ServerAdmin admin@learnitive.com ServerName edu.learnitive.com DocumentRoot /var/www/edu.learnitive.com/public_html/dist SSLEngine on SSLCertificateFile /etc/letsencrypt/live/edu.learnitive.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/edu.learnitive.com/privkey.pem ProxyPreserveHost On ProxyRequests Off RequestHeader set X-Forwarded-Proto "https" RequestHeader set X-Forwarded-Port "443" ProxyPass /api/ http://127.0.0.1:4210/api/ ProxyPassReverse /api/ http://127.0.0.1:4210/api/ ProxyPass /sitemap.xml http://127.0.0.1:4210/sitemap.xml ProxyPassReverse /sitemap.xml http://127.0.0.1:4210/sitemap.xml ProxyPass /robots.txt http://127.0.0.1:4210/robots.txt ProxyPassReverse /robots.txt http://127.0.0.1:4210/robots.txt ProxyPass /blog/rss.xml http://127.0.0.1:4210/blog/rss.xml ProxyPassReverse /blog/rss.xml http://127.0.0.1:4210/blog/rss.xml ProxyPass /collab-live ws://127.0.0.1:4211/collab-live ProxyPassReverse /collab-live ws://127.0.0.1:4211/collab-live ProxyPass /collab-signal ws://127.0.0.1:4211/collab-signal ProxyPassReverse /collab-signal ws://127.0.0.1:4211/collab-signal # Public Cloud Terminal WebSocket endpoint. ProxyPass strips the public # /console-gateway/ prefix so the private gateway receives /console/. # Use a direct WebSocket proxy instead of relying on per-vhost rewrite # matching; this also makes the route deterministic when Apache evaluates # directory rewrites for non-file requests. ProxyPass /console-gateway/ ws://127.0.0.1:9887/ retry=0 ProxyPassReverse /console-gateway/ ws://127.0.0.1:9887/ # Never expose implementation paths. The renderer itself accepts only # loopback requests from this vhost. Require all denied Options -Indexes AllowOverride None Require all granted DirectoryIndex disabled RewriteEngine On RewriteCond %{REQUEST_URI} !^/(?:api|collab-live|collab-signal|console-gateway)/ [NC] RewriteCond %{REQUEST_METHOD} ^(?:GET|HEAD)$ [NC] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ http://127.0.0.1:4210/__learnitive/render/$1 [P,L,QSA] AddType application/wasm .wasm AddType image/x-icon .ico AddType image/svg+xml .svg AddType application/manifest+json .webmanifest AddType font/woff2 .woff2 AddType font/otf .otf AddType font/ttf .ttf ForceType application/manifest+json Header always set Cross-Origin-Opener-Policy "same-origin" Header always set Cross-Origin-Embedder-Policy "credentialless" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set X-Frame-Options "SAMEORIGIN" Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" # Staging must never become an indexed public surface, even if robots.txt is cached or misconfigured. Header always set X-Robots-Tag "noindex, nofollow, noarchive" Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://www.youtube.com https://s.ytimg.com https://fast.wistia.com https://*.wistia.net https://src.litix.io https://*.sentry-cdn.com https://webr.r-wasm.org https://www.statcounter.com https://www.googletagmanager.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data: https://*.wistia.com; connect-src 'self' https: https://challenges.cloudflare.com wss://edu.learnitive.com http://127.0.0.1:* http://localhost:*; frame-src 'self' https://preview.learnitive.com https://www.youtube.com https://www.youtube-nocookie.com https://fast.wistia.net https://fast.wistia.com https://challenges.cloudflare.com; worker-src 'self' blob: https://webr.r-wasm.org; child-src 'self' blob:; manifest-src 'self'; media-src 'self' blob: data: https://*.wistia.com https://*.wistia.net https://*.wistia.land https://*.akamaized.net https://embedwistia-a.akamaihd.net" Header always set Strict-Transport-Security "max-age=31536000" Header always set Cache-Control "no-cache, no-store, must-revalidate" Header always set Cache-Control "public, max-age=86400" Header always set Cache-Control "public, max-age=31536000, immutable" Header always set Cache-Control "public, max-age=31536000, immutable" Header always set Cache-Control "no-cache, no-store, must-revalidate" Header always set Cache-Control "no-cache, no-store, must-revalidate" ErrorLog ${APACHE_LOG_DIR}/learnitive-edu-error.log CustomLog ${APACHE_LOG_DIR}/learnitive-edu-access.log combined