server {
	listen 3001;
	server_name _;

	location / {
		proxy_pass http://127.0.0.1:2080;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection 'upgrade';
		proxy_set_header Host $host;
		proxy_cache_bypass $http_upgrade;
	}

	# App's Hono proxy (/api/*).
	location /api/ {
		proxy_pass http://127.0.0.1:3456;
		proxy_http_version 1.1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# Browser → internal PocketBase SDK (REST + realtime WebSocket). Only the
	# /api subtree the PocketBase JS SDK uses. The admin UI (/_ and everything
	# else under /pb/) is intentionally NOT proxied, keeping it internal.
	location /pb/api/ {
		proxy_pass http://127.0.0.1:8090/api/;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection 'upgrade';
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_buffering off;
		proxy_read_timeout 3600s;
	}

	# Everything else under /pb/ (including /pb/_ admin UI) → 404.
	location /pb/ {
		return 404;
	}
}