# api.codex.philiprehberger.com — Laravel API + Filament admin host.
#
# DocumentRoot points at the atomic-release `current` symlink. mod_php
# served (NOT PHP-FPM) because the EC2 box co-tenants WordPress demos
# that depend on Apache mpm_prefork + mod_php. The plan documents this
# in docs/architecture.md as a co-tenancy choice, with the "would do
# FPM greenfield" caveat so the buyer narrative addresses the choice
# rather than letting them infer ignorance.
#
# Loopback http carve-out: the Next.js dashboard SSR fetches via
# http://127.0.0.1 + an injected Host: api.codex.philiprehberger.com
# header. Without the carve-out, certbot's auto-redirect rule sends
# loopback traffic into TLS and SSR silently 301s. Phase 8 DoD curl
# proves the carve-out.

<VirtualHost *:80>
    ServerName api.codex.philiprehberger.com
    DocumentRoot /var/www/codex/current/public

    <Directory /var/www/codex/current/public>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # 1MB body cap at the Apache layer — the only POSTs the API receives
    # are revalidate calls (capped at 1KB on Next.js too) and Filament
    # form posts. Larger uploads go via the signed-URL asset route
    # which streams to disk.
    LimitRequestBody 1048576

    # Suppress access-log noise for the BetterStack ping endpoints.
    SetEnvIf Request_URI "^/(up|up/diagnostics|up/queue)$" dontlog

    Include /var/www/codex/infra/apache/security-headers-common.conf
    Include /var/www/codex/infra/apache/csp-api.conf

    ErrorLog ${APACHE_LOG_DIR}/codex-api-error.log
    CustomLog ${APACHE_LOG_DIR}/codex-api-access.log combined env=!dontlog
</VirtualHost>