/**
 * Generate an nginx server block (vhost) for a Forge-style site and the shell
 * commands that install it.
 *
 * Site `type` drives the template:
 *  - `laravel` / `statamic` / `wordpress` — `public/` web root, `index.php`,
 *    `try_files … /index.php?$query_string`, and a `fastcgi_pass` to the site's
 *    php-fpm socket (see {@link import('./php-provision').phpFpmSocketPath}).
 *  - `php` — generic PHP app behind php-fpm, web root at the release root.
 *  - `static` — plain files, `try_files … =404`.
 *  - `spa` — SPA fallback to `/index.html`.
 *
 * The block listens on :80 only; TLS (the `:443` block + redirect) is layered
 * on by certbot in the SSL step, so this stays stable across cert renewals.
 */
import type { SiteConfig, SiteNginxConfig } from '@ts-cloud/core';
export type NginxSiteType = NonNullable<SiteConfig['type']>;
/**
 * Resolve the nginx directive lines for a site's vhost from its
 * {@link SiteNginxConfig} and the server's reusable templates: the referenced
 * template's lines first, then the per-site `serverSnippet`. Unknown template
 * names resolve to nothing. Returns `[]` when there's no customization.
 */
export declare function resolveNginxSnippet(nginx: SiteNginxConfig | undefined, templates: Record<string, string[]> | undefined): string[];
export interface NginxVhostOptions {
    /** Site key — names the config file (`/etc/nginx/sites-available/<siteName>`). */
    siteName: string;
    /** Primary hostname (`server_name`). */
    domain: string;
    /** Additional hostnames added to `server_name`. */
    aliases?: string[];
    /** Site type — selects the template. @default 'laravel' */
    type?: NginxSiteType;
    /**
     * Directory the vhost serves from. For zero-downtime sites this is the
     * `current` symlink (`/var/www/<site>/current`); the web root appends
     * {@link webDirectory}.
     */
    appDir: string;
    /** Web root relative to {@link appDir}. Defaults per type (see {@link defaultWebDirectory}). */
    webDirectory?: string;
    /** PHP version selecting the php-fpm socket. @default '8.3' */
    phpVersion?: string;
    /**
     * Override the `fastcgi_pass` target (e.g. an isolated site's dedicated
     * php-fpm pool — see {@link import('./php-fpm-pool').phpFpmPoolListen}).
     * Defaults to the shared php-fpm listen address for {@link phpVersion}.
     */
    fastcgiPass?: string;
    /** `from path` → `to URL` 301 redirects. */
    redirects?: Record<string, string>;
    /**
     * Serve TLS directly from this vhost using operator-provided certs. When set,
     * the :80 block becomes an HTTPS redirect and a :443 `ssl` block serves the
     * site. Used for the `custom` SSL provider; for Let's Encrypt, certbot
     * rewrites the :80 block itself (leave this unset).
     */
    ssl?: {
        certPath: string;
        keyPath: string;
    };
    /**
     * HTTP Basic auth (htpasswd). When set, the vhost requires auth and the
     * generated script writes the htpasswd file. The `realm` is shown in the
     * browser prompt.
     */
    auth?: {
        username: string;
        password: string;
        realm?: string;
    };
    /**
     * Custom nginx directive lines injected into the server block (after the
     * managed directives) — a resolved reusable template plus per-site snippet.
     * See {@link import('@ts-cloud/core').SiteNginxConfig}.
     */
    serverSnippet?: string[];
    /** `client_max_body_size` override for this vhost (e.g. `'256M'`). */
    clientMaxBodySize?: string;
    /** Emit an HSTS header. `true` = 1yr + includeSubDomains; object customizes. */
    hsts?: boolean | {
        maxAge?: number;
        includeSubDomains?: boolean;
        preload?: boolean;
    };
    /** `ssl_protocols` for the custom-cert :443 block. */
    tlsProtocols?: string[];
    /** Per-site IP allow/deny (Forge "Security Rules"). */
    security?: {
        allow?: string[];
        deny?: string[];
    };
}
/** Path of the htpasswd file for a site. */
export declare function htpasswdPath(siteName: string): string;
/** Whether a site type is served by php-fpm. */
export declare function isPhpSiteType(type: NginxSiteType): boolean;
/** Default web root (relative to the release dir) for a site type. */
export declare function defaultWebDirectory(type: NginxSiteType): string;
/**
 * Build the nginx server block text for a site. With `options.ssl`, emits a
 * :80 → HTTPS redirect plus a :443 `ssl` block (the `custom` cert path);
 * otherwise a single :80 block (certbot upgrades it for Let's Encrypt).
 */
export declare function buildNginxVhost(options: NginxVhostOptions): string;
/**
 * Build the shell commands that write the vhost, enable it, validate the nginx
 * config, and reload. Re-runnable (overwrites the config + refreshes the symlink).
 */
export declare function buildNginxVhostScript(options: NginxVhostOptions): string[];
/** Wrapper that runs the pantry-installed nginx binary inside pantry's env. */
export declare const NGINX_WRAPPER = "/usr/local/bin/ts-cloud-nginx";
/**
 * Set up ts-cloud-managed nginx on top of the pantry-installed nginx binary:
 * a wrapper that runs nginx within `pantry env` (so it + its shared libs
 * resolve), a full `/etc/nginx/nginx.conf` that `include`s the per-site vhosts,
 * and a systemd unit on :80/:443. Replaces apt's nginx service (pantry's own
 * nginx service serves a minimal :8080 default and isn't started here).
 *
 * Run once at provision time, after the nginx binary is installed.
 */
export declare function buildNginxServiceScript(projectDir?: string): string[];
