<VirtualHost *:80>
    ServerName vpn.lambicall.com
    DocumentRoot /var/www/html/openvpn/web/public

    # Redirect all HTTP to HTTPS
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName vpn.lambicall.com
    DocumentRoot /var/www/html/openvpn/web/public

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/vpn.lambicall.com.crt
    SSLCertificateKeyFile /etc/ssl/private/vpn.lambicall.com.key
    SSLCertificateChainFile /etc/ssl/certs/vpn.lambicall.com.chain.crt

    <Directory /var/www/html/openvpn/web/public>
        AllowOverride All
        Require all granted
        
        Options Indexes FollowSymLinks
        
        # Laravel rewrite rules
        <IfModule mod_rewrite.c>
            RewriteEngine On
            RewriteCond %{REQUEST_FILENAME} !-d
            RewriteCond %{REQUEST_FILENAME} !-f
            RewriteRule ^ index.php [L]
        </IfModule>
    </Directory>

    # PHP-FPM configuration for PHP 8.3
    <FilesMatch \.php$>
        SetHandler "proxy:unix:/var/run/php/php8.3-fpm.sock|fcgi://localhost"
    </FilesMatch>

    # Security Headers
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.tailwindcss.com; style-src 'self' 'unsafe-inline';"

    # Logs
    ErrorLog ${APACHE_LOG_DIR}/vpn.lambicall.com-error.log
    CustomLog ${APACHE_LOG_DIR}/vpn.lambicall.com-access.log combined

    # Compression
    <IfModule mod_deflate.c>
        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json
    </IfModule>

    # Cache static assets
    <FilesMatch "\.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|svg|eot)$">
        Header set Cache-Control "max-age=604800, public"
    </FilesMatch>
</VirtualHost>