# Vhost HTTPS (port 443). Les directives SSLCertificate* seront complétées/ajustées par certbot.
# À copier vers /etc/apache2/sites-available/leperelion.fr-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName leperelion.fr
    ServerAlias www.leperelion.fr

    ErrorLog ${APACHE_LOG_DIR}/leperelion.fr-error.log
    CustomLog ${APACHE_LOG_DIR}/leperelion.fr-access.log combined

    # Fichiers uploadés servis en statique (court-circuite le proxy)
    Alias /uploads /var/www/leperelion.fr/uploads
    <Directory /var/www/leperelion.fr/uploads>
        Options -Indexes
        AllowOverride None
        Require all granted
    </Directory>
    ProxyPass /uploads/ !

    # Proxy vers l'API Express (backend)
    ProxyPreserveHost On
    ProxyPass /backend/ http://localhost:4002/
    ProxyPassReverse /backend/ http://localhost:4002/

    # WebSocket (hot reload Next.js si dev) vers le frontend
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/?(.*) ws://localhost:3002/$1 [P,L]

    # Proxy vers Next.js (frontend)
    ProxyPass / http://localhost:3002/
    ProxyPassReverse / http://localhost:3002/

    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/leperelion.fr/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/leperelion.fr/privkey.pem

    Header always unset X-Powered-By
    # Force HTTPS côté navigateur (évite l'avertissement "non sécurisé" sur visite http)
    Header always set Strict-Transport-Security "max-age=15768000"
</VirtualHost>
</IfModule>