# WebSocket proxy: /chat -> chat-server:8081
# Requires: proxy, proxy_http, proxy_wstunnel, rewrite
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so

ProxyRequests Off
ProxyPreserveHost On

# Deny direct access to sensitive files (e.g. banned.json) if present in docroot
<Directory /var/www/html>
  <Files "banned.json">
    Require all denied
  </Files>
</Directory>

# Single mechanism: ProxyPass for WebSocket upgrade and initial request
RewriteEngine On
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule ^/chat$ ws://chat-server:8081/ [P,L]
RewriteRule ^/chat ws://chat-server:8081/ [P,L]
ProxyPass /chat ws://chat-server:8081/
ProxyPassReverse /chat ws://chat-server:8081/