# ── admin.vandes-web.com — Application Laravel ──────────────────────────────
# Chemin : /etc/nginx/sites-available/admin.vandes-web.com
# Activer : ln -s /etc/nginx/sites-available/admin.vandes-web.com /etc/nginx/sites-enabled/

# Définir une zone de rate limiting (évite le brute-force login)
limit_req_zone $binary_remote_addr zone=login_zone:10m rate=5r/m;

server {
    listen 80;
    server_name admin.vandes-web.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name admin.vandes-web.com;

    # SSL (généré par : certbot --nginx -d admin.vandes-web.com)
    ssl_certificate     /etc/letsencrypt/live/admin.vandes-web.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/admin.vandes-web.com/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/admin.vandes-web.com/public;
    index index.php;

    server_tokens off;

    # Pas d'accès aux fichiers cachés (.env, .git, etc.)
    location ~ /\.(env|git|htaccess) {
        deny all;
        return 404;
    }

    # Rate limiting sur la page de login (5 tentatives/min par IP)
    location ~ ^/(login|password) {
        limit_req zone=login_zone burst=3 nodelay;
        try_files $uri $uri/ /index.php?$query_string;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Endpoint tracking (ouvert au public mais rate-limité côté Laravel)
    location = /api/track {
        try_files $uri /index.php?$query_string;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Toutes les autres routes → Laravel
    location / {
        # Optionnel : restriction IP pour l'admin (décommentez et ajustez)
        # allow 1.2.3.4;       # Votre IP fixe
        # deny all;

        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP-FPM
    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;

        fastcgi_read_timeout 120;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }

    # Bloquer l'accès aux fichiers sensibles
    location ~* \.(sql|log|bak|sh|key|pem)$ {
        deny all;
    }

    # Cache pour les assets buildés (Vite)
    location ~* \.(css|js|jpg|jpeg|png|gif|svg|ico|woff2?)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }

    # En-têtes de sécurité
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self';" always;
}