# Managed by HostDesk. Sensitive application paths are explicitly denied.
server {
    listen 80;
    listen [::]:80;
    server_name tanwan.de www.tanwan.de;
    location ^~ /.well-known/acme-challenge/ {
        root /var/lib/hostdesk/acme-http;
        default_type text/plain;
    }
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name tanwan.de www.tanwan.de;
    ssl_certificate /etc/hostdesk/certificates/tanwan-de/fullchain.pem;
    ssl_certificate_key /etc/hostdesk/certificates/tanwan-de/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:HostDeskSSL:10m;
    client_max_body_size 64m;
    keepalive_timeout 65;
    server_tokens off;
    gzip on;
    gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml;
    access_log /var/log/nginx/tanwan-de.access.log;
    error_log /var/log/nginx/tanwan-de.error.log;
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    location ^~ /.well-known/acme-challenge/ {
        root /var/lib/hostdesk/acme-http;
        default_type text/plain;
    }
    root /var/www/tanwan.de/public;
    index index.php index.html;
    location = /database.sql { deny all; }
    location = /README.md { deny all; }
    location ^~ /database/ { deny all; }
    location ^~ /storage/ { deny all; }
    location ^~ /maintenance/ { deny all; }
    location ^~ /deploy/ { deny all; }
    location ~* \.(?:sql|sqlite|bak|backup|dist|ini|log|sh)$ { deny all; }
    location / { try_files $uri $uri/ /index.php?$query_string; }
    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi.conf;
        fastcgi_pass 127.0.0.1:9000;
    }
    location ~ /\. { deny all; }
}