#vim:syntax=apache

<IfModule mod_ssl.c>
<VirtualHost *:80>
	ServerName git.lirion.de
	ServerAlias git.lirion.de
	ServerSignature Off

	RewriteEngine on
	RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
	RewriteRule ^(.*)$ http://%1/$1 [R=301,L]
	RewriteCond %{HTTPS} !=on
	RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [NE,R,L]
</VirtualHost>
<VirtualHost *:443>
	header set Public-Key-Pins 'pin-sha256="NxMynxRVjjSnl8BnON+6WwexY53HOyKtctua48Am6xA=";pin-sha256="8cwqjzxOlLuW9OGaHAj5GG6DCgZdXEd+OB9UJPWV9KE=";max-age=2419200;'
	ServerAdmin webmaster@lirion.net
	ServerName git.lirion.de
	ServerAlias git.lirion.de git.lirion.net
	# not my true DocRoot. Remember to replace this, and pay respect to the FHS, kids!
	DocumentRoot "/www/cgit"

	<Directory "/www/cgit">
		AllowOverride None
		Options ExecCGI FollowSymlinks
		Order allow,deny
		Allow from all
	</Directory>

	Alias /cgit.css "/www/cgit/cgit.css"
	Alias /cgit.png "/www/cgit/cgit.png"
	Alias /favicon.ico "/www/cgit/favicon.ico"
	Alias /assets "/www/cgit/assets"
	Alias /fonts "/www/cgit/fonts"
	ScriptAlias / "/usr/lib/cgit/cgit.cgi/"

	ErrorLog ${APACHE_LOG_DIR}/git.lirion.de-error.log
	LogLevel warn
	CustomLog ${APACHE_LOG_DIR}/git.lirion.de-access.log combined
	SSLEngine on
	# same as above - this is not the true entry. Adjust!
	SSLCertificateKeyFile	/ssl/private/git.lirion.de.key
	SSLCertificateFile	/ssl/public/git.lirion.de-chain.pem
	<FilesMatch "\.(cgi|shtml|phtml|php)$">
		SSLOptions +StdEnvVars
	</FilesMatch>
	<Directory /usr/lib/cgi-bin>
		SSLOptions +StdEnvVars
	</Directory>
	BrowserMatch "MSIE [2-6]" \
		nokeepalive ssl-unclean-shutdown \
		downgrade-1.0 force-response-1.0
	# MSIE 7 and newer should be able to use keepalive
	BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
</IfModule>