TLS is terminated at the proxy; Apache receives plain HTTP on :80.
Merge all rules into a single *:80 vhost (the :443 vhost was never
reached) and make the HTTPS redirect conditional on
X-Forwarded-Proto: http. Fixes ERR_TOO_MANY_REDIRECTS.
Apache vhost for omny-test.psi.ch (migration from lighttpd)
This config replaces the lighttpd setup for the OMNY status page. All authentication is done at the PHP level via rewrite rules — there is no mod_auth usage. Requests to the administrators:
Enable mod_rewrite and mod_ssl. Note: the vhost will fail configtest without mod_rewrite — this is intentional (without the rewrite rules, Apache would serve all files with no authentication, so failing loudly is the safe mode).
Certificate: the SSLCertificateFile / SSLCertificateKeyFile paths are placeholders in Let's Encrypt layout — please adjust to the actual certificate location for omny-test.psi.ch, or let us know how TLS is provisioned on this host.
PHP execution must be active for .php files under /var/www/omny (PHP-FPM, CGI/FastCGI, or mod_php — whichever is standard on this host is fine; the code requires PHP ≥ 7.1, no extensions beyond the defaults).
Please confirm whether any reverse proxy / load balancer sits in front of Apache. Several endpoints (upload.php, session_query.php, set_password.php) authorize by client IP (REMOTE_ADDR); if requests arrive via a proxy, we need to know so we can adapt the whitelist logic.
After deployment: apachectl configtest and reload. A quick functional check is opening https://omny-test.psi.ch/login.php — the login form should render (if PHP source code is shown instead, PHP execution is not wired up; please don't leave it in that state, as the source contains a secret).
The optional HSTS header is present but commented out (would additionally require mod_headers)
hollerandgitadmin
bruhn_b