# ============================================================================
#  Apache reverse proxy -> Next.js support portal (127.0.0.1:3000)
#
#  Bluehost VPS (CentOS/AlmaLinux + cPanel/WHM):
#     /etc/apache2/conf.d/userdata/ssl/2_4/<cpuser>/<domain>/support-portal.conf
#     then:  /scripts/ensure_vhost_includes --all-users && systemctl restart httpd
#     (editing httpd.conf directly gets overwritten by cPanel — use the include)
#
#  Plain Apache (no cPanel):
#     Ubuntu/Debian: /etc/apache2/sites-available/support-portal.conf
#                    a2ensite support-portal && systemctl reload apache2
#     CentOS/Alma:   /etc/httpd/conf.d/support-portal.conf
#                    systemctl reload httpd
#
#  Required modules (enable first — see DEPLOY.md):
#     proxy proxy_http proxy_wstunnel headers rewrite ssl
# ============================================================================

# ---------- Port 80: redirect everything to HTTPS ----------
<VirtualHost *:80>
    ServerName  support.example.com
    ServerAlias www.support.example.com

    # keep Let's Encrypt / AutoSSL renewals working
    ProxyPass        /.well-known/acme-challenge !
    Alias            /.well-known/acme-challenge /var/www/html/.well-known/acme-challenge

    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
    RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]
</VirtualHost>

# ---------- Port 443: the real thing ----------
<VirtualHost *:443>
    ServerName  support.example.com
    ServerAlias www.support.example.com

    SSLEngine on
    SSLCertificateFile      /etc/letsencrypt/live/support.example.com/fullchain.pem
    SSLCertificateKeyFile   /etc/letsencrypt/live/support.example.com/privkey.pem
    # On cPanel/AutoSSL, omit the three SSL lines above — cPanel injects them.

    SSLProxyEngine off
    ProxyPreserveHost On
    ProxyRequests Off
    ProxyTimeout 120

    # Tell Next.js what the browser actually asked for. Without these, absolute
    # URLs and the secure session cookie get the wrong scheme/host.
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port  "443"

    # --- Next.js dev/HMR websockets are not used in production, but the AI
    # --- chat streams over plain HTTP so no ws upgrade is strictly needed.
    # --- Left in so a future streaming/websocket feature just works:
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule ^/?(.*) ws://127.0.0.1:3000/$1 [P,L]

    # --- Everything to the Node app ---
    ProxyPass        / http://127.0.0.1:3000/ retry=0
    ProxyPassReverse / http://127.0.0.1:3000/

    # Long cache for immutable Next build assets (Next already sets the header;
    # this just stops Apache from stripping it on some cPanel configs).
    <LocationMatch "^/_next/static/">
        Header always set Cache-Control "public, max-age=31536000, immutable"
    </LocationMatch>

    # HSTS — only enable once HTTPS is confirmed working
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    ErrorLog  /var/log/apache2/support-portal-error.log
    CustomLog /var/log/apache2/support-portal-access.log combined
    # CentOS/Alma/cPanel use /etc/httpd/logs/ or /usr/local/apache/logs/ instead
</VirtualHost>