# DO NOT REMOVE. CLOUDLINUX PASSENGER CONFIGURATION BEGIN
PassengerAppRoot "/home/mljneti1/public_html/waba.mljnet.id"
PassengerBaseURI "/"
PassengerNodejs "/home/mljneti1/nodevenv/public_html/waba.mljnet.id/20/bin/node"
PassengerAppType node
PassengerStartupFile server.js
# DO NOT REMOVE. CLOUDLINUX PASSENGER CONFIGURATION END
# MPWA v15.1.1 — cPanel Hosting Configuration
# ================================================
# This .htaccess supports BOTH Apache + CloudLinux Passenger
# and standalone Node.js via proxy.

# ── CloudLinux Passenger (Node.js app server on cPanel) ──────────────────
# Uncomment the block below ONLY if using CloudLinux Passenger.
# Replace paths/versions with your actual cPanel Node.js setup.
#
# <IfModule mod_passenger.c>
#   PassengerAppRoot "/home/YOUR_USER/public_html/wa.yourdomain.com"
#   PassengerBaseURI "/"
#   PassengerNodejs "/home/YOUR_USER/nodevenv/public_html/wa.yourdomain.com/20/bin/node"
#   PassengerAppType node
#   PassengerStartupFile server.js
# </IfModule>

# ── Fallback: Apache serves Laravel (PHP) ────────────────────────────────
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Proxy Socket.IO requests to Node.js server (both HTTP polling + WebSocket upgrade)
    RewriteCond %{REQUEST_URI} ^/socket\.io/ [NC]
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^socket\.io/(.*) ws://127.0.0.1:3100/socket.io/$1 [P,L]

    RewriteCond %{REQUEST_URI} ^/socket\.io/ [NC]
    RewriteRule ^socket\.io/(.*) http://127.0.0.1:3100/socket.io/$1 [P,L]

    # Proxy Node.js backend API endpoints
    RewriteCond %{REQUEST_URI} ^/backend- [NC]
    RewriteRule ^(.*)$ http://127.0.0.1:3100$1 [P,L]

    # Serve static assets directly (bypass PHP for performance)
    RewriteCond %{REQUEST_URI} ^/public/ [NC]
    RewriteRule ^(.*)$ - [L,QSA]

    # Route all other requests to Laravel's public/index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ /public/index.php [L,QSA]
</IfModule>

# ── Security Headers ─────────────────────────────────────────────────────
<IfModule mod_headers.c>
    # Prevent MIME-type sniffing
    Header set X-Content-Type-Options "nosniff"

    # XSS Protection (legacy browsers)
    Header set X-XSS-Protection "1; mode=block"

    # Prevent clickjacking
    Header set X-Frame-Options "SAMEORIGIN"

    # Referrer Policy
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ── Disable ModSecurity for API endpoints (prevents false positives) ─────
<IfModule mod_security2.c>
    <LocationMatch "^/backend-">
        SecFilterEngine Off
        SecFilterScanPOST Off
    </LocationMatch>
    <LocationMatch "^/socket\.io/">
        SecFilterEngine Off
        SecFilterScanPOST Off
    </LocationMatch>
    <LocationMatch "^/api/">
        SecFilterEngine Off
        SecFilterScanPOST Off
    </LocationMatch>
</IfModule>

# ── CORS preflight support for API ────────────────────────────────────────
<IfModule mod_headers.c>
    <LocationMatch "^/api/">
        Header always set Access-Control-Allow-Origin "*"
        Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
        Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-API-Key"
        Header always set Access-Control-Max-Age 3600
    </LocationMatch>
</IfModule>

# ── Proxy rules active via RewriteRule above ───────────────────────────
# Note: ProxyPass directives are not used here because some cPanel configs
# restrict them to server/vhost context only. The RewriteRule [P] approach
# above is more universally compatible with .htaccess.

# ── Increase upload limits for media messages ──────────────────────────────
<IfModule mod_php.c>
    php_value upload_max_filesize 64M
    php_value post_max_size 64M
    php_value max_execution_time 300
    php_value memory_limit 512M
</IfModule>

# ── Protect sensitive files ───────────────────────────────────────────────
<FilesMatch "^(\.env|composer\.json|composer\.lock|package\.json|server\.js)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# ── Protect credentials directory ─────────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteRule ^credentials/ - [F,L]
    RewriteRule ^node_modules/ - [F,L]
</IfModule>

AddHandler mod-proxy2 mod_proxy_wstunnel
AddHandler mod-proxy mod_proxy
