# Prometheus proxy configuration with authentication
location /prometheus/ {
    # HTTP Basic Authentication
    auth_basic "Prometheus Monitoring";
    auth_basic_user_file /etc/nginx/passwords/monitoring.htpasswd;
    
    # Rate limiting
    limit_req zone=api burst=10 nodelay;
    
    proxy_pass http://prometheus_backend/prometheus/;
    proxy_redirect /prometheus/ /prometheus/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Port $server_port;

    # Timeouts
    proxy_connect_timeout 30s;
    proxy_send_timeout 30s;
    proxy_read_timeout 30s;

    # Buffer settings
    proxy_buffering on;
    proxy_buffer_size 4k;
    proxy_buffers 8 4k;
    proxy_busy_buffers_size 8k;
}

# Health check endpoint
location /prometheus/-/healthy {
    proxy_pass http://prometheus_backend/prometheus/-/healthy;
    proxy_set_header Host $host;
    access_log off;
}