# deploy/apache-gestion.conf
# Apache2 VirtualHost — ACX Super Admin (Next.js)
# Domaine  : gestion.acx-acremac.net
# Certificat : DigiCert wildcard *.acx-acremac.net (même cert que app.*)
#
# Installation :
#   sudo cp deploy/apache-gestion.conf /etc/apache2/sites-available/acx-gestion.conf
#   sudo a2ensite acx-gestion
#   sudo systemctl reload apache2

# ── HTTP : redirection vers HTTPS ─────────────────────────────────────────────
<VirtualHost *:80>
    ServerName gestion.acx-acremac.net

    RewriteEngine On
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    ErrorLog  ${APACHE_LOG_DIR}/acx-gestion-error.log
    CustomLog ${APACHE_LOG_DIR}/acx-gestion-access.log combined
</VirtualHost>

# ── HTTPS : proxy vers Next.js (même instance, port 3000) ─────────────────────
<VirtualHost *:443>
    ServerName gestion.acx-acremac.net

    # ── SSL (certificat wildcard *.acx-acremac.net) ───────────────────────────
    SSLEngine on
    SSLCertificateFile      /etc/ssl/acx-acremac/star_acx-acremac_net.crt
    SSLCertificateKeyFile   /etc/ssl/acx-acremac/acx-acremac.key
    SSLCertificateChainFile /etc/ssl/acx-acremac/My_CA_Bundle.crt

    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
    SSLHonorCipherOrder     off
    SSLSessionTickets       off

    # ── Proxy vers Next.js (même instance que app.*) ──────────────────────────
    # ProxyPreserveHost On est OBLIGATOIRE : le middleware Next.js lit le Host
    # header pour détecter gestion.* et restreindre les routes admin.
    ProxyPreserveHost On
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-For   "%{REMOTE_ADDR}s"

    ProxyPass        / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/

    ProxyTimeout 60

    # ── En-têtes sécurité ─────────────────────────────────────────────────────
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    Header always set X-Content-Type-Options    "nosniff"
    Header always set X-Frame-Options           "DENY"
    Header always set Referrer-Policy           "strict-origin-when-cross-origin"

    # ── Logs séparés pour isoler le trafic admin ──────────────────────────────
    ErrorLog  ${APACHE_LOG_DIR}/acx-gestion-error.log
    CustomLog ${APACHE_LOG_DIR}/acx-gestion-access.log combined
</VirtualHost>