# =====================================================================
#  Apache VirtualHost fuer barox SN Check  (https://sncheck.barox.io)
#  Ablage:  /etc/apache2/sites-available/sncheck.barox.io.conf
#  Aktivieren:
#     sudo a2enmod rewrite ssl headers expires
#     sudo a2ensite sncheck.barox.io
#     sudo systemctl reload apache2
#  DocumentRoot zeigt bewusst auf public/ – der Rest des Projekts
#  (inkl. .env, src/, storage/) liegt ausserhalb des Webroots.
# =====================================================================

<VirtualHost *:80>
    ServerName sncheck.barox.io
    # Gesamten HTTP-Verkehr dauerhaft auf HTTPS umleiten.
    RewriteEngine On
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</VirtualHost>

<VirtualHost *:443>
    ServerName sncheck.barox.io
    DocumentRoot /var/www/html/barox-sncheck/public

    <Directory /var/www/html/barox-sncheck/public>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # Zugriff auf Projektinterna hart verbieten (Defense in depth).
    <DirectoryMatch "/var/www/html/barox-sncheck/(src|config|storage|database|vendor|bin)">
        Require all denied
    </DirectoryMatch>

    # --- TLS -----------------------------------------------------------
    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/sncheck.barox.io.crt
    SSLCertificateKeyFile   /etc/ssl/private/sncheck.barox.io.key
    # SSLCertificateChainFile /etc/ssl/certs/sncheck.barox.io.chain.crt
    SSLProtocol             -all +TLSv1.2 +TLSv1.3
    SSLHonorCipherOrder     off

    # --- Sicherheits-Header (ergaenzend zu denen aus PHP) --------------
    <IfModule mod_headers.c>
        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
        Header always set X-Content-Type-Options "nosniff"
        Header always set X-Frame-Options "DENY"
        Header always set Referrer-Policy "strict-origin-when-cross-origin"
    </IfModule>

    # PHP-FPM (Pfad ggf. an die installierte PHP-Version anpassen).
    <FilesMatch "\.php$">
        SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost"
    </FilesMatch>

    ErrorLog  ${APACHE_LOG_DIR}/sncheck_error.log
    CustomLog ${APACHE_LOG_DIR}/sncheck_access.log combined
</VirtualHost>
