{% if www_membership_enabled %}
ProxyRequests Off
ProxyPreserveHost On
# Service sign-up buttons link to /members; the app lives under /members/.
# Absolute target: TLS ends at ingress, so a relative one becomes http://...:443
RedirectMatch 301 "^/members$" "https://{{ www_hostname }}/members/"
ProxyPass "/members/" "http://membership:8000/members/" connectiontimeout=5 timeout=120
ProxyPassReverse "/members/" "http://membership:8000/members/"
<Location "/members/">
    # NetworkPolicy permits only Apache to assert these headers.
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Membership-Client-IP "expr=%{REMOTE_ADDR}"
    LimitRequestBody 262144
    # The Tor/public static mirror remains available, but account/billing flows
    # use only the canonical HTTPS origin registered in Dex and Stripe.
    <If "%{HTTP_HOST} != '{{ www_hostname }}'">
        Require all denied
    </If>
</Location>
<Location "/members/profile/">
    # Bounded JPEG upload plus multipart overhead; other routes remain 256 KiB.
    LimitRequestBody 2097152
</Location>
{% else %}
# Membership proxy disabled. Existing stateful workloads are not deleted.
<Location "/members/">
    Require all denied
</Location>
{% endif %}