upstream panel {
    server roboco-panel:3000;
}

upstream orchestrator {
    server roboco-orchestrator:8000;
}

server {
    listen 80;
    server_name _;

    # Health check -> orchestrator (no auth needed)
    location /health {
        proxy_pass http://orchestrator;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Readiness check -> orchestrator
    location /ready {
        proxy_pass http://orchestrator;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # API requests -> orchestrator
    location /api/ {
        proxy_pass http://orchestrator;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # The browser never holds the signing secret. nginx (the only trusted
        # hop for the human panel) attaches the CEO token so secure mode
        # (ROBOCO_AGENT_AUTH_REQUIRED=true) does not lock the panel out. Empty
        # when unset, in which case nginx sends no header (dev/header-trust).
        proxy_set_header X-Agent-Token "${ROBOCO_PANEL_AGENT_TOKEN}";
    }

    # WebSocket requests -> orchestrator
    location /ws/ {
        proxy_pass http://orchestrator;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Agent-Token "${ROBOCO_PANEL_AGENT_TOKEN}";
        proxy_read_timeout 86400;
    }

    # Everything else -> panel
    location / {
        proxy_pass http://panel;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}