# Public, read-only identity resolution. The service returns only the projection
# needed for routing; credentials and private repository contents are never exposed.
location = /api/hololake/enterprise/identity/health {
    limit_except GET { deny all; }
    proxy_pass http://127.0.0.1:8032/health;
    proxy_set_header Host $host;
    proxy_read_timeout 15s;
}

location = /api/hololake/enterprise/resolve {
    limit_except GET { deny all; }
    proxy_pass http://127.0.0.1:8032/v1/resolve;
    proxy_set_header Host $host;
    proxy_read_timeout 15s;
}

# These three writes require the user's own Forgejo Basic authentication. Nginx
# does not terminate or persist the credential; the loopback service verifies it.
location = /api/hololake/enterprise/relationship-confirmations {
    limit_except POST { deny all; }
    proxy_pass http://127.0.0.1:8032/v1/relationship-confirmations;
    proxy_set_header Host $host;
    proxy_read_timeout 15s;
    client_max_body_size 16k;
}

location = /api/hololake/enterprise/responsibility-receipts {
    limit_except POST { deny all; }
    proxy_pass http://127.0.0.1:8032/v1/responsibility-receipts;
    proxy_set_header Host $host;
    proxy_read_timeout 15s;
    client_max_body_size 16k;
}

location = /api/hololake/enterprise/me/entry {
    limit_except POST { deny all; }
    proxy_pass http://127.0.0.1:8032/v1/me/entry;
    proxy_set_header Host $host;
    proxy_read_timeout 15s;
    client_max_body_size 16k;
}

location = /api/hololake/enterprise/change-password {
    limit_except POST { deny all; }
    proxy_pass http://127.0.0.1:8032/v1/change-password;
    proxy_set_header Host $host;
    proxy_read_timeout 30s;
    client_max_body_size 16k;
}