# NOTE: forces a base-image rebuild. A prior failed CD run pushed a base to ECR
# :8.2 whose nginx.conf lacked the /healthz probe; restoring nginx.conf alone left
# it byte-identical to the deployed baseline, so the change-aware pipeline skipped
# the base rebuild and reused the corrupted :8.2. This comment makes docker/php-nginx/
# differ from the baseline so the base is rebuilt and :8.2 republished with /healthz.
user nginx;
worker_processes 1;
pid /run/nginx/nginx.pid;
error_log /dev/stderr warn;

events {
    worker_connections 512;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    access_log /dev/stdout;
    sendfile on;
    keepalive_timeout 65;
    # Match php.ini post_max_size: PHP discarded anything larger anyway, and rejecting it
    # here keeps oversized bodies (chunked ones too) from ever reaching php-fpm.
    client_max_body_size 64M;

    # Long-running sync endpoints (e.g. profilemgmt apipm/taskinsert/synclocationdata,
    # which pulls from the external Bridge) can take well over the 60s nginx default,
    # so nginx cut php-fpm with "upstream timed out" -> 504. Allow up to 5 min, matching
    # the Service Connect perRequestTimeout and the sync worker's curl timeout.
    fastcgi_read_timeout 300s;
    fastcgi_send_timeout 300s;

    # One server block per Yii entry point, on distinct internal ports.
    # A container only answers on the ports whose docroot exists in the
    # bind-mounted app; the rest simply 404. Kong targets the right port.

    # :80 — basic-template web root (all 8 basic services)
    server {
        listen 80;
        root /app/web;
        index index.php;
        # Liveness/readiness probe for ALB target groups and ECS container health
        # checks. Exact-match location, so it outranks the prefix and regex blocks
        # and never touches the filesystem - it answers 200 even on ports whose
        # docroot does not exist for this service (e.g. :81 on profilemgmt).
        location = /healthz { access_log off; return 200 "ok
"; }

        location / { try_files $uri $uri/ /index.php$is_args$args; }
        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass 127.0.0.1:9000;
            try_files $uri =404;
        }
        location ~ /\.(ht|svn|git) { deny all; }
    }

    # :81 — api root (basic services with api/, and filemst /app/api)
    server {
        listen 81;
        root /app/api;
        index index.php;
        # Liveness/readiness probe for ALB target groups and ECS container health
        # checks. Exact-match location, so it outranks the prefix and regex blocks
        # and never touches the filesystem - it answers 200 even on ports whose
        # docroot does not exist for this service (e.g. :81 on profilemgmt).
        location = /healthz { access_log off; return 200 "ok
"; }

        location / { try_files $uri $uri/ /index.php$is_args$args; }
        # api/ docroots contain app source dirs — never serve or execute them
        location ~ ^/(config|models|modules|common|commonfunction)/ { deny all; }
        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass 127.0.0.1:9000;
            try_files $uri =404;
        }
        location ~ /\.(ht|svn|git) { deny all; }
    }

    # :82/:83/:84 — b2g_filemst advanced-template roots
    server {
        listen 82;
        root /app/backend/web;
        index index.php;
        # Liveness/readiness probe for ALB target groups and ECS container health
        # checks. Exact-match location, so it outranks the prefix and regex blocks
        # and never touches the filesystem - it answers 200 even on ports whose
        # docroot does not exist for this service (e.g. :81 on profilemgmt).
        location = /healthz { access_log off; return 200 "ok
"; }

        location / { try_files $uri $uri/ /index.php$is_args$args; }
        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass 127.0.0.1:9000;
            try_files $uri =404;
        }
        location ~ /\.(ht|svn|git) { deny all; }
    }
    server {
        listen 83;
        root /app/frontend/web;
        index index.php;
        # Liveness/readiness probe for ALB target groups and ECS container health
        # checks. Exact-match location, so it outranks the prefix and regex blocks
        # and never touches the filesystem - it answers 200 even on ports whose
        # docroot does not exist for this service (e.g. :81 on profilemgmt).
        location = /healthz { access_log off; return 200 "ok
"; }

        location / { try_files $uri $uri/ /index.php$is_args$args; }
        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass 127.0.0.1:9000;
            try_files $uri =404;
        }
        location ~ /\.(ht|svn|git) { deny all; }
    }
    server {
        listen 84;
        root /app/storage/web;
        index index.php;
        # Liveness/readiness probe for ALB target groups and ECS container health
        # checks. Exact-match location, so it outranks the prefix and regex blocks
        # and never touches the filesystem - it answers 200 even on ports whose
        # docroot does not exist for this service (e.g. :81 on profilemgmt).
        location = /healthz { access_log off; return 200 "ok
"; }

        location / { try_files $uri $uri/ /index.php$is_args$args; }
        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass 127.0.0.1:9000;
            try_files $uri =404;
        }
        location ~ /\.(ht|svn|git) { deny all; }
    }
}