ansible/roles/nextcloud/templates/apache2-vhost-ssl.conf

# Configuration for {{ nextcloud_url }}
# vim:ft=apache:

# Accept connections from non-SNI clients
SSLStrictSNIVHostCheck off

# Website configuration
<VirtualHost *:80>
	ServerName {{ nextcloud_url }}
	Redirect permanent / https://{{ nextcloud_url }}
</VirtualHost>
<VirtualHost *:443>
	SSLEngine on
	SSLCertificateFile /etc/pki/cert/crt/{{ nextcloud_url }}.crt
	SSLCertificateKeyFile /etc/pki/cert/private/{{ nextcloud_url }}.key
	SSLCertificateChainFile /etc/pki/cert/crt/{{ nextcloud_url}}-fullchain.crt
	SSLProtocol {{ ssl_protocol }}
	SSLCipherSuite {{ ssl_cipher_suite }}
	<FilesMatch "\.(cgi|shtml|phtml|php)$">\
		SSLOptions +StdEnvVars
	</FilesMatch>
	<Directory /usr/lib/cgi-bin>
		SSLOptions +StdEnvVars
	</Directory>
	ServerName {{ nextcloud_url }}
	DocumentRoot {{ nextcloud_webroot }}
	<Directory "{{ nextcloud_webroot }}">
		Require all granted
		AllowOverride All
		Options MultiViews FollowSymlinks
	</Directory>
	<IfModule mod_headers.c>
		Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
	</IfModule>
</VirtualHost>