# Example host Apache vhost for the SelfPost panel (spec 10.3, default
# scenario). Install on the host running Apache — NOT inside the SelfPost
# container. Requires mod_ssl and mod_proxy/mod_proxy_http enabled
# (`a2enmod ssl proxy proxy_http`).
#
# Certificates: obtain with the Apache certbot plugin against THIS vhost
# (`certbot --apache -d mail.example.com`). Certbot edits this file in place
# to add the SSLCertificateFile/SSLCertificateKeyFile directives and a
# :80 -> :443 redirect vhost, and renews in the background via its own timer.
# The resulting PEM files land at
# /etc/letsencrypt/live/mail.example.com/{fullchain,privkey}.pem on the host
# — bind-mount that directory read-only into the SelfPost container (see
# ../docker-compose.yml, the `./certs:/etc/postfix/tls:ro` volume) so Postfix
# can present the very same certificate on 465/587. One certificate, two
# consumers (spec 10 p.4) — no separate cert just for the panel.

<VirtualHost *:443>
	ServerName mail.example.com

	# Filled in by `certbot --apache`; shown here for clarity.
	# SSLEngine on
	# SSLCertificateFile /etc/letsencrypt/live/mail.example.com/fullchain.pem
	# SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.com/privkey.pem

	ProxyPreserveHost On
	ProxyPass "/" "http://127.0.0.1:8080/"
	ProxyPassReverse "/" "http://127.0.0.1:8080/"

	# The panel is plain HTTP behind the proxy; it never terminates TLS
	# itself (spec 10 p.2). Cookies are still marked Secure by the panel
	# (spec 7.6.6) because the browser only ever sees this HTTPS vhost.
</VirtualHost>

<VirtualHost *:80>
	ServerName mail.example.com
	# certbot's http-01 challenge needs this on plain :80; everything else
	# redirects to HTTPS once certbot adds the RewriteRule/Redirect block.
	RewriteEngine On
	RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
	RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
</VirtualHost>