##
##  nextcloud-apache.conf -- ownCloud Apache Custom Configuration
##

ServerRoot             @l_prefix@
ServerAdmin            root@@l_hostname@.@l_domainname@
ServerName             @l_hostname@.@l_domainname@
ServerTokens           Prod
User                   @l_rusr@
Group                  @l_rgrp@
Listen                 127.0.0.1:8081

#   runtime files
PidFile                @l_prefix@/var/nextcloud/run/nextcloud-apache.pid
ScoreBoardFile         @l_prefix@/var/nextcloud/run/nextcloud-apache.sb
LockFile               @l_prefix@/var/nextcloud/run/nextcloud-apache.lck

#   include apache-php
Include                @l_prefix@/etc/apache/apache.d/apache-php.conf

#   server behaviour
Timeout                300
KeepAlive              on
MaxKeepAliveRequests   100
KeepAliveTimeout       15
MinSpareServers        5
MaxSpareServers        10
StartServers           5
MaxClients             15
MaxRequestsPerChild    500
HostnameLookups        off
UseCanonicalName       on

#   access logging
LogFormat              "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat              "%h %l %u %t \"%r\" %>s %b" common
LogFormat              "%{Referer}i -> %U" referer
LogFormat              "%{User-agent}i" agent
CustomLog              @l_prefix@/var/nextcloud/log/nextcloud-apache.access.log common

#   error logging
LogLevel               warn
ErrorLog               @l_prefix@/var/nextcloud/log/nextcloud-apache.error.log
ServerSignature        on

#   secure root directory
<Directory />
    Options FollowSymLinks
    AllowOverride None
</Directory>

#   browser specifics
BrowserMatch "Mozilla/2"       nokeepalive
BrowserMatch "MSIE 4\.0b2;"    nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0"       force-response-1.0
BrowserMatch "JDK/1\.0"        force-response-1.0

#   SSL/TLS support
<IfModule ssl_module>
    SSLRandomSeed           startup builtin
    SSLRandomSeed           connect builtin
    SSLMutex                sem
    SSLSessionCache         shmcb:@l_prefix@/var/nextcloud/run/nextcloud-apache.scache(512000)
    SSLSessionCacheTimeout  300
    SSLCipherSuite          ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SetEnvIf User-Agent ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
    <Files ~ "\.(cgi|shtml|phtml|php?)$">
        SSLOptions +StdEnvVars
    </Files>
    <Directory "@l_prefix@/cgi">
        SSLOptions +StdEnvVars
    </Directory>
</IfModule>

#   configure PHP for ownCloud
AddType           application/x-httpd-php .php
php_admin_flag    allow_url_fopen     1
php_admin_flag    safe_mode           0
php_admin_flag    magic_quotes_gpc    0
php_admin_flag    register_globals    0
php_admin_flag    session.auto_start  0
php_admin_value   session.save_path   @l_prefix@/var/nextcloud/run/session
php_admin_value   upload_tmp_dir      @l_prefix@/var/nextcloud/tmp
php_admin_value   upload_max_filesize 512M
php_admin_value   post_max_size       512M
php_admin_value   memory_limit        512M

#   URL handling
RewriteEngine     on
RewriteRule       ^/nextcloud/dav/(.*)$ /nextcloud/files/webdav.php$1 [PT]
RewriteRule       ^/\.well-known/host-meta       /nextcloud/public.php?service=host-meta      [QSA,L]
RewriteRule       ^/\.well-known/host-meta\.json /nextcloud/public.php?service=host-meta-json [QSA,L]
RewriteRule       ^/\.well-known/webfinger       /nextcloud/public.php?service=webfinger      [QSA,L]
RewriteRule       ^/\.well-known/carddav         /nextcloud/remote.php/dav/ [R=301,L]
RewriteRule       ^/\.well-known/caldav          /nextcloud/remote.php/dav/ [R=301,L]
DocumentRoot      @l_prefix@/lib/nextcloud
Alias             /nextcloud @l_prefix@/lib/nextcloud
DirectoryIndex    index.php
ErrorDocument     404 /index.php

#   configure ownCloud application area
ExpiresByType     text/html A1
<Directory        "@l_prefix@/lib/nextcloud">
    Options       -Indexes +FollowSymLinks
    AllowOverride All
    Order         allow,deny
    Allow         from all
</Directory>