server {
    listen 80;
    server_name localhost;
    root /var/www/html/public;
    index index.php;

    client_max_body_size 50M;

    # Compress responses served directly by this container (API JSON, static assets).
    gzip on;
    gzip_vary on;
    gzip_comp_level 6;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/manifest+json
        application/xml
        image/svg+xml
        font/ttf
        font/otf;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_read_timeout 600s;
        fastcgi_pass erpflow-backend:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;

        # This vhost is FastCGI (php-fpm), not HTTP proxy_pass — proxy_set_header
        # would be a no-op here. Client IP reaches PHP via FastCGI params.
        #
        # Docker published ports (8010:80) SNAT the TCP peer to the bridge
        # gateway (typically 172.18.0.1), so $remote_addr is that gateway, not
        # the phone/PC. $proxy_add_x_forwarded_for keeps an upstream
        # X-Forwarded-For (Cloudflare, host nginx, load balancer) and appends
        # that hop so Laravel's trusted-proxy list can unwind it.
        fastcgi_param HTTP_X_REAL_IP $remote_addr;
        fastcgi_param HTTP_X_FORWARDED_FOR $proxy_add_x_forwarded_for;
        fastcgi_param HTTP_X_FORWARDED_PROTO $scheme;
        fastcgi_param HTTP_X_FORWARDED_HOST $host;
        fastcgi_param HTTP_X_FORWARDED_PORT $server_port;
        fastcgi_param HTTPS $https if_not_empty;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}