# Apache vhost for the Conjurer file-share links.
#
# The entrypoint substitutes __SERVER_NAME__ from CONJURER_SHARE_SERVER_NAME and
# writes the result to /etc/apache2/sites-available/000-default.conf (same
# pattern as docker/icecast.xml.tpl).
#
# What this serves: media_search_functions.publish() creates a symlink named
# after a random 32-hex token inside the share dir, pointing at a file in the
# media library. Apache hands that file out at /share/<token>; revoke_shares.py
# later unlinks it. Nothing is ever copied.

<VirtualHost *:80>
    ServerName __SERVER_NAME__
    DocumentRoot /var/www/html

    # The share links ARE symlinks into the media library, so FollowSymLinks is
    # mandatory. SymLinksIfOwnerMatch is deliberately NOT used: the targets are
    # owned by whoever owns the media, not by www-data, so it would break every
    # link. -Indexes is equally mandatory - a directory listing here would hand
    # out every currently live token at once.
    <Directory /var/www/html/share>
        Options +FollowSymLinks -Indexes
        AllowOverride None
        Require all granted

        # revoke_shares.py keeps its state (.downloads.json, .logpos) in this
        # very directory. .downloads.json maps every live token to its download
        # time, so serving it would leak the entire active link set.
        <FilesMatch "^\.">
            Require all denied
        </FilesMatch>
    </Directory>

    # Nothing outside /share is published. The more specific block above wins
    # for the share dir itself.
    <Directory /var/www/html>
        Options -Indexes -FollowSymLinks
        AllowOverride None
        Require all denied
    </Directory>

    # Dedicated access log. revoke_shares.py tails exactly this file and matches
    # the standard "%r" request line against:
    #     "\s*GET\s+/share/([0-9a-f]{32})\s+HTTP/
    # so the format must stay `combined` (or any format containing %r).
    SetEnvIf Request_URI "^/share/" conjurer_share
    CustomLog ${APACHE_LOG_DIR}/share_access.log combined env=conjurer_share
    ErrorLog ${APACHE_LOG_DIR}/share_error.log
</VirtualHost>