# CareBill — nginx site. Copy to /etc/nginx/sites-available/carebill, adjust the
# three marked lines, then:  ln -s ../sites-available/carebill /etc/nginx/sites-enabled/
#                            nginx -t && systemctl reload nginx
#
# The one rule that matters: the web root is the public/ folder, never the
# project folder. Everything else — config with the database password, sql,
# tools that wipe the ledger, storage with bank statements — sits outside it and
# cannot be requested at all.

server {
    listen 80;
    server_name billing.caresoft.co.in;                      # <- your address
    return 301 https://$host$request_uri;                    # nothing is served over plain http
}

server {
    listen 443 ssl http2;
    server_name billing.caresoft.co.in;                      # <- your address

    root /var/www/carebill/public;                           # <- public/, not the project folder
    index index.php;

    # certbot fills these in:  certbot --nginx -d billing.caresoft.co.in
    ssl_certificate     /etc/letsencrypt/live/billing.caresoft.co.in/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/billing.caresoft.co.in/privkey.pem;

    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    client_max_body_size 20m;                                # bank statements and workbooks

    # belt and braces, in case the root is ever pointed at the wrong folder. Tested
    # that way on purpose: with the root wrong, these still refuse the private
    # folders, so config is not executed and no test tool can be run from outside.
    location ~ ^/(app|config|tools|sql|storage|cron|deploy|modules)(/|$) { deny all; return 404; }
    location ~ /\.            { deny all; return 404; }
    location ~* \.(sql|log|md|sh|bak|zip)$ { deny all; return 404; }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        try_files $uri =404;                                 # only files that really exist in public/
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_read_timeout 120;
    }

    # webhooks from payment gateways, Meta and SES: POST only, and never cached
    location ~ ^/(webhook|wahook|mailhook)\.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        add_header Cache-Control "no-store" always;
    }

    location ~* \.(css|js|png|jpg|svg|ico|woff2?)$ {
        expires 7d;
        access_log off;
    }
}