ServerName freshrss.localhost
Listen 80
DocumentRoot /var/www/FreshRSS/p/
RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 10.0.0.1/8 172.16.0.1/12 192.168.0.1/16
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined_proxy
CustomLog "|/var/www/FreshRSS/cli/sensitive-log.sh" combined_proxy
ErrorLog /dev/stderr
AllowEncodedSlashes On
ServerTokens OS
TraceEnable Off

<IfDefine OIDC_ENABLED>
	<IfModule !auth_openidc_module>
		Error "The auth_openidc_module is not available. Install it or unset environment variable OIDC_ENABLED."
	</IfModule>

	OIDCProviderMetadataURL ${OIDC_PROVIDER_METADATA_URL}
	OIDCClientID ${OIDC_CLIENT_ID}
	OIDCClientSecret ${OIDC_CLIENT_SECRET}

	OIDCRedirectURI /i/oidc/
	OIDCCryptoPassphrase ${OIDC_CLIENT_CRYPTO_KEY}

	OIDCRemoteUserClaim preferred_username
	OIDCScope "openid"

	OIDCRefreshAccessTokenBeforeExpiry 30
</IfDefine>

<Directory />
	AllowOverride None
	Options FollowSymLinks
	Require all denied
</Directory>

<Directory /var/www/FreshRSS/p>
	AllowOverride None
	Include /var/www/FreshRSS/p/.htaccess
	Options FollowSymLinks
	Require all granted
</Directory>

<Directory /var/www/FreshRSS/p/api>
	Include /var/www/FreshRSS/p/api/.htaccess
</Directory>

<Directory /var/www/FreshRSS/p/i>
	ExpiresActive Off

	<IfDefine OIDC_ENABLED>
		AuthType openid-connect
		Require valid-user
	</IfDefine>
	IncludeOptional /var/www/FreshRSS/p/i/.htaccess
</Directory>

<Directory /var/www/FreshRSS/p/themes>
	Include /var/www/FreshRSS/p/themes/.htaccess
</Directory>