server {
    listen 443 ssl http2;
    server_name api.caremeet.in;

    ssl_certificate     /etc/letsencrypt/live/api.caremeet.in/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.caremeet.in/privkey.pem;

    # Only public/ is served. src/ and config/ sit above the web root, so a
    # PHP misconfiguration cannot expose config.php or the JWT private key.
    root /opt/caremeet/api/public;
    index index.php;

    client_max_body_size 8m;

    location / {
        try_files $uri /index.php$is_args$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param HTTPS on;
    }

    # Never serve dotfiles or backups left behind by an editor.
    location ~ /\. { deny all; }
    location ~ \.(sql|bak|env|pem)$ { deny all; }
}