52 lines
1.6 KiB
Plaintext
52 lines
1.6 KiB
Plaintext
# Copy to /etc/httpd/conf.d/DOMAIN.conf and replace placeholders.
|
|
# This variant includes source IP allowlist and shared-secret header check.
|
|
|
|
<VirtualHost *:80>
|
|
ServerName __DOMAIN__
|
|
RewriteEngine On
|
|
RewriteRule ^/(.*)$ https://__DOMAIN__/$1 [R=301,L]
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:443>
|
|
ServerName __DOMAIN__
|
|
|
|
SSLEngine On
|
|
SSLCertificateFile /etc/letsencrypt/live/__DOMAIN__/fullchain.pem
|
|
SSLCertificateKeyFile /etc/letsencrypt/live/__DOMAIN__/privkey.pem
|
|
|
|
ProxyRequests Off
|
|
ProxyPreserveHost On
|
|
SSLProxyEngine On
|
|
|
|
RequestHeader set X-Forwarded-Proto "https"
|
|
RequestHeader append X-Forwarded-For %{REMOTE_ADDR}s
|
|
|
|
ProxyTimeout 60
|
|
Timeout 60
|
|
|
|
# Allow only known HealthPlix source IPs (replace with official list)
|
|
<Location /healthplix/fetch>
|
|
Require all denied
|
|
Require ip __HEALTHPLIX_IP_1__
|
|
Require ip __HEALTHPLIX_IP_2__
|
|
<LimitExcept POST>
|
|
Require all denied
|
|
</LimitExcept>
|
|
</Location>
|
|
|
|
# Block requests without valid shared secret header
|
|
RewriteEngine On
|
|
RewriteCond %{REQUEST_URI} ^/healthplix/fetch$
|
|
RewriteCond %{HTTP:X-Healthplix-Secret} !^__STRONG_SHARED_SECRET__$
|
|
RewriteRule ^ - [F,L]
|
|
|
|
# Limit payload size to 1 MB (adjust as needed)
|
|
LimitRequestBody 1048576
|
|
|
|
ProxyPass /healthplix/fetch http://__VPN_HMS_IP__/healthplix/fetch
|
|
ProxyPassReverse /healthplix/fetch http://__VPN_HMS_IP__/healthplix/fetch
|
|
|
|
ErrorLog /var/log/httpd/__DOMAIN__-healthplix-error.log
|
|
CustomLog /var/log/httpd/__DOMAIN__-healthplix-access.log combined
|
|
</VirtualHost>
|