Listen 3080
<VirtualHost *:3080>
  ServerName gitea99.opendev.org
  ServerAdmin infra-root@opendev.org

  ErrorLog ${APACHE_LOG_DIR}/gitea-redirect-error.log
  LogLevel warn
  LogFormat "%h:%{remote}p %A:%{proxy-source-port}n %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combinedport
  CustomLog ${APACHE_LOG_DIR}/gitea-redirect-access.log combinedport

  Use UserAgentFilter

  Redirect / https://opendev.org/
</VirtualHost>

Listen 3081
<VirtualHost *:3081>
  ServerName gitea99.opendev.org
  ServerAdmin infra-root@opendev.org
  DocumentRoot /var/www/opendev.org

  # Process PROXY Protocol Headers from our haproxy load balancer so
  # mod_remoteip can recover the real client address. haproxy runs in
  # mode tcp and terminates no TLS, so it cannot inject X-Forwarded-For
  # itself; the PROXY header is the only way to carry the client address.
  # Except localhost over both IPv4 and IPv6: functional test connections
  # reach this vhost directly (e.g. `git clone https://localhost:3081`)
  # and so carry no PROXY header. The haproxy load balancer itself must
  # NOT be excepted here or mod_remoteip would stop recovering the client
  # address for proxied traffic; haproxy health checks still succeed
  # because `send-proxy` also prepends the PROXY header to httpchk
  # connections.
  #
  # No RemoteIPTrustedProxy is set: that directive only gates the
  # header-based path (RemoteIPHeader, e.g. X-Forwarded-For), which we do
  # not use. RemoteIPProxyProtocol trusts any peer not listed in
  # RemoteIPProxyProtocolExceptions, so the exceptions list is what
  # restricts this. Access to port 3081 is already limited to the
  # gitea-lb group by iptables_extra_allowed_groups.
  RemoteIPProxyProtocol On
  RemoteIPProxyProtocolExceptions 127.0.0.1 ::1

  <Directory /var/www/opendev.org/>
    Require all granted
    Order allow,deny
    Allow from all
  </Directory>

  AllowEncodedSlashes On

  ErrorLog ${APACHE_LOG_DIR}/gitea-ssl-error.log

  LogLevel warn

  LogFormat "%h:%{remote}p %A:%{proxy-source-port}n %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combinedport
  CustomLog ${APACHE_LOG_DIR}/gitea-ssl-access.log combinedport

  SSLEngine on
  SSLProtocol All -SSLv2 -SSLv3
  # Note: this list should ensure ciphers that provide forward secrecy
  SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
  SSLHonorCipherOrder on

  SSLCertificateFile /etc/letsencrypt-certs/gitea99.opendev.org/gitea99.opendev.org.cer
  SSLCertificateKeyFile /etc/letsencrypt-certs/gitea99.opendev.org/gitea99.opendev.org.key
  SSLCertificateChainFile /etc/letsencrypt-certs/gitea99.opendev.org/ca.cer

  <Location /.well-known/matrix/client>
    Header set Access-Control-Allow-Origin "*"
  </Location>

  # From https://anubis.techaro.lol/docs/admin/environments/apache/
  # These headers need to be set or else Anubis will
  # throw an "admin misconfiguration" error.
  RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR}
  RequestHeader set X-Forwarded-Proto "https"
  RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s"

  Use UserAgentFilter

  # We need to set env vars for subsequent header creation below.
  # Based on https://andreas.scherbaum.la/post/2024-12-26_add-canonical-headers-for-files-in-apache2/
  RewriteEngine On
  RewriteCond %{REQUEST_URI} (.*)
  RewriteRule .* - [E=RU:%1]
  RewriteCond %{QUERY_STRING} (.+)
  RewriteRule .* - [E=QS:%1]

  Header setifempty Link "<https://testgitea.opendev.org%{RU}e>; rel=\"canonical\"" env=!QS
  Header setifempty Link "<https://testgitea.opendev.org%{RU}e?%{QS}e>; rel=\"canonical\"" env=QS

  ProxyPreserveHost On
  ProxyRequests Off
  ProxyVia Off
  ProxyPass /.well-known/ !
  ProxyPass / http://[::1]:10000/
  ProxyPassReverse / http://[::1]:10000/
</VirtualHost>