ServerName vm.txt3.net ErrorLog /var/log/virtualmin/vm.txt3.net_error_log CustomLog /var/log/virtualmin/vm.txt3.net_access_log combined Alias /.well-known/acme-challenge/ /home/txt3/domains/vm.txt3.net/public_html/.well-known/acme-challenge/ Require all granted Options -Indexes ProxyPass /.well-known ! RewriteEngine on RewriteCond %{HTTPS} !=on RewriteRule ^/(?!\.well-known)(.*)$ https://vm.txt3.net/$1 [R=301,L] ServerName vm.txt3.net ErrorLog /var/log/virtualmin/vm.txt3.net_error_log CustomLog /var/log/virtualmin/vm.txt3.net_access_log combined SSLEngine on SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLCertificateFile /etc/letsencrypt/live/vm.txt3.net/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/vm.txt3.net/privkey.pem Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "DENY" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Strict-Transport-Security "max-age=15768000" Header always set Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; connect-src 'self' http://127.0.0.1:8098; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'" # --- API -> JSON backend ---------------------------------------- ProxyPreserveHost On ProxyRequests Off ProxyTimeout 120 ProxyPass /.well-known ! ProxyPass /api/ http://127.0.0.1:8098/api/ retry=0 ProxyPassReverse /api/ http://127.0.0.1:8098/api/ # --- audio files -> old portal ---------------------------------- ProxyPass /audio/ http://127.0.0.1:8099/audio/ retry=0 ProxyPassReverse /audio/ http://127.0.0.1:8099/audio/ # --- React frontend (static build) ------------------------------ DocumentRoot /home/jp/Work/voicemail-ui/dist Require all granted Options -Indexes # SPA fallback: serve index.html for any non-file, non-api, non-audio path RewriteEngine on RewriteCond %{REQUEST_URI} !^/api/ RewriteCond %{REQUEST_URI} !^/audio/ RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f RewriteRule ^ /index.html [L] RequestHeader set X-Forwarded-Proto "https" Require all granted