Memberships

conf/httpd.conf

@@ -139,10 +139,10 @@ LoadModule headers_module modules/mod_headers.so
 LoadModule setenvif_module modules/mod_setenvif.so
 LoadModule version_module modules/mod_version.so
 #LoadModule remoteip_module modules/mod_remoteip.so
-#LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_module modules/mod_proxy.so
 #LoadModule proxy_connect_module modules/mod_proxy_connect.so
 #LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
-#LoadModule proxy_http_module modules/mod_proxy_http.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
 #LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
 #LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
 #LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
@@ -240,6 +240,18 @@ ServerAdmin eric@eom.dev
 #
 ServerName eom.dev:443
 
+# Membership is isolated behind Apache. The outer TLS terminator must expose
+# this listener only over its private network; never publish port 8080 directly.
+ProxyRequests Off
+ProxyPreserveHost On
+ProxyPass "/members/" "http://membership:8000/members/" connectiontimeout=5 timeout=120
+ProxyPassReverse "/members/" "http://membership:8000/members/"
+<Location "/members/">
+    RequestHeader set X-Forwarded-Proto "https"
+    RequestHeader set X-Membership-Client-IP "expr=%{REMOTE_ADDR}"
+    LimitRequestBody 262144
+</Location>
+
 #
 # Deny access to the entirety of your server's filesystem. You must
 # explicitly permit access to web content directories in other 
@@ -357,7 +369,10 @@ LogLevel warn
     # define per-<VirtualHost> access logfiles, transactions will be
     # logged therein and *not* in this file.
     #
-    CustomLog /proc/self/fd/1 common
+    # Avoid logging email bearer tokens and OIDC authorization codes, including
+    # in request lines/query strings. Apply the same policy at the TLS edge.
+    SetEnvIf Request_URI "^/members/" membership_sensitive
+    CustomLog /proc/self/fd/1 common env=!membership_sensitive
 
     #
     # If you prefer a logfile with access, agent, and referer information