# Example host Apache vhost for the SelfPost panel (default scenario). Install
# on the host running Apache — NOT inside the SelfPost container. Requires
# mod_ssl, mod_proxy/mod_proxy_http and mod_rewrite enabled (`a2enmod ssl proxy proxy_http rewrite`).
#
# Certificates: obtain with the Apache certbot plugin against THIS vhost
# (`certbot --apache -d mail.example.com`). Certbot edits this file in place to
# add the SSLCertificateFile/SSLCertificateKeyFile directives and a :80 -> :443
# redirect vhost, and renews in the background via its own timer. The resulting
# PEM files land at
# /etc/letsencrypt/live/mail.example.com/{fullchain,privkey}.pem on the host,
# as links into ../../archive/. Link certs/fullchain.pem and certs/privkey.pem
# to them and mount /etc/letsencrypt read-only at the same path (see
# ../docker-compose.yml and docs/guide.md, "Reverse proxy") so Postfix can
# present the very same certificate on 465/587. Mounting live/mail.example.com
# alone gives the container links into a directory it does not have. One
# certificate, two consumers — no separate cert just for the panel.

<VirtualHost *:443>
	ServerName mail.example.com

	# Filled in by `certbot --apache`; shown here for clarity.
	# SSLEngine on
	# SSLCertificateFile /etc/letsencrypt/live/mail.example.com/fullchain.pem
	# SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.com/privkey.pem

	ProxyPreserveHost On
	ProxyPass "/" "http://127.0.0.1:8080/"
	ProxyPassReverse "/" "http://127.0.0.1:8080/"

	# The panel is plain HTTP behind the proxy; it never terminates TLS itself.
	# Cookies are still marked Secure by the panel because the browser only ever
	# sees this HTTPS vhost.
</VirtualHost>

<VirtualHost *:80>
	ServerName mail.example.com
	# certbot's http-01 challenge needs this on plain :80; everything else
	# redirects to HTTPS once certbot adds the RewriteRule/Redirect block.
	RewriteEngine On
	RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
	RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
</VirtualHost>