# Apache configuration of sciblog
# To add this configuration file to Apache type:
# $ cp sciblog.conf /etc/apache2/sites-available/
# $ a2ensite sciblog.conf
#
# Add the modules you want to activate:
# $ a2enmod wsgi
# $ a2enmod rewrite
# $ a2enmod expires
# $ a2enmod headers
# $ a2enmod deflate
# $ a2enmod http2
# 
# Optionally, you can activate the module ssl
# $ a2enmod ssl
#

# Setup domain without SSL (uncomment the next VirtualHost instruction if 
# you want to set the domain without SSL)
#<VirtualHost *:80>
#    # Enable HTTP2
#    # Add Protocols h2 http/1.1
#    # Server names and root folder
#    ServerName example.com
#    ServerAlias www.example.com
#    DocumentRoot /var/www/sciblog
    
#    # Set public directories for Apache
#    Alias /img/ /var/www/sciblog/img/
#    Alias /static/ /var/www/sciblog/blog/static/
#    <Directory /var/www/sciblog/blog/static>
#        Require all granted
#    </Directory>
#    <Directory /var/www/sciblog/img>
#        Require all granted
#    </Directory>
#    <Directory /var/www/sciblog/sciblog>
#        <Files wsgi.py>
#            Require all granted
#        </Files>
#    </Directory>

#    # Set wsgi
#    # NOTE: Make sure that WSGIDaemonProcess points to your correct python path
#    WSGIDaemonProcess example.com python-path=/var/www/sciblog:/home/ubuntu/anaconda/envs/py35/lib/python3.5/site-packages
#    WSGIProcessGroup example.com
#    WSGIScriptAlias / /var/www/sciblog/sciblog/wsgi.py process-group=example.com

#    # Log files
#    ErrorLog /var/log/apache2/sciblog.error.log
#    CustomLog /var/log/apache2/sciblog.access.log combined

#    # Redirect www to /
#    # +info: https://simonecarletti.com/blog/2016/08/redirect-domain-http-https-www-apache/
#    RewriteEngine On
#    RewriteCond %{HTTPS} off [OR]
#    RewriteCond %{HTTP_HOST} ^www\. [NC]
#    RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
#    RewriteRule ^ http://%1%{REQUEST_URI} [L,NE,R=301]
#</VirtualHost>

# Setup domain with SSL (the next 2 VirtualHost instructions show how to set up a 
# domain with SSL and a WSGI server.
<VirtualHost *:80>
    # Enable HTTP2
    Add Protocols h2 http/1.1

    # Server names and root folder
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin me@example.com
    DocumentRoot /var/www/sciblog

    # Redirect www to /
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =example.com [OR]
    RewriteCond %{SERVER_NAME} =www.example.com
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
    # Enable HTTP2
    Add Protocols h2 http/1.1

    # Server names and root folder
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin me@example.com
    DocumentRoot /var/www/sciblog

    # SLL directives and certificates
    SSLEngine On
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem


    # Set wsgi
    WSGIPassAuthorization On
    WSGIApplicationGroup %{GLOBAL}
    # NOTE: Make sure that WSGIDaemonProcess points to your correct python path
    WSGIDaemonProcess example.com python-path=/var/www/sciblog:/home/ubuntu/anaconda/envs/py35/lib/python3.5/site-packages
    WSGIProcessGroup example.com
    WSGIScriptAlias / /var/www/sciblog/sciblog/wsgi.py process-group=example.com

    # Set public directories for Apache
    Alias /img/ /var/www/sciblog/img/
    Alias /static/ /var/www/sciblog/blog/static/
    <Directory /var/www/sciblog/blog/static>
        Require all granted
    </Directory>
    <Directory /var/www/sciblog/img>
        Require all granted
    </Directory>
    <Directory /var/www/sciblog/sciblog>
        <Files wsgi.py>
            Require all granted
        </Files>
    </Directory>

    # (Optional) Other directories
    Alias /docs/ /var/www/sciblog/docs/
    Alias /bibtex/ /var/www/sciblog/bibtex/
    <Directory /var/www/sciblog/docs>
        Require all granted
    </Directory>
    <Directory /var/www/sciblog/bibtex>
        Require all granted
    </Directory>

    # Log files
    LogLevel error wsgi:debug # More info: https://httpd.apache.org/docs/2.4/mod/core.html#loglevel
    ErrorLog /var/log/apache2/sciblog.error.log
    CustomLog /var/log/apache2/sciblog.access.log combined
    
    # Redirect www to /
    # +info: https://www.lcwsoft.com/knowledgebase/66/How-do-I-redirect-www-to-non-www-or-vice-versa-http-and-https.html
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^www.example.com$
    RewriteCond %{SERVER_PORT} ^443
    RewriteRule ^(.*)$ https://example.com$1 [R=301]

</VirtualHost>
</IfModule>



# Cache control headers
# Add expiration date to static objects.
# According to Google:
# The Cache-Control header was defined as part of the HTTP/1.1 specification 
# and supersedes previous headers (for example, Expires) used to define 
# response caching policies. All modern browsers support Cache-Control, so 
# that's all you need.
# https://developers.google.com/web/fundamentals/performance/optimizing-content-efficiency/http-caching?hl=en#cache-control
# To enable this type: a2enmod headers and then restart apache
<IfModule mod_headers.c>
    Header set Connection keep-alive
    Header set X-Content-Type-Options nosniff
    <filesmatch "\.(jpg|jpeg|png|ico|flv|gif|swf|eot|woff|otf|ttf|svg)$">
        Header set Cache-Control "max-age=31536000, public"
    </filesmatch>
    # css and js should use private for proxy caching https://developers.google.com/speed/docs/best-practices/caching#LeverageProxyCaching
    <filesmatch "\.(css|js)$">
        Header set Cache-Control "max-age=2628000, private"
    </filesmatch>
    <filesMatch "\.(x?html?|php)$">
        Header set Cache-Control "max-age=86400, private, must-revalidate"
    </filesMatch>
</IfModule>


# Expire headers
# Add expiration date to static objects.
# To enable this type: a2enmod expires and then restart apache
# <IfModule mod_expires.c>
#     ExpiresActive On
#     ExpiresDefault "access plus 1 month"
#     ExpiresByType image/jpg "access plus 1 year"
#     ExpiresByType image/jpeg "access plus 1 year"
#     ExpiresByType image/gif "access plus 1 year"
#     ExpiresByType image/png "access plus 1 year"
#     ExpiresByType image/x-icon "access plus 1 year"
#     ExpiresByType text/css "access plus 1 month"
#     ExpiresByType text/html "access plus 1 week"
#     ExpiresByType application/pdf "access plus 1 month"
#     ExpiresByType application/javascript "access plus 1 year"
#     ExpiresByType application/x-javascript "access plus 1 year"
#     ExpiresByType text/x-javascript "access plus 1 year"
#     ExpiresByType video/ogg "access plus 1 year"
#     ExpiresByType audio/ogg "access plus 1 year"
#     ExpiresByType video/mp4 "access plus 1 year"
#     ExpiresByType video/webm "access plus 1 year"
#     ExpiresByType font/truetype "access plus 1 year"
#     ExpiresByType font/opentype "access plus 1 year"
#     ExpiresByType application/font-woff "access plus 1 year"
#     ExpiresByType application/x-font-woff "access plus 1 year"
#     ExpiresByType application/woff "access plus 1 year"
#     ExpiresByType application/font-woff2 "access plus 1 year"
#     ExpiresByType application/vnd.ms-fontobject "access plus 1 year"
#     ExpiresByType application/eot "access plus 1 year"
#     ExpiresByType application/x-font-ttf "access plus 1 year" 
#     ExpiresByType application/x-shockwave-flash "access plus 1 year"
#     ExpiresByType application/manifest+json  "access plus 1 year"
#     ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds"
#     ExpiresByType text/cache-manifest "access plus 0 seconds"
# </IfModule>

# Disable server signature (for security)
ServerSignature Off
ServerTokens Prod

# Security:  prevent Clickjacking attacks
Header set X-Frame-Options "deny"

# Secure Apache from Cross-Site Scripting
Header always set X-XSS-Protection "1;  mode=block"

# Other security
Header set Cross-Origin-Embedder-Policy-Report-Only "require-corp; report-to='default'"
Header set Cross-Origin-Opener-Policy-Report-Only "same-origin; report-to='default'"
Header set Content-Security-Policy "upgrade-insecure-requests"
Header set Permissions-Policy "microphone=(), camera=(), accelerometer=(), gyroscope=(), magnetometer=()"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header add Strict-Transport-Security "max-age=157680000"

# Compress static objects with gzip
# To enable this type: a2enmod deflate and then restart apache
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
    AddOutputFilterByType DEFLATE application/x-font
    AddOutputFilterByType DEFLATE application/x-font-opentype
    AddOutputFilterByType DEFLATE application/x-font-otf
    AddOutputFilterByType DEFLATE application/x-font-truetype
    AddOutputFilterByType DEFLATE application/x-font-ttf
    AddOutputFilterByType DEFLATE application/font-woff
    AddOutputFilterByType DEFLATE application/x-font-woff
    AddOutputFilterByType DEFLATE application/woff
    AddOutputFilterByType DEFLATE application/font-woff2
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE font/opentype
    AddOutputFilterByType DEFLATE font/otf
    AddOutputFilterByType DEFLATE font/ttf
    AddOutputFilterByType DEFLATE image/x-icon
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/plain
    BrowserMatch ^Mozilla/4 gzip-only-text/html
    BrowserMatch ^Mozilla/4\.0[678] no-gzip
    BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
    Header append Vary User-Agent
</IfModule> 









