🔧 Story 1.4: nginx config

nginx.conf.example

@@ -0,0 +1,58 @@
+server {
+    listen 80;
+    server_name codex.skycel.me www.codex.skycel.me;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name codex.skycel.me www.codex.skycel.me;
+
+    # SSL
+    ssl_certificate /etc/letsencrypt/live/codex.skycel.me/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/codex.skycel.me/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    root /var/www/codex.skycel.me;
+    index index.php;
+    charset utf-8;
+
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Block sensitive files
+    location ~ /\.(env|git|htaccess) { deny all; return 404; }
+    location ^~ /vendor/ { deny all; return 404; }
+    location ^~ /node_modules/ { deny all; return 404; }
+    location ^~ /logs/ { deny all; return 404; }
+    location ^~ /data/ { deny all; return 404; }
+    location ^~ /includes/ { deny all; return 404; }
+
+    # Static assets
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        gzip_static on;
+    }
+
+    # Front controller
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    # PHP-FPM
+    location ~ \.php$ {
+        fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+    }
+
+    # Compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/javascript application/javascript application/json image/svg+xml;
+}