AI overhaul

files/httpd.conf

@@ -139,10 +139,10 @@ LoadModule headers_module modules/mod_headers.so
 LoadModule setenvif_module modules/mod_setenvif.so
 LoadModule version_module modules/mod_version.so
 #LoadModule remoteip_module modules/mod_remoteip.so
-#LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_module modules/mod_proxy.so
 #LoadModule proxy_connect_module modules/mod_proxy_connect.so
 #LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
-#LoadModule proxy_http_module modules/mod_proxy_http.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
 #LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
 #LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
 #LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
@@ -240,6 +240,9 @@ ServerAdmin eric@eom.dev
 #
 ServerName eom.dev:443
 
+# Rendered separately so the membership proxy can be disabled safely.
+IncludeOptional conf/extra/membership.conf
+
 #
 # Deny access to the entirety of your server's filesystem. You must
 # explicitly permit access to web content directories in other 
@@ -357,7 +360,9 @@ LogLevel warn
     # define per-<VirtualHost> access logfiles, transactions will be
     # logged therein and *not* in this file.
     #
-    CustomLog /proc/self/fd/1 common
+    # Never log email verification tokens or OIDC callback authorization codes.
+    SetEnvIf Request_URI "^/members/" membership_sensitive
+    CustomLog /proc/self/fd/1 common env=!membership_sensitive
 
     #
     # If you prefer a logfile with access, agent, and referer information