worker_processes auto;
error_log /dev/stderr warn;
pid /run/nginx.pid;

events { worker_connections 1024; }

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    access_log    /dev/stdout;
    sendfile      on;
    keepalive_timeout 65;
    client_max_body_size 50M;   # upload de supports/médias

    server {
        listen 8080;
        server_name _;
        root /var/www/html/public;
        index index.php;

        charset utf-8;

        location / {
            try_files $uri $uri/ /index.php?$query_string;
        }

        location = /favicon.ico { access_log off; log_not_found off; }
        location = /robots.txt  { access_log off; log_not_found off; }

        error_page 404 /index.php;

        location ~ \.php$ {
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
            include fastcgi_params;
            fastcgi_hide_header X-Powered-By;
        }

        # Bloquer l'accès aux fichiers cachés (sauf .well-known)
        location ~ /\.(?!well-known).* {
            deny all;
        }
    }
}