server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Echte Besucher-IP aus dem Reverse Proxy übernehmen (Docker-Netze)
    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 172.16.0.0/12;
    set_real_ip_from 192.168.0.0/16;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

    # ---- Passwortschutz -------------------------------------------------
    auth_basic           "TD-Pult";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # ---- Kein Caching: eine neue HTML-Datei ist sofort aktiv ------------
    add_header Cache-Control "no-store, must-revalidate" always;
    add_header X-Content-Type-Options   "nosniff"        always;
    add_header X-Frame-Options          "SAMEORIGIN"     always;
    add_header Referrer-Policy          "no-referrer"    always;
    add_header Permissions-Policy       "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;

    gzip              on;
    gzip_types        text/plain application/json;   # text/html macht nginx immer
    gzip_min_length   1024;

    client_max_body_size 2m;

    # Statusabfrage für den Healthcheck – ohne Passwort
    location = /healthz {
        auth_basic off;
        access_log off;
        default_type text/plain;
        return 200 "ok\n";
    }

    location / {
        try_files $uri $uri/ /index.html;
    }

    # Versteckte Dateien nie ausliefern
    location ~ /\. {
        deny all;
    }
}