server {
    listen 80;
    listen [::]:80;
    server_name kundasang.com www.kundasang.com;

    root /var/www/kundasang.com;
    index index.php index.html;

    client_max_body_size 20M;
    server_tokens off;

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { allow all; access_log off; log_not_found off; }
    location = /sitemap.xml { types { application/xml xml; } add_header Cache-Control "public, max-age=3600"; allow all; access_log off; }
    location = /llms.txt    { types { text/plain txt; } add_header Cache-Control "public, max-age=3600"; allow all; access_log off; }

    # Enable CORS for static assets to prevent canvas screenshot tainting
    location /assets/ {
        add_header Access-Control-Allow-Origin "*";
        add_header Cache-Control "public, max-age=86400";
        try_files $uri =404;
    }

    # Protect SQLite database from direct web access
    location ~ \.sqlite$ {
        deny all;
        return 404;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php8.5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_read_timeout 60;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name kundasang.com www.kundasang.com;

    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    root /var/www/kundasang.com;
    index index.php index.html;

    client_max_body_size 20M;
    server_tokens off;

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { allow all; access_log off; log_not_found off; }
    location = /sitemap.xml { types { application/xml xml; } add_header Cache-Control "public, max-age=3600"; allow all; access_log off; }
    location = /llms.txt    { types { text/plain txt; } add_header Cache-Control "public, max-age=3600"; allow all; access_log off; }

    # Enable CORS for static assets to prevent canvas screenshot tainting
    location /assets/ {
        add_header Access-Control-Allow-Origin "*";
        add_header Cache-Control "public, max-age=86400";
        try_files $uri =404;
    }

    # Protect SQLite database from direct web access
    location ~ \.sqlite$ {
        deny all;
        return 404;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php8.5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_read_timeout 60;
    }
}
