# Example Apache virtual host for live deployment with PM2 + Next.js.
#
# Prerequisites:
#   - mod_proxy, mod_proxy_http, mod_alias, mod_headers enabled
#   - Next.js running via PM2 on 127.0.0.1:3042 (see ecosystem.config.cjs)
#
# Install:
#   1. Copy/adapt this file into your Apache sites config.
#   2. Update ServerName, paths, and upstream port if needed.
#   3. sudo apachectl configtest && sudo systemctl reload apache2

<VirtualHost *:80>
    ServerName example.com

    # Absolute path to this repo on the server.
    Define APP_ROOT /var/www/coporatebackend_nextjs
    Define APP_PORT 3042

    # Serve the fallback page from disk — never proxy this path.
    Alias /index.html ${APP_ROOT}/public/index.html

    <Directory "${APP_ROOT}/public">
        Require all granted
        Options -Indexes
        <Files "index.html">
            Header set Cache-Control "no-store"
        </Files>
    </Directory>

    ProxyPreserveHost On
    ProxyRequests Off

    # Forward the public host/proto so Next.js same-origin + CSRF checks match the browser URL.
    # Unset first: clients (and bots) can send a forged X-Forwarded-Host (e.g. "i=81").
    # Next.js prefers that header over Host for Server Action CSRF, so a spoofed value
    # aborts actions even when Origin is oxyfinz.info.
    RequestHeader unset X-Forwarded-Host
    RequestHeader unset X-Forwarded-Proto
    RequestHeader set X-Forwarded-Proto "https" env=HTTPS
    RequestHeader set X-Forwarded-Host "%{HTTP_HOST}e"

    # Exclude fallback asset from the reverse proxy.
    ProxyPass /index.html !
    ProxyPass / http://127.0.0.1:${APP_PORT}/
    ProxyPassReverse / http://127.0.0.1:${APP_PORT}/

    # When the app is down or the proxy times out, show public/index.html.
    ProxyErrorOverride On
    ErrorDocument 502 /index.html
    ErrorDocument 503 /index.html
    ErrorDocument 504 /index.html

    # Optional: tighten proxy timeouts so failures surface faster.
    ProxyTimeout 60

    # If the Yii backend is on the same host, ensure Authorization reaches PHP:
    # SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
    # (Or use CGIPassAuth On on Apache 2.4.13+)

    ErrorLog ${APACHE_LOG_DIR}/coporatebackend-nextjs-error.log
    CustomLog ${APACHE_LOG_DIR}/coporatebackend-nextjs-access.log combined
</VirtualHost>

# HTTPS example (uncomment and configure certificates):
#
# <VirtualHost *:443>
#     ServerName example.com
#
#     SSLEngine on
#     SSLCertificateFile /etc/ssl/certs/example.com.crt
#     SSLCertificateKeyFile /etc/ssl/private/example.com.key
#
#     Define APP_ROOT /var/www/coporatebackend_nextjs
#     Define APP_PORT 3042
#
#     Alias /index.html ${APP_ROOT}/public/index.html
#
#     <Directory "${APP_ROOT}/public">
#         Require all granted
#         Options -Indexes
#         <Files "index.html">
#             Header set Cache-Control "no-store"
#         </Files>
#     </Directory>
#
#     ProxyPreserveHost On
#     ProxyRequests Off
#     RequestHeader unset X-Forwarded-Host
#     RequestHeader unset X-Forwarded-Proto
#     RequestHeader set X-Forwarded-Proto "https" env=HTTPS
#     RequestHeader set X-Forwarded-Host "%{HTTP_HOST}e"
#     ProxyPass /index.html !
#     ProxyPass / http://127.0.0.1:${APP_PORT}/
#     ProxyPassReverse / http://127.0.0.1:${APP_PORT}/
#     ProxyErrorOverride On
#     ErrorDocument 502 /index.html
#     ErrorDocument 503 /index.html
#     ErrorDocument 504 /index.html
#     ProxyTimeout 60
#
#     ErrorLog ${APACHE_LOG_DIR}/coporatebackend-nextjs-ssl-error.log
#     CustomLog ${APACHE_LOG_DIR}/coporatebackend-nextjs-ssl-access.log combined
# </VirtualHost>