# Apache Rate Limiting Configuration for SellZaki
# For Apache 2.4+ with mod_ratelimit and mod_evasive

# ============================================================================
# OPTION 1: Using mod_evasive (Recommended for DDoS protection)
# ============================================================================
# Install: sudo apt-get install libapache2-mod-evasive
# Enable: sudo a2enmod evasive

<IfModule mod_evasive20.c>
    # Maximum requests per page per second per IP
    DOSPageCount 10
    
    # Maximum requests per site per second per IP
    DOSSiteCount 50
    
    # Interval for page count threshold (in seconds)
    DOSPageInterval 1
    
    # Interval for site count threshold (in seconds)
    DOSSiteInterval 1
    
    # Blocking period (in seconds)
    DOSBlockingPeriod 60
    
    # Email to notify (optional)
    # DOSEmailNotify admin@sellzaki.com
    
    # Log directory
    DOSLogDir "/var/log/apache2/mod_evasive"
    
    # Whitelist trusted IPs (your office, monitoring services, etc.)
    # DOSWhitelist 127.0.0.1
    # DOSWhitelist 192.168.1.*
</IfModule>

# ============================================================================
# OPTION 2: Using mod_qos (Quality of Service)
# ============================================================================
# Install: sudo apt-get install libapache2-mod-qos
# Enable: sudo a2enmod qos

<IfModule mod_qos.c>
    # Maximum connections per IP
    QS_SrvMaxConnPerIP 10
    
    # Request rate per second per IP
    QS_SrvRequestRate 50
    
    # Minimum request rate (to detect slow attacks)
    QS_SrvMinDataRate 150 1200
    
    # Maximum connections to server
    QS_SrvMaxConnClose 180
    
    # Log only (don't block) - remove when ready to enforce
    # QS_LogOnly on
</IfModule>

# ============================================================================
# OPTION 3: Using mod_security (Web Application Firewall)
# ============================================================================
# Install: sudo apt-get install libapache2-mod-security2
# Enable: sudo a2enmod security2

<IfModule security2_module>
    # Enable ModSecurity
    SecRuleEngine On
    
    # Rate limiting rules
    SecAction "id:900001,phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR}"
    
    # Block if more than 10 requests in 60 seconds
    SecRule IP:REQUEST_COUNT "@gt 10" \
        "id:900002,phase:1,deny,status:429,\
        msg:'Rate limit exceeded',\
        setvar:ip.request_count=+1"
    
    # Reset counter after 60 seconds
    SecRule IP:REQUEST_COUNT "@gt 0" \
        "id:900003,phase:5,pass,nolog,\
        expirevar:ip.request_count=60"
</IfModule>

# ============================================================================
# OPTION 4: Using .htaccess rules (Basic protection)
# ============================================================================
# This goes in your .htaccess file or VirtualHost configuration

# Block specific IP (the attacker)
<RequireAll>
    Require all granted
    Require not ip 41.44.117.225
</RequireAll>

# Limit request body size (prevent large POST attacks)
LimitRequestBody 10485760

# Timeout settings
Timeout 60
KeepAliveTimeout 5

# ============================================================================
# VirtualHost Configuration Example
# ============================================================================
# Add to your /etc/apache2/sites-available/sellzaki.conf
#
# NOTE: mod_evasive does NOT support per-Location/LocationMatch overrides.
# Per-endpoint rate limiting (search, login, etc.) is handled by Laravel's
# AggressiveRateLimiter middleware (routes/api.php).

<VirtualHost *:80>
    ServerName tyson.sellzaki.com
    DocumentRoot /var/www/html/sellzaki.com/production/public
    
    # Block specific IPs
    <RequireAll>
        Require all granted
        Require not ip 41.44.117.225
    </RequireAll>
    
    # mod_evasive: global limits for this vhost
    <IfModule mod_evasive20.c>
        DOSPageCount 5
        DOSSiteCount 50
        DOSBlockingPeriod 60
    </IfModule>
    
    # PHP-FPM or mod_php configuration
    <FilesMatch \.php$>
        SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost"
    </FilesMatch>
    
    # Logging
    ErrorLog ${APACHE_LOG_DIR}/sellzaki-error.log
    CustomLog ${APACHE_LOG_DIR}/sellzaki-access.log combined
    
    # Additional security headers
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
</VirtualHost>

# ============================================================================
# Create blocked IPs file
# ============================================================================
# Create: /etc/apache2/conf-available/blocked-ips.conf

<RequireAll>
    Require all granted
    Require not ip 41.44.117.225
    # Add more IPs as needed
    # Require not ip 192.168.1.100
</RequireAll>

# Then enable it:
# sudo a2enconf blocked-ips
# sudo systemctl reload apache2