nginx.conf

server {
    listen 80;
    client_max_body_size 0;
    root /usr/share/nginx/html;
    index index.html;
    etag on;

    # Docker internal DNS resolver (for service name resolution)
    resolver 127.0.0.11 ipv6=off;

    proxy_read_timeout 3600;
    proxy_connect_timeout 3600;
    proxy_send_timeout 3600;

    # Security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy "no-referrer-when-downgrade";

    # Gzip compression for faster content delivery
    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # Pocketbase and WebSocket requests
    location /api {
        # Forwarded headers
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;

        # Proxy requests
        proxy_pass "http://backend:8090";
    }

    # Frontend Vue app
    location / {
        try_files $uri $uri/ /index.html;
    }
}