# Absurdities NG - Nginx
# Replace PHP socket and TLS paths for your server. Not tested here (no nginx binary in the build sandbox):
# run `nginx -t` before reloading.

# Redirect everything on plain HTTP and the bare domain to https://www
server {
    listen 80;
    listen [::]:80;
    server_name absurdities.ng www.absurdities.ng cytadel.absurdities.ng;
    location /.well-known/acme-challenge/ { root /var/www/certbot; }
    location / { return 301 https://www.absurdities.ng$request_uri; }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name absurdities.ng;
    ssl_certificate     /etc/letsencrypt/live/absurdities.ng/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/absurdities.ng/privkey.pem;
    return 301 https://www.absurdities.ng$request_uri;
}

# ---- Members and visitors ---------------------------------------------------
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name www.absurdities.ng;

    ssl_certificate     /etc/letsencrypt/live/absurdities.ng/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/absurdities.ng/privkey.pem;

    root /var/www/absurdities-ng/public;
    index index.php;
    charset utf-8;
    client_max_body_size 110m;      # videos are uploaded in Phase 2; keep in step with php.ini

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Extension-less URLs. /about.php and /about.html both 301 to /about, using ngx_http_rewrite_module.
    # `$request_uri` (not `$uri`) is matched so the internal /index.php front-controller hop never loops.
    if ($request_uri ~ "^(?<clean>[^?]*?)\.(?:php|html?)(?<args_part>\?.*)?$") {
        set $redirect_clean 1;
    }
    if ($request_uri ~ "^/index\.php") { set $redirect_clean 0; }
    if ($redirect_clean = 1) { return 301 $clean$args_part; }

    # Web installer (public/install.php). It deletes itself when finished, after which this returns 404.
    # You may remove this block once the site is installed.
    location = /install {
        if (!-f $document_root/install.php) { return 404; }
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root/install.php;
        fastcgi_read_timeout 120s;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    # Static assets: long cache; filenames change when rebuilt (build/app.css) or are versioned by query.
    location ~* ^/(build|js|images|fonts)/ {
        expires 30d;
        add_header Cache-Control "public, max-age=2592000";
        try_files $uri =404;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ ^/index\.php(/|$) {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root/index.php;
        fastcgi_param DOCUMENT_ROOT   $realpath_root;
        fastcgi_hide_header X-Powered-By;
    }

    # Never serve any other PHP file or dotfile
    location ~ \.php$ { return 404; }
    location ~ /\.(?!well-known) { deny all; }
}

# ---- Staff panel (own sub-domain; same Laravel app, host-only cookies) -----------
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name cytadel.absurdities.ng;

    ssl_certificate     /etc/letsencrypt/live/absurdities.ng/fullchain.pem;   # use a wildcard or SAN certificate
    ssl_certificate_key /etc/letsencrypt/live/absurdities.ng/privkey.pem;

    root /var/www/absurdities-ng/public;
    index index.php;
    charset utf-8;

    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Robots-Tag "noindex, nofollow" always;

    # Optional extra layer: allow only office/VPN addresses at the web server too.
    # allow 203.0.113.10; deny all;

    if ($request_uri ~ "^(?<clean>[^?]*?)\.(?:php|html?)(?<args_part>\?.*)?$") { set $redirect_clean 1; }
    if ($request_uri ~ "^/index\.php") { set $redirect_clean 0; }
    if ($redirect_clean = 1) { return 301 $clean$args_part; }

    location ~* ^/(build|js|images|fonts)/ { expires 7d; try_files $uri =404; }
    location / { try_files $uri $uri/ /index.php?$query_string; }

    location ~ ^/index\.php(/|$) {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root/index.php;
        fastcgi_param DOCUMENT_ROOT   $realpath_root;
        fastcgi_hide_header X-Powered-By;
    }
    location ~ \.php$ { return 404; }
    location ~ /\.(?!well-known) { deny all; }
}