LoadModule mpm_event_module modules/mod_mpm_event.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule access_compat_module modules/mod_access_compat.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule reqtimeout_module modules/mod_reqtimeout.so
LoadModule filter_module modules/mod_filter.so
LoadModule mime_module modules/mod_mime.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule env_module modules/mod_env.so
LoadModule headers_module modules/mod_headers.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule version_module modules/mod_version.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule proxy_http2_module modules/mod_proxy_http2.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule http2_module modules/mod_http2.so

ServerRoot "/usr/local/apache2"
LogLevel debug
ErrorLog /proc/self/fd/2
CustomLog /proc/self/fd/1 "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""

Listen 443

SSLRandomSeed startup builtin
SSLRandomSeed connect builtin

<VirtualHost *:443>
    # Enable HTTP/2 and configure ALPN for gRPC
    Protocols h2 http/1.1
    H2Direct on
    
    # SSL Configuration
    SSLEngine on
    SSLProxyEngine on
    SSLCertificateFile /etc/certs/selfsigned.crt
    SSLCertificateKeyFile /etc/certs/selfsigned.key
    
    # Modern SSL settings for gRPC compatibility
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305
    SSLHonorCipherOrder off
    
    # Relax SSL Proxy Configuration to debug
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    
    # Add timeouts to prevent hanging
    ProxyTimeout 60

    # Proxy settings
    ProxyPreserveHost on
    ProxyAddHeaders on
    RequestHeader set X-Forwarded-Proto "https"
    
    # Route login UI
    ProxyPass /ui/v2/login http://login-enabled-tls:3000/ui/v2/login
    ProxyPassReverse /ui/v2/login http://login-enabled-tls:3000/ui/v2/login
    
    # Route to Zitadel with TLS
    ProxyPass / https://zitadel-enabled-tls:8080/
    ProxyPassReverse / https://zitadel-enabled-tls:8080/
</VirtualHost>