# Forwarding vhost for docker-distribution-registry
Listen 444
<VirtualHost *:444>
        ServerName registry

	#  General setup for the virtual host
        DocumentRoot  "/srv/www/obs/container-registry/htdocs"
	ErrorLog /srv/www/obs/container-registry/log/apache_error.log
	TransferLog /srv/www/obs/container-registry/log/apache_access.log

        # Enable maintenance mode. All requests will be redirected
        # to the maintenance page and return 503 as http status.
        # Start your apache with -D MAINTENANCE to enable this.
        # On (open)SUSE you can do this by setting
        # APACHE_SERVER_FLAGS="MAINTENANCE" in /etc/sysconfig/apache
        <IfDefine MAINTENANCE>
          ErrorDocument 503 /503.html
          RewriteEngine on
          RewriteCond %{REQUEST_URI} !=/503.html
          RewriteRule ^ - [R=503,L]
        </IfDefine>

	SSLEngine on

	#  SSL protocols
	#  Supporting TLS only is adequate nowadays
	SSLProtocol all -SSLv2 -SSLv3

	#   SSL Cipher Suite:
	#   List the ciphers that the client is permitted to negotiate.
	#   We disable weak ciphers by default.
	#   See the mod_ssl documentation or "openssl ciphers -v" for a
	#   complete list.
	SSLCipherSuite ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!MD5:@STRENGTH

	SSLCertificateFile /srv/obs/certs/server.crt
	SSLCertificateKeyFile /srv/obs/certs/server.key

        <Directory /srv/www/obs/container-registry/htdocs>
           AllowOverride all
           Options -MultiViews

           # This requires mod_xforward loaded in apache 
           # Enable the usage via options.yml
           # This will decrease the load due to long running requests a lot (unloading from rails stack)
           XForward on

           Require all granted
        </Directory>

	SetEnvIf User-Agent ".*MSIE [1-5].*" \
		 nokeepalive ssl-unclean-shutdown \
		 downgrade-1.0 force-response-1.0

	CustomLog /var/log/apache2/ssl_request_log   ssl_combined

        RequestHeader set X-Forwarded-Proto "https"
        ProxyPass "/" "http://localhost:5000/"
        ProxyPassReverse "/" "http://localhost:5000/"

        <Location "/">
          <LimitExcept GET HEAD>
            Require host localhost
          </LimitExcept>
        </Location>
</VirtualHost>
