<VirtualHost *:80>
    ServerName forum.example.com
    DocumentRoot /srv/forum-rewrite/app/public

    <Directory /srv/forum-rewrite/app/public>
        AllowOverride All
        Require all granted
        Options FollowSymLinks
    </Directory>

    # Prefer explicit env wiring in the vhost so PHP and CLI agree on paths.
    SetEnv FORUM_REPOSITORY_ROOT /srv/forum-rewrite/repository
    SetEnv FORUM_DATABASE_PATH /srv/forum-rewrite/state/cache/post_index.sqlite3
    SetEnv FORUM_STATIC_HTML_ROOT /srv/forum-rewrite/state/static_html

    # Optional: selects which SiteProfileRegistry entry (name, default theme,
    # composer copy) this vhost renders. Omit to keep the zenmemes default.
    # SetEnv FORUM_SITE_ID zenmemes

    # Optional: lock this instance to approved users; lobby users receive only
    # Lobby, Account, and their own profile. Defaults to public when absent.
    # SetEnv FORUM_APPROVED_MEMBERS_ONLY true

    ErrorLog ${APACHE_LOG_DIR}/forum-rewrite-error.log
    CustomLog ${APACHE_LOG_DIR}/forum-rewrite-access.log combined
</VirtualHost>

# Notes:
# - enable mod_rewrite
# - ensure the web user can write FORUM_REPOSITORY_ROOT and the parent of FORUM_DATABASE_PATH
# - ensure the web user can write FORUM_STATIC_HTML_ROOT and its releases/ directory
# - the checked-in public/.htaccess routes content through PHP, which selects the active static release
# - do not force HTTP to HTTPS in the default vhost; plain HTTP remains a supported access path
# - do not emit Strict-Transport-Security by default; operators may add local HTTPS policy only after accepting the access-failure tradeoffs
# - browser OpenPGP uses /assets/openpgp_loader.js, selecting the modern v6 bundle on secure origins and a pinned v5 fallback on public HTTP