server {
    listen 80 default_server;
    listen [::]:80 ipv6only=on default_server;
    server_name pretix.mydomain.com;
}
server {
    listen 443 default_server;
    listen [::]:443 ipv6only=on default_server;
    server_name pretix.mydomain.com;

    ssl on;
    ssl_certificate /path/to/cert.chain.pem;
    ssl_certificate_key /path/to/key.pem;

    add_header Referrer-Policy same-origin;
    add_header X-Content-Type-Options nosniff;

    location / {
        proxy_pass http://localhost:8345/;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Host $http_host;
    }

    location /media/ {
        alias /var/pretix/data/media/;
        expires 7d;
        access_log off;
    }

    location ^~ /media/cachedfiles {
        deny all;
        return 404;
    }
    location ^~ /media/invoices {
        deny all;
        return 404;
    }

    location /static/ {
        alias /var/pretix/venv/lib/python3.5/site-packages/pretix/static.dist/;
        access_log off;
        expires 365d;
        add_header Cache-Control "public";
    }
}

<VirtualHost *:80>
    ServerName pretix.mydomain.com

    ServerAdmin webmaster@mydomain.com
    DocumentRoot /var/pretix

    #LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    RewriteEngine on
    RewriteCond %{SERVER_NAME} =pretix.mydomain.com
    RewriteRule ^ https://pretix.mydomain.com%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerName pretix@mydomain.com

        ServerAdmin webmaster@mydomain.com
        DocumentRoot /var/pretix

        #LogLevel info ssl:warn
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # always redirect to tickets.gra5.de
        RewriteEngine on
        RewriteCond %{SERVER_NAME} =pretix.mydomain.com
        RewriteRule ^ https://pretix.mydomain.com%{REQUEST_URI} [END,NE,R=permanent]

        # PROXY CONFIG
        ProxyPass "/" "http://localhost:8345/"
        ProxyPassReverse "/" "http://localhost:8345/"

        # SSL Engine Switch:
        SSLEngine on

        <FilesMatch ".(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                SSLOptions +StdEnvVars
        </Directory>

        SSLCertificateFile /etc/letsencrypt/live/mydomain.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
    </VirtualHost>
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet