# ─────────────────────────────────────────────────────────────────────────────
#  apache-topup.conf — Virtual Host لبوت شحن الألعاب
#  نسخه إلى: /etc/apache2/sites-available/topup-bot.conf
#  ثم فعّله: sudo a2ensite topup-bot.conf && sudo systemctl restart apache2
# ─────────────────────────────────────────────────────────────────────────────

# ── HTTP → HTTPS redirect ─────────────────────────────────────────────────────
<VirtualHost *:80>
    ServerName your-domain.com
    Redirect permanent / https://your-domain.com/
</VirtualHost>

# ── HTTPS ─────────────────────────────────────────────────────────────────────
<VirtualHost *:443>
    ServerName your-domain.com

    # SSL — احصل عليها مجاناً: sudo certbot --apache
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/your-domain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/your-domain.com/privkey.pem

    # ── mod_wsgi ────────────────────────────────────────────────────────────
    # عدّل python-home ليشير إلى venv الخاص بالمشروع
    WSGIDaemonProcess topupbot \
        user=www-data \
        group=www-data \
        threads=5 \
        python-home=/var/www/game-topup-bot/venv \
        python-path=/var/www/game-topup-bot

    WSGIProcessGroup  topupbot
    WSGIScriptAlias   /api /var/www/game-topup-bot/topup.wsgi

    <Directory /var/www/game-topup-bot>
        <Files topup.wsgi>
            Require all granted
        </Files>
    </Directory>

    # ── Logs ────────────────────────────────────────────────────────────────
    ErrorLog  /var/www/game-topup-bot/logs/apache_error.log
    CustomLog /var/www/game-topup-bot/logs/apache_access.log combined

    # ── Security headers ────────────────────────────────────────────────────
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"

    # ── Block everything except /api ────────────────────────────────────────
    <Location "/">
        <RequireAny>
            Require all denied
        </RequireAny>
    </Location>

    <Location "/api">
        Require all granted
    </Location>

</VirtualHost>
