debt-tracker/deploy/apache.conf at main · noderaven/debt-tracker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
# /etc/apache2/sites-available/debt-tracker.conf
# Replace tracker.example.com with your real subdomain.
# Required modules: proxy, proxy_http, ssl, headers, rewrite
#   sudo a2enmod proxy proxy_http ssl headers rewrite

<VirtualHost *:80>
    ServerName tracker.example.com

    # Allow Let's Encrypt validation
    Alias /.well-known/acme-challenge/ /var/www/letsencrypt/.well-known/acme-challenge/

    # Redirect everything else to HTTPS
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName tracker.example.com

    SSLEngine on
    SSLCertificateFile      /etc/letsencrypt/live/tracker.example.com/fullchain.pem
    SSLCertificateKeyFile   /etc/letsencrypt/live/tracker.example.com/privkey.pem
    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder     on

    # Security headers
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Reverse proxy to Node app on localhost:3000
    ProxyPreserveHost On
    ProxyRequests Off
    ProxyPass        / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/

    # Limit upload size
    LimitRequestBody 1048576

    ErrorLog  ${APACHE_LOG_DIR}/debt-tracker-error.log
    CustomLog ${APACHE_LOG_DIR}/debt-tracker-access.log combined
</VirtualHost>