map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}
upstream artwork_reverb_ws {
    server artwork_reverb:8080;
    keepalive 32;
}
server {
    listen 80;

    server_name _;

    root /var/www/html/public;
    index index.php index.html;

    large_client_header_buffers 8 64k;
    client_header_buffer_size 16k;

    location ~* \.mjs$ {
        default_type application/javascript;
        try_files $uri =404;
    }

    # Nur der Front-Controller wird als PHP ausgeführt; jede andere .php-Datei (z. B. eine
    # versehentlich hochgeladene) liefert 404.
    location ~ \.php$ {
        return 404;
    }

    location = /index.php {
       try_files $uri =404;

       fastcgi_split_path_info ^(.+\.php)(/.+)$;
       fastcgi_pass unix:/run/php/php8.4-fpm.sock;
       fastcgi_index index.php;
       fastcgi_send_timeout 180s;
       fastcgi_read_timeout 180s;

       include fastcgi_params;
       fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
       fastcgi_param PATH_INFO $fastcgi_path_info;
       fastcgi_buffering on;
       fastcgi_buffer_size 64k;
       fastcgi_buffers 32 64k;
       fastcgi_busy_buffers_size 128k;
       fastcgi_temp_file_write_size 256k;

       fastcgi_max_temp_file_size 0;
    }

    location / {
      try_files $uri $uri/ /index.php$is_args$args;
    }

    # Nur der WebSocket-Pfad /app/{key}; die Reverb-HTTP-API unter /apps/... (Events senden mit
    # App-Secret) bleibt intern und landet hier bei Laravel (404).
    location /app/ {
            proxy_http_version 1.1;
            proxy_set_header Upgrade    $http_upgrade;
            proxy_set_header Connection $connection_upgrade;

            proxy_set_header Host               $host;
            proxy_set_header X-Real-IP          $remote_addr;
            proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto  $scheme;

            proxy_read_timeout  600s;
            proxy_send_timeout  600s;

            proxy_pass http://artwork_reverb_ws;
        }

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
    add_header X-XSS-Protection "1; mode=block";
}