# Nginx สำหรับ srv1361159.hstgr.cloud — ใช้แทนของเดิมใน /etc/nginx/sites-available/
# คัดลอกไปที่เซิร์ฟเวอร์: sudo cp srv1361159.hstgr.cloud.conf /etc/nginx/sites-available/srv1361159.hstgr.cloud
# แล้ว: sudo nginx -t && sudo systemctl reload nginx

server {
    server_name srv1361159.hstgr.cloud;
    root /var/www/html;
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    # Browsers request /favicon.ico by default — serve branded SVG (no 404 noise)
    location = /favicon.ico {
        alias /var/www/html/favicon.svg;
        default_type image/svg+xml;
        access_log off;
    }

    # /Game/img/.../ with trailing slash = directory (no index) → was 403 Forbidden
    location ~ ^/Game/img/(?!characters/).+/$ {
        return 404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }

    location ^~ /Admin/private/ {
        deny all;
        return 404;
    }

    # RealtimeChat — ไฟล์จากโฟลเดอร์ + Socket.IO ไป Node
    location /realtimechat/ {
        alias /var/www/html/realtimechat/public/;
        index index.html;
        try_files $uri $uri/ /realtimechat/index.html;
    }
    location /realtimechat/socket.io/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # ชุด sandbox TryChangeCSS (JS เก่า) — ห้ามเปิดทางเว็บ ใช้เฉพาะ design-ref-archive บนเซิร์ฟเวอร์
    location ^~ /Game/trycss/ {
        return 404;
    }
    location ^~ /Game/public/trycss/ {
        return 404;
    }

    # Game (ZEP-like) — รูปตัวละครอยู่ที่ Node (data/characters)
    location /Game/img/characters/ {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    # รูปใต้ /Game/img/ (ยกเว้น characters ด้านบน) — ห้าม try_files ไป index.html เมื่อไม่เจอไฟล์ (ไม่งั้น <img> ได้ HTML แล้วแตกเงียบ ๆ)
    location ^~ /Game/img/ {
        alias /var/www/html/Game/public/img/;
        try_files $uri =404;
        access_log off;
    }
    # Game — API ต้องรับ body ใหญ่ (รูปพื้นหลัง base64) จึงตั้ง 20M
    location /Game/api/ {
        client_max_body_size 20M;
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location ~ ^/Game/(?!socket\.io/)(.+\.(html|js))$ {
        alias /var/www/html/Game/public/$1;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }
    location /Game/ {
        alias /var/www/html/Game/public/;
        index index.html;
        try_files $uri $uri/ /Game/index.html;
    }
    location /Game/socket.io/ {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen [::]:443 ssl ipv6only=on;
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/srv1361159.hstgr.cloud/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/srv1361159.hstgr.cloud/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

server {
    if ($host = srv1361159.hstgr.cloud) {
        return 301 https://$host$request_uri;
    }
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name srv1361159.hstgr.cloud;
    return 404;
}