###########
# Ollama  #
###########
<IfModule mod_ssl.c>
<VirtualHost *:80>
    ServerName ${FQDN}

    # Force https.
    UseCanonicalName on
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =${FQDN}

    # Ignore rewrite rules for 127.0.0.1
    RewriteCond %{HTTP_HOST} !=127.0.0.1
    RewriteCond %{REMOTE_ADDR} !=127.0.0.1

    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
</IfModule>

<IfModule mod_ssl.c>
<VirtualHost *:443> ${FQDN}
UseCanonicalName on

    Keepalive On
    RewriteEngine on

    ServerName ${FQDN}

    # See https://github.com/ollama/ollama/issues/1053#issuecomment-2253445923
    RewriteCond %{HTTP:Authorization} !^Bearer\s+${AUTH_TOKEN}$
    RewriteRule ^ - [R=401,L]

    SSLCompression off

    ProxyRequests Off
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"
    RequestHeader set X-Forwarded-Host "${FQDN}"
    RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
    RequestHeader set Host "${FQDN}"

    ProxyPass / http://127.0.0.1:11434/ connectiontimeout=300 timeout=300 Keepalive=On max=50
    ProxyPassReverse / http://127.0.0.1:11434/

    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/${FQDN}/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/${FQDN}/privkey.pem
</VirtualHost>
</IfModule>
