# {{ ansible_managed }}
<IfModule mod_ssl.c>
        <VirtualHost *:443>
                ServerName {{ site.domain }}
{% if site.aliases %}
                ServerAlias {{ site.aliases | join(' ') }}
{% endif %}
                ServerAdmin webmaster@{{ site.domain }}

                DocumentRoot "{{ site.docroot }}"
                <Directory "{{ site.docroot }}">
                        Options Indexes MultiViews Includes FollowSymLinks
                        AddOutputFilter Includes html
                        AllowOverride All
                        Require all granted
                </Directory>

                ErrorLog ${APACHE_LOG_DIR}/{{ site.domain }}.error.log
                CustomLog ${APACHE_LOG_DIR}/{{ site.domain }}.access.log combined

                SSLEngine on
                SSLCertificateFile      /etc/ssl/certs/{{ site.domain }}.pem
                SSLCertificateKeyFile /etc/ssl/private/{{ site.domain }}.key

                <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                SSLOptions +StdEnvVars
                </FilesMatch>
                <Directory /usr/lib/cgi-bin>
                                SSLOptions +StdEnvVars
                </Directory>
{% if site.proxy_pass %}
{%   set path = site.proxy_path | string %}
{%   set target = site.proxy_pass if (site.proxy_pass.endswith('/') or not path.endswith('/')) else site.proxy_pass ~ '/' %}
{%   set opts = [] %}
{%   if site.proxy_timeout | string | length %}{% set _ = opts.append('timeout=' ~ site.proxy_timeout) %}{% endif %}
{%   if site.proxy_websocket | bool %}{% set _ = opts.append('upgrade=websocket') %}{% endif %}
{%   if site.proxy_options %}{% set _ = opts.append(site.proxy_options) %}{% endif %}

                # reverse proxy
                ProxyRequests Off
                ProxyPreserveHost {{ 'On' if site.proxy_preserve_host | bool else 'Off' }}
{%   if site.proxy_forwarded_headers | bool %}
                RequestHeader set X-Forwarded-Proto "https"
                RequestHeader set X-Forwarded-Port "443"
{%   endif %}
{%   if target is match('https://') %}
                SSLProxyEngine On
{%     if not site.proxy_ssl_verify | bool %}
                SSLProxyVerify none
                SSLProxyCheckPeerName off
                SSLProxyCheckPeerCN off
                SSLProxyCheckPeerExpire off
{%     endif %}
{%   endif %}
                ProxyPass "{{ path }}" "{{ target }}"{{ (' ' ~ opts | join(' ')) if opts else '' }}
                ProxyPassReverse "{{ path }}" "{{ target }}"
{% endif %}
{% if site.extra_directives %}

{{ site.extra_directives | trim | indent(16, true) }}
{% endif %}
        </VirtualHost>
</IfModule>