api/services/nginx/nginx.conf

# Main Nginx Configuration File
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    # Add rate limiting to prevent abuse
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
    limit_req_status 429;
    # Include additional configuration files
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Structured JSON access logs and correlation id
    map $http_x_request_id $req_id { default $http_x_request_id; "" $request_id; }
    log_format json escape=json '{"time":"$time_iso8601","req_id":"$req_id","remote":"$remote_addr","host":"$host","method":"$request_method","uri":"$request_uri","status":$status,"bytes":$bytes_sent,"referer":"$http_referer","ua":"$http_user_agent","up_addr":"$upstream_addr","up_st":"$upstream_status","up_rt":$upstream_response_time,"rt":$request_time}';

    # Log settings
    access_log /var/log/nginx/access.ndjson json;
    error_log /var/log/nginx/error.log warn;

    # Gzip settings (optional)
    gzip on;
    gzip_types text/plain application/xml text/css application/javascript;

    # Include server block configurations
    include /etc/nginx/conf.d/*.conf;

    # Upstream pool for PHP-FPM (load-balanced)
    upstream php_fpm {
        least_conn;
        server php1:9000 max_fails=3 fail_timeout=10s;
        server php2:9000 max_fails=3 fail_timeout=10s;
        server php3:9000 max_fails=3 fail_timeout=10s;
        server php4:9000 max_fails=3 fail_timeout=10s;
        server php5:9000 max_fails=3 fail_timeout=10s;
        keepalive 32;
    }


    # Redirect HTTP to HTTPS
    server {
        listen 80;
        server_name api.truckwash.dk;

        return 301 https://$host$request_uri;
    }

    # Localhost api server block (api.truckwash.dk)
    server {
        listen 80;
        server_name localhost;

        # Logging
                add_header X-Request-Id $req_id always;
                error_log /var/log/nginx/error.log;
                access_log /var/log/nginx/access.ndjson json;

                # Index file
                index index.php index.html index.htm;

                # Root directory (public- uses index.php)
                root /var/www/html;

                # Location block for PHP files
                location ^~ / {
                    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
                    add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number, X-Release-Trace, X-Release-Channel, X-Frontend-Version";
                    add_header Access-Control-Allow-Credentials true;

                    if ($request_method = 'OPTIONS') {
                        add_header Access-Control-Allow-Origin *;
                        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
                        add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number, X-Release-Trace, X-Release-Channel, X-Frontend-Version";
                        return 204;
                    }

                    include fastcgi_params;
                    fastcgi_pass php_fpm;
                    fastcgi_index index.php;
                    fastcgi_read_timeout 60s;
                    fastcgi_param SCRIPT_FILENAME $document_root/index.php;
                    fastcgi_param X_REQUEST_ID $req_id;
                    fastcgi_keep_conn on;
                }

                # Deny access to .htaccess files
                location ~ /\.ht {
                    deny all;
                }

                # Deny access to hidden files
                location ~ /\. {
                    deny all;
                }
    }

    server {
        listen 443 ssl;
        server_name api.truckwash.dk;


        # SSL certificates
        ssl_certificate /etc/letsencrypt/live/api.truckwash.dk/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/api.truckwash.dk/privkey.pem;

        # Enable SSL options
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;

        # Logging
        add_header X-Request-Id $req_id always;
        error_log /var/log/nginx/error.log;
        access_log /var/log/nginx/access.ndjson json;

        # Index file
        index index.php index.html index.htm;

        # Root directory (public- uses index.php)
        root /var/www/html;

        # Location block for PHP files
        location ^~ / {
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
            add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number, X-Release-Trace, X-Release-Channel, X-Frontend-Version";
            add_header Access-Control-Allow-Credentials true;

            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin *;
                add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
                add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number, X-Release-Trace, X-Release-Channel, X-Frontend-Version";
                return 204;
            }

            include fastcgi_params;
            fastcgi_pass php_fpm;
            fastcgi_index index.php;
            fastcgi_read_timeout 60s;
            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
            fastcgi_param X_REQUEST_ID $req_id;
            fastcgi_keep_conn on;
        }

        # Deny access to .htaccess files
        location ~ /\.ht {
            deny all;
        }

        # Deny access to hidden files
        location ~ /\. {
            deny all;
        }
    }
    # Nextcloud server block (cloud.truckwash.dk)
    server {
        listen 443 ssl;
        server_name cloud.truckwash.dk;

        # SSL certificates
        ssl_certificate /etc/letsencrypt/live/cloud.truckwash.dk/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/cloud.truckwash.dk/privkey.pem;

        # Enable SSL options
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;

        # Proxy settings to Nextcloud on port 11000
        location / {
            proxy_pass http://94.130.142.41:11000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
        # Deny access to .htaccess files
        location ~ /\.ht {
            deny all;
        }
        # Deny access to hidden files
        location ~ /\. {
            deny all;
        }
    }


    # Additional server blocks can be added here

    # Restrict access to the server, if the

}