server {
  listen 80;
  server_name _;

  # Resolver — coredns (10.233.0.3 на kubespray-кластерах). nodelocal-dns
  # (169.254.25.10) при первом cold lookup отвечает SERVFAIL, поэтому
  # обращаемся напрямую к ClusterDNS service.
  resolver ${RESOLVER_IP} valid=30s ipv6=off;

  # Real client IP behind ingress-nginx.
  set_real_ip_from 0.0.0.0/0;
  real_ip_header X-Forwarded-For;
  real_ip_recursive on;

  root /usr/share/nginx/html;
  index index.html;

  # /api/v1/dictionaries/* — все admin endpoints (schema, raw record, mutations) идут
  # на writer. Read-api держит /api/v1/{name}/records/* (другой URL pattern, flatten i18n).
  # Regex-location имеет приоритет над префиксом ниже.
  location ~ ^/api/v1/dictionaries/ {
    set $backend "ordinis-app.${ORDINIS_NAMESPACE}.svc.${CLUSTER_DOMAIN}";
    proxy_pass http://$backend$request_uri;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass_request_headers on;
  }

  # GET → read-api, мутирующие → writer.
  # FQDN в proxy_pass нужен потому что nginx resolver не использует search list.
  # Namespace и cluster-domain инжектятся через ENV (см. admin-ui Deployment).
  location /api/v1/ {
    set $backend "ordinis-read-api.${ORDINIS_NAMESPACE}.svc.${CLUSTER_DOMAIN}";
    if ($request_method ~ ^(POST|PUT|PATCH|DELETE)$) {
      set $backend "ordinis-app.${ORDINIS_NAMESPACE}.svc.${CLUSTER_DOMAIN}";
    }
    proxy_pass http://$backend;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass_request_headers on;
  }

  # SPA history fallback.
  location / {
    try_files $uri $uri/ /index.html;
  }
}