<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName webhook-relay.dcsuniverse.com

    # Reverse-proxy to the PM2 Next.js process on port 3005.
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:3005/
    ProxyPassReverse / http://127.0.0.1:3005/

    # Long timeouts for any SSE / streaming endpoints.
    ProxyTimeout 600

    ErrorLog ${APACHE_LOG_DIR}/webhook-relay-web-error.log
    CustomLog ${APACHE_LOG_DIR}/webhook-relay-web-access.log combined

    # LOAD-ORDER REQUIREMENT: this vhost MUST be included before the
    # tenant-sites.conf `*.dcsuniverse.com` catch-all vhost. Apache selects the
    # first-loaded vhost whose name matches the TLS SNI; because
    # webhook-relay.dcsuniverse.com is a single label under dcsuniverse.com it
    # also matches the catch-all's wildcard. If the catch-all loads first it
    # wins the handshake, the request then routes here by Host, and mod_ssl
    # rejects the SNI/Host SSL-config mismatch with 421 Misdirected Request.
    # On the server this is enforced by enabling it as
    # 000-webhook-relay.dcsuniverse.com-le-ssl.conf so it sorts before
    # tenant-sites.conf. Do not re-enable it under the bare filename.
    SSLCertificateFile /etc/letsencrypt/live/webhook-relay.dcsuniverse.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/webhook-relay.dcsuniverse.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>