<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName waylow.world
    ServerAdmin webmaster@waylow.world

    # WebSocket upgrade
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/ws$ ws://localhost:3008/ws [P,L]

    # Backend endpoints
    ProxyPass /api/ http://localhost:3008/api/
    ProxyPassReverse /api/ http://localhost:3008/api/
    ProxyPass /health http://localhost:3008/health
    ProxyPass /metrics http://localhost:3008/metrics

    # Frontend (Next.js)
    ProxyPass / http://localhost:3009/
    ProxyPassReverse / http://localhost:3009/

    ProxyPreserveHost On
    ProxyTimeout 120

    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/waylow.world/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/waylow.world/privkey.pem
</VirtualHost>
</IfModule>