gitignore claude local settings

Static file locations now return 404 instead of falling through to
index.php, and the default location uses a clean rewrite to prevent
/index.php/index.php redirect cycles.

.claude/settings.local.json

@@ -1,30 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "WebSearch",
-      "WebFetch(domain:docs.docker.com)",
-      "WebFetch(domain:hub.docker.com)",
-      "WebFetch(domain:caddyserver.com)",
-      "WebFetch(domain:docs.nextcloud.com)",
-      "Bash(git log:*)",
-      "Bash(git diff:*)",
-      "Bash(git status:*)"
-    ],
-    "deny": [
-      "Bash(ssh:*)",
-      "Bash(rm -rf:*)",
-      "Bash(docker system prune:*)",
-      "Bash(docker volume rm:*)",
-      "Bash(docker compose down:*)",
-      "Bash(docker stop:*)",
-      "Bash(docker rm:*)",
-      "Bash(scp:*)",
-      "Bash(rsync:*)",
-      "Bash(curl -X POST:*)",
-      "Bash(curl -X DELETE:*)",
-      "Bash(git push:*)",
-      "Bash(git reset --hard:*)",
-      "Bash(git clean:*)"
-    ]
-  }
-}

.gitignore

@@ -1,3 +1,4 @@
 .env
 .idea/
 *.iml
+.claude/settings.local.json

nextcloud/nginx.conf

@@ -2,6 +2,10 @@ upstream php-handler {
     server nextcloud:9000;
 }
 
+map $uri $nonce_uri {
+    default "";
+}
+
 server {
     listen 80;
     server_name _;
@@ -30,22 +34,21 @@ server {
     location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
     location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)              { return 404; }
 
-    # Serve static files directly
+    # Serve static files directly — only if file exists on disk
     location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
-        try_files $uri /index.php$request_uri;
+        try_files $uri =404;
         expires 6M;
         access_log off;
     }
 
     location ~ \.woff2?$ {
-        try_files $uri /index.php$request_uri;
+        try_files $uri =404;
         expires 7d;
         access_log off;
     }
 
     # PHP handling
     location ~ \.php(?:$|/) {
-        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
         fastcgi_split_path_info ^(.+?\.php)(/.*)$;
         set $path_info $fastcgi_path_info;
         try_files $fastcgi_script_name =404;
@@ -61,8 +64,8 @@ server {
         fastcgi_max_temp_file_size 0;
     }
 
-    # Default handler
+    # Default handler — route everything else through PHP front controller
     location / {
-        try_files $uri $uri/ /index.php$request_uri;
+        rewrite ^ /index.php$request_uri last;
     }
 }