# Apache vhost template for @mostajs/media studio
# Author: Dr Hamid MADANI <drmdh@msn.com>
#
# Rendered by install.sh : every ${DOMAIN} / ${PORT} placeholder is
# substituted using values from .env.deploy.
#
# @mostajs/media uses getUserMedia / getDisplayMedia → HTTPS is mandatory.

<VirtualHost *:80>
    ServerName ${DOMAIN}
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName ${DOMAIN}
    ServerAdmin ${EMAIL}

    # SSL — auto-managed by certbot --apache after the cert has been issued.
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/${DOMAIN}/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/${DOMAIN}/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf

    # Reverse proxy → Next.js (PM2 process)
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:${PORT}/
    ProxyPassReverse / http://127.0.0.1:${PORT}/

    # WebSocket upgrade (Next.js HMR + future SSE/WS features in @mostajs/media)
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/(.*) ws://127.0.0.1:${PORT}/$1 [P,L]

    # Cross-Origin headers required for ffmpeg.wasm (SharedArrayBuffer).
    Header always set Cross-Origin-Embedder-Policy "require-corp"
    Header always set Cross-Origin-Opener-Policy "same-origin"

    # Standard security headers.
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    ErrorLog ${APACHE_LOG_DIR}/${DOMAIN}-error.log
    CustomLog ${APACHE_LOG_DIR}/${DOMAIN}-access.log combined
</VirtualHost>
</IfModule>