ServerName vm.txt3.net ErrorLog /var/log/virtualmin/vm.txt3.net_error_log CustomLog /var/log/virtualmin/vm.txt3.net_access_log combined # Let certbot answer HTTP-01 challenges from the webroot Alias /.well-known/acme-challenge/ /home/txt3/domains/vm.txt3.net/public_html/.well-known/acme-challenge/ Require all granted Options -Indexes ProxyPass /.well-known ! # Everything else goes to HTTPS RewriteEngine on RewriteCond %{HTTPS} !=on RewriteRule ^/(?!\.well-known)(.*)$ https://vm.txt3.net/$1 [R=301,L] ServerName vm.txt3.net ErrorLog /var/log/virtualmin/vm.txt3.net_error_log CustomLog /var/log/virtualmin/vm.txt3.net_access_log combined SSLEngine on SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 # Replaced by certbot with the vm.txt3.net cert once issued. SSLCertificateFile /etc/letsencrypt/live/vm.txt3.net/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/vm.txt3.net/privkey.pem # --- security headers ------------------------------------------------- Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "DENY" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Strict-Transport-Security "max-age=15768000" # The app uses only inline