# Configuration Apache pour RDV Planner Pro
# Placez ce contenu dans /etc/apache2/sites-available/rdv-planner.conf

<VirtualHost *:80>
    ServerName votre-domaine.com
    ServerAlias www.votre-domaine.com
    
    # Redirection vers HTTPS
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName votre-domaine.com
    ServerAlias www.votre-domaine.com
    
    # Configuration SSL
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/votre-domaine.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/votre-domaine.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
    
    # Proxy vers Node.js (API)
    ProxyPreserveHost On
    ProxyRequests Off
    
    # API routes
    ProxyPass /api http://localhost:3000/api
    ProxyPassReverse /api http://localhost:3000/api
    
    # WebSocket support pour futures fonctionnalités
    ProxyPass /socket.io http://localhost:3000/socket.io
    ProxyPassReverse /socket.io http://localhost:3000/socket.io
    
    # Headers pour le proxy
    ProxyPassReverse / http://localhost:3000/
    ProxyPassReverseCookieDomain localhost votre-domaine.com
    
    # Servir les fichiers statiques directement
    DocumentRoot /var/www/html/rdv-planner/public
    
    <Directory /var/www/html/rdv-planner/public>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
        
        # Cache statique pour les assets
        <FilesMatch "\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$">
            ExpiresActive On
            ExpiresDefault "access plus 1 year"
            Header append Cache-Control "public, immutable"
        </FilesMatch>
        
        # Compression gzip
        <IfModule mod_deflate.c>
            AddOutputFilterByType DEFLATE text/plain
            AddOutputFilterByType DEFLATE text/html
            AddOutputFilterByType DEFLATE text/xml
            AddOutputFilterByType DEFLATE text/css
            AddOutputFilterByType DEFLATE application/xml
            AddOutputFilterByType DEFLATE application/xhtml+xml
            AddOutputFilterByType DEFLATE application/rss+xml
            AddOutputFilterByType DEFLATE application/javascript
            AddOutputFilterByType DEFLATE application/x-javascript
        </IfModule>
    </Directory>
    
    # Rediriger toutes les requêtes non-fichiers vers index.html (SPA)
    <Location "/">
        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteCond %{REQUEST_URI} !^/api/
        RewriteCond %{REQUEST_URI} !^/socket.io/
        RewriteRule ^(.*)$ /index.html [L]
    </Location>
    
    # Headers de sécurité
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; font-src 'self' https://cdnjs.cloudflare.com; img-src 'self' data: https:; connect-src 'self' ws: wss:;"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    
    # CORS headers pour l'API
    <Location "/api">
        Header always set Access-Control-Allow-Origin "https://votre-domaine.com"
        Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
        Header always set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
        Header always set Access-Control-Allow-Credentials "true"
    </Location>
    
    # Rate limiting
    <IfModule mod_reqtimeout.c>
        RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
    </IfModule>
    
    # Log files
    ErrorLog ${APACHE_LOG_DIR}/rdv-planner-error.log
    CustomLog ${APACHE_LOG_DIR}/rdv-planner-access.log combined
    
    # Log rotation
    LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined_with_time
</VirtualHost>

# Configuration pour le monitoring
<VirtualHost *:443>
    ServerName status.votre-domaine.com
    
    # Page de statut (protégée par IP)
    <Location "/server-status">
        SetHandler server-status
        Require ip 127.0.0.1 ::1 votre-ip-publique
    </Location>
    
    DocumentRoot /var/www/html/rdv-planner/public
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/votre-domaine.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/votre-domaine.com/privkey.pem
</VirtualHost>
