# ─────────────────────────────────────────────────────────────────────────────
# Nginx — Laravel API backend
# Domain: api.soarcorp.co.ke
# SSL:    managed by Certbot (Let's Encrypt)
#
# Setup:
#   sudo cp api.soarcorp.co.ke.conf /etc/nginx/sites-available/
#   sudo ln -s /etc/nginx/sites-available/api.soarcorp.co.ke.conf /etc/nginx/sites-enabled/
#   sudo certbot --nginx -d api.soarcorp.co.ke
#   sudo nginx -t && sudo systemctl reload nginx
# ─────────────────────────────────────────────────────────────────────────────

server {
    listen 80;
    server_name api.soarcorp.co.ke;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.soarcorp.co.ke;

    # SSL — filled in by Certbot automatically
    # ssl_certificate     /etc/letsencrypt/live/api.soarcorp.co.ke/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/api.soarcorp.co.ke/privkey.pem;
    # include /etc/letsencrypt/options-ssl-nginx.conf;
    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/demand-lead/public;
    index index.php;

    # Security headers
    add_header X-Frame-Options           "SAMEORIGIN"            always;
    add_header X-Content-Type-Options    "nosniff"               always;
    add_header X-XSS-Protection          "1; mode=block"         always;
    add_header Referrer-Policy           "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Gzip
    gzip on;
    gzip_types application/json text/plain application/javascript;

    # Laravel catch-all
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP-FPM
    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include        fastcgi_params;
        fastcgi_read_timeout 120;
    }

    # Block dot-files (.env, .git, etc.)
    location ~ /\. {
        deny all;
    }

    # Longer timeout for CSV export and AI endpoints
    location ~ ^/api/v1/reports/export {
        fastcgi_pass         unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_index        index.php;
        fastcgi_param        SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include              fastcgi_params;
        fastcgi_read_timeout 300;
    }

    client_max_body_size 20M;

    access_log /var/log/nginx/api.soarcorp.access.log;
    error_log  /var/log/nginx/api.soarcorp.error.log;
}