diff --git a/roles/ccsdb/templates/ccsdb.conf b/roles/ccsdb/templates/ccsdb.conf
new file mode 100644
index 0000000000..7863c4fcf8
--- /dev/null
+++ b/roles/ccsdb/templates/ccsdb.conf
@@ -0,0 +1,27 @@
+WSGIDaemonProcess ccsdb user=apache group=apache threads=5
+WSGIScriptAlias /{{ ccsdb_endpoint }} /usr/share/ccsdb/ccsdb.wsgi
+WSGISocketPrefix run/wsgi
+
+# this isn't the best way to force SSL but it works for now
+#RewriteEngine On
+#RewriteCond %{HTTPS} !=on
+#RewriteRule ^/execdb/admin/?(.*) https://%{SERVER_NAME}/$1 [R,L]
+
+<Directory /usr/share/ccsdb>
+    WSGIProcessGroup ccsdb
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIScriptReloading On
+    <IfModule mod_authz_core.c>
+        # Apache 2.4
+        <RequireAny>
+            Require method GET
+            Require ip 127.0.0.1 ::1{% for host in allowed_hosts %} {{ host }}{% endfor %}
+
+        </RequireAny>
+    </IfModule>
+    <IfModule !mod_auth_core.c>
+        Order allow,deny
+        Allow from all
+    </IfModule>
+
+</Directory>