server {
    # Non-privileged port so the whole stack can run as www-data (non-root).
    # Coolify/Traefik routes to whatever port the service exposes — assign 8080
    # as the service port in Coolify.
    listen 8080 default_server;
    server_name _;
    root /app/public;

    # Symfony front controller
    location / {
        try_files $uri /index.php$is_args$args;
    }

    location ~ ^/index\.php(/|$) {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT $realpath_root;
        # Forwarded headers from Traefik (Coolify) are trusted via Symfony trusted_proxies
        internal;
    }

    # Block direct access to any other .php file
    location ~ \.php$ {
        return 404;
    }

    client_max_body_size 16m;   # keep in sync with MAX_FILE_SIZE_BYTES / php.ini

    error_log /dev/stderr warn;
    access_log /dev/stdout;
}