# ---
# Titre : Template virtualhost apache2
# Auteur : Louis MEDO
# Date de modification : 26/03/2026
# ----

<VirtualHost *:80>
    ServerName <nom-prenom>.bts-sio.eu

    # Redirection permanente de tout le trafic HTTP vers HTTPS
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Logs
    ErrorLog ${APACHE_LOG_DIR}/<nom-prenom>-error.log
    CustomLog ${APACHE_LOG_DIR}/<nom-prenom>-access.log combined
</VirtualHost>

<VirtualHost *:443>
    ServerName <nom-prenom>.bts-sio.eu
    DocumentRoot /var/www/portfolio/portfolio-<nom-prenom>

    # --- Activation du SSL et certificats ---
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/bts-sio.eu/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/bts-sio.eu/privkey.pem

    Protocols h2 http/1.1
    
    # Optimisation H2
    H2Direct on
    H2Push on
    H2SerializeHeaders on

    # Désactivation des vieux protocoles
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    
    # Obligation d'utiliser des algorithmes forts
    SSLCipherSuite TLSv1.3:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
    SSLCipherSuite TLSv1.2:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
    SSLHonorCipherOrder off

    # --- En-têtes de sécurité ---
    <IfModule mod_headers.c>
        # HSTS : Force le navigateur à utiliser HTTPS
        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        # Protection contre le clic-jacking
        Header always set X-Frame-Options "SAMEORIGIN"
        # Protection XSS
        Header always set X-Content-Type-Options "nosniff"
    </IfModule>

    # --- Configuration du répertoire et PHP ---
    <Directory /var/www/portfolio/portfolio-<nom-prenom>>
        Options -Indexes +FollowSymLinks

        # Interdit l'utilisation du .htaccess
        AllowOverride None

        Require all granted
        
        # Priorité aux fichiers PHP
        DirectoryIndex index.php index.html
    </Directory>

    # --- Gestion explicite des fichiers PHP (Si .htaccess est désactivé) ---
    <FilesMatch \.php$>
        SetHandler "proxy:unix:/run/php/php8.4-fpm-portfolio-<nom-prenom>.sock|fcgi://localhost"
    </FilesMatch>

    # --- Logs ---
    ErrorLog ${APACHE_LOG_DIR}/<nom-prenom>-error.log
    CustomLog ${APACHE_LOG_DIR}/<nom-prenom>-access.log combined
</VirtualHost>