# The HF ingress terminates TLS; preserve its explicit protocol indication.
map $http_x_forwarded_proto $brainapi_forwarded_proto {
    default $scheme;
    https https;
    http http;
}

server {
    listen 7860 default_server;
    listen [::]:7860 default_server;
    server_name _;

    client_max_body_size 100M;

    location ~ ^/brains/[^/]+/mcp(/.*)?$ {
        proxy_pass http://127.0.0.1:8001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $brainapi_forwarded_proto;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding off;
    }

    location ~ ^/(mcp(/|$)|mcp-oauth/|authorize$|token$|register$|\.well-known/) {
        proxy_pass http://127.0.0.1:8001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $brainapi_forwarded_proto;
        proxy_set_header Connection "";
        proxy_buffering off;
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $brainapi_forwarded_proto;
    }
}