<Directory "/home/eric/vhost">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.4/mod/core.html#options
    # for more information.
    #
    Options Indexes FollowSymLinks

    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   Options FileInfo AuthConfig Limit
    #
    AllowOverride All

    #
    # Controls who can get stuff from this server.
    #
    Require all granted
</Directory>

<VirtualHost *:80>
    ServerName www.wsten.se
    ServerAlias wsten.se
    ServerAdmin eric@wsten.se
    Redirect / https://www.wsten.se/
</VirtualHost>   

<VirtualHost *:443>
    ServerName www.wsten.se
    ServerAlias wsten.se
    ServerAdmin eric@wsten.se
    DocumentRoot /home/eric/vhost/wsten/
    DirectoryIndex index.php index.htm index.html

    CustomLog /var/log/httpd/wsten-access.log combined
    ErrorLog  /var/log/httpd/wsten.log

    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1
    SSLHonorCipherOrder on
    SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS

    SSLCertificateFile /etc/letsencrypt/live/wsten.se/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/wsten.se/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/wsten.se/fullchain.pem

    Alias /mariadb_man /home/eric/vhost/phpmyadmin

    ProxyPreserveHost On                                     
    ProxyRequests Off                                        

    SSLProxyEngine          On
    # required module
    RewriteEngine           On
    # required module
    ProxyPreserveHost       On
    # required
    ProxyRequests           Off
    # RECOMMENDED, disables forwarding, see https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxyrequests
    ProxyErrorOverride      Off
    # if possible, present cockpit's error pages instead of apache's
    SSLProxyVerify optional_no_ca
    # cockpit has a self-signed cert by default, therefore no CA
    SSLProxyCheckPeerCN Off
    # SSL error without this
    SSLProxyCheckPeerName Off
    # SSL error without this
    SSLProxyCheckPeerExpire Off
    # recommended since potential SSL error without this
    RequestHeader set "X-Forwarded-Proto" "https"
    # required by cockpit.conf
    # following is adapted from https://httpd.apache.org/docs/2.4/mod/mod_proxy_wstunnel.html
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule "^/server_man/(.*)" "wss://127.0.0.1:9090/server_man/$1" [P,L]
    # when websocket in upgrade AND
    # within UrlRoot, rewrite proxy with wss://
    RewriteCond %{HTTP:Upgrade} !=websocket [NC]
    RewriteRule "^/server_man/(.*)" "https://127.0.0.1:9090/server_man/$1" [P,L]

    # Redirect /scm → /scm/
    RedirectMatch 301 ^/scm$ /scm/

    # GitLab WebSocket (ActionCable)
    ProxyPass        "/scm/-/cable/"  "ws://127.0.0.1:7000/scm/-/cable"
    ProxyPassReverse "/scm/-/cable/"  "ws://127.0.0.1:7000/scm/-/cable"

   # Everything else
   ProxyPass        "/scm/"  "http://127.0.0.1:7000/scm/" nocanon
   ProxyPassReverse "/scm/"  "http://127.0.0.1:7000/scm/"
</VirtualHost>