server {
    listen 80;
    listen [::]:80;
    server_name twoja-domena.com;  # ZMIEŃ na swoją domenę lub IP

    # Redirect HTTP -> HTTPS (zalecane!)
    # return 301 https://$host$request_uri;

    root /var/www/tradesignal;
    index index.html;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
    add_header Referrer-Policy "strict-origin-when-cross-origin";

    # PWA: manifest i SW bez cachowania
    location = /manifest.json {
        add_header Cache-Control "no-cache";
        add_header Content-Type "application/manifest+json";
    }

    location = /sw.js {
        add_header Cache-Control "no-cache";
        add_header Content-Type "application/javascript";
    }

    # Ikony - długi cache
    location ~* \.(png|jpg|ico|svg)$ {
        add_header Cache-Control "public, max-age=604800";
    }

    # JS / CSS - krótszy cache
    location ~* \.(js|css)$ {
        add_header Cache-Control "public, max-age=86400";
    }

    # Główna aplikacja - no-cache
    location / {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-cache";
    }

    # Gzip
    gzip on;
    gzip_types text/html text/css application/javascript application/json;
    gzip_min_length 1024;
}

# HTTPS (odkomentuj po skonfigurowaniu certyfikatu SSL np. Let's Encrypt)
# server {
#     listen 443 ssl http2;
#     listen [::]:443 ssl http2;
#     server_name twoja-domena.com;
#     ssl_certificate /etc/letsencrypt/live/twoja-domena.com/fullchain.pem;
#     ssl_certificate_key /etc/letsencrypt/live/twoja-domena.com/privkey.pem;
#     ... (reszta konfiguracji jak wyżej)
# }