# Roundcube 1.7 : seul public_html/ est exposé (index.php, static.php).
# Les ressources statiques sont référencées en /static.php/<chemin> ; nginx les
# sert directement depuis le volume partagé et ne délègue à PHP que le reste.

upstream roundcube_fpm {
    server ${NGINX_PHP_FPM};
}

server {
    listen 80 default_server;
    server_name _;

    root /var/www/html/public_html;
    index index.php;

    client_max_body_size ${NGINX_CLIENT_MAX_BODY_SIZE};
    server_tokens off;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "same-origin" always;

    # Statique servi par nginx (même liste de préfixes que ALLOWED_PATHS de static.php)
    location ~ ^/static\.php/((?:skins|plugins|program/js|program/resources)/.+\.(?:css|js|map|png|gif|jpe?g|svg|ico|webp|avif|woff2?|ttf|eot|html|json))$ {
        alias /var/www/html/$1;
        expires 30d;
        add_header X-Content-Type-Options "nosniff" always;
        access_log off;
    }

    location = /favicon.ico {
        alias /var/www/html/skins/elastic/images/favicon.ico;
        access_log off;
    }

    # Points d'entrée PHP autorisés (installer.php volontairement exclu)
    location ~ ^/(?:index|static)\.php(?:/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTP_PROXY "";
        fastcgi_pass roundcube_fpm;
        fastcgi_read_timeout 300s;
    }

    # Healthcheck : ping du pool php-fpm, local uniquement
    location = /fpm-ping {
        allow 127.0.0.1;
        deny all;
        access_log off;
        include fastcgi_params;
        fastcgi_param SCRIPT_NAME /fpm-ping;
        fastcgi_param SCRIPT_FILENAME /fpm-ping;
        fastcgi_pass roundcube_fpm;
    }

    location = / {
        rewrite ^ /index.php last;
    }

    # Tout le reste (installer.php, fichiers cachés...) : refusé
    location / {
        return 404;
    }
}