# /etc/apache2/sites-available/bns-admin.sijbers.uk.conf
#
# Reverse-proxy vhost for the brass-sigil-server admin panel.
# certbot will manage the SSL config (certificate paths, redirect from :80, etc.)
# when run as: sudo certbot --apache -d bns-admin.sijbers.uk

<VirtualHost *:80>
    ServerName bns-admin.sijbers.uk

    ProxyPreserveHost On
    ProxyRequests Off

    # SSE log stream needs streaming responses, not buffered ones.
    SetEnv no-gzip 1
    SetEnv proxy-sendcl 1

    # `flushpackets=on` is the SSE-critical bit on Apache -- pushes each chunk
    # straight through instead of batching for ~60 s.
    ProxyPass        / http://127.0.0.1:8080/ flushpackets=on keepalive=On
    ProxyPassReverse / http://127.0.0.1:8080/

    # So brass-sigil-server's rate limiter sees the real client IP, not 127.0.0.1.
    RequestHeader set X-Forwarded-Proto "https"

    ErrorLog  ${APACHE_LOG_DIR}/bns-admin.sijbers.uk-error.log
    CustomLog ${APACHE_LOG_DIR}/bns-admin.sijbers.uk-access.log combined
</VirtualHost>