<VirtualHost {{ zabbix_web_vhost_listen_ip }}:{{ zabbix_web_vhost_port }}>
  ServerName {{ zabbix_api_server_url }}
  {% for alias in zabbix_url_aliases %}
  ServerAlias {{ alias }}
  {% endfor %}

  ## Vhost docroot
  DocumentRoot "/usr/share/zabbix"

{% if zabbix_apache_custom_includes is iterable and (zabbix_apache_custom_includes | length>0) %}
  {% for include in zabbix_apache_custom_includes %}
  {{ include }}
  {% endfor %}
{% endif %}

{% if zabbix_web_redirect|default(false) and zabbix_web_tls|default(false) %}
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
{% endif %}

{% set directory_paths = ['/usr/share/zabbix/conf', '/usr/share/zabbix/app', '/usr/share/zabbix/include', '/usr/share/zabbix/include/classes'] %}

  <Directory "/usr/share/zabbix">
  {% if apache_version|string() == '2.4' %}
    Options FollowSymLinks
    AllowOverride None
    Require all granted
  {% else %}
    AllowOverride None
    Order Allow,Deny
    Allow from all
  {% endif %}

    <IfModule dir_module>
        DirectoryIndex index.php
    </IfModule>

{% if ansible_os_family == "RedHat" %}
    <FilesMatch \.(php|phar)$>
        SetHandler "proxy:unix:{{ zabbix_php_fpm_listen }}|fcgi://localhost"
    </FilesMatch>
{% endif %}

  </Directory>

{% for my_path in directory_paths %}
  <Directory "{{ my_path }}">
  {% if apache_version|string() == '2.4' %}
    Require all denied
  {% else %}
    AllowOverride None
    Order Deny,Allow
    Deny from all
  {% endif %}
  </Directory>

{% endfor %}
  ## Logging
  ErrorLog "/var/log/{{ _apache_log }}/{{ zabbix_api_server_url }}_error.log"
  ServerSignature Off
  CustomLog "/var/log/{{ _apache_log }}/{{ zabbix_api_server_url }}_access.log" combined

  ## Rewrite rules
  RewriteEngine On
  RewriteRule ^$ /index.php [L]
</VirtualHost>

{# Set up TLS vhosts #}
{% if zabbix_web_tls and zabbix_web_vhost_tls_port %}

{{ (zabbix_web_SSLPassPhraseDialog is defined and zabbix_web_SSLPassPhraseDialog is not none) | ternary('', '# ') }}SSLPassPhraseDialog {{ zabbix_web_SSLPassPhraseDialog | default('') }}
{{ (zabbix_web_SSLSessionCache is defined and zabbix_web_SSLSessionCache is not none) | ternary('', '# ') }}SSLSessionCache {{ zabbix_web_SSLSessionCache | default('') }}
{{ (zabbix_web_SSLSessionCacheTimeout is defined and zabbix_web_SSLSessionCacheTimeout is not none) | ternary('', '# ') }}SSLSessionCacheTimeout {{ zabbix_web_SSLSessionCacheTimeout | default('') }}
{{ (zabbix_web_SSLCryptoDevice is defined and zabbix_web_SSLCryptoDevice is not none) | ternary('', '# ') }}SSLCryptoDevice {{ zabbix_web_SSLCryptoDevice | default('') }}
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin

<VirtualHost {{ zabbix_web_vhost_listen_ip }}:{{ zabbix_web_vhost_tls_port }}>
  ServerName {{ zabbix_api_server_url }}
  {% for alias in zabbix_url_aliases %}
  ServerAlias {{ alias }}
  {% endfor %}

  ## Vhost docroot
  DocumentRoot "/usr/share/zabbix"

{% if zabbix_apache_custom_includes is iterable and (zabbix_apache_custom_includes | length>0) %}
  {% for include in zabbix_apache_custom_includes %}
  {{ include }}
  {% endfor %}
{% endif %}

  SSLEngine on
  {{ (zabbix_web_ssl_cipher_suite is defined and zabbix_web_ssl_cipher_suite is not none) | ternary('', '# ') }}SSLCipherSuite {{ zabbix_web_ssl_cipher_suite | default('') }}
  {{ (zabbix_web_ssl_cipher_suite is defined and zabbix_web_ssl_cipher_suite is not none) | ternary('', '# ') }}SSLHonorCipherOrder On
{% if apache_version|string() == '2.4' %}
  SSLCompression off
{% endif %}
  SSLCertificateFile {{ zabbix_web_tls_crt }}
  SSLCertificateKeyFile {{ zabbix_web_tls_key }}
  {{ (zabbix_web_tls_chain is defined and zabbix_web_tls_chain is not none) | ternary('', '# ') }}SSLCertificateChainFile {{ zabbix_web_tls_chain | default('') }}

{% set directory_paths = ['/usr/share/zabbix/conf', '/usr/share/zabbix/app', '/usr/share/zabbix/include', '/usr/share/zabbix/include/classes'] %}

  <Directory "/usr/share/zabbix">
  {% if apache_version|string() == '2.4' %}
    Options FollowSymLinks
    AllowOverride None
    Require all granted
  {% else %}
    AllowOverride None
    Order Allow,Deny
    Allow from all
  {% endif %}

    <IfModule dir_module>
        DirectoryIndex index.php
    </IfModule>

{% if ansible_os_family == "RedHat" %}
    <FilesMatch \.(php|phar)$>
        SetHandler "proxy:unix:{{ zabbix_php_fpm_listen }}|fcgi://localhost"
    </FilesMatch>
{% endif %}

  </Directory>

{% for my_path in directory_paths %}
  <Directory "{{ my_path }}">
  {% if apache_version|string() == '2.4' %}
    Require all granted
  {% else %}
    AllowOverride None
    Order Deny,Allow
    Deny from all
  {% endif %}
  </Directory>

{% endfor %}
  ## Logging
  ErrorLog "/var/log/{{ _apache_log }}/{{ zabbix_api_server_url }}_tls_error.log"
  ServerSignature Off
  CustomLog "/var/log/{{ _apache_log }}/{{ zabbix_api_server_url }}_tls_access.log" combined

  ## Rewrite rules
  RewriteEngine On
  RewriteRule ^$ /index.php [L]

</VirtualHost>
{% endif %}
