nginx.staging.conf

# FORGE CONFIG (DO NOT REMOVE!)
include forge-conf/staging.llmstxt.directory/before/*;

server {
    http2 on;
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name staging.llmstxt.directory;
    server_tokens off;
    root /home/stagingllmstxtdirectory/staging.llmstxt.directory/public;

    # FORGE SSL (DO NOT REMOVE!)
    ssl_certificate /etc/nginx/ssl/staging.llmstxt.directory/2432113/server.crt;
    ssl_certificate_key /etc/nginx/ssl/staging.llmstxt.directory/2432113/server.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_dhparam /etc/nginx/dhparams.pem;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";
    add_header Referrer-Policy "strict-origin-when-cross-origin";

    index index.html index.htm index.php;
    charset utf-8;

    # FORGE CONFIG (DO NOT REMOVE!)
    include forge-conf/staging.llmstxt.directory/server/*;

    # Static file caching
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
        expires 1d;
        add_header Cache-Control "public, no-transform";
        access_log off;
        try_files $uri =404;
    }

    # Primary location block
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # Block access to sensitive directories
    location ~ ^/(storage|db|includes)/ {
        deny all;
    }

    # Block PHP files in uploads directory
    location ~ ^/logos/.+\.php$ {
        deny all;
    }

    location = /favicon.ico { 
        access_log off; 
        log_not_found off;
        expires 1d;
    }

    location = /robots.txt  { 
        access_log off; 
        log_not_found off;
        add_header Content-Type text/plain;
        return 200 "User-agent: *\nDisallow: /\n";
    }

    # Enable request timing logs
    log_format timing '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     '$request_time $upstream_response_time $pipe';

    access_log /var/log/nginx/staging.llmstxt.directory-access.log timing buffer=32k flush=5s;
    error_log  /var/log/nginx/staging.llmstxt.directory-error.log error;

    error_page 404 /index.php;

    # PHP handling
    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php8.3-fpm-stagingllmstxtdirectory.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        
        # Development-specific timeouts
        fastcgi_read_timeout 300;
        fastcgi_send_timeout 300;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied expired no-cache no-store private auth;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
}

# FORGE CONFIG (DO NOT REMOVE!)
include forge-conf/staging.llmstxt.directory/after/*;