# Copy to /etc/httpd/conf.d/DOMAIN.conf and replace placeholders.
# This variant includes source IP allowlist and shared-secret header check.

<VirtualHost *:80>
    ServerName __DOMAIN__
    RewriteEngine On
    RewriteRule ^/(.*)$ https://__DOMAIN__/$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName __DOMAIN__

    SSLEngine On
    SSLCertificateFile /etc/letsencrypt/live/__DOMAIN__/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/__DOMAIN__/privkey.pem

    ProxyRequests Off
    ProxyPreserveHost On
    SSLProxyEngine On

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader append X-Forwarded-For %{REMOTE_ADDR}s

    ProxyTimeout 60
    Timeout 60

    # Allow only known HealthPlix source IPs (replace with official list)
    <Location /healthplix/fetch>
        Require all denied
        Require ip __HEALTHPLIX_IP_1__
        Require ip __HEALTHPLIX_IP_2__
        <LimitExcept POST>
            Require all denied
        </LimitExcept>
    </Location>

    # Block requests without valid shared secret header
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/healthplix/fetch$
    RewriteCond %{HTTP:X-Healthplix-Secret} !^__STRONG_SHARED_SECRET__$
    RewriteRule ^ - [F,L]

    # Limit payload size to 1 MB (adjust as needed)
    LimitRequestBody 1048576

    ProxyPass        /healthplix/fetch http://__VPN_HMS_IP__/healthplix/fetch
    ProxyPassReverse /healthplix/fetch http://__VPN_HMS_IP__/healthplix/fetch

    ErrorLog  /var/log/httpd/__DOMAIN__-healthplix-error.log
    CustomLog /var/log/httpd/__DOMAIN__-healthplix-access.log combined
</VirtualHost>