# Apache Reverse Proxy Configuration for LWFS Meeting Platform
# Domain: meet.lwfoundationschool.org
# Server IP: 172.241.251.140
# 
# This file should be placed in /etc/apache2/sites-available/ or included in your virtual host config
# Ensure mod_proxy, mod_proxy_http, mod_proxy_wstunnel, and mod_ssl are enabled:
#   sudo a2enmod proxy proxy_http proxy_wstunnel ssl
#   sudo systemctl restart apache2

<VirtualHost *:443>
    ServerName meet.lwfoundationschool.org
    ServerAdmin webmaster@lwfoundationschool.org
    
    # SSL Configuration (update paths to your actual certificates)
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/meet.lwfoundationschool.org.crt
    SSLCertificateKeyFile /etc/ssl/private/meet.lwfoundationschool.org.key
    SSLCertificateChainFile /etc/ssl/certs/meet.lwfoundationschool.org.chain.crt
    
    # SSL Settings
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
    SSLHonorCipherOrder on
    SSLCompression off
    
    # Enable Proxy SSL for backend connections to Jitsi Docker
    SSLProxyEngine On
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    
    # Document root for PHP application
    DocumentRoot /var/www/html/meet
    
    # Directory settings for PHP application
    <Directory /var/www/html/meet>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
        
        # PHP-FPM or mod_php configuration
        <FilesMatch \.php$>
            SetHandler "proxy:unix:/run/php/php8.1-fpm.sock|fcgi://localhost"
        </FilesMatch>
    </Directory>
    
    # ============================================
    # PHP FILES - Exclude from Proxy (Serve Locally)
    # ============================================
    
    # Keycloak Integration
    ProxyPass /kc_login.php !
    ProxyPass /kc_callback.php !
    
    # Installation Scripts
    ProxyPass /install_saas.php !
    ProxyPass /install_phase2.php !
    ProxyPass /install_enterprise.php !
    ProxyPass /install_pro.php !
    ProxyPass /patch_database.php !
    
    # Main Application Files
    ProxyPass /index.php !
    ProxyPass /login.php !
    ProxyPass /checkout.php !
    ProxyPass /verify.php !
    ProxyPass /register.php !
    ProxyPass /upgrade.php !
    ProxyPass /report.php !
    ProxyPass /attendance.php !
    ProxyPass /leave.php !
    ProxyPass /dashboard.php !
    ProxyPass /join.php !
    ProxyPass /logout.php !
    ProxyPass /admin.php !
    ProxyPass /log_event.php !
    ProxyPass /config.php !
    
    # Static Assets - Serve Locally
    ProxyPass /assets !
    ProxyPass /css !
    ProxyPass /js !
    ProxyPass /images !
    ProxyPass /pages !
    ProxyPass /api !
    
    # ============================================
    # JITSI DOCKER PROXY CONFIGURATION
    # ============================================
    
    # WebSocket for Jitsi (XMPP/WebSocket)
    ProxyPass /xmpp-websocket ws://127.0.0.1:5280/xmpp-websocket
    ProxyPassReverse /xmpp-websocket ws://127.0.0.1:5280/xmpp-websocket
    
    # Colibri WebSocket for JVB
    ProxyPass /colibri-ws/default ws://127.0.0.1:9090/colibri-ws/default
    ProxyPassReverse /colibri-ws/default ws://127.0.0.1:9090/colibri-ws/default
    
    # BOSH endpoint (HTTP binding for XMPP)
    ProxyPass /http-bind http://127.0.0.1:5280/http-bind
    ProxyPassReverse /http-bind http://127.0.0.1:5280/http-bind
    
    # Jitsi Meet External API (loaded by join.php)
    # Serve the external_api.js from Jitsi Docker container
    ProxyPass /external_api.js http://127.0.0.1:8000/external_api.js
    ProxyPassReverse /external_api.js http://127.0.0.1:8000/external_api.js
    
    # Room API endpoints
    ProxyPass /conference-mapper http://127.0.0.1:8000/conference-mapper
    ProxyPassReverse /conference-mapper http://127.0.0.1:8000/conference-mapper
    
    # Jibri recording callback
    ProxyPass /jibri http://127.0.0.1:8000/jibri
    ProxyPassReverse /jibri http://127.0.0.1:8000/jibri
    
    # ============================================
    # FALLTHROUGH - Proxy Everything Else to Jitsi Docker
    # ============================================
    
    # Main Jitsi Meet Application (Docker web container)
    ProxyPass / http://127.0.0.1:8000/
    ProxyPassReverse / http://127.0.0.1:8000/
    
    # Proxy timeouts for WebSocket connections
    ProxyTimeout 900
    ProxyBadHeader Ignore
    
    # Disable forward proxy
    ProxyRequests Off
    
    # Logging
    ErrorLog ${APACHE_LOG_DIR}/meet_error.log
    CustomLog ${APACHE_LOG_DIR}/meet_access.log combined
    
    # Security headers
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    
    # HSTS (optional but recommended)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    
</VirtualHost>

# HTTP Redirect to HTTPS
<VirtualHost *:80>
    ServerName meet.lwfoundationschool.org
    
    # Redirect all HTTP traffic to HTTPS
    Redirect permanent / https://meet.lwfoundationschool.org/
    
    # ACME challenge for Let's Encrypt (if using)
    # Alias /.well-known/acme-challenge/ /var/www/html/.well-known/acme-challenge/
    
    ErrorLog ${APACHE_LOG_DIR}/meet_http_error.log
    CustomLog ${APACHE_LOG_DIR}/meet_http_access.log combined
</VirtualHost>

# ============================================
# ADDITIONAL CONFIGURATION NOTES
# ============================================
#
# 1. Docker Jitsi Ports (exposed on localhost):
#    - 8000: Web interface (Jitsi Meet)
#    - 5280: BOSH/WebSocket (Prosody)
#    - 9090: Colibri WebSocket (JVB)
#    - 5222: XMPP client connections
#    - 5269: XMPP server federation
#
# 2. Docker Compose Configuration:
#    Ensure your docker-compose.yml has these port mappings:
#    
#    services:
#      web:
#        ports:
#          - "127.0.0.1:8000:80"
#      prosody:
#        ports:
#          - "127.0.0.1:5222:5222"
#          - "127.0.0.1:5269:5269"
#          - "127.0.0.1:5280:5280"
#      jvb:
#        ports:
#          - "127.0.0.1:9090:9090"
#
# 3. Coturn TURN Server:
#    The Coturn server handles NAT traversal for media.
#    Ensure it's configured to listen on:
#    - UDP 3478 (STUN)
#    - TCP 3478 (TURN)
#    - UDP 5349 (TLS)
#    - TCP 5349 (TLS)
#    - UDP 49152-65535 (relay ports)
#
# 4. PHP Application Structure:
#    /var/www/html/meet/
#    ├── index.php
#    ├── login.php
#    ├── register.php
#    ├── logout.php
#    ├── dashboard.php
#    ├── join.php
#    ├── leave.php
#    ├── admin.php
#    ├── attendance.php
#    ├── report.php
#    ├── upgrade.php
#    ├── log_event.php
#    ├── config.php
#    ├── install_enterprise.php
#    ├── assets/
#    ├── css/
#    ├── js/
#    └── config/
#        ├── config.php
#        └── database.php
#
# 5. File Permissions:
#    chown -R www-data:www-data /var/www/html/meet
#    chmod -R 755 /var/www/html/meet
#    chmod 640 /var/www/html/meet/config/config.php
#    chmod 640 /var/www/html/meet/config/database.php
#
# 6. Database Configuration:
#    Database: lwfoundationscho_meet
#    User: (configured in config/database.php)
#    Host: localhost (or remote MySQL server)
#
# 7. Firewall Rules (ufw example):
#    sudo ufw allow 80/tcp
#    sudo ufw allow 443/tcp
#    sudo ufw allow 3478/tcp
#    sudo ufw allow 3478/udp
#    sudo ufw allow 5349/tcp
#    sudo ufw allow 5349/udp
#    sudo ufw allow 10000/udp  # Jitsi media
#    sudo ufw allow 49152:65535/udp  # Coturn relay ports
#