# Enable this vhost after Certbot has issued the certificate.
# Apache listens on 40443; the router forwards external :443 to it.
<VirtualHost *:40443>
    ServerName kiln.spb.ru
    ServerAlias kiln.beer kiln.bar xn--h1adei.xn--90a1af.xn--p1ai

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/kiln.spb.ru/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/kiln.spb.ru/privkey.pem

    ProxyRequests Off
    ProxyPreserveHost On

    # Bot-owned public pages and callbacks. Keep /api/order and /api/booking
    # on the website; the website calls the bot API internally on 127.0.0.1:8383.
    ProxyPass        /o/      http://127.0.0.1:8383/o/      timeout=90
    ProxyPassReverse /o/      http://127.0.0.1:8383/o/
    ProxyPass        /z/      http://127.0.0.1:8383/z/      timeout=90
    ProxyPassReverse /z/      http://127.0.0.1:8383/z/
    ProxyPass        /pay/    http://127.0.0.1:8383/pay/    timeout=90
    ProxyPassReverse /pay/    http://127.0.0.1:8383/pay/
    ProxyPass        /cal/    http://127.0.0.1:8383/cal/    timeout=90
    ProxyPassReverse /cal/    http://127.0.0.1:8383/cal/
    ProxyPass        /dv/     http://127.0.0.1:8383/dv/     timeout=90
    ProxyPassReverse /dv/     http://127.0.0.1:8383/dv/
    ProxyPass        /media/  http://127.0.0.1:8383/media/
    ProxyPassReverse /media/  http://127.0.0.1:8383/media/
    ProxyPass        /health  http://127.0.0.1:8383/health
    ProxyPassReverse /health  http://127.0.0.1:8383/health

    ProxyPass / http://127.0.0.1:3100/
    ProxyPassReverse / http://127.0.0.1:3100/

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"

    ErrorLog ${APACHE_LOG_DIR}/kiln-ssl-error.log
    CustomLog ${APACHE_LOG_DIR}/kiln-ssl-access.log combined
</VirtualHost>
