server {
    listen 80;

    location / {
        root /usr/share/nginx/html;
        index index.html index.htm;
        try_files $uri $uri/ /index.html;
    }

    # Admin endpoints need the admin key, not the regular API key. This prefix
    # location is longer than "/api", and nginx picks the longest matching
    # prefix location, so it wins for /api/admin/* while /api handles the rest.
    location /api/admin/ {
        proxy_pass http://backend:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header Authorization "Bearer ${MUZICK_ADMIN_KEY}";
        proxy_cache_bypass $http_upgrade;
    }

    location /api {
        proxy_pass http://backend:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header Authorization "Bearer ${MUZICK_API_KEY}";
        proxy_cache_bypass $http_upgrade;
    }
}
