nginx.conf

# Custom log format for media endpoints (exclude query string to avoid logging tokens)
log_format media_safe '$remote_addr - $remote_user [$time_local] "$request_method $uri HTTP/$server_protocol" '
                      '$status $body_bytes_sent "$http_referer" "$http_user_agent"';

server {
    listen [::]:8080 default_server;
    listen 8080 default_server;
    server_name _;
    tcp_nodelay on;
    absolute_redirect off;
    
    root /var/www/html/public;
    index index.html index.php;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; connect-src 'self' https:; media-src 'self' data: blob:;" always;

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied expired no-cache no-store private;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json;

    # Static assets with cache headers (like original config but extended)
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|xml)$ {
        expires 5d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }

    # API routes - handled by PHP (using original PHP settings)
    location ~ ^/api/.*$ {
        # CORS headers
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, HEAD, POST, PUT, DELETE, OPTIONS" always;
        add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
        add_header Access-Control-Expose-Headers "Content-Length,Content-Range,Accept-Ranges,X-Content-Duration,X-Media-Duration" always;
        
        # Handle preflight requests
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin "*";
            add_header Access-Control-Allow-Methods "GET, HEAD, POST, PUT, DELETE, OPTIONS";
            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization";
            add_header Access-Control-Expose-Headers "Content-Length,Content-Range,Accept-Ranges,X-Content-Duration,X-Media-Duration";
            add_header Access-Control-Max-Age 1728000;
            add_header Content-Type "text/plain; charset=utf-8";
            add_header Content-Length 0;
            return 204;
        }
        
        try_files /index.php =404;
        
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param REQUEST_URI $request_uri;
        fastcgi_param SCRIPT_NAME /index.php;
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }

    # Media streaming endpoint - OPTIMIZED for maximum performance
    location ~ ^/api/media/play/.*$ {
        access_log /var/log/nginx/access.log media_safe;
        
        # STREAMING PERFORMANCE OPTIMIZATIONS
        tcp_nodelay on;
        tcp_nopush on;
        sendfile on;
        sendfile_max_chunk 1m;
        
        # Disable buffering for immediate streaming start
        proxy_buffering off;
        fastcgi_buffering off;
        fastcgi_request_buffering off;
        
        # Increase buffer sizes for large media files
        fastcgi_buffer_size 128k;
        fastcgi_buffers 4 256k;
        fastcgi_busy_buffers_size 256k;
        
        # Extended timeouts for streaming
        fastcgi_connect_timeout 60s;
        fastcgi_send_timeout 300s;
        fastcgi_read_timeout 300s;
        
        # CORS headers
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, HEAD, POST, PUT, DELETE, OPTIONS" always;
        add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
        add_header Access-Control-Expose-Headers "Content-Length,Content-Range,Accept-Ranges,X-Content-Duration,X-Media-Duration" always;
        
        # Handle preflight requests
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin "*";
            add_header Access-Control-Allow-Methods "GET, HEAD, POST, PUT, DELETE, OPTIONS";
            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization";
            add_header Access-Control-Expose-Headers "Content-Length,Content-Range,Accept-Ranges,X-Content-Duration,X-Media-Duration";
            add_header Access-Control-Max-Age 1728000;
            add_header Content-Type "text/plain; charset=utf-8";
            add_header Content-Length 0;
            return 204;
        }
        
        try_files /index.php =404;
        
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param REQUEST_URI $request_uri;
        fastcgi_param SCRIPT_NAME /index.php;
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }


    # X-Accel-Redirect location - OPTIMIZED for streaming
    location /protected_music/ {
        internal;
        alias /var/www/html/var/music/;
        
        # MAXIMUM STREAMING PERFORMANCE
        tcp_nodelay on;
        tcp_nopush on;
        sendfile on;
        sendfile_max_chunk 1m;
        
        # Enable efficient file serving
        directio 4m;
        directio_alignment 512;
        
        # Optimal caching for media files
        expires 1h;
        add_header Cache-Control "public, no-transform";
        
        # Support range requests for seeking
        add_header Accept-Ranges bytes;
        
        # Add duration headers from URL parameter if available
        set $duration "";
        if ($arg_duration) {
            set $duration $arg_duration;
        }
        add_header X-Content-Duration $duration;
        add_header X-Media-Duration $duration;
    }

    # PHP-FPM handling (using original settings)
    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    # Vue.js SPA - all other routes serve index.html
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Redirect server error pages to the static page /50x.html (from original config)
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /var/lib/nginx/html;
    }

    # Deny access to hidden files
    location ~ /\. {
        log_not_found off;
        deny all;
    }

    # Deny access to composer files
    location ~ /composer\.(json|lock)$ {
        deny all;
    }

    # Deny access to config files
    location ~ /config/ {
        deny all;
    }

    # Allow fpm ping and status from localhost (from original config)
    location ~ ^/(fpm-status|fpm-ping)$ {
        access_log off;
        allow 127.0.0.1;
        deny all;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_pass unix:/run/php-fpm.sock;
    }
}