
Listen 82
# May needed on old distributions or after an update from them.
#Listen 443

# Passenger defaults
PassengerSpawnMethod "smart"
PassengerMaxPoolSize 20
#RailsEnv "development"

# allow long request urls and being part of headers
LimitRequestLine 20000
LimitRequestFieldsize 20000
# unlimited request body (default would be 1GB)
LimitRequestBody 0

# Just the overview page
<VirtualHost *:80>
        # just give an overview about this OBS instance via static web page
        DocumentRoot  "@@OBS_DOCUMENT_ROOT@@/overview"

        <Directory @@OBS_DOCUMENT_ROOT@@/overview>
           Options Indexes
           Require all granted
        </Directory>
</VirtualHost>


# Build Results
<VirtualHost *:82>
        # The resulting repositories
        DocumentRoot  "@@OBS_BACKEND_DATA_DIR@@/repos"

        <Directory @@OBS_BACKEND_DATA_DIR@@/repos>
           Options Indexes FollowSymLinks
           Require all granted
        </Directory>
</VirtualHost>


# OBS WEBUI & API
<VirtualHost *:443>
        ServerName api

	#  General setup for the virtual host
	DocumentRoot  "@@OBS_API_PREFIX@@/public"
	ErrorLog @@OBS_API_PREFIX@@/log/apache_error.log
	TransferLog @@OBS_API_PREFIX@@/log/apache_access.log

        # Enable maintenance mode. All requests will be redirected
        # to the maintenance page and return 503 as http status.
        # Start your apache with -D MAINTENANCE to enable this.
        # On (open)SUSE you can do this by setting
        # APACHE_SERVER_FLAGS="MAINTENANCE" in /etc/sysconfig/apache
        <IfDefine MAINTENANCE>
          ErrorDocument 503 /503.html
          RewriteEngine on
          RewriteCond %{REQUEST_URI} !=/503.html
          RewriteCond %{REQUEST_URI} !=/obs-down.png
          RewriteRule ^ - [R=503,L]
        </IfDefine>

        PassengerMinInstances 2
        PassengerPreStart https://api

	SSLEngine on

	#  SSL protocols
	#  Supporting TLS only is adequate nowadays
	SSLProtocol all -SSLv2 -SSLv3

	#   SSL Cipher Suite:
	#   List the ciphers that the client is permitted to negotiate.
	#   We disable weak ciphers by default.
	#   See the mod_ssl documentation or "openssl ciphers -v" for a
	#   complete list.
	SSLCipherSuite ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!MD5:@STRENGTH

	SSLCertificateFile    @@OBS_BACKEND_DATA_DIR@@/certs/server.crt
	SSLCertificateKeyFile @@OBS_BACKEND_DATA_DIR@@/certs/server.key

        <Directory @@OBS_API_PREFIX@@/public>
           AllowOverride all
           Options -MultiViews

           # This requires mod_xforward loaded in apache 
           # Enable the usage via options.yml
           # This will decrease the load due to long running requests a lot (unloading from rails stack)
           XForward on

           Require all granted
        </Directory>

	SetEnvIf User-Agent ".*MSIE [1-5].*" \
		 nokeepalive ssl-unclean-shutdown \
		 downgrade-1.0 force-response-1.0

	CustomLog @@APACHE_LOGDIR@@/ssl_request_log   ssl_combined

	# Make sure the browser supports gzip encoding before we send it
	RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
	RewriteCond "%{DOCUMENT_ROOT}%{REQUEST_FILENAME}\.gz" -s
	RewriteRule "^(.*)\.(css|eot|ico|js|svg|ttf)"         "$1\.$2\.gz" [QSA]

	# Serve correct content types, and prevent mod_deflate double gzip.
	RewriteRule "\.css\.gz$"  "-" [T=text/css,E=no-gzip:1]
	RewriteRule "\.eot\.gz$"  "-" [T=application/vnd.ms-fontobject,E=no-gzip:1]
	RewriteRule "\.ico\.gz$"  "-" [T=image/x-icon,E=no-gzip:1]
	RewriteRule "\.js\.gz$"   "-" [T=text/javascript,E=no-gzip:1]
	RewriteRule "\.svg\.gz$"  "-" [T=image/svg+xml,E=no-gzip:1]
	RewriteRule "\.ttf\.gz$"  "-" [T=application/x-font-ttf,E=no-gzip:1]

	<FilesMatch "\.(css|eot|ico|js|svg|ttf)\.gz$">
	  # Serve correct encoding type.
	  Header append Content-Encoding gzip

	  # Force proxies to cache gzipped &
	  # non-gzipped css/js files separately.
	  Header append Vary Accept-Encoding
	</FilesMatch>

        # from http://guides.rubyonrails.org/asset_pipeline.html
        <LocationMatch "^/assets/.*$">
          Header unset ETag
          FileETag None
          # RFC says only cache for 1 year
          ExpiresActive On
          ExpiresDefault "access plus 1 year"
       </LocationMatch>

	SetEnvIf User-Agent ".*MSIE [1-5].*" \
		 nokeepalive ssl-unclean-shutdown \
		 downgrade-1.0 force-response-1.0

        ## Older firefox versions needs this, otherwise it wont cache anything over SSL.
        Header append Cache-Control "public"

        ProxyPass /v2 http://localhost:5352/registry
        ProxyPassReverse /v2 http://localhost:5352/registry
        ProxyPass /sigstore http://localhost:5352/sigstore
        ProxyPassReverse /sigstore http://localhost:5352/sigstore
        ProxyPass /extensions/v2 http://localhost:5352/registry
        ProxyPassReverse /extensions/v2 http://localhost:5352/registry

        # gitea
        ProxyPass /gitea http://localhost:3000
        ProxyPassReverse /gitea http://localhost:3000
</VirtualHost>
