# Toolvana — nginx reverse proxy + static asset server.

server {
    listen 80;
    server_name _;
    root /app/public;
    index index.php;

    # security headers (TLS terminates here in production; enable HSTS after cert)
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;

    gzip on;
    gzip_comp_level 5;
    gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;
    # brotli: enable with the ngx_brotli module where available
    # brotli on; brotli_types text/plain text/css application/javascript application/json image/svg+xml;

    # --- static assets: immutable caching ------------------------------------
    location ~* \.(css|js|svg|png|jpg|webp|woff2?|ico)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    # --- PHP-FPM to the web/api upstreams --------------------------------------
    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_pass web:9000;
        fastcgi_read_timeout 120s;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}

# HTTP/3 note: run behind Cloudflare or a QUIC-enabled edge for h3.