<IfModule mod_ssl.c>
    <VirtualHost *:80>
            ServerName {{ server.hostname }}
            Redirect 301 / https://{{ server.hostname }}/

    </VirtualHost>
    <VirtualHost *:443>
        ServerName {{ server.hostname }}
        AddDefaultCharset UTF-8
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        DocumentRoot {{ rt_folder }}/share/html
        ScriptAlias / {{ rt_folder }}/sbin/rt-server.fcgi/

        SSLEngine on
        SSLProxyEngine on
        SSLCertificateFile	/etc/ssl/certs/{{ server.hostname }}.pem
        SSLCertificateKeyFile /etc/ssl/private/{{ server.hostname }}.key
        SSLCACertificatePath /etc/ssl/certs

        ProxyRequests off

        <FilesMatch "\.(cgi|shtml|phtml|php|pl)$">
            SSLOptions +StdEnvVars
        </FilesMatch>

        <Directory "{{ rt_folder }}/sbin">
            SSLOptions +StdEnvVars
        </Directory>

        <Location />
            Require all granted
            Options +ExecCGI
            AddHandler fcgid-script fcgi
            Options FollowSymLinks
        </Location>

        <Location /reports/api>
            ProxyPass https://localhost:9443 Keepalive=On retry=30 acquire=60 connectiontimeout=60 timeout=60
            ProxyPassReverse https://localhost:9443
            SSLOptions +StdEnvVars
            SSLVerifyClient require
            SSLVerifyDepth 4
            <RequireAll>
                Require expr "%{SSL_CLIENT_S_DN_O} == 'Masarykova univerzita'"
                Require expr "%{SSL_CLIENT_S_DN_CN} in { '{{ server.hostname }}' }"
                Require expr "%{SSL_CLIENT_M_SERIAL} in  {'F580756FA1E9BF033D6C4950280F15B1', '36367086B25370D6A5E553E4E8C4D1C3', 'B7016804299E61B4B845B652CDBE48DC'}"
            </RequireAll>
            SetEnv proxy-initial-not-pooled 1
        </Location>
        SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

    </VirtualHost>
</IfModule>
