whatsapp/docker/nginx/default.conf

server {
    listen 80;
    listen [::]:80;
    server_name _;
    root /var/www/html;
    index index.php index.html;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;

    # Logs
    access_log /var/log/nginx/whatsapp-access.log;
    error_log /var/log/nginx/whatsapp-error.log warn;

    # Aumentar timeouts para webhook (procesamiento puede tardar)
    fastcgi_read_timeout 300;
    fastcgi_send_timeout 300;
    proxy_read_timeout 300;
    proxy_send_timeout 300;

    # Root location
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP files
    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;

        # FastCGI buffers
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        
        # Importante para que webhook responda rápido
        fastcgi_buffering off;
        
        # 🚫 ANTI-CACHÉ AGRESIVO PARA ARCHIVOS PHP DINÁMICOS
        # Evita que el navegador cachee páginas como conversations.php
        add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0" always;
        add_header Pragma "no-cache" always;
        add_header Expires "Thu, 01 Jan 1970 00:00:00 GMT" always;
        expires off;
    }

    # Webhook endpoint (configuración especial para respuesta rápida y sin caché)
    location ~ ^/api/webhook(_optimized)?\.php$ {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index webhook_optimized.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        
        # Sin buffering para respuesta inmediata
        fastcgi_buffering off;
        fastcgi_request_buffering off;
        
        # Timeouts ajustados
        fastcgi_read_timeout 60;
        fastcgi_send_timeout 60;
        
        # Anti-caché (webhook siempre debe procesar en tiempo real)
        add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0" always;
        add_header Pragma "no-cache" always;
        expires off;
    }

    # Health check endpoint
    location /health.php {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root/health.php;
        include fastcgi_params;
        access_log off;
    }

    # Static assets
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
        expires 7d;
        add_header Cache-Control "public, max-age=604800" always;
        access_log off;
    }

    # Deny access to hidden files
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Deny access to sensitive files
    location ~ /(?:composer\.json|composer\.lock|package\.json|\.env|\.git) {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Uploads directory
    location ^~ /uploads/ {
        alias /var/www/html/uploads/;
        autoindex off;
        
        # Security: solo permitir ciertos tipos de archivo - SIN CACHE
        location ~* \.(jpg|jpeg|png|gif|pdf|doc|docx|xls|xlsx|mp4|mp3|webp)$ {
            # CACHE DESACTIVADO
            add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0" always;
            add_header Pragma "no-cache" always;
            expires off;
        }
        
        # Denegar ejecución de PHP en uploads
        location ~ \.php$ {
            deny all;
        }
    }

    # API directory (sin directorio listing)
    location ^~ /api/ {
        location ~ \.php$ {
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
        }
    }
}