nginx.conf

worker_processes 1;
events { worker_connections 1024; }
pid /tmp/nginx.pid;
http {
  server {
    listen 7860;

    # Security headers (X-Frame-Options omitted: HF Spaces embeds via iframe)
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location /api/ {
      proxy_pass http://127.0.0.1:8000/;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_connect_timeout       600s;
      proxy_send_timeout          600s;
      proxy_read_timeout          600s;
      send_timeout                600s;
    }

    location / {
      proxy_pass http://127.0.0.1:8001;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_connect_timeout       600s;
      proxy_send_timeout          600s;
      proxy_read_timeout          600s;
      send_timeout                600s;
    }
  }
}