# Apache bleibt öffentlich auf Port 8080.
# Node/Rakku läuft intern auf 127.0.0.1:3008.
# Aktivieren:
# sudo a2enmod proxy proxy_http headers
# sudo cp deploy/apache-rakku-8080-proxy.conf /etc/apache2/sites-available/rakku-8080.conf
# sudo a2ensite rakku-8080.conf
# sudo apache2ctl configtest
# sudo systemctl reload apache2

<VirtualHost *:8080>
    ServerAdmin webmaster@localhost
    ServerName _default_

    ProxyPreserveHost On
    ProxyRequests Off
    RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}

    ProxyPass / http://127.0.0.1:3008/
    ProxyPassReverse / http://127.0.0.1:3008/

    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    Header always set X-Frame-Options "SAMEORIGIN"

    ErrorLog ${APACHE_LOG_DIR}/rakku-error.log
    CustomLog ${APACHE_LOG_DIR}/rakku-access.log combined
</VirtualHost>