server {
    listen 8080;
    server_name localhost;

    root /var/www/html/public;
    index index.php index.html;

    # Health checks
    location = /healthz {
        access_log off;
        return 200 "ok\n";
    }

    # FPM ping/status (optional, secure in prod)
    location = /fpm-ping {
        access_log off;
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
        fastcgi_param SCRIPT_NAME /ping;
        fastcgi_param PATH_INFO /ping;
    }

    location = /fpm-status {
        access_log off;
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
        fastcgi_param SCRIPT_NAME /status;
        fastcgi_param PATH_INFO /status;
    }

    # Main app
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP handling
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_read_timeout 60s;
        fastcgi_buffers 16 16k;
    }

    # Deny hidden files
    location ~ /\.ht {
        deny all;
    }

    # Cache static assets
    location ~* \.(?:css|js|jpg|jpeg|gif|png|svg|ico|webp|woff2?)$ {
        access_log off;
        expires 7d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }
}