<VirtualHost *:80>
    ServerName web.DOMAIN

    ProxyRequests Off
    ProxyPreserveHost On
    ProxyVia Full

    <Proxy *>
        Require all granted
    </Proxy>

    ProxyPass "/bridge-minimal.html" !

    # Routing WebSockets (Next.js)
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule ^/(.*)           ws://127.0.0.1:3000/$1 [P,L]

    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/

    RequestHeader set X-Forwarded-Proto "http"
    RequestHeader set X-Forwarded-Port "80"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"

    Alias "/bridge-minimal.html" "/home/aurion/aurionmail/bridges/webmail_bridge.html"

    <Location "/bridge-minimal.html">
        Header always set Content-Security-Policy "frame-ancestors https://sso.DOMAIN"
        Require all granted
    </Location>

    ErrorLog ${APACHE_LOG_DIR}/bulwark-webmail-error.log
    CustomLog ${APACHE_LOG_DIR}/bulwark-webmail-access.log combined
</VirtualHost>