# -----------------------------------------------------------------------------
# Apache 2.4 (MPM event) + PHP-FPM 8.3 via proxy_fcgi : webhook TradingView KORU
#
# Modules : a2enmod ssl rewrite headers proxy proxy_fcgi setenvif
#           a2enconf php8.3-fpm   (ou le bloc FilesMatch ci-dessous)
# Remplacer koru.example.com par le nom de domaine (ou l'adresse IP) du serveur
# et /var/www/koru-webhook par le dossier d'installation.
# -----------------------------------------------------------------------------

# --- Port 80 : uniquement Let's Encrypt (HTTP-01) et redirection vers HTTPS ---
<VirtualHost *:80>
    ServerName koru.example.com

    DocumentRoot /var/www/letsencrypt

    Alias /.well-known/acme-challenge/ /var/www/letsencrypt/.well-known/acme-challenge/
    <Directory /var/www/letsencrypt>
        Options None
        AllowOverride None
        Require all granted
    </Directory>

    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    ErrorLog ${APACHE_LOG_DIR}/koru-webhook-error.log
    CustomLog ${APACHE_LOG_DIR}/koru-webhook-access.log combined
</VirtualHost>

# --- Port 443 : le webhook ---------------------------------------------------
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName koru.example.com

    DocumentRoot /var/www/koru-webhook/public

    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/koru.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/koru.example.com/privkey.pem
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

    # Let's Encrypt peut aussi passer par 443 lors d'un renouvellement
    Alias /.well-known/acme-challenge/ /var/www/letsencrypt/.well-known/acme-challenge/
    <Directory /var/www/letsencrypt>
        Options None
        AllowOverride None
        Require all granted
    </Directory>

    <Directory /var/www/koru-webhook/public>
        Options -Indexes -MultiViews
        AllowOverride None
        Require all granted
    </Directory>

    # Seule l'URL du webhook est routée vers PHP (pas de .htaccess).
    RewriteEngine On
    RewriteRule ^/webhook/tradingview$ /index.php [L]

    <FilesMatch "\.php$">
        SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost"
    </FilesMatch>

    # Messages TradingView très courts
    LimitRequestBody 65536

    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set X-Content-Type-Options "nosniff"
    ServerSignature Off

    ErrorLog ${APACHE_LOG_DIR}/koru-webhook-error.log
    CustomLog ${APACHE_LOG_DIR}/koru-webhook-access.log combined
</VirtualHost>
</IfModule>