server {
    listen 80;
    # Declare IPv6 explicitly ourselves - the stock nginx image otherwise
    # tries to inject this line into default.conf on startup
    # (10-listen-on-ipv6-by-default.sh), which fails with a "read-only file
    # system?" message because we mount this file read-only. Harmless, but
    # noisy; setting it here avoids the entrypoint script touching the file
    # at all.
    listen [::]:80;
    server_name _;

    # Small landing response at the root so a bare hit doesn't 404.
    location = / {
        default_type text/plain;
        return 200 "RPM mirror - browse /repo/\n";
    }

    # The actual mirrored repos (one subdirectory per source name) and the
    # generated client .repo files under /repo/client-repos/.
    location /repo/ {
        alias /usr/share/nginx/html/repo/;
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;

        # repomd.xml is what dnf checks first to see if a repo changed -
        # keep it uncached so clients notice updates immediately. Everything
        # else (rpms, *.xml.gz) is content-addressed enough to cache freely.
        if ($request_uri ~* /repodata/repomd\.xml$) {
            add_header Cache-Control "no-cache";
        }
    }

    location /healthz {
        default_type text/plain;
        return 200 "ok\n";
    }
}