ServerTokens ProductOnly

#<IfModule mod_mime.c>
#    AddType application/font-woff .woff
#    AddType application/x-font-ttf .ttf
#</IfModule>

Listen 8443
<VirtualHost *:8443>
    ServerAdmin tango@voicecom.ee
    ServerName klient.liisi.ee

#    ErrorDocument 500 /maintenance_holm.html
#    #RewriteEngine On
#    #RewriteCond %{REQUEST_URI} !=/maintenance
#    #RewriteRule ^ /maintenance [R=302]

#    <LocationMatch "/maintenance">
#        Alias "/home/tango/tangoweb/templates/maintenance_holm.html"
#        Require all granted
#    </LocationMatch>

    SSLEngine On
    SSLVerifyClient none
    # Sisaldab: klient.liisi.ee, pood.liisi.ee, TODO: crs.liisi.ee, vana.liisi.ee?
    SSLCertificateFile /etc/letsencrypt/live/prelive.liisi.ee/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/prelive.liisi.ee/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/prelive.liisi.ee/chain.pem
    
    # SSLProtocol ALL -SSLv2
    SSLProtocol ALL -SSLv2 -SSLv3
    SSLHonorCipherOrder On
    SSLCipherSuite "ECDHE+AESGCM DHE+AESGCM ECDH+AESGCM DH+AESGCM ECDHE+AES256 DHE+AES256 ECDH+AES256 DH+AES256 ECDHE+AES128 DHE+AES ECDH+AES128 DH+AES ECDHE+3DES DHE+3DES ECDH+3DES DH+3DES RSA+AESGCM RSA+AES RSA+3DES !aNULL !MD5 !DSS"

    # Kliendi sertifikaadi kontroll
    SSLCACertificatePath /etc/pki/esteid/ca
    #SSLCARevocationPath /etc/pki/esteid/crl

    # Limiidipäringu iframe lubamine
    # Header always append X-Frame-Options ALLOW-FROM "http://www.liisi.ee"

    <LocationMatch "(/accounts/idcard_auth)">
        SSLVerifyClient require
        SSLVerifyDepth 3
        SSLOptions +StdEnvVars
   </LocationMatch>

    <LocationMatch "(/accounts/get_cert)">
        SSLVerifyClient optional
        SSLVerifyDepth 2
        SSLOptions +StdEnvVars
   </LocationMatch>


    <IfModule mod_headers.c>
        #Header set Strict-Transport-Security "max-age=15768000"
        Header set X-UA-Compatible "IE=edge"
        Header set X-Frame-Options "SAMEORIGIN"
        <Location /link/>
            # Lubatud iframe's laadida
            Header unset X-Frame-Options
        </Location>
    </IfModule>

    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>

      <Location /leasing_limit >
            # Lubatud iframe's laadida
            Header unset X-Frame-Options
      </Location>

      <Location /taotlus >
            # Lubatud iframe's laadida
            Header unset X-Frame-Options
      </Location>

      <Location /calculator >
            # Lubatud iframe's laadida
            Header unset X-Frame-Options
      </Location>

    <Directory /home/tango/tangoweb/static_serve>
        AllowOverride None
        Require all granted

        <IfModule mod_expires.c>
            ExpiresActive On
            ExpiresDefault "access plus 30 minutes"
        </IfModule>
    </Directory>

    # Apache 2.4
    <Files wsgi.py>
        Require all granted
    </Files>

    WSGIDaemonProcess linkweb processes=8 threads=1 display-name=%{GROUP} \
                      python-path=/home/tango/env/lib/python3.6/site-packages
    WSGIProcessGroup linkweb
    WSGIPassAuthorization On
    # Work around psycopg2 "can't adapt type Decimal" (?)
    # https://code.google.com/p/modwsgi/wiki/ApplicationIssues
    WSGIApplicationGroup %{GLOBAL}

    WSGIScriptAlias /       /home/tango/tangoweb/link/wsgi.py
    Alias           /static /home/tango/tangoweb/static_serve

</VirtualHost>