# Put in a server block with the host-managed TLS certificate.
server {
    listen 80;
    server_name hr.example.com;
    root /var/www/zentrikhrms/public;
    index index.php;
    client_max_body_size 12m;
    location / { try_files $uri $uri/ /index.php?$query_string; }
    location = /index.php {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }
    location ~ \.php$ { return 404; }
    location ~ /\.(?!well-known).* { deny all; }
}