#
# Load SSL module if not loaded
#
<IfModule !mod_ssl.c>
LoadModule ssl_module modules/mod_ssl.so
</IfModule>

# Listen to puppet port also
Listen 8140

# Proxy balancer settings
<Proxy balancer://puppetmaster>
<% puppet_listenports.each do |port| -%>
  BalancerMember http://127.0.0.1:<%= port %> keepalive=on max=2 retry=30
<% end -%>
</Proxy>

##
## Puppet Virtual Host
##

<VirtualHost _default_:8140>

  # Use default log path for puppet
  ErrorLog /srv/www/log/https/<%= homename %>/error_log
  CustomLog /srv/www/log/https/<%= homename %>/access_log combined
  LogLevel warn

  # SSL settings
  SSLEngine on
  SSLProtocol TLSv1
  SSLCipherSuite DHE-RSA-AES256-SHA

  # Certificates and keys
  SSLCertificateFile <%= puppet_ssldir %>/certs/<%= homename %>.pem
  SSLCertificateKeyFile <%= puppet_ssldir %>/private_keys/<%= homename %>.pem
  SSLCertificateChainFile <%= puppet_ssldir %>/certs/ca.pem
  SSLCACertificateFile <%= puppet_ssldir %>/certs/ca.pem
  SSLCARevocationFile <%= puppet_ssldir %>/ca/ca_crl.pem

  # Client authentication
  SSLVerifyClient optional
  SSLVerifyDepth  1

  # SSL options and headers
  SSLOptions +StdEnvVars
  RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e

  # Proxy settings
  <IfModule mod_rewrite.c>
    <LocationMatch ^/production/file_content/.*>
      ForceType application/x-raw
    </LocationMatch>
    RewriteEngine On
    RewriteRule ^/production/file_content/files/(.+)$ /srv/puppet/files/common/$1 [L]
    RewriteRule ^/production/file_content/modules/([^/]+)/files/(.+)$ /etc/puppet/modules/$1/files/$2 [L]
    RewriteRule ^/(.*)$ balancer://puppetmaster%{REQUEST_URI} [P,QSA,L]
  </Ifmodule>
  <IfModule !mod_rewrite.c>
    ProxyPass / balancer://puppetmaster:8140/ timeout=180
  </IfModule>
  ProxyPassReverse / balancer://puppetmaster:8140/
  ProxyPreserveHost on
  SetEnv force-proxy-request-1.0 1
  SetEnv proxy-nokeepalive 1

</VirtualHost>

