# ============================================================
# AETHER CHAT — Apache VirtualHost Yapılandırması
# Apache 2.4 + PHP 7.4 + mod_proxy (WebSocket için)
#
# Kurulum:
#   sudo cp aether.apache.conf /etc/apache2/sites-available/aether.conf
#   sudo a2ensite aether
#   sudo a2enmod proxy proxy_http proxy_wstunnel rewrite headers ssl
#   sudo systemctl reload apache2
# ============================================================

# HTTP → HTTPS yönlendirme
<VirtualHost *:80>
    ServerName yourdomain.com
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

# Ana HTTPS VirtualHost
<VirtualHost *:443>
    ServerName yourdomain.com
    DocumentRoot /var/www/aether/server

    # SSL (Certbot otomatik doldurur)
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/yourdomain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem

    # Güvenlik başlıkları
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "no-referrer"

    # PHP 7.4 FPM
    <FilesMatch "\.php$">
        SetHandler "proxy:unix:/var/run/php/php7.4-fpm.sock|fcgi://localhost"
    </FilesMatch>

    # API dizini — sadece .php dosyaları
    <Directory /var/www/aether/server/api>
        Options -Indexes
        AllowOverride None
        Require all granted

        # verify_token.php sadece localhost
        <Files "verify_token.php">
            Require local
        </Files>
    </Directory>

    # WebSocket Proxy → Ratchet (port 8090)
    # /ws yolunu WebSocket sunucusuna ilet
    ProxyRequests Off
    ProxyPreserveHost On

    <Location /ws>
        ProxyPass        ws://127.0.0.1:8090/
        ProxyPassReverse ws://127.0.0.1:8090/
        
        # WebSocket için gerekli başlıklar
        RewriteEngine On
        RewriteCond %{HTTP:Upgrade} =websocket [NC]
        RewriteRule /ws(.*) ws://127.0.0.1:8090/$1 [P,L]
    </Location>

    # Gizli dosyalara erişimi engelle
    <FilesMatch "(\.env|\.git|composer\.json|composer\.lock)">
        Require all denied
    </FilesMatch>

    # vendor/ dizinini engelle
    <Directory /var/www/aether/server/vendor>
        Require all denied
    </Directory>

    # ws/ ve cron/ dizinlerini engelle (doğrudan HTTP erişimi)
    <Directory /var/www/aether/server/ws>
        Require all denied
    </Directory>
    <Directory /var/www/aether/server/cron>
        Require all denied
    </Directory>

    # Log
    ErrorLog  ${APACHE_LOG_DIR}/aether_error.log
    CustomLog ${APACHE_LOG_DIR}/aether_access.log combined
</VirtualHost>
