# Substitute certificate paths, document root, and PHP socket before installation.
# This server terminates HTTPS directly. Forwarded headers are not trusted by default.
server {
    listen 80;
    server_name app.myhuntingclubroster.com;
    return 301 https://app.myhuntingclubroster.com$request_uri;
}
server {
    listen 443 ssl;
    server_name app.myhuntingclubroster.com;
    ssl_certificate /etc/ssl/hcr/fullchain.pem;
    ssl_certificate_key /etc/ssl/hcr/privkey.pem;
    root /srv/hcr/current;
    index main.php;
    autoindex off;
    client_max_body_size 1m;
    location ~ ^/(classes|vendor|xml|tables|views|migrations|bin|tests|nbproject|reports|deploy)(/|$) { return 404; }
    location ~ /\. { return 404; }
    location ~* \.(json|lock|xml|sql|md|ya?ml|toml|log|cnf|env|zip|bak)$ { return 404; }
    location = /main.php {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root/main.php;
        fastcgi_param HTTPS on;
        fastcgi_pass unix:/run/php/hcr.sock;
    }
    location ~ \.php(?:/|$) { return 404; }
    location / { try_files $uri $uri/ =404; }
}