apache.conf

# Reference apache config file for hosting wsgi application
# Several variables related to OIDC connection paramters and reverse proxy urls
# will need to be filled in
<VirtualHost *:80>

  # Default server configuration
  ServerName localhost
  ServerAdmin admin@localhost
  DocumentRoot /var/www/html

  <Directory "/var/www/html">
    Options Indexes
    AllowOverride None
  </Directory>

  # Require OIDC auth at every location
  <Location "/">
    <RequireAny>
      Require valid-user
    </RequireAny>
    AuthType openid-connect
  </Location>

  # Reverse proxy API requests to local uvicorn instance
  <Location "/api">
    ProxyPass http://localhost:8089
    ProxyPassReverse http://localhost:8089
  </Location>

  # Allow public access to the root url
  <LocationMatch "^/$">
    <RequireAny>
      Require all granted
    </RequireAny>
    AuthType none
  </LocationMatch>

  # Allow public access to the landing page of the frontend, and any static assets
  <LocationMatch "^/ui(/?|.*js|.*css)$">
    <RequireAny>
      Require all granted
    </RequireAny>
    AuthType none
  </LocationMatch>

  # Allow public access to the "list institutions" endpoint
  <Location "/api/institution_ids">
    <RequireAny>
      Require all granted
    </RequireAny>
    AuthType none
  </Location>

  <Location "/callback">
    <RequireAny>
      Require valid-user
    </RequireAny>
    AuthType openid-connect
  </Location>

  <Directory "/srv">
    AllowOverride none
    <RequireAny>
      Require all granted
    </RequireAny>
  </Directory>

  # Redirect the root url to the frontend
  RedirectMatch "^/$" "/ui"
  # Reverse proxy the frontend to an internal service
  ProxyPass        "/ui" "http://institutions-ui/"
  ProxyPassReverse "/ui" "http://institutions-ui/"

  ## Logging
  ErrorLog "/var/log/httpd/local_default_ssl_error_ssl.log"
  LogLevel info
  ServerSignature Off
  CustomLog "/var/log/httpd/local_default_ssl_access_ssl.log" combined 

  # # WSGI application
  # WSGIDaemonProcess topology-institutions
  # WSGIProcessGroup topology-institutions
  # WSGIScriptAlias / /srv/wsgi.py
  # # Syslog CA issuer require examination of the authorization header
  # WSGIPassAuthorization On

  # # OIDC configuration
  # OIDCProviderMetadataURL https://cilogon.org/.well-known/openid-configuration
  # OIDCClientID <oidc client id>
  # OIDCClientSecret <oidc client secret>

  # OIDCRedirectURI https://{{getenv "EXTERNAL_HOSTNAME"}}/callback

  # # Used to encrypt the session cookie and the local cache.
  # OIDCCryptoPassphrase <oidc passphrase>

  # # Control the information in the returned token.
  # OIDCScope  "openid email org.cilogon.userinfo"

  # # The value of this scope is used as the username in the environment
  # # variables provided to WSGI, e.g. REMOTE_USERNAME. If not
  # # specified, defaults to "sub@iss" from OIDC_CLAIM_sub and
  # # OIDC_CLAIM_iss. Use 'osgid' since anyone associated with the OSG
  # # CO will have this claim
  # OIDCRemoteUserClaim  osgid

</VirtualHost>