upstream zabbix_backend {
    server unix:/run/php/php8.3-fpm.sock;
    keepalive 32;
    keepalive_requests 1000;
    keepalive_timeout 60s;
}

################################################################################
# RATE LIMITING
################################################################################

limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s;
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=5r/m;
limit_req_zone $binary_remote_addr zone=general_limit:10m rate=100r/s;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

################################################################################
# FASTCGI CACHE
################################################################################

fastcgi_cache_path /var/cache/nginx/zabbix 
    levels=1:2 
    keys_zone=zabbix_cache:100m 
    max_size=2g 
    inactive=1d 
    use_temp_path=off;

fastcgi_cache_key "$scheme$request_method$host$request_uri$cookie_zbx_session";

################################################################################
# HTTP - REDIRECT TO HTTPS
################################################################################

server {
    listen 80;
    listen [::]:80;
    
    # ADJUST SERVER NAME HERE
    server_name zabbix.seudominio.com.br;
    server_tokens off;
    
    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/html;
        allow all;
    }
    
    location / {
        return 301 https://$host$request_uri;
    }
}

################################################################################
# HTTPS - MAIN SERVER
################################################################################

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    
    # ADJUST SERVER NAME HERE
    server_name zabbix.seudominio.com.br;
    server_tokens off;
    
    # SSL/TLS - ADJUST PATHS HERE
    ssl_certificate /etc/nginx/ssl/zabbix.crt;
    ssl_certificate_key /etc/nginx/ssl/zabbix.key;
    
    # Recommended SSL settings if not managed by Certbot
    ssl_session_cache shared:ZabbixSSL:50m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    
    # Security Headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    # General
    root /usr/share/zabbix;
    index index.php;
    access_log /var/log/nginx/zabbix_access.log combined buffer=32k flush=5s;
    error_log /var/log/nginx/zabbix_error.log warn;
    
    client_max_body_size 50M;
    client_body_buffer_size 256k;
    client_header_buffer_size 4k;
    large_client_header_buffers 4 16k;
    
    client_body_timeout 30s;
    client_header_timeout 30s;
    send_timeout 60s;
    limit_conn conn_limit 50;
    
    # Security Blocks
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
    
    location ~ ^/(conf|app|include|local)/ {
        deny all;
        return 404;
    }
    
    location ~ \.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)$ {
        deny all;
        return 404;
    }
    
    # Static Files
    location ~* \.(jpg|jpeg|gif|png|webp|ico|svg)$ {
        expires 90d;
        add_header Cache-Control "public, immutable, no-transform";
        access_log off;
        try_files $uri =404;
    }
    
    location ~* \.(css|js)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
        access_log off;
        try_files $uri =404;
    }
    
    location ~* \.(woff|woff2|ttf|eot|otf)$ {
        expires 365d;
        add_header Cache-Control "public, immutable";
        access_log off;
        try_files $uri =404;
    }
    
    # Zabbix API
    location /api_jsonrpc.php {
        limit_req zone=api_limit burst=50 nodelay;
        fastcgi_no_cache 1;
        fastcgi_cache_bypass 1;
        fastcgi_pass zabbix_backend;
        include fastcgi_params;
        fastcgi_param HTTPS on;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_buffer_size 64k;
        fastcgi_buffers 16 32k;
        fastcgi_busy_buffers_size 64k;
        fastcgi_read_timeout 600s;
        fastcgi_send_timeout 600s;
    }
    
    # Login Protection
    location = /index.php {
        limit_req zone=login_limit burst=3 nodelay;
        fastcgi_pass zabbix_backend;
        include fastcgi_params;
        fastcgi_param HTTPS on;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_buffer_size 32k;
        fastcgi_buffers 8 16k;
        fastcgi_busy_buffers_size 32k;
        fastcgi_read_timeout 300s;
        fastcgi_no_cache 1;
        fastcgi_cache_bypass 1;
    }
    
    # PHP with FastCGI Cache
    location ~ \.php$ {
        limit_req zone=general_limit burst=200 nodelay;
        try_files $uri =404;
        fastcgi_pass zabbix_backend;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param HTTPS on;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        
        # Cache configuration
        fastcgi_cache zabbix_cache;
        fastcgi_cache_valid 200 301 302 10m;
        fastcgi_cache_valid 404 1m;
        fastcgi_cache_valid any 1m;
        fastcgi_cache_bypass $http_pragma $http_authorization $cookie_zbx_session;
        fastcgi_no_cache $http_pragma $http_authorization $cookie_zbx_session;
        add_header X-FastCGI-Cache $upstream_cache_status;
        
        fastcgi_buffer_size 32k;
        fastcgi_buffers 16 32k;
        fastcgi_busy_buffers_size 64k;
        fastcgi_connect_timeout 60s;
        fastcgi_send_timeout 300s;
        fastcgi_read_timeout 300s;
    }
    
    # Health Check
    location /nginx-health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
}