<VirtualHost *:80>
	ServerAdmin webmaster@minmaxiste.com
	ServerName <%= @name %>

	DocumentRoot <%= @docroot %>
	RedirectMatch permanent "^(?!/.well-known/acme-challenge/.*)" https://<%= @name %>/$1

	ErrorLog ${APACHE_LOG_DIR}/<%= @name %>/error.log
	CustomLog ${APACHE_LOG_DIR}/<%= @name %>/access.log combined
</VirtualHost>

<VirtualHost *:442>
	ServerAdmin webmaster@minmaxiste.com
	ServerName <%= @name %>

	DocumentRoot <%= @docroot %>
	DirectoryIndex index.html

	ErrorLog ${APACHE_LOG_DIR}/<%= @name %>/error.log
	CustomLog ${APACHE_LOG_DIR}/<%= @name %>/access.log combined

	RemoteIPProxyProtocol On

	SSLEngine on
	SSLCertificateFile      /etc/ssl/certs/certes.pem
	SSLCertificateKeyFile   /etc/ssl/private/certes.key
	SSLCACertificateFile    /etc/certes/root.pem
	SSLVerifyClient         require
	SSLVerifyDepth          2
	SSLUserName             SSL_CLIENT_S_DN_CN

	AddDefaultCharset UTF-8

	# See also:
	#   https://docs.bestpractical.com/rt/5.0.6/web_deployment.html#mod_proxy_fcgi
	ProxyPass / unix:/run/rt-fcgi.sock|fcgi://localhost/
	ProxyFCGIBackendType GENERIC
	ProxyFCGISetEnvIf "true" SCRIPT_NAME ""

	# Limit mail gateway access to localhost by default
	<Location /REST/1.0/NoAuth>
		Require ip <%= @facts['networking']['ip6'] %>
		Require ip <%= @facts['networking']['ip'] %>
		Require local
	</Location>
</VirtualHost>
