# Let's Encrypt HTTP-01 (certbot webroot)
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
        allow all;
    }

    # ── STOMP / SockJS (Spring context-path /api → /api/ws/trading) ───
    location /api/ws/ {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade           $http_upgrade;
        proxy_set_header    Connection        $connection_upgrade;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 7d;
        proxy_send_timeout    7d;
        proxy_read_timeout    7d;
        proxy_buffering           off;
        proxy_request_buffering   off;
        gzip                        off;
        chunked_transfer_encoding   on;
    }

    # ── LLM / AI 검증 (Ta4j 재평가 + LLM — exact match, 일반 /api/ 60s 회피) ───
    location = /api/strategy/evaluation/ai-verify/jobs {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 60s;
        proxy_read_timeout    30s;
        proxy_send_timeout    30s;
        proxy_buffering       off;
        client_max_body_size  16m;
    }

    location ~ ^/api/strategy/evaluation/ai-verify/jobs/[^/]+$ {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 10s;
        proxy_read_timeout    30s;
        proxy_send_timeout    30s;
        proxy_buffering       off;
    }

    location = /api/strategy/evaluation/ai-verify {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 60s;
        proxy_read_timeout    600s;
        proxy_send_timeout    600s;
        proxy_buffering       off;
        client_max_body_size  16m;
    }

    location = /api/strategy/evaluation/llm-test {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 60s;
        proxy_read_timeout    600s;
        proxy_send_timeout    600s;
        proxy_buffering       off;
    }

    # ── GoldenChart Spring Boot Backend 프록시 ────────────────────────
    location /api/ {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade           $http_upgrade;
        proxy_set_header    Connection        $connection_upgrade;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 10s;
        proxy_read_timeout    180s;
        proxy_send_timeout    180s;
        proxy_buffering       off;
    }

    # ── Upbit REST API 역방향 프록시 ──────────────────────────────────────
    location /upbit-api/ {
        proxy_pass          https://api.upbit.com/;
        proxy_ssl_server_name on;
        proxy_ssl_protocols   TLSv1.2 TLSv1.3;
        proxy_set_header    Host api.upbit.com;
        proxy_set_header    Accept application/json;
        proxy_set_header    X-Real-IP $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_hide_header   Access-Control-Allow-Origin;
        add_header          Access-Control-Allow-Origin *;
        proxy_cache_bypass  $http_upgrade;
    }

    # ── Upbit WebSocket 역방향 프록시 ─────────────────────────────────────
    location /upbit-ws {
        proxy_pass          https://api.upbit.com/websocket/v1;
        proxy_http_version  1.1;
        proxy_ssl_server_name on;
        proxy_ssl_protocols   TLSv1.2 TLSv1.3;
        proxy_ssl_verify      off;
        proxy_set_header    Upgrade $http_upgrade;
        proxy_set_header    Connection "Upgrade";
        proxy_set_header    Host api.upbit.com;
        proxy_set_header    Origin "https://upbit.com";
        proxy_set_header    X-Real-IP $remote_addr;
        proxy_set_header    Authorization "";
        proxy_read_timeout  3600s;
        proxy_send_timeout  3600s;
        proxy_buffering     off;
    }

    # ── STOMP / SockJS WebSocket 프록시 (구버전 /ws/**) ─────────────────
    location /ws/ {
        proxy_pass          http://backend:8080/api/ws/;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade    $http_upgrade;
        proxy_set_header    Connection $connection_upgrade;
        proxy_set_header    Host             $host;
        proxy_set_header    X-Real-IP        $remote_addr;
        proxy_set_header    X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 7d;
        proxy_send_timeout    7d;
        proxy_read_timeout    7d;
        proxy_buffering       off;
    }

    # ── 모바일 APK 다운로드 (대용량) ─────────────────────────────────────
    location /api/mobile-app/download/ {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_read_timeout    600s;
        proxy_send_timeout    600s;
        proxy_buffering       off;
        client_max_body_size  200m;
    }

    # ── React SPA 폴백 ────────────────────────────────────────────────────
    location / {
        try_files $uri $uri/ /index.html;
    }

    location ~* \.(js|css|woff2?|ttf|eot|svg|ico|png|jpg|jpeg|gif|webp)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location ~* \.html$ {
        expires -1;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    # GoldenChart Desktop updater manifest + bundles
    location /desktop/updates/ {
        alias /usr/share/nginx/html/desktop/updates/;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }
    location = /desktop/updates/latest.json {
        alias /usr/share/nginx/html/desktop/updates/latest.json;
        default_type application/json;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }

    gzip            on;
    gzip_vary       on;
    gzip_min_length 1024;
    gzip_types      text/plain text/css text/javascript application/javascript
                    application/json image/svg+xml;