# Cloudflare arkasında gerçek istemci IP'si (cloudflare-ufw.sh ile aynı liste güncel tutulmalı)
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
real_ip_header CF-Connecting-IP;

limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;

server {
    listen 80;
    listen [::]:80;
    server_name __DOMAIN__;
    # Cloudflare "Full (strict)" için sunucuda Origin sertifikası kurulunca 443 bloğu eklenir (DEPLOY.md)
    root /var/www/nexusjet/public;
    index index.php;
    server_tokens off;
    client_max_body_size 8m;

    location / { try_files $uri $uri/ /index.php?$query_string; }

    location = /login { limit_req zone=login burst=5 nodelay; try_files $uri /index.php?$query_string; }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_param REMOTE_ADDR $remote_addr;
    }

    location ~ /\.(?!well-known) { deny all; }
    location ~* \.(env|sql|log|bak)$ { deny all; }
    location /build/ { expires 1y; add_header Cache-Control "public, immutable"; }
}