# Change this to the path to your Kresus installation. This is facultative and
# will just avoid the proxying of static assets requests through the NodeJS
# application.
Define KRESUS_ROOT /home/kresus/kresus/build/client
# Change this to your kresus server name.
Define KRESUS_SERVER_NAME your.domain.tld
# Change if your Kresus local instance runs on another port.
Define KRESUS_LOCAL_PORT 9876
# Change this if your Kresus instance is exposed under a subpath, for instance
# /kresus.
Define KRESUS_EXPOSED_PATH ""
# Change this to the path where the logs should be recorded, if needed.
Define KRESUS_LOG_ROOT /var/log/kresus
# Change this to the path to your certificates directory.
Define CERTS_ROOT /etc/letsencrypt/live/${KRESUS_SERVER_NAME}

<VirtualHost *:80>
    ServerName ${KRESUS_SERVER_NAME}
    # If you are using Docker, it's better to drop this line altogether.
    DocumentRoot ${KRESUS_ROOT}/

    Header set Strict-Transport-Security max-age=15768000

    ErrorLog ${KRESUS_LOG_ROOT}/kresus_error.log
    CustomLog ${KRESUS_LOG_ROOT}/kresus_access.log combined

    # If your setup uses SSL, you only need this line:
    <Location ${KRESUS_EXPOSED_PATH}/ >
        Redirect / https://${KRESUS_SERVER_NAME}/
    </Location>

    # Otherwise, this is the correct setup to proxy external traffic to your
    # Kresus installation.
    <IfModule mod_http2.c>
        Protocols h2 http/1.1
    </IfModule>

    <Location ${KRESUS_EXPOSED_PATH}/ >
        ProxyPass http://127.0.0.1:${KRESUS_LOCAL_PORT}/ redirect="" timeout=600
        ProxyPreserveHost On
        LimitRequestBody 8192
    </Location>

    <Location ~ ${KRESUS_EXPOSED_PATH}/.*\.(css|js|png|jpe?g|svg|eot|woff2?)$ >
        ProxyPass http://127.0.0.1:${KRESUS_LOCAL_PORT} redirect="" timeout=600
        ProxyPreserveHost On
        LimitRequestBody 8192
        Header set Cache-Control 'max-age=2592000, must-revalidate, public'
        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
    </Location>

    AllowEncodedSlashes On
</VirtualHost>

# If you don't plan to support HTTPS, you can skip this part.
# Otherwise, CERTS_ROOT variable need to point to your certs directory.
<VirtualHost *:443>
    ServerName ${KRESUS_SERVER_NAME}
    # If you are using Docker, it's better to drop this line altogether.
    DocumentRoot ${KRESUS_ROOT}/

    SSLEngine on
    SSLCompression off
    SSLSessionCacheTimeout 300
    SSLCipherSuite EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!CAMELLIA256-SHA:!AES256-SHA:!CAMELLIA128-SHA:!AES128-SHA
    SSLCertificateFile ${CERTS_ROOT}/fullchain.pem
    SSLCertificateKeyFile ${CERTS_ROOT}/privkey.pem

    ErrorLog ${KRESUS_LOG_ROOT}/kresus_error.log
    CustomLog ${KRESUS_LOG_ROOT}/kresus_access.log combined

    Header set Strict-Transport-Security max-age=15768000

    <IfModule mod_http2.c>
        Protocols h2 http/1.1
    </IfModule>

    <Location ${KRESUS_EXPOSED_PATH}/ >
        # Create /home/kresus/.htpasswd file with `htpasswd -c /home/kresus/.htpasswd`.
        # In Debian, `htpasswd` is provided by the package `apache2-utils`.
        AuthType basic
        AuthUserFile /home/kresus/.htpasswd
        Require valid-user

        ProxyPass http://127.0.0.1:${KRESUS_LOCAL_PORT} redirect="" timeout=600
        ProxyPreserveHost On
        LimitRequestBody 8192
    </Location>

    <Location ~ ${KRESUS_EXPOSED_PATH}/.*\.(css|js|png|jpe?g|svg|eot|woff2?)$ >
        ProxyPass http://127.0.0.1:${KRESUS_LOCAL_PORT} redirect="" timeout=600
        ProxyPreserveHost On
        LimitRequestBody 8192
        Header set Cache-Control 'max-age=2592000, must-revalidate, public'
        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
    </Location>

    AllowEncodedSlashes On
</VirtualHost>
