUT|PATCH|DELETE)$) {
      set $backend "ordinis-app";
    }
    proxy_pass http://$backend;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass_request_headers on;
  }

  # SPA history fallback.
  location / {
    try_files $uri $uri/ /index.html;
  }
}