<VirtualHost *:80>
    ServerName kenken.brchad.com

    RewriteEngine on
    RewriteCond %{SERVER_NAME} =kenken.brchad.com
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>
    ServerName kenken.brchad.com

    # SSL (preenchido pelo certbot)
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/kenken.brchad.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/kenken.brchad.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf

    # Proxy para o Node.js na porta 3001
    ProxyPreserveHost On
    ProxyPass        / http://localhost:3001/
    ProxyPassReverse / http://localhost:3001/
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Real-IP %{REMOTE_ADDR}s

    # Segurança de iframe
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Content-Security-Policy "frame-ancestors 'self'"

    # Domínios autorizados a embedar o player
    <LocationMatch "^/embed\.html$">
        Header always unset X-Frame-Options
        Header always set Content-Security-Policy "frame-ancestors 'self' https://caiomga.com https://www.caiomga.com https://*.brchad.com https://brchad.com https://cruzadinha.com.br https://www.cruzadinha.com.br"
    </LocationMatch>

    ErrorLog  ${APACHE_LOG_DIR}/kenken.brchad_error.log
    CustomLog ${APACHE_LOG_DIR}/kenken.brchad_access.log combined
</VirtualHost>
