# Rate limiting zones
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=60r/m;
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/m;

server {
    listen 80;
    server_name _;
    root /var/www/html/public;
    index index.php index.html;

    # Upload size limit
    client_max_body_size 10M;

    # Disable access log for performance, send errors to stderr for Docker logging
    access_log off;
    error_log /dev/stderr warn;

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml application/atom+xml image/svg+xml text/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype;

    # Serve frontend app
    location /app {
        alias /var/www/html/public/app;
        try_files $uri $uri/ /app/index.html;

        # Cache static assets
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
    }

    # Laravel API routes with rate limiting
    location /api {
        # Apply rate limiting with burst allowance
        limit_req zone=api_limit burst=10 nodelay;

        # Extra strict rate limiting for auth endpoints
        location ~ ^/api/(login|register) {
            limit_req zone=auth_limit burst=3 nodelay;
            try_files $uri $uri/ /index.php?$query_string;
        }

        try_files $uri $uri/ /index.php?$query_string;
    }

    # Laravel backend
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP handler
    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_buffer_size 32k;
        fastcgi_buffers 8 16k;
        fastcgi_read_timeout 240;
    }

    # Deny access to hidden files
    location ~ /\.(?!well-known).* {
        deny all;
    }

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
}