server {
    listen 80;
    server_name _;

    root /var/www/html/public;
    index index.php;

    charset utf-8;
    client_max_body_size 32m;

    # Sicherheits-Header. Content-Security-Policy ist bewusst streng: die
    # Anwendung lädt weder externe Skripte noch externe Stylesheets.
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "same-origin" always;
    add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; frame-ancestors 'self'" always;

    # Statische Dateien direkt ausliefern, alles andere an den Front-Controller.
    location /static/ {
        try_files $uri =404;
        access_log off;
        expires 1h;
    }

    location / {
        try_files $uri /index.php$is_args$args;
    }

    location ~ ^/index\.php$ {
        fastcgi_pass php:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_read_timeout 300;
    }

    # Kein direkter Aufruf anderer PHP-Dateien.
    location ~ \.php$ {
        return 404;
    }

    location ~ /\. {
        deny all;
    }
}