server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Serve the app under /loanapp, stripping the prefix for static assets and
    # falling back to the SPA entrypoint for deep links.
    location /loanapp/ {
        rewrite ^/loanapp/(.*)$ /$1 break;
        try_files $uri $uri/ /index.html;
    }

    # Fallback for any other paths (e.g., health checks).
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Basic security headers.
    add_header X-Content-Type-Options "nosniff";
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
}