<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName cms.throughline-demo.dcsuniverse.com
    ServerAdmin admin@dcsuniverse.com
    DocumentRoot /var/www/throughline-headless-wp

    <Directory /var/www/throughline-headless-wp>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # Block public access to wp-config.php, .ht*, and other sensitive files
    <FilesMatch "^(wp-config\.php|\.ht.*|\.user\.ini|readme\.html|license\.txt|wp-content/debug\.log)$">
        Require all denied
    </FilesMatch>

    # xmlrpc.php hard-blocked at the web-server level
    <Files "xmlrpc.php">
        Require all denied
    </Files>

    # User enumeration block: ?author=N → 301 to homepage (which itself redirects to Next.js)
    RewriteEngine On



    RewriteCond %{QUERY_STRING} (^|&)author=\d
    RewriteRule ^ https://throughline-demo.dcsuniverse.com/ [R=301,L]

    # Robots noindex at every response from this host (not just robots.txt)
    Header always set X-Robots-Tag "noindex, nofollow, noarchive"

    # HSTS — basic-auth credentials can't be downgraded to HTTP
    # (only effective on HTTPS responses; certbot block will inherit this Header directive)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Other security headers
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Basic auth on /wp-admin and /wp-login.php (belt-and-suspenders for the demo)
    # Uncomment after the .htpasswd is generated; see infra/apache/README.md.
    <LocationMatch "^/(wp-admin|wp-login\.php)">
        AuthType Basic
        AuthName "Throughline CMS Staff Only"
        AuthUserFile /etc/apache2/htpasswd/throughline-demo
        Require valid-user
    </LocationMatch>

    ErrorLog ${APACHE_LOG_DIR}/throughline-demo-cms-error.log
    CustomLog ${APACHE_LOG_DIR}/throughline-demo-cms-access.log combined

    # HTTP → HTTPS redirect added by certbot

    Protocols h2 http/1.1
SSLCertificateFile /etc/letsencrypt/live/cms.throughline-demo.dcsuniverse.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cms.throughline-demo.dcsuniverse.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>