events {
    worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    # Single HTTP server for internal proxying (edge TLS handled by nginx-proxy)
    server {
        listen 3000;
        server_name localhost motovaultpro.com;

        root /usr/share/nginx/html;
        index index.html;

        # Handle React Router (SPA)
        location / {
            try_files $uri $uri/ /index.html;
        }

        # Security headers
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
    }
}