# =============================================================================
# Apache Configuration for Accessible Video Platform
# =============================================================================
# Add this configuration to your existing VirtualHost for ai-sandbox.oliver.solutions
# Location: /etc/apache2/sites-available/ai-sandbox.oliver.solutions-ssl.conf
# =============================================================================

# -----------------------------------------------------------------------------
# Frontend - Static React SPA served from subdirectory
# -----------------------------------------------------------------------------

# Serve frontend from /video-accessibility subdirectory
Alias /video-accessibility /var/www/html/video-accessibility

<Directory /var/www/html/video-accessibility>
    # Basic options
    Options -Indexes +FollowSymLinks
    AllowOverride All
    Require all granted

    # React SPA routing - rewrite all requests to index.html
    RewriteEngine On
    RewriteBase /video-accessibility

    # Don't rewrite files or directories that exist
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    # Rewrite everything else to index.html
    RewriteRule ^ /video-accessibility/index.html [L]

    # Security headers
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Cache control for static assets
    <FilesMatch "\.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>

    # No cache for HTML files
    <FilesMatch "\.(html)$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires "0"
    </FilesMatch>
</Directory>

# -----------------------------------------------------------------------------
# Backend API - Reverse proxy to Docker container
# -----------------------------------------------------------------------------

# Proxy backend API to Docker container on port 8000
<Location /video-accessibility-back>
    # Preserve original host header
    ProxyPreserveHost On

    # Proxy HTTP requests
    ProxyPass http://localhost:8000
    ProxyPassReverse http://localhost:8000

    # Proxy timeout settings (important for long-running video processing)
    ProxyTimeout 300

    # WebSocket support (CRITICAL for real-time job updates)
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /video-accessibility-back/(.*) ws://localhost:8000/$1 [P,L]
    RewriteCond %{HTTP:Upgrade} !=websocket [NC]
    RewriteRule /video-accessibility-back/(.*) http://localhost:8000/$1 [P,L]

    # Security headers
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"

    # CORS is handled by the backend, don't add headers here
</Location>

# -----------------------------------------------------------------------------
# Required Apache Modules
# -----------------------------------------------------------------------------

# Enable these modules with:
#   sudo a2enmod rewrite
#   sudo a2enmod proxy
#   sudo a2enmod proxy_http
#   sudo a2enmod proxy_wstunnel
#   sudo a2enmod headers
#   sudo systemctl restart apache2

# Verify modules are enabled:
#   apache2ctl -M | grep -E '(rewrite|proxy|headers)'

# =============================================================================
# Full VirtualHost Example
# =============================================================================

# Example of complete VirtualHost configuration:
#
# <VirtualHost *:443>
#     ServerName ai-sandbox.oliver.solutions
#     ServerAdmin admin@oliver.solutions
#
#     DocumentRoot /var/www/html
#
#     # SSL Configuration (with wildcard cert)
#     SSLEngine on
#     SSLCertificateFile /path/to/wildcard-ai-sandbox.oliver.solutions.crt
#     SSLCertificateKeyFile /path/to/wildcard-ai-sandbox.oliver.solutions.key
#     SSLCertificateChainFile /path/to/chain.crt  # If needed
#
#     # SSL Protocol and Cipher settings
#     SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
#     SSLCipherSuite HIGH:!aNULL:!MD5
#
#     # Frontend configuration (from above)
#     Alias /video-accessibility /var/www/html/video-accessibility
#     <Directory /var/www/html/video-accessibility>
#         ...
#     </Directory>
#
#     # Backend API configuration (from above)
#     <Location /video-accessibility-back>
#         ...
#     </Location>
#
#     # Logging
#     ErrorLog ${APACHE_LOG_DIR}/ai-sandbox-error.log
#     CustomLog ${APACHE_LOG_DIR}/ai-sandbox-access.log combined
# </VirtualHost>

# =============================================================================
# Testing & Verification
# =============================================================================

# Test Apache configuration:
#   sudo apache2ctl configtest
#
# Restart Apache:
#   sudo systemctl restart apache2
#
# Test frontend:
#   curl -I https://ai-sandbox.oliver.solutions/video-accessibility
#
# Test backend:
#   curl https://ai-sandbox.oliver.solutions/video-accessibility-back/health
#
# Test WebSocket (requires wscat):
#   wscat -c wss://ai-sandbox.oliver.solutions/video-accessibility-back/api/v1/ws/job-list

# =============================================================================
# Troubleshooting
# =============================================================================

# Check Apache logs:
#   sudo tail -f /var/log/apache2/ai-sandbox-error.log
#   sudo tail -f /var/log/apache2/ai-sandbox-access.log
#
# Check if backend is running:
#   curl http://localhost:8000/health
#
# Check Docker containers:
#   cd /opt/accessible-video
#   docker-compose ps
#
# Common issues:
#   - 502 Bad Gateway: Backend container not running
#   - 404 Not Found: Frontend not deployed or Apache alias incorrect
#   - WebSocket fails: mod_proxy_wstunnel not enabled
#   - CORS errors: Check backend CORS configuration, not Apache