nginx conf

Author: Surfoo

georoadbook.nginx.conf

@@ -0,0 +1,51 @@
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name georoadbook.vaguelibre.net;
+    server_tokens off;
+
+    root /var/www/georoadbook/public;
+    index index.php;
+
+    client_max_body_size 18M;
+
+    # Access and error logs
+    access_log /var/log/nginx/georoadbook.access.log;
+    error_log /var/log/nginx/georoadbook.error.log;
+
+    ssl_certificate /etc/letsencrypt/live/vaguelibre.net-0001/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/vaguelibre.net-0001/privkey.pem; # managed by Certbot
+
+    add_header Strict-Transport-Security "max-age=31536000";
+
+    # Symfony try_files: try to serve files directly, fallback to front controller index.php
+    location / {
+        try_files $uri /index.php$is_args$args;
+    }
+
+    # Cache static assets for 1 year
+    location ~ \.(css|js|jpg|jpeg|webp|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1y;
+        gzip on;
+        gzip_types text/css application/javascript image/svg+xml font/woff font/woff2;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Handle the main Symfony front controller (index.php)
+    location ~ ^/index\.php(/|$) {
+        include snippets/fastcgi-php.conf;
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+        fastcgi_param APP_ENV prod;
+        fastcgi_param DOCUMENT_ROOT $realpath_root;
+        fastcgi_pass unix:/var/run/php/php8.5-fpm.sock;
+        
+        # Prevents direct access to index.php by users
+        internal;
+    }
+
+    # Return 404 for all other PHP files to prevent arbitrary code execution
+    location ~ \.php$ {
+        return 404;
+    }
+}