# Example Nginx server block for Aradhya Enterprises ERP.
# Matches the architecture in claude.md's Deployment section:
#   Cloudflare / SSL -> Nginx -> Laravel -> PHP-FPM -> MySQL -> Redis
#
# Cloudflare terminates SSL and proxies to this server over HTTP/HTTPS at the edge;
# Laravel itself trusts the forwarded headers (see bootstrap/app.php's trustProxies()).
# Adjust paths, PHP-FPM socket/pool name, and server_name for your actual host.

server {
    listen 80;
    listen [::]:80;
    server_name erp.aradhyaenterprise.com;

    root /var/www/erp.aradhyaenterprise.com/public;
    index index.php;

    # Never expose MySQL publicly (claude.md's own rule) - nothing here proxies to port 3306,
    # and the firewall/security group should block external access to it entirely.

    client_max_body_size 20M; # Excel import files can be a few MB; keep headroom.

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.3-fpm.sock; # adjust to your PHP-FPM pool socket
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_read_timeout 60s; # AI assistant calls can take a few seconds
    }

    # Deny access to dotfiles (.env, .git, etc.) and any other hidden file.
    location ~ /\. {
        deny all;
    }

    # Cache static assets built by `npm run build`.
    location ~* \.(css|js|svg|woff2?|ttf|eot|png|jpg|jpeg|gif|ico)$ {
        expires 30d;
        access_log off;
        add_header Cache-Control "public, immutable";
    }

    access_log /var/log/nginx/erp.aradhyaenterprise.com-access.log;
    error_log  /var/log/nginx/erp.aradhyaenterprise.com-error.log;
}

# HTTPS: if Cloudflare is in "Full" or "Full (strict)" SSL mode, add a matching
# `listen 443 ssl;` server block with your origin certificate here. In "Flexible" mode
# (Cloudflare <-> origin over plain HTTP) the block above is sufficient, since Cloudflare
# is what actually terminates SSL for browsers.