# Add these rules inside the server {} block that serves Skulitech ERP.
# Adjust the PHP-FPM socket and document root to match the hosting server.

# Private application directories must never be served directly.
location ~ ^/(?:app|bin|config|database|docs|includes|storage)(?:/|$) {
    deny all;
    return 404;
}

# Block hidden files except ACME validation.
location ~ /\.(?!well-known/) {
    deny all;
    return 404;
}

# Block source, archive, log and backup files.
location ~* \.(?:sql|log|md|json|ya?ml|ini|env|bak|old|orig|dist|zip|tar|gz|7z)$ {
    deny all;
    return 404;
}

# Never execute scripts from upload or export directories.
location ~* ^/(?:uploads|exports)/.*\.(?:php[0-9]?|phtml|phar|cgi|pl|py|sh|jsp|asp|aspx)$ {
    deny all;
    return 404;
}

location ^~ /storage/ {
    deny all;
    return 404;
}

add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
