# -----------------------------------------------------------------------------
# Shared configuration for every location proxied to the Django container.
#
# Django's SecurityMiddleware sets its own X-Frame-Options, nosniff,
# Referrer-Policy and Cross-Origin-Opener-Policy, and nginx adds the same
# names from security-headers.conf - so without the proxy_hide_header lines
# below the client receives each one twice.  That is not merely untidy: on
# /api/docs/ drf-spectacular relaxes COOP to "unsafe-none" while the edge
# sends "same-origin", and a response carrying two contradictory
# Cross-Origin-Opener-Policy values is one the browser is free to resolve
# either way.  The edge is the single authority; the upstream copies are
# dropped here.
# -----------------------------------------------------------------------------
proxy_hide_header X-Frame-Options;
proxy_hide_header X-Content-Type-Options;
proxy_hide_header Referrer-Policy;
proxy_hide_header Cross-Origin-Opener-Policy;

proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Request-ID $request_id;
proxy_connect_timeout 5s;
proxy_read_timeout 30s;