events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;
    
    client_max_body_size 128M;

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    # API-only server (api.koppkb.com via host reverse proxy)
    server {
        listen 80;
        server_name _;
        root /var/www/public;
        index index.php;

        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;

        location / {
            try_files $uri $uri/ /index.php?$query_string;
        }

        location = /health {
            access_log off;
            default_type text/plain;
            return 200 'ok';
        }

        location ~ \.php$ {
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
            fastcgi_param HTTP_PROXY "";
            fastcgi_param HTTPS $https if_not_empty;
            fastcgi_read_timeout 300;
            fastcgi_send_timeout 300;
        }

        location ~ /\. {
            deny all;
        }

        location ^~ /horizon {
            add_header Content-Security-Policy "default-src 'self' http: https: data: blob 'unsafe-inline' 'unsafe-eval'" always;
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
            include fastcgi_params;
            fastcgi_param HTTP_PROXY "";
            fastcgi_param HTTPS $https if_not_empty;
            fastcgi_read_timeout 300;
            fastcgi_send_timeout 300;
        }
    }
}