WSGISocketPrefix /var/run/wsgi

WSGIPassAuthorization On
WSGIDaemonProcess libravatar user=apache group=apache threads=25 display-name=libravatar maximum-requests=10000 graceful-timeout=20 python-home=/mnt/data/.virtualenv python-path=/srv/libravatar
WSGIScriptAlias / /mnt/data/wsgi.py

RewriteEngine on

<Directory "/var/www/html/.well-known/">
    Require all granted
</Directory>

Alias "/nobody" "/srv/libravatar/static/img/nobody"

<Directory /srv/libravatar/static/img>
    <IfModule mod_expires.c>
        ExpiresActive On
        ExpiresDefault "A86400"
        Header merge "Cache-Control" "public"
    </IfModule>
</Directory>

<VirtualHost *:80>
    ServerName  {{ server_name }}
    ServerAlias {{ server_redirect_name }}
    RewriteRule ^/\.well-known/(.*) /var/www/html/.well-known/$1 [L]
    RewriteRule "^/?(.*)" "https://%{HTTP_HOST}/$1" [L,R=301,NE]
</VirtualHost>

<VirtualHost *:443>
    ServerName {{ cdn_server_name }}
    ServerAlias {{ cdn_server_alias }}

    SSLCertificateFile    /etc/letsencrypt/live/{{ cdn_server_cert_name }}/cert.pem
    SSLCertificateKeyFile  /etc/letsencrypt/live/{{ cdn_server_cert_name }}/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/{{ cdn_server_cert_name }}/fullchain.pem
    Header always add Strict-Transport-Security "max-age=31536000; preload; includeSubDomains"

    RewriteRule ^/\.well-known/(.*) /var/www/html/.well-known/$1 [L]

    Include /etc/httpd/conf.d/libravatar-app.include
</VirtualHost>

<VirtualHost *:443>
    ServerName {{ server_name }}

    SSLCertificateFile    /etc/letsencrypt/live/{{ server_cert_name }}/cert.pem
    SSLCertificateKeyFile  /etc/letsencrypt/live/{{ server_cert_name }}/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/{{ server_cert_name }}/fullchain.pem
    Header always add Strict-Transport-Security "max-age=31536000; preload; includeSubDomains"

    RewriteRule ^/\.well-known/(.*) /var/www/html/.well-known/$1 [L]

    Include /etc/httpd/conf.d/libravatar-app.include
</VirtualHost>

<VirtualHost *:443>
    ServerAlias {{ server_redirect_name }}

    SSLCertificateFile    /etc/letsencrypt/live/{{ server_cert_name }}/cert.pem
    SSLCertificateKeyFile  /etc/letsencrypt/live/{{ server_cert_name }}/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/{{ server_cert_name }}/fullchain.pem
    Header always add Strict-Transport-Security "max-age=31536000; preload; includeSubDomains"

    RewriteRule "^/?(.*)" "https://{{ server_name }}/$1" [L,R=301,NE]
</VirtualHost>

<IfModule mod_status.c>
    ExtendedStatus On
    <Location /server-status>
        SetHandler server-status
        Require all denied
        Require host localhost
    </Location>
</IfModule>

<IfModule mpm_prefork_module>
    StartServers          8
    MinSpareServers       8
    MaxSpareServers       20
    MaxClients            50
    MaxRequestsPerChild   10000
</IfModule>
