# Example host Apache vhost for the SelfPost panel (default scenario). Install
# on the host running Apache — NOT inside the SelfPost container. Requires
# mod_ssl and mod_proxy/mod_proxy_http enabled (`a2enmod ssl proxy proxy_http`).
#
# Certificates: obtain with the Apache certbot plugin against THIS vhost
# (`certbot --apache -d mail.example.com`). Certbot edits this file in place to
# add the SSLCertificateFile/SSLCertificateKeyFile directives and a :80 -> :443
# redirect vhost, and renews in the background via its own timer. The resulting
# PEM files land at
# /etc/letsencrypt/live/mail.example.com/{fullchain,privkey}.pem on the host —
# bind-mount that directory read-only into the SelfPost container (see
# ../docker-compose.yml, the `./certs:/etc/postfix/tls:ro` volume) so Postfix
# can present the very same certificate on 465/587. One certificate, two
# consumers — no separate cert just for the panel.

<VirtualHost *:443>
	ServerName mail.example.com

	# Filled in by `certbot --apache`; shown here for clarity.
	# SSLEngine on
	# SSLCertificateFile /etc/letsencrypt/live/mail.example.com/fullchain.pem
	# SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.com/privkey.pem

	ProxyPreserveHost On
	ProxyPass "/" "http://127.0.0.1:8080/"
	ProxyPassReverse "/" "http://127.0.0.1:8080/"

	# The panel is plain HTTP behind the proxy; it never terminates TLS itself.
	# Cookies are still marked Secure by the panel because the browser only ever
	# sees this HTTPS vhost.
</VirtualHost>

<VirtualHost *:80>
	ServerName mail.example.com
	# certbot's http-01 challenge needs this on plain :80; everything else
	# redirects to HTTPS once certbot adds the RewriteRule/Redirect block.
	RewriteEngine On
	RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
	RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
</VirtualHost>