server {
    # Loopback ONLY. This container is host-networked, so this nginx binds the
    # HOST's address directly — `listen 50002;` meant every interface, and the
    # app gate could never stand in front of it (there is no podman publish to
    # pin, and the manifest declared no port, so the gate neither protected it
    # nor reported it — it served this page to anyone who asked, on LAN,
    # Tailscale and the mesh alike). Binding loopback lets the daemon claim the
    # external addresses and authenticate them; see appgate::listener.
    listen 127.0.0.1:50002;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    location /electrs-status {
        proxy_pass http://127.0.0.1:5678/electrs-status;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_connect_timeout 10s;
        proxy_read_timeout 10s;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    location / {
        add_header Cache-Control "no-cache";
        try_files $uri $uri/ /index.html;
    }
}