# TIEASY Nginx example
# Copy to /etc/nginx/sites-available/tieasy and replace the server_name.
# Document root MUST be the public/ directory, not the project root.

server {
    listen 80;
    listen [::]:80;
    server_name tieasy.example.com;

    # After Certbot, this server block is typically redirected to HTTPS.
    root /var/www/tieasy/public;
    index index.php;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    location ^~ /writable/ {
        deny all;
        return 404;
    }

    location ~ /\. {
        deny all;
        return 404;
    }

    location ~* /(composer\.(json|lock)|env|README\.md|DEPLOYMENT\.md)$ {
        deny all;
        return 404;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_hide_header X-Powered-By;
    }

    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff2)$ {
        expires 7d;
        access_log off;
        try_files $uri =404;
    }

    client_max_body_size 8m;
}

# HTTPS (enable after certificates exist):
#
# server {
#     listen 443 ssl http2;
#     listen [::]:443 ssl http2;
#     server_name tieasy.example.com;
#     root /var/www/tieasy/public;
#     index index.php;
#
#     ssl_certificate     /etc/letsencrypt/live/tieasy.example.com/fullchain.pem;
#     ssl_certificate_key /etc/letsencrypt/live/tieasy.example.com/privkey.pem;
#     include /etc/letsencrypt/options-ssl-nginx.conf;
#     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
#
#     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
#     # then the same location blocks as above
# }