# server configuration for WATCHMAN
#
server {
    listen 192.168.133.1:80;
    server_name watchman.xandari.net;
    include /etc/nginx/acme.conf;
    return 301 https://$server_name$request_uri;
}

server {
    listen 192.168.133.1:443 ssl http2; # managed by Certbot
    server_name watchman.xandari.net;

    include /etc/nginx/acme.conf;
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

    ssl_certificate /etc/nginx/ssl/watchman.xandari.net.chain;
    ssl_certificate_key /etc/nginx/ssl/watchman.xandari.net.key;
    ssl_trusted_certificate /etc/nginx/ssl/watchman.xandari.net.crt;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    root /srv/webs/watchman/public;

    #rewrite ^/api/swagger-ui.html /index.php last;
    #rewrite ^/_profiler/phpinfo /index.php last;

    #location ~ "^/paypal" {
    #    try_files $uri /backend.php$is_args$args;
    #}

    #rewrite ^/pay/ /backend.php last;
    #rewrite ^/pdf/ /backend.php last;
    #rewrite ^/api /backend.php last;
    #rewrite ^/admin /backend.php last;
    #rewrite ^/oauth /backend.php last;
    #rewrite ^/_wdt /backend.php last;
    #rewrite ^/_profiler /backend.php last;

    #if ($request_uri ~ "protected") {
    #    rewrite protected /admin/core/private-files/get/?file=$request_uri last;
    #}

    #rewrite ^/private-files /backend.php last;

    #location ~ "^/app" {
    #    try_files $uri /app/index.html$is_args$args;
    #}

    location / {
        index index.php index.html;
        try_files $uri $uri/ @rewrites; 
    }

    location @rewrites {
        rewrite ^ /index.php?_url=$uri&$args last;
    }

    # pass PHP scripts to FastCGI server
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param STAGE development;
    }

    location ~* ^.+\.(jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
        expires 30d;
        access_log off;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    location ~ /\.ht {
	deny all;
    }

    access_log /srv/logs/watchman.access.log;
    error_log /srv/logs/watchman.error.log;
}
