server {
    listen 80;
    server_name _;

    root  /usr/share/nginx/html;
    index index.html;

    # Résolveur Docker interne — re-résolution DNS à chaque requête (évite le cache IP stale)
    resolver 127.0.0.11 valid=30s ipv6=off;
    resolver_timeout 5s;

    # ── Compression ───────────────────────────────────────────
    gzip on;
    gzip_vary on;
    gzip_types
        text/plain text/css text/javascript
        application/javascript application/json
        image/svg+xml;

    # ── PWA : cache long sur les assets hasheés ───────────────
    location ~* \.(js|css|woff2?|png|svg|ico|webmanifest)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    # ── API → backend (service Docker interne) ────────────────
    location /api/ {
        set $upstream_backend http://notesfrais-backend:3001;
        proxy_pass         $upstream_backend/api/;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Nécessaire pour l'upload d'images (jusqu'à 15 Mo)
        client_max_body_size 20m;

        # Timeout généreux pour la génération PDF
        pr