Chat's updates for security, db and workflow

deploy/nginx.conf.example

@@ -0,0 +1,28 @@
+# Substitute certificate paths, document root, and PHP socket before installation.
+# This server terminates HTTPS directly. Forwarded headers are not trusted by default.
+server {
+    listen 80;
+    server_name app.myhuntingclubroster.com;
+    return 301 https://app.myhuntingclubroster.com$request_uri;
+}
+server {
+    listen 443 ssl;
+    server_name app.myhuntingclubroster.com;
+    ssl_certificate /etc/ssl/hcr/fullchain.pem;
+    ssl_certificate_key /etc/ssl/hcr/privkey.pem;
+    root /srv/hcr/current;
+    index main.php;
+    autoindex off;
+    client_max_body_size 1m;
+    location ~ ^/(classes|vendor|xml|tables|views|migrations|bin|tests|nbproject|reports|deploy)(/|$) { return 404; }
+    location ~ /\. { return 404; }
+    location ~* \.(json|lock|xml|sql|md|ya?ml|toml|log|cnf|env|zip|bak)$ { return 404; }
+    location = /main.php {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/main.php;
+        fastcgi_param HTTPS on;
+        fastcgi_pass unix:/run/php/hcr.sock;
+    }
+    location ~ \.php(?:/|$) { return 404; }
+    location / { try_files $uri $uri/ =404; }
+}