# Apache 2.4 — reverse proxy vers le conteneur Docker Novelia (127.0.0.1:3010).
# Mode SSL : Cloudflare Full (Strict). Le certificat utilise ci-dessous est un
# Cloudflare Origin Certificate (genere dans Cloudflare > SSL/TLS > Origin Server).
#
# Domaine actuel : agence-novelia.fr (acquis chez Ionos, DNS via Cloudflare).
# Le domaine canonique vise est novelia.fr (a acquerir plus tard) — quand il
# sera disponible, ajouter ServerAlias novelia.fr www.novelia.fr ici.
#
# Modules requis (a activer une seule fois sur le VPS) :
#   sudo a2enmod proxy proxy_http proxy_wstunnel ssl headers rewrite http2 remoteip
#   sudo systemctl reload apache2
#
# Emplacement du certificat origine Cloudflare :
#   /etc/cloudflare/agence-novelia.fr.pem        (cert)
#   /etc/cloudflare/agence-novelia.fr.key        (cle privee)

# -----------------------------------------------------------------------------
# Restauration de la vraie IP visiteur (Cloudflare envoie CF-Connecting-IP).
# Indispensable pour les logs, le rate-limit, et les futures protections anti-bot.
# -----------------------------------------------------------------------------
<IfModule remoteip_module>
    RemoteIPHeader CF-Connecting-IP
    # Plages IP Cloudflare (https://www.cloudflare.com/ips/).
    RemoteIPTrustedProxy 173.245.48.0/20
    RemoteIPTrustedProxy 103.21.244.0/22
    RemoteIPTrustedProxy 103.22.200.0/22
    RemoteIPTrustedProxy 103.31.4.0/22
    RemoteIPTrustedProxy 141.101.64.0/18
    RemoteIPTrustedProxy 108.162.192.0/18
    RemoteIPTrustedProxy 190.93.240.0/20
    RemoteIPTrustedProxy 188.114.96.0/20
    RemoteIPTrustedProxy 197.234.240.0/22
    RemoteIPTrustedProxy 198.41.128.0/17
    RemoteIPTrustedProxy 162.158.0.0/15
    RemoteIPTrustedProxy 104.16.0.0/13
    RemoteIPTrustedProxy 104.24.0.0/14
    RemoteIPTrustedProxy 172.64.0.0/13
    RemoteIPTrustedProxy 131.0.72.0/22
    RemoteIPTrustedProxy 2400:cb00::/32
    RemoteIPTrustedProxy 2606:4700::/32
    RemoteIPTrustedProxy 2803:f800::/32
    RemoteIPTrustedProxy 2405:b500::/32
    RemoteIPTrustedProxy 2405:8100::/32
    RemoteIPTrustedProxy 2a06:98c0::/29
    RemoteIPTrustedProxy 2c0f:f248::/32
</IfModule>

# -----------------------------------------------------------------------------
# Redirection HTTP -> HTTPS (apex + www + app)
# -----------------------------------------------------------------------------
<VirtualHost *:80>
    ServerName agence-novelia.fr
    ServerAlias www.agence-novelia.fr app.agence-novelia.fr

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^/(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    ErrorLog ${APACHE_LOG_DIR}/novelia-http-error.log
    CustomLog ${APACHE_LOG_DIR}/novelia-http-access.log combined
</VirtualHost>

# -----------------------------------------------------------------------------
# Vitrine + portail + admin (agence-novelia.fr + www.agence-novelia.fr)
# -----------------------------------------------------------------------------
<VirtualHost *:443>
    ServerName agence-novelia.fr
    ServerAlias www.agence-novelia.fr

    Protocols h2 http/1.1

    # Cloudflare Origin Cert (Full Strict)
    SSLEngine on
    SSLCertificateFile      /etc/cloudflare/agence-novelia.fr.pem
    SSLCertificateKeyFile   /etc/cloudflare/agence-novelia.fr.key

    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder     on
    SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

    # Redirige www -> apex (canonical). Commente si tu preferes garder les deux.
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^www\.agence-novelia\.fr$ [NC]
    RewriteRule ^/(.*)$ https://agence-novelia.fr/$1 [R=301,L]

    # Reverse proxy vers le conteneur Docker.
    ProxyPreserveHost On
    ProxyRequests Off
    ProxyTimeout 60

    # Forward headers attendus par Next.js (req.headers + IP reelle).
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port  "443"

    ProxyPass        / http://127.0.0.1:3010/ retry=0
    ProxyPassReverse / http://127.0.0.1:3010/

    # WebSocket (HMR Next, futures fonctions temps reel).
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*) ws://127.0.0.1:3010/$1 [P,L]

    ErrorLog ${APACHE_LOG_DIR}/novelia-error.log
    CustomLog ${APACHE_LOG_DIR}/novelia-access.log combined
</VirtualHost>

# -----------------------------------------------------------------------------
# app.agence-novelia.fr — prepare le sous-domaine portail.
# Pour l'instant pointe sur le meme conteneur (memes routes /portail, /admin).
# Quand on splittera le portail en app separee, on changera le ProxyPass.
# -----------------------------------------------------------------------------
<VirtualHost *:443>
    ServerName app.agence-novelia.fr

    Protocols h2 http/1.1

    SSLEngine on
    SSLCertificateFile      /etc/cloudflare/agence-novelia.fr.pem
    SSLCertificateKeyFile   /etc/cloudflare/agence-novelia.fr.key

    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder     on
    SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyTimeout 60

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port  "443"

    ProxyPass        / http://127.0.0.1:3010/ retry=0
    ProxyPassReverse / http://127.0.0.1:3010/

    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*) ws://127.0.0.1:3010/$1 [P,L]

    ErrorLog ${APACHE_LOG_DIR}/novelia-app-error.log
    CustomLog ${APACHE_LOG_DIR}/novelia-app-access.log combined
</VirtualHost>
