<VirtualHost *:80>
  RewriteEngine On
  RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
  SSLEngine on
  SSLCertificateFile   /etc/ssl/certs/ssl-cert-snakeoil.pem
  SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
  SSLProxyEngine On
  SSLProxyCheckPeerCN Off
  SSLProxyCheckPeerName Off

  ServerAdmin webmaster@localhost
  DocumentRoot /var/www/html
  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined
  DefineExternalAuth pwauth pipe /usr/sbin/pwauth

  SetOutputFilter DEFLATE
  AddOutputFilterByType DEFLATE text/plain
  AddOutputFilterByType DEFLATE text/html
  AddOutputFilterByType DEFLATE text/xml
  AddOutputFilterByType DEFLATE text/css
  AddOutputFilterByType DEFLATE application/xml
  AddOutputFilterByType DEFLATE application/xhtml+xml
  AddOutputFilterByType DEFLATE application/rss+xml
  AddOutputFilterByType DEFLATE application/javascript
  AddOutputFilterByType DEFLATE application/x-javascript

  Alias /image /usr/share/elephant-shed/image

  Alias /static /usr/share/elephant-shed/static
  <Directory /usr/share/elephant-shed/static>
    Satisfy Any
    Allow from all
  </Directory>

  Alias /doc /usr/share/elephant-shed/doc

  # directory listings
  Options +Indexes
  HeaderName /cgi-bin/index_header.pl
  ReadmeName /cgi-bin/index_footer.pl
  IndexOptions HTMLTable FancyIndexing FoldersFirst NameWidth=* VersionSort SuppressHTMLPreamble
  # mod_autoindex wants the cgi's file type to be text/*
  AddType text/html .pl

  # custom error pages
  ErrorDocument 401 /cgi-bin/notloggedin.pl
  ErrorDocument 403 /cgi-bin/error.pl
  ErrorDocument 404 /cgi-bin/error.pl
  ErrorDocument 500 /cgi-bin/error.pl
  ErrorDocument 503 /cgi-bin/error.pl

  # pgadmin4 3.2 on CentOS 7 doesn't like /pgadmin4
  RedirectMatch "/pgadmin4$" "/pgadmin4/browser/"

  # pgBackRest
  AddType text/plain .backup
  AddType text/plain .log

  Redirect "/prometheus" "/prometheus/"
  <Location /prometheus/>
    ProxyPass http://127.0.0.1:9090/prometheus/
    ProxyPassReverse http://127.0.0.1:9090/prometheus/
  </Location>

  <Location /grafana>
    ProxyPreserveHost On
    ProxyPass http://127.0.0.1:3000
    ProxyPassReverse http://127.0.0.1:3000

    RewriteEngine On
    # forward authed user to proxied applications
    RewriteRule .* - [E=PROXY_USER:%{LA-U:REMOTE_USER},NS]
    RequestHeader set X-WEBAUTH-USER "%{PROXY_USER}e"

    RequestHeader unset Authorization

  </Location>

  <IfModule wsgi_module>
    WSGIDaemonProcess omnidb user=omnidb group=omnidb
    WSGIScriptAlias /omnidb /usr/share/elephant-shed/omnidb/wsgi.py process-group=omnidb
    Alias /omnidb/static /usr/lib/python3/dist-packages/OmniDB_app/static
    <Directory /usr/share/elephant-shed/omnidb>
      <Files wsgi.py>
        Require all granted
      </Files>
    </Directory>
    <Directory /usr/lib/python3/dist-packages/OmniDB_app/static>
      Require all granted
    </Directory>
  </IfModule>

  <Location /powa>
    ProxyPreserveHost On
    ProxyPass http://127.0.0.1:8888/powa
    ProxyPassReverse http://127.0.0.1:8888/powa
  </Location>

  <Location /shellinabox>
    ProxyPreserveHost On
    ProxyPass https://127.0.0.1:4200
    ProxyPassReverse https://127.0.0.1:4200
  </Location>

 Alias "/pgbadger" "/var/lib/pgbadger/"
  <Directory /var/lib/pgbadger/>
    Options +Indexes
    IndexOptions HTMLTable IgnoreCase FancyIndexing FoldersFirst NameWidth=* VersionSort SuppressHTMLPreamble SuppressLastModified SuppressSize SuppressDescription
  </Directory>

  # require user for access
  <Location />
    AuthType Basic
    AuthName "Elephant Shed"
    AuthBasicProvider external
    AuthExternal pwauth
    Require unix-group elephant-shed

    AddOutputFilterByType SUBSTITUTE text/html
    Substitute "s!</head!<link rel=\"stylesheet\" href=\"/static/css/esmenu.css\"></head!nq"
    Substitute "s!</body!\
<div class=\"esmenu\">\
<hr>\
<a target=\"_top\" href=\"../../../../../../../../\"><img title=\"Portal Home\" src=\"/image/button_home.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../omnidb/\"><img title=\"OmniDB\" src=\"/image/button_omnidb.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../grafana/\"><img title=\"Grafana\" src=\"/image/button_grafana.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../prometheus/\"><img title=\"Prometheus\" src=\"/image/button_prometheus.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../powa/server/\"><img title=\"PoWA\" src=\"/image/button_powa.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../pgbadger/\"><img title=\"pgBadger\" src=\"/image/button_pgbadger.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../cgi-bin/backrest.pl\"><img title=\"pgBackRest\" src=\"/image/button_pgbackrest.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../system\"><img title=\"Cockpit\" src=\"/image/button_cockpit.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../system/terminal\"><img title=\"Shell\" src=\"/image/button_shellinabox.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../doc/html/\"><img title=\"Documentation\" src=\"/image/button_doc.png\"></a>\
<a target=\"_top\" href=\"../../../../../../../../cgi-bin/support.pl\"><img title=\"Support\" src=\"/image/button_credativ.png\"></a>\
</div></body!nq"
    # cockpit tries to redirect all local links through its websocket, and the only
    # way around seems to be using ../links (onclick and friends are all caught)

    # Debian stretch's apache runs deflate before substitute, breaking our menu. Disable deflating.
    RequestHeader unset Accept-Encoding
  </Location>

  RewriteEngine On
  # rewrite / to portal menu
  RewriteRule ^/?$ /cgi-bin/portalmain.pl [PT]
  # catch Cockpit paths (@ is /@localhost)
  RewriteRule ^/cockpit/socket wss://127.0.0.1:10090/cockpit/socket [P,L]
  RewriteRule ^/(apps|cockpit|dashboard|network|system|storage|updates|users|@)(.*) https://127.0.0.1:10090/$1$2 [P]

  <Location ~ "^/(apps|cockpit|dashboard|network|system|storage|updates|users|@)">
    # Fix CSP header
    RewriteRule . - [env=HOST:%{HTTP_HOST}]
    Header edit* Content-Security-Policy 127.0.0.1:10090 %{HOST}e
    # Apache 2.4.6 on CentOS 7 does not interpolate variables here, unset the header instead
    #Header unset Content-Security-Policy
    # Origin accepted in cockpit.conf
    RequestHeader set Origin https://localhost
    RequestHeader set X-Authorize password
  </Location>

  # /logout: sending any sort of 401 to the browser makes it forget the current credentials
  <Location /logout>
    AuthType Basic
    AuthName "Elephant Shed"
    AuthBasicProvider external
    AuthExternal pwauth
    Require user does-not-exist
  </Location>

  # allow access to notloggedin page
  <Location ~ "^(/favicon.ico|/.*\.png|/cgi-bin/notloggedin.pl|/cgi-bin/error.pl)">
    allow from all
    satisfy any
  </Location>

  Alias /favicon.ico /usr/share/elephant-shed/image/favicon.ico

</VirtualHost>
