{% if www_membership_enabled %}
ProxyRequests Off
ProxyPreserveHost On
ProxyPass "/members/" "http://membership:8000/members/" connectiontimeout=5 timeout=120
ProxyPassReverse "/members/" "http://membership:8000/members/"
<Location "/members/">
    # NetworkPolicy permits only Apache to assert these headers.
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Membership-Client-IP "expr=%{REMOTE_ADDR}"
    LimitRequestBody 262144
    # The Tor/public static mirror remains available, but account/billing flows
    # use only the canonical HTTPS origin registered in Dex and Stripe.
    <If "%{HTTP_HOST} != '{{ www_hostname }}'">
        Require all denied
    </If>
</Location>
{% else %}
# Membership proxy disabled. Existing stateful workloads are not deleted.
<Location "/members/">
    Require all denied
</Location>
{% endif %}