# =============================================================================
# barox SecPen - Apache VirtualHost
# Ablage: /etc/apache2/sites-available/barox-secpen.conf
# Aktivieren: a2ensite barox-secpen && systemctl reload apache2
#
# Benoetigte Module: rewrite, headers, ssl, http2 (optional), expires
#   a2enmod rewrite headers ssl http2 expires
# =============================================================================

<VirtualHost *:80>
    ServerName secpen.barox.io

    # Ausschliesslich HTTPS - ausser fuer die ACME-Pruefung.
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

    ErrorLog  ${APACHE_LOG_DIR}/barox-secpen-error.log
    CustomLog ${APACHE_LOG_DIR}/barox-secpen-access.log combined
</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName secpen.barox.io
    ServerAdmin secpen@barox.io

    DocumentRoot /var/www/html/barox-secpen/public

    # ---------------------------------------------------------------- TLS ---
    SSLEngine on
    SSLCertificateFile      /etc/letsencrypt/live/secpen.barox.io/fullchain.pem
    SSLCertificateKeyFile   /etc/letsencrypt/live/secpen.barox.io/privkey.pem
    SSLProtocol             -all +TLSv1.2 +TLSv1.3
    SSLHonorCipherOrder     off
    SSLSessionTickets       off
    SSLUseStapling          on

    # ------------------------------------------------------------ Verzeichnis
    <Directory /var/www/html/barox-secpen/public>
        Options -Indexes -MultiViews +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # Anwendungsverzeichnisse sind nie direkt erreichbar. Das DocumentRoot
    # zeigt bereits auf public/; diese Regeln sind eine zweite Absicherung.
    <DirectoryMatch "^/var/www/html/barox-secpen/(app|bootstrap|config|database|resources|routes|storage|tests|vendor|deploy|docs)">
        Require all denied
    </DirectoryMatch>

    <FilesMatch "^(\.env.*|composer\.(json|lock)|package\.json|phpunit\.xml|artisan)$">
        Require all denied
    </FilesMatch>

    # ------------------------------------------------------------- Header ---
    # Die Anwendung setzt CSP, HSTS und die uebrigen Header selbst
    # (App\Http\Middleware\SecurityHeaders). Hier nur ergaenzende Absicherung.
    <IfModule mod_headers.c>
        Header always set X-Content-Type-Options "nosniff"
        Header always set X-Frame-Options "DENY"
        Header unset X-Powered-By
        Header always unset Server
        # Statische Assets duerfen zwischengespeichert werden.
        <FilesMatch "\.(css|js|woff2?|otf|png|jpg|svg|ico)$">
            Header set Cache-Control "public, max-age=2592000, immutable"
        </FilesMatch>
    </IfModule>

    ServerTokens Prod
    ServerSignature Off
    TraceEnable Off

    # ---------------------------------------------------------------- PHP ---
    # Empfohlen: PHP-FPM mit eigenem Pool (siehe deploy/php-fpm-barox-secpen.conf).
    <IfModule proxy_fcgi_module>
        <FilesMatch "\.php$">
            SetHandler "proxy:unix:/run/php/php8.3-fpm-barox-secpen.sock|fcgi://localhost"
        </FilesMatch>
    </IfModule>

    # Uploads begrenzen (zusaetzlich zur Anwendungsvalidierung).
    LimitRequestBody 26214400

    ErrorLog  ${APACHE_LOG_DIR}/barox-secpen-error.log
    CustomLog ${APACHE_LOG_DIR}/barox-secpen-access.log combined
</VirtualHost>
</IfModule>