proxmox_apache.conf

<IfModule mod_ssl.c>

    SSLStaplingCache        shmcb:/var/run/ocsp(128000)

    <VirtualHost *:80>

        ServerName #nome-dominio
        ServerSignature Off
        RewriteEngine on
        RewriteCond %{HTTPS} !=on
        RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [NE,R,L]
        
    </VirtualHost>

    <VirtualHost *:443>
    
        ServerName #nome-dominio
        
        Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
        SSLEngine on
        SSLProxyEngine on
        SSLProxyVerify none
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off
        SSLCipherSUite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
        SSLProtocol TLSv1.2 TLSv1.3
        SSLCompression off
        SSLUseStapling          on
        SSLStaplingResponderTimeout 5
        SSLStaplingReturnResponderErrors off
        
        ProxyRequests off
        ProxyPreserveHost On
        
        <Location />
        
            ProxyPass https://192.168.x.x:8006/
            ProxyPassReverse https://192.168.x.x:8006/
        
        </Location>
        
        <LocationMatch ^/(api2/json/nodes/[^\/]+/[^\/]+/[^\/]+/vncwebsocket.*)$>
            
            ProxyPass wss://192.168.x.x:8006/$1 retry=0
        
        </LocationMatch>
        
        <Location /websockify>
        
            ProxyPass ws://192.168.x.x:8006
            ProxyPassReverse ws://192.168.x.x:8006
        
        </Location>
        
        <LocationMatch ^/(api2/json/nodes/[^\/]+/vncwebsocket.*)$>
        
            ProxyPass wss://192.168.x.x:8006/$1 retry=0
        
        </LocationMatch>

# attivare dopo aver creato il certificato

#        SSLCertificateFile /etc/letsencrypt/live/<nome-dominio>/fullchain.pem
#        SSLCertificateKeyFile /etc/letsencrypt/live/<nome-dominio>/privkey.pem
#        Include /etc/letsencrypt/options-ssl-apache.conf
    
    </VirtualHost>

</IfModule>