# perinco Pulse - Apache Vhost
# Ablage: /etc/apache2/sites-available/pulse.perinco.de.conf
# Aktivieren: a2ensite pulse.perinco.de && systemctl reload apache2
#
# Reihenfolge beim Aufsetzen:
#   1. DNS A-Record pulse.perinco.de -> 31.70.144.60
#   2. Diese Datei aktivieren (HTTP-Teil), Apache neu laden
#   3. certbot --apache -d pulse.perinco.de  (legt den :443-Block selbst an)

<VirtualHost *:80>
    ServerName pulse.perinco.de
    DocumentRoot /var/www/pulse/dist

    <Directory /var/www/pulse/dist>
        Options -Indexes +FollowSymLinks
        AllowOverride None
        Require all granted
        FallbackResource /index.html
    </Directory>

    # Gehashte Build-Dateien duerfen dauerhaft im Cache liegen, index.html nie.
    <IfModule mod_expires.c>
        ExpiresActive On
        <FilesMatch "\.(js|css|woff2|png|jpg|svg|ico)$">
            ExpiresDefault "access plus 1 year"
        </FilesMatch>
    </IfModule>
    <FilesMatch "index\.html$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>

    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Frame-Options "SAMEORIGIN"

    # API lokal auf 127.0.0.1:5010, von aussen nur hierueber erreichbar.
    ProxyPreserveHost On
    ProxyPass /api http://127.0.0.1:5010/api
    ProxyPassReverse /api http://127.0.0.1:5010/api
    RequestHeader set X-Forwarded-Proto "https"

    ErrorLog ${APACHE_LOG_DIR}/pulse_error.log
    CustomLog ${APACHE_LOG_DIR}/pulse_access.log combined
</VirtualHost>