# mBlog — Apache virtual host (example, Fedora/RHEL paths).
# DocumentRoot is the web/ folder; the app/ layer lives ABOVE it and is not
# web-accessible. Adjust paths, TLS, and the PHP handler to your server.

<VirtualHost *:443>
    ServerName mblog.in
    DocumentRoot /var/www/mblog/web

    # --- Application environment -------------------------------------------
    # Works for mod_php (getenv() sees SetEnv). For php-fpm, prefer setting
    # these in the FPM pool as  env[MBLOG_DB_HOST] = 127.0.0.1  (see DEPLOYMENT.md).
    SetEnv MBLOG_DB_HOST 127.0.0.1
    SetEnv MBLOG_DB_PORT 5432
    SetEnv MBLOG_DB_NAME mblog
    SetEnv MBLOG_DB_USER mblog_app
    SetEnv MBLOG_DB_PASS "CHANGE_ME"
    SetEnv ADMIN_PASSWORD_HASH "CHANGE_ME"

    <Directory /var/www/mblog/web>
        AllowOverride All          # required so .htaccess routing works
        Require all granted
        Options -Indexes
    </Directory>

    # Belt-and-suspenders: even though these sit above DocumentRoot, deny web
    # access outright in case DocumentRoot is ever misconfigured.
    <Directory /var/www/mblog/app>     Require all denied </Directory>
    <Directory /var/www/mblog/config>  Require all denied </Directory>
    <Directory /var/www/mblog/scripts> Require all denied </Directory>

    # Stale-feed fix: never let the PageSpeed module cache API responses.
    <IfModule pagespeed_module>
        ModPagespeedDisallow "*/api/*"
    </IfModule>

    # TLS (certbot-managed) ---------------------------------------------------
    # SSLEngine on
    # SSLCertificateFile      /etc/letsencrypt/live/mblog.in/fullchain.pem
    # SSLCertificateKeyFile   /etc/letsencrypt/live/mblog.in/privkey.pem

    ErrorLog  /var/log/httpd/mblog_error.log
    CustomLog /var/log/httpd/mblog_access.log combined
</VirtualHost>

# Redirect http -> https
<VirtualHost *:80>
    ServerName mblog.in
    Redirect permanent / https://mblog.in/
</VirtualHost>