# Load and configure SSL module
<IfModule !ssl_module>
  LoadModule ssl_module libexec/apache24/mod_ssl.so
</IfModule>
SSLProtocol +TLSv1.3 +TLSv1.2
SSLCipherSuite TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLCompression off

# Load and configure SSL session cache module
<IfModule !socache_dbm_module>
  LoadModule socache_dbm_module libexec/apache24/mod_socache_dbm.so
</IfModule>
SSLSessionCache dbm:/var/db/httpd_ssl_cache.db

# Load and configure Managed Domain module
<IfModule !watchdog_module>
  LoadModule watchdog_module libexec/apache24/mod_watchdog.so
</IfModule>
<IfModule !md_module>
  LoadModule md_module libexec/apache24/mod_md.so
</IfModule>
MDCertificateAgreement accepted
MDContactEmail acme@example.com

# Load Rewrite module (needed for HTTP -> HTTPS redirect)
<IfModule !rewrite_module>
  LoadModule rewrite_module libexec/apache24/mod_rewrite.so
</IfModule>

# Load Headers module (needed for HSTS)
<IfModule !headers_module>
  LoadModule headers_module libexec/apache24/mod_headers.so
</IfModule>

# Listen on port 443 for HTTPS
Listen 443

# Server name and admin email
ServerName server.example.com
ServerAdmin www@example.com

# HTTP-only
<VirtualHost localhost:80>
  ServerName localhost
  <Location />
    Require ip 127.0.0.1/8 ::1
  </Location>
  <Location "/md-status">
    SetHandler md-status
  </Location>
</VirtualHost>

# Declare site.example.com as a managed domain
MDomain site.example.com

# HTTP virtual host for legacy reasons, redirects to HTTPS
<VirtualHost *:80>
  ServerName site.example.com
  RewriteEngine on
  RewriteRule "^/(?!.well-known/acme-challenge)(.*)" https://site.example.com/$1 [R=301,L]
  ErrorLog /www/site.example.com/logs/http-error.log
  CustomLog /www/site.example.com/logs/http-access.log combined
</VirtualHost>

# HTTPS virtual host with strict SNI and HSTS
<VirtualHost *:443>
  ServerName site.example.com
  SSLEngine on
  SSLStrictSNIVHostCheck On
  Header always set Strict-Transport-Security "max-age=15552000; includeSubdomains;"
  DocumentRoot /www/site.example.com/data
  IncludeOptional /www/site.example.com/etc/*.conf
  ErrorLog /www/site.example.com/logs/https-error.log
  CustomLog /www/site.example.com/logs/https-access.log combined
</VirtualHost>