# OpnForm ingress — HTTP<->FastCGI + routing.
# Upstreams via docker-compose SERVICE-namen (api/ui): die zijn altijd
# resolvbaar op het compose-netwerk, ook als Coolify de container-namen wijzigt.
# Dit bestand wordt als nginx-TEMPLATE gemount; alleen ${NGINX_MAX_BODY_SIZE}
# wordt door de nginx-entrypoint (envsubst) ingevuld. Alle andere $-tokens zijn
# nginx-variabelen en blijven ongemoeid (staan niet in de container-env).

map $request_uri $api_uri {
    ~^/api(/.*$) $1;
    default $request_uri;
}

server {
    listen 80;
    server_name opnform;
    root /usr/share/nginx/html/public;
    client_max_body_size ${NGINX_MAX_BODY_SIZE};

    access_log /dev/stdout;
    error_log /dev/stderr error;

    index index.html index.htm index.php;

    location / {
        proxy_http_version 1.1;
        proxy_pass http://ui:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
    }

    location ~/(api|open|local\/temp|forms\/assets)/ {
        set $original_uri $uri;
        try_files $uri $uri/ /index.php$is_args$args;
    }

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass api:9000;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
        fastcgi_param REQUEST_URI $api_uri;
        # Laravel accepteert deze headers alleen van IP's in TRUSTED_PROXIES.
        # Zo blijft het echte client-IP + het https-schema achter Traefik/nginx behouden.
        fastcgi_param HTTP_X_FORWARDED_FOR $proxy_add_x_forwarded_for;
        fastcgi_param HTTP_X_FORWARDED_HOST $http_x_forwarded_host;
        fastcgi_param HTTP_X_FORWARDED_PORT $http_x_forwarded_port;
        fastcgi_param HTTP_X_FORWARDED_PROTO $http_x_forwarded_proto;
    }

    # Weiger toegang tot .-bestanden
    location ~ /\. {
        deny all;
    }
}