<VirtualHost *:80>
    ServerName 100002.dhms.in
    RewriteEngine On
    RewriteRule ^/(.*)$ https://100002.dhms.in/$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName 100002.dhms.in

    SSLEngine On
    SSLCertificateFile /etc/letsencrypt/live/100002.dhms.in/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/100002.dhms.in/privkey.pem

    ProxyRequests Off
    ProxyPreserveHost On
    SSLProxyEngine On

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader append X-Forwarded-For %{REMOTE_ADDR}s

    ProxyTimeout 60
    Timeout 60

    # Replace with official HealthPlix source IPs
    <Location /healthplix/fetch>
        Require all denied
        Require ip 203.0.113.10
        Require ip 203.0.113.11
        <LimitExcept POST>
            Require all denied
        </LimitExcept>
    </Location>

    # Replace with your strong shared secret
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/healthplix/fetch$
    RewriteCond %{HTTP:X-Healthplix-Secret} !^CHANGE_ME_TO_STRONG_SECRET$
    RewriteRule ^ - [F,L]

    LimitRequestBody 1048576

    ProxyPass        /healthplix/fetch http://10.8.0.45/healthplix/fetch
    ProxyPassReverse /healthplix/fetch http://10.8.0.45/healthplix/fetch

    ErrorLog  /var/log/httpd/100002-healthplix-error.log
    CustomLog /var/log/httpd/100002-healthplix-access.log combined
</VirtualHost>