Keith Solomon
d3e8cf8fae
Implements MeshVault M1 (issues #6–11): - Four-service Docker Compose stack (nginx, PHP-FPM 8.3, PostgreSQL 17, Node assets) - Slim 4 + PHP-DI routing with escaped PHP views and production/dev error handling - Immutable validated AppConfig with redacted diagnostics - JSON stdout Monolog logging with job-scoped context - Tailwind CSS v4 deterministic locked builds with template scanning - POSIX and PowerShell dev wrappers (up/down/test/lint/assets/watch) - Startup config validation fails before FPM serves as unprivileged www-data - migrate/seed explicitly unavailable until M2 (#12); #10 remains open Verified via clean-start acceptance on remote host (keith@192.168.2.23).
29 lines
604 B
Plaintext
29 lines
604 B
Plaintext
server {
|
|
listen 80;
|
|
server_name _;
|
|
root /var/www/html/public;
|
|
index index.php;
|
|
server_tokens off;
|
|
autoindex off;
|
|
|
|
location ~ /\. {
|
|
return 404;
|
|
}
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.php?$query_string;
|
|
}
|
|
|
|
# Only the front controller may execute; never arbitrary uploaded PHP.
|
|
location = /index.php {
|
|
include fastcgi_params;
|
|
fastcgi_param SCRIPT_FILENAME /var/www/html/public/index.php;
|
|
fastcgi_param HTTP_PROXY "";
|
|
fastcgi_pass app:9000;
|
|
}
|
|
|
|
location ~* \.php(?:/|$) {
|
|
return 404;
|
|
}
|
|
}
|