WSGIDaemonProcess vault user=apache group=apache threads=5
WSGIScriptAlias /{{ vault_endpoint }} /usr/share/vault/vault.wsgi
WSGISocketPrefix run/wsgi
WSGIPassAuthorization On

# this isn't the best way to force SSL but it works for now
#RewriteEngine On
#RewriteCond %{HTTPS} !=on
#RewriteRule ^/vault/admin/?(.*) https://%{SERVER_NAME}/$1 [R,L]

<Directory /usr/share/vault>
    WSGIProcessGroup vault
    WSGIApplicationGroup %{GLOBAL}
    WSGIScriptReloading On
    <IfModule mod_authz_core.c>
        # Apache 2.4
        <RequireAny>
            Require method GET
            Require ip 127.0.0.1 ::1{% for host in allowed_hosts %} {{ host }}{% endfor %}

        </RequireAny>
    </IfModule>
    <IfModule !mod_auth_core.c>
        Order allow,deny
        Allow from all
    </IfModule>

</Directory>

#Alias /vault/static /var/www/vault/vault/static

#<Directory /var/www/vault/vault/static>
#Order allow,deny
#Allow from all
#</Directory>
