# Throughline Next.js frontend — Apache vhost
#
# Reverse-proxy to localhost:3009 (PM2-managed Node server.js — Next.js standalone output).
# Mirrors converter.dcsuniverse.com.conf conventions.
#
# DNS for throughline-demo.dcsuniverse.com is deferred to Phase 4 per plan
# (open question 5: index only the scopeforged.com case-study page, keep the
# demo subdomain quiet until the build is polished). Until then this vhost can
# be hit on the EC2 box via `curl -H "Host: throughline-demo.dcsuniverse.com"`.
#
# certbot --apache adds the matching :443 block with the SSL cert paths and
# HTTP→HTTPS redirect once DNS resolves.

<VirtualHost *:80>
    ServerName throughline-demo.dcsuniverse.com
    ServerAdmin admin@dcsuniverse.com

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyPass        / http://localhost:3009/
    ProxyPassReverse / http://localhost:3009/

    # Security headers (most are also set by Next.js next.config.ts; doubled here so
    # they're present even on Node-handled error responses that bypass Next's chain)
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    ErrorLog ${APACHE_LOG_DIR}/throughline-demo-web-error.log
    CustomLog ${APACHE_LOG_DIR}/throughline-demo-web-access.log combined

    # HTTP → HTTPS redirect added by certbot
RewriteEngine on
RewriteCond %{SERVER_NAME} =throughline-demo.dcsuniverse.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>