# ERP-Core RELEASE environment (deployed from the production branch) — docs/40-DEPLOYMENT.md §4.
#
# Install:  cp deploy/apache/erp.hexdive.com.conf /etc/httpd/conf.d/
#           apachectl configtest && systemctl reload httpd
#           certbot --apache -d erp.hexdive.com
# certbot copies this vhost to :443 with the certificate and turns :80 into a redirect to https.
# The session cookies are Secure + SameSite=Strict, so login only works over HTTPS.
# Needs mod_proxy, mod_proxy_http, mod_headers, mod_ssl and SELinux httpd_can_network_connect=on.

<VirtualHost *:80>
    ServerName erp.hexdive.com

    ProxyRequests     Off
    ProxyPreserveHost On
    ProxyTimeout      120
    RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}

    Header always set Strict-Transport-Security "max-age=31536000" "expr=%{HTTPS} == 'on'"
    Header always set X-Content-Type-Options "nosniff"

    # HR documents are capped at 10 MB by the API (FileStorage:MaxSizeBytes); allow a little overhead.
    LimitRequestBody 12582912

    # Order matters — the first matching ProxyPass wins, so /api/ must come before /.
    # /health and /swagger are deliberately NOT proxied (they fall through to Next and 404).
    ProxyPass        /api/ http://127.0.0.1:5220/api/
    ProxyPassReverse /api/ http://127.0.0.1:5220/api/
    ProxyPass        /     http://127.0.0.1:3020/
    ProxyPassReverse /     http://127.0.0.1:3020/

    ErrorLog  /var/log/httpd/erp.hexdive.com-error.log
    CustomLog /var/log/httpd/erp.hexdive.com-access.log combined
</VirtualHost>