nginx.conf

# ==========================================
# TREVIO PROJECT
# ==========================================

# --- 1. PRODUCTION (trevio.mfjrxn.eu.org) ---
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name trevio.mfjrxn.eu.org;
    #root /var/www/trevio-prod;
    root /var/www/trevio-prod/public;
    index index.php index.html;

    # SSL Keys
    ssl_certificate /etc/letsencrypt/live/trevio.mfjrxn.eu.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/trevio.mfjrxn.eu.org/privkey.pem;

    # --- SECURITY PRODUCTION ---
    # 1. Matikan daftar file (Jika user buka folder, muncul 403 Forbidden)
    autoindex off;

    # 2. Sembunyikan versi Nginx (biar hacker ga tau versi berapa)
    server_tokens off;

    # 3. Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # 4. Blokir file sensitif (.env, .git, .sql) -> WAJIB 403
    location ~ /\.(?!well-known).* {
        deny all;
    }

    # 5. Blokir akses langsung ke folder /app/ (Source Code)
    location ~ ^/app/ {
        deny all;
        return 403;
    }

    # Logs
    access_log /var/log/nginx/trevio_prod_access.log;
    error_log /var/log/nginx/trevio_prod_error.log;

    location / {
        try_files $uri $uri/ /index.php?url=$uri&$args;
    }

    # PHP CONFIG (Sembunyikan Error di Browser)
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;

        # PENTING: Jangan tampilkan error coding di layar user
        fastcgi_param PHP_FLAG "display_errors=Off";
        fastcgi_param PHP_ADMIN_VALUE "error_reporting=0";
    }

    # Menangani file gambar, css, js, font
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|webp|woff|woff2|ttf|eot)$ {
        # 1. Simpan di cache browser selama 30 hari (Bikin website ngebut)
        expires 30d;

        # 2. Matikan log akses (Biar log server ga penuh sampah request gambar)
        access_log off;

        # 3. Header tambahan
        add_header Cache-Control "public, no-transform";

        # 4. Jika file tidak ada, jangan lempar ke PHP, langsung 404
        try_files $uri =404;
    }

    # Blokir eksekusi PHP di folder uploads (Anti Shell/Backdoor)
    location ^~ /uploads/ {
        # Matikan PHP engine di folder ini
        location ~ \.php$ { deny all; }
    }

    # Izinkan upload hingga 10MB (sesuaikan kebutuhan)
    client_max_body_size 10M;

    # Custom Error Pages
    error_page 403 /errors/403;
    error_page 404 /errors/404;
    error_page 500 502 503 504 /errors/500;

    # Route error pages through MVC
    location ~ ^/errors/(403|404|500)$ {
        rewrite ^/errors/(.*)$ /index.php?url=errors/$1 last;
    }

}

# Redirect HTTP -> HTTPS (Prod)
server {
    listen 80;
    listen [::]:80;
    server_name trevio.mfjrxn.eu.org;
    return 301 https://$host$request_uri;
}

# --- 2. DEVELOPMENT (trevio-dev.mfjrxn.eu.org) ---
server {
    listen 443 ssl;
    listen [::]:443 ssl;          # Support IPv6
    server_name trevio-dev.mfjrxn.eu.org;
    #root /var/www/trevio-dev;
    root /var/www/trevio-dev/public;
    index index.php index.html;

    # SSL Keys
    ssl_certificate /etc/letsencrypt/live/trevio.mfjrxn.eu.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/trevio.mfjrxn.eu.org/privkey.pem;

    # --- FREEDOM DEVELOPMENT ---
    # 1. Hidupkan daftar file (Agar GA 403 kalau buka folder aset/gambar)
    autoindex on;

    # 2. Security Headers (sama seperti prod)
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # 3. Tetap blokir .git dan .env
    location ~ /\.(?!well-known).* {
        deny all;
    }

    # 4. Blokir akses langsung ke folder /app/ (Source Code)
    location ~ ^/app/ {
        deny all;
        return 403;
    }

    # Logs
    access_log /var/log/nginx/trevio_dev_access.log;
    error_log /var/log/nginx/trevio_dev_error.log;

    location / {
        try_files $uri $uri/ /index.php?url=$uri&$args;
    }

    # PHP CONFIG (Munculkan Error di Browser)
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;

        # PENTING: Munculkan error coding langsung di layar (biar gampang fix bug)
        fastcgi_param PHP_FLAG "display_errors=On";
        fastcgi_param PHP_ADMIN_VALUE "error_reporting=E_ALL";
    }

    location = /report.html {
        # 1. Ambil file dari ROOT folder (di luar public)
        alias /var/www/trevio-dev/report.html;
        default_type "text/html";

        # 2. Paksa Browser Minta Password
        #auth_basic "Restricted Area - Admin Only";
        #auth_basic_user_file /etc/nginx/.htpasswd;

        # 3. Matikan log akses buat file ini (biar log ga penuh sama admin sendiri)
        access_log off;
     }

     # Menangani file gambar, css, js, font
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|webp|woff|woff2|ttf|eot)$ {
        # 1. Simpan di cache browser selama 30 hari (Bikin website ngebut)
        expires 30d;

        # 2. Matikan log akses (Biar log server ga penuh sampah request gambar)
        access_log off;

        # 3. Header tambahan
        add_header Cache-Control "public, no-transform";

        # 4. Jika file tidak ada, jangan lempar ke PHP, langsung 404
        try_files $uri =404;
    }

    # Custom Error Pages
    error_page 403 /errors/403;
    error_page 404 /errors/404;
    error_page 500 502 503 504 /errors/500;

    # Route error pages through MVC
    location ~ ^/errors/(403|404|500)$ {
        rewrite ^/errors/(.*)$ /index.php?url=errors/$1 last;
    }
}

# Redirect HTTP -> HTTPS (Dev)
server {
    listen 80;
    listen [::]:80;
    server_name trevio-dev.mfjrxn.eu.org;
    return 301 https://$host$request_uri;
}