termanager2/docker/nginx/default.conf

server {
    listen 80 default_server;
    server_name _;
    root /var/www/html/public;
    index index.php;

    charset utf-8;

    # NOTE: client_max_body_size is deliberately NOT set here.
    #
    # entrypoint.sh writes it to /etc/nginx/conf.d/upload-limit.conf from
    # MAX_UPLOAD_MB, together with PHP's upload_max_filesize/post_max_size, so
    # that one variable governs the whole chain. A value in this server block
    # would override the generated one and silently reinstate the mismatch this
    # arrangement exists to prevent — the symptom being a 413 with no body,
    # returned after zero bytes, which leaves the browser's upload bar frozen
    # and the page with nothing to report.

    # Behind Dokploy's Traefik, the real client IP arrives in X-Forwarded-For.
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 172.16.0.0/12;
    set_real_ip_from 192.168.0.0/16;
    real_ip_recursive on;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    # Vite emits content-hashed filenames, so these are safe to cache hard.
    location /build/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
        try_files $uri =404;
    }

    # Territory files (PDFs, archived versions, thumbnails, map images) are NOT
    # public: anyone could download /storage/territori-pdf/territorio-12-34.pdf
    # without logging in, the names are guessable, and the public cache header
    # below let Cloudflare keep them for a week. Logged-in users get them from
    # TerritorioFileController, publishers from the expiring assignment link.
    location ^~ /storage/territori- {
        return 404;
    }

    # What is left on the public disk (the congregation logo).
    location /storage/ {
        expires 7d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }

    error_page 404 /index.php;

    location ~ ^/index\.php(/|$) {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;

        # Restores the port, which nginx's own fastcgi_params drops.
        #
        # Since nginx 1.26 the packaged fastcgi_params sets HTTP_HOST to $host
        # instead of $http_host. $host carries the hostname only: a request to
        # localhost:8090 reaches PHP as "localhost". Laravel then rebuilds the
        # request URL without the port, while URL::forceRootUrl() (see
        # AppServiceProvider) generates links WITH it — so every signed URL
        # fails validation. Concretely: all Livewire file uploads answer 401,
        # because the upload endpoint aborts on an invalid signature.
        #
        # Only bites when APP_URL carries a non-standard port, i.e. local
        # development. In production APP_URL has no port and the two forms
        # agree. Forwarding the raw header is safe here because trustHosts()
        # in bootstrap/app.php already rejects any Host that is not APP_URL's,
        # localhost or 127.0.0.1.
        fastcgi_param HTTP_HOST $http_host;

        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param DOCUMENT_ROOT $realpath_root;
        fastcgi_hide_header X-Powered-By;

        # PDF generation and ZIP imports can outrun the default 60s.
        fastcgi_read_timeout 300;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;

        # Set server-side, NOT taken from the client's header: honouring a
        # client-supplied X-Forwarded-Proto would let an attacker declare the
        # connection plaintext and skew signed-URL validation and secure-cookie
        # decisions. The value is written by the entrypoint from APP_URL's
        # scheme (see /etc/nginx/conf.d/forwarded-proto.conf) — https in
        # production behind Traefik, http for local plain-HTTP development.
        fastcgi_param HTTP_X_FORWARDED_PROTO $app_forwarded_proto;
        # X-Forwarded-Port is deliberately NOT set here. nginx already passes
        # the incoming header through as HTTP_X_FORWARDED_PORT, and Traefik
        # sends the real public port; overriding it with $server_port (always
        # 80 inside the container) would corrupt generated URLs.

        internal;
    }

    # Any other .php file is not a valid entrypoint — Laravel routes everything
    # through index.php. This blocks execution of uploaded/stray scripts.
    location ~ \.php$ {
        return 404;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript
               text/xml application/xml image/svg+xml;
}