diff --git a/manifests/apache/common.pp b/manifests/apache/common.pp
new file mode 100644
index 0000000..f1c5ab2
--- /dev/null
+++ b/manifests/apache/common.pp
@@ -0,0 +1,4 @@
+class profile::apache::common {
+  include ::apache
+  include ::apache::mod::status
+}
diff --git a/manifests/apache/mod_proxy_fcgi.pp b/manifests/apache/mod_proxy_fcgi.pp
index a79bccd..2d2953b 100644
--- a/manifests/apache/mod_proxy_fcgi.pp
+++ b/manifests/apache/mod_proxy_fcgi.pp
@@ -1,4 +1,5 @@
 # Profile for apache mod proxy fcgi
 class profile::apache::mod_proxy_fcgi {
-    ::apache::mod {'proxy_fcgi':}
+  include ::profile::apache::common
+  ::apache::mod {'proxy_fcgi':}
 }
diff --git a/manifests/apache/rewrite_domains.pp b/manifests/apache/rewrite_domains.pp
index be88307..e78e210 100644
--- a/manifests/apache/rewrite_domains.pp
+++ b/manifests/apache/rewrite_domains.pp
@@ -1,46 +1,46 @@
 # Simple apache domain rewriting
 class profile::apache::rewrite_domains {
-  include ::apache
+  include ::profile::apache::common
 
   include ::profile::ssl
 
   $ssl_protocol = hiera('apache::ssl_protocol')
   $ssl_honorcipherorder = hiera('apache::ssl_honorcipherorder')
   $ssl_cipher = hiera('apache::ssl_cipher')
   $hsts_header = hiera('apache::hsts_header')
 
   $rewrite_domains = hiera_hash('apache::rewrite_domains')
   each($rewrite_domains) |$name, $data| {
     $ssl_cert_name = $data['ssl_cert_name']
 
     $ssl_cert = $::profile::ssl::certificate_paths[$ssl_cert_name]
     $ssl_ca   = $::profile::ssl::ca_paths[$ssl_cert_name]
     $ssl_key  = $::profile::ssl::private_key_paths[$ssl_cert_name]
 
     ::apache::vhost {"${name}_non-ssl":
       servername      => $name,
       port            => '80',
       docroot         => '/var/www',
       redirect_status => 'permanent',
       redirect_dest   => "https://${name}/",
     }
 
 
     ::apache::vhost {"${name}_ssl":
       servername           => $name,
       port                 => '443',
       ssl                  => true,
       ssl_protocol         => $ssl_protocol,
       ssl_honorcipherorder => $ssl_honorcipherorder,
       ssl_cipher           => $ssl_cipher,
       ssl_cert             => $ssl_cert,
       ssl_ca               => $ssl_ca,
       ssl_key              => $ssl_key,
       headers              => [$hsts_header],
       docroot              => '/var/www',
       rewrites             => [
         { rewrite_rule => $data['rewrites'], },
       ],
     }
   }
 }
diff --git a/manifests/apache/simple_server.pp b/manifests/apache/simple_server.pp
index 75734ca..3e52ea1 100644
--- a/manifests/apache/simple_server.pp
+++ b/manifests/apache/simple_server.pp
@@ -1,3 +1,3 @@
 class profile::apache::simple_server {
-  include ::apache
+  include ::profile::apache::common
 }
diff --git a/manifests/munin/master.pp b/manifests/munin/master.pp
index 9bf00e5..91886a2 100644
--- a/manifests/munin/master.pp
+++ b/manifests/munin/master.pp
@@ -1,59 +1,59 @@
 # Munin master class
 class profile::munin::master {
   $master_hostname = hiera('munin::master::hostname')
   $master_hostname_domain = join(delete_at(split($master_hostname, '[.]'), 0), '.')
   $master_hostname_target = "${::hostname}.${master_hostname_domain}."
 
   class { '::munin::master':
     extra_config => ["cgiurl_graph http://$master_hostname"],
   }
 
-  include ::apache
+  include ::profile::apache::common
   include ::apache::mod::rewrite
   include ::apache::mod::fcgid
 
   apache::vhost { $master_hostname:
     port        => 80,
     docroot     => '/var/www/html',
     rewrites    => [
       {
         comment      => 'static resources',
         rewrite_rule => [
           '^/favicon.ico /etc/munin/static/favicon.ico [L]',
           '^/static/(.*) /etc/munin/static/$1          [L]',
         ],
       },
       {
         comment      => 'HTML',
         rewrite_cond => [
           '%{REQUEST_URI} .html$ [or]',
           '%{REQUEST_URI} =/',
         ],
         rewrite_rule => [
           '^/(.*)          /usr/lib/munin/cgi/munin-cgi-html/$1 [L]',
         ],
       },
       {
         comment      => 'Images',
         rewrite_rule => [
           '^/munin-cgi/munin-cgi-graph/(.*) /usr/lib/munin/cgi/munin-cgi-graph/$1 [L]',
           '^/(.*) /usr/lib/munin/cgi/munin-cgi-graph/$1 [L]',
         ],
       },
     ],
     directories => [
       { 'path'       => '/usr/lib/munin/cgi',
         'options'    => '+ExecCGI',
         'sethandler' => 'fcgid-script' },
     ],
   }
 
   $bind_key = hiera('bind::update_key')
 
   @@resource_record { 'munin/CNAME':
     record  => $master_hostname,
     type    => 'CNAME',
     data    => $master_hostname_target,
     keyfile => "/etc/bind/keys/${bind_key}",
   }
 }
diff --git a/manifests/munin/stats_export.pp b/manifests/munin/stats_export.pp
index 96487af..17d88e8 100644
--- a/manifests/munin/stats_export.pp
+++ b/manifests/munin/stats_export.pp
@@ -1,84 +1,84 @@
 # stats_export master class
 class profile::munin::stats_export {
   $vhost_name = hiera('stats_export::vhost::name')
   $vhost_docroot = hiera('stats_export::vhost::docroot')
   $vhost_ssl_protocol = hiera('stats_export::vhost::ssl_protocol')
   $vhost_ssl_honorcipherorder = hiera('stats_export::vhost::ssl_honorcipherorder')
   $vhost_ssl_cipher = hiera('stats_export::vhost::ssl_cipher')
   $vhost_hsts_header = hiera('stats_export::vhost::hsts_header')
 
   $export_file = "${vhost_docroot}/history_counters.json"
 
   $packages = ['python3-click']
 
   package {$packages:
     ensure => present,
   }
 
   file {'/usr/local/bin/export-rrd':
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0755',
     source  => 'puppet:///modules/profile/munin/stats_export/export-rrd',
     require => Package[$packages],
   }
 
   cron {'stats_export':
     ensure   => present,
     user     => 'www-data',
     command  => "/usr/local/bin/export-rrd > ${export_file}.tmp && /bin/mv ${export_file}.tmp ${export_file}",
     hour     => fqdn_rand(24, 'stats_export_hour'),
     minute   => fqdn_rand(60, 'stats_export_minute'),
     month    => '*',
     monthday => '*',
     weekday  => '*',
     require  => [
       File['/usr/local/bin/export-rrd'],
       File[$vhost_docroot],
     ],
   }
 
   file {$vhost_docroot:
     ensure  => directory,
     owner   => 'www-data',
     group   => 'www-data',
     mode    => '0755',
   }
 
+  include ::profile::apache::common
   include ::profile::ssl
-  include ::apache
 
   ::apache::vhost {"${vhost_name}_non-ssl":
     servername      => $vhost_name,
     port            => '80',
     docroot         => $vhost_docroot,
     redirect_status => 'permanent',
     redirect_dest   => "https://${vhost_name}/",
   }
 
   $ssl_cert_name = 'stats_export_softwareheritage_org'
   $ssl_cert = $::profile::ssl::certificate_paths[$ssl_cert_name]
   $ssl_ca   = $::profile::ssl::ca_paths[$ssl_cert_name]
   $ssl_key  = $::profile::ssl::private_key_paths[$ssl_cert_name]
 
   ::apache::vhost {"${vhost_name}_ssl":
     servername           => $vhost_name,
     port                 => '443',
     ssl                  => true,
     ssl_protocol         => $vhost_ssl_protocol,
     ssl_honorcipherorder => $vhost_ssl_honorcipherorder,
     ssl_cipher           => $vhost_ssl_cipher,
     ssl_cert             => $ssl_cert,
     ssl_ca               => $ssl_ca,
     ssl_key              => $ssl_key,
     headers              => [$vhost_hsts_header],
     docroot              => $vhost_docroot,
     require              => [
         File[$ssl_cert],
         File[$ssl_ca],
         File[$ssl_key],
     ],
   }
 
 }
diff --git a/manifests/phabricator.pp b/manifests/phabricator.pp
index d5b2840..24b322a 100644
--- a/manifests/phabricator.pp
+++ b/manifests/phabricator.pp
@@ -1,276 +1,276 @@
 # Setup an instance of phabricator
 class profile::phabricator {
   $phabricator_basepath = hiera('phabricator::basepath')
   $phabricator_user = hiera('phabricator::user')
   $phabricator_vcs_user = hiera('phabricator::vcs_user')
 
   $phabricator_db_root_password = hiera('phabricator::mysql::root_password')
   $phabricator_db_basename = hiera('phabricator::mysql::database_prefix')
   $phabricator_db_user = hiera('phabricator::mysql::username')
   $phabricator_db_password = hiera('phabricator::mysql::password')
 
   $phabricator_db_max_allowed_packet = hiera('phabricator::mysql::conf::max_allowed_packet')
   $phabricator_db_sql_mode = hiera('phabricator::mysql::conf::sql_mode')
   $phabricator_db_ft_stopword_file = hiera('phabricator::mysql::conf::ft_stopword_file')
   $phabricator_db_ft_min_word_len = hiera('phabricator::mysql::conf::ft_min_word_len')
   $phabricator_db_ft_boolean_syntax = hiera('phabricator::mysql::conf::ft_boolean_syntax')
   $phabricator_db_innodb_buffer_pool_size = hiera('phabricator::mysql::conf::innodb_buffer_pool_size')
   $phabricator_db_innodb_file_per_table = hiera('phabricator::mysql::conf::innodb_file_per_table')
   $phabricator_db_innodb_flush_method = hiera('phabricator::mysql::conf::innodb_flush_method')
   $phabricator_db_innodb_log_file_size = hiera('phabricator::mysql::conf::innodb_log_file_size')
 
   $phabricator_fpm_listen = hiera('phabricator::php::fpm_listen')
   $phabricator_max_size = hiera('phabricator::php::max_file_size')
   $phabricator_opcache_validate_timestamps = hiera('phabricator::php::opcache_validate_timestamps')
 
   $phabricator_notification_listen = hiera('phabricator::notification::listen')
   $phabricator_notification_client_host = hiera('phabricator::notification::client_host')
   $phabricator_notification_client_port = hiera('phabricator::notification::client_port')
 
   $phabricator_vhost_name = hiera('phabricator::vhost::name')
   $phabricator_vhost_docroot = hiera('phabricator::vhost::docroot')
   $phabricator_vhost_basic_auth_file = "${phabricator_basepath}/http_auth"
   $phabricator_vhost_basic_auth_content = hiera('phabricator::vhost::basic_auth_content')
   $phabricator_vhost_ssl_protocol = hiera('phabricator::vhost::ssl_protocol')
   $phabricator_vhost_ssl_honorcipherorder = hiera('phabricator::vhost::ssl_honorcipherorder')
   $phabricator_vhost_ssl_cipher = hiera('phabricator::vhost::ssl_cipher')
   $phabricator_vhost_hsts_header = hiera('phabricator::vhost::hsts_header')
 
   include ::systemd
 
   $homedirs = {
     $phabricator_user     => $phabricator_basepath,
     $phabricator_vcs_user => "${phabricator_basepath}/vcshome",
   }
 
   $homedir_modes = {
     $phabricator_user     => '0644',
     $phabricator_vcs_user => '0640',
   }
 
   each([$phabricator_user, $phabricator_vcs_user]) |$name| {
     user {$name:
       ensure => present,
       system => true,
       shell  => '/bin/bash',
       home   => $homedirs[$name],
     }
 
     file {$homedirs[$name]:
       ensure => directory,
       owner  => $name,
       group  => $name,
       mode   => $homedir_modes[$name],
     }
   }
 
   ::sudo::conf {'phabricator-ssh':
     ensure  => present,
     content => "${phabricator_vcs_user} ALL=(${phabricator_user}) SETENV: NOPASSWD: /usr/bin/git-upload-pack, /usr/bin/git-receive-pack, /usr/bin/hg",
   }
 
   ::sudo::conf {'phabricator-http':
     ensure  => present,
     content => "www-data ALL=(${phabricator_user}) SETENV: NOPASSWD: /usr/bin/git-http-backend, /usr/bin/hg",
     require => File['/usr/bin/git-http-backend'],
   }
 
   file {'/usr/bin/git-http-backend':
     ensure => link,
     target => '/usr/lib/git-core/git-http-backend',
   }
 
   $phabricator_ssh_hook = '/usr/bin/phabricator-ssh-hook.sh'
   $phabricator_ssh_config = '/etc/ssh/ssh_config.phabricator'
 
   file {$phabricator_ssh_hook:
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0755',
     content => template('profile/phabricator/phabricator-ssh-hook.sh.erb'),
   }
 
   file {$phabricator_ssh_config:
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0600',
     content => template('profile/phabricator/sshd_config.phabricator.erb'),
     require => File[$phabricator_ssh_hook],
   }
 
   file {'/etc/systemd/system/phabricator-sshd.service':
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0644',
     content => template('profile/phabricator/phabricator-sshd.service.erb'),
     notify  => Exec['systemd-daemon-reload'],
     require => File[$phabricator_ssh_config],
   }
 
   service {'phabricator-sshd':
     ensure  => 'running',
     enable  => true,
     require => [
       File['/etc/systemd/system/phabricator-sshd.service'],
       Exec['systemd-daemon-reload'],
     ],
   }
 
   include ::mysql::client
 
   class {'::mysql::server':
     root_password    => $phabricator_db_root_password,
     override_options => {
       mysqld => {
         max_allowed_packet      => $phabricator_db_max_allowed_packet,
         sql_mode                => $phabricator_db_sql_mode,
         ft_stopword_file        => $phabricator_db_ft_stopword_file,
         ft_min_word_len         => $phabricator_db_ft_min_word_len,
         ft_boolean_syntax       => $phabricator_db_ft_boolean_syntax,
         innodb_buffer_pool_size => $phabricator_db_innodb_buffer_pool_size,
         innodb_file_per_table   => $phabricator_db_innodb_file_per_table,
         innodb_flush_method     => $phabricator_db_innodb_flush_method,
         innodb_log_file_size    => $phabricator_db_innodb_log_file_size,
       }
     }
   }
 
   $mysql_username = "${phabricator_db_user}@localhost"
   $mysql_tables = "${phabricator_db_basename}_%.*"
 
   mysql_user {$mysql_username:
     ensure        => present,
     password_hash => mysql_password($phabricator_db_password),
   }
 
   mysql_grant {"${mysql_username}/${mysql_tables}":
     user       => $mysql_username,
     table      => $mysql_tables,
     privileges => ['ALL'],
     require    => Mysql_user[$mysql_username],
   }
 
   include ::php::cli
 
   include ::php::fpm::daemon
 
   ::php::ini {'/etc/php5/cli/php.ini':}
 
   ::php::fpm::conf {'phabricator':
     listen          => $phabricator_fpm_listen,
     user            => 'www-data',
     php_admin_value => {
       post_max_size                 => $phabricator_max_size,
       upload_max_filesize           => $phabricator_max_size,
       'opcache.validate_timestamps' => $phabricator_opcache_validate_timestamps,
     },
   }
 
   ::php::module {[
     'apcu',
     'curl',
     'gd',
     'mailparse',
     'mysql',
   ]:
   }
 
   include ::profile::ssl
-  include ::apache
+  include ::profile::apache::common
   include ::apache::mod::proxy
   include ::profile::apache::mod_proxy_fcgi
 
   ::apache::mod {'proxy_wstunnel':}
 
   ::apache::vhost {"${phabricator_vhost_name}_non-ssl":
     servername      => $phabricator_vhost_name,
     port            => '80',
     docroot         => $phabricator_vhost_docroot,
     redirect_status => 'permanent',
     redirect_dest   => "https://${phabricator_vhost_name}/",
   }
 
   $ssl_cert_name = 'star_softwareheritage_org'
   $ssl_cert = $::profile::ssl::certificate_paths[$ssl_cert_name]
   $ssl_ca   = $::profile::ssl::ca_paths[$ssl_cert_name]
   $ssl_key  = $::profile::ssl::private_key_paths[$ssl_cert_name]
 
   ::apache::vhost {"${phabricator_vhost_name}_ssl":
     servername           => $phabricator_vhost_name,
     port                 => '443',
     ssl                  => true,
     ssl_protocol         => $phabricator_vhost_ssl_protocol,
     ssl_honorcipherorder => $phabricator_vhost_ssl_honorcipherorder,
     ssl_cipher           => $phabricator_vhost_ssl_cipher,
     ssl_cert             => $ssl_cert,
     ssl_ca               => $ssl_ca,
     ssl_key              => $ssl_key,
     headers              => [$phabricator_vhost_hsts_header],
     docroot              => $phabricator_vhost_docroot,
     rewrites             => [
       { rewrite_rule => '^/rsrc/(.*) - [L,QSA]' },
       { rewrite_rule => '^/favicon.ico - [L,QSA]' },
       { rewrite_rule => "^/ws/(.*)$ ws://${phabricator_notification_listen}/\$1 [L,P]" },
       { rewrite_rule => "^(.*)$ fcgi://${phabricator_fpm_listen}${phabricator_vhost_docroot}/index.php?__path__=\$1 [B,L,P,QSA]" },
     ],
     require              => [
         File[$ssl_cert],
         File[$ssl_ca],
         File[$ssl_key],
     ],
   }
 
   file {$phabricator_vhost_basic_auth_file:
     ensure  => absent,
   }
 
   # Uses:
     # $phabricator_basepath
     # $phabricator_user
   file {'/etc/systemd/system/phabricator-phd.service':
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0644',
     content => template('profile/phabricator/phabricator-phd.service.erb'),
     notify  => Exec['systemd-daemon-reload'],
   }
 
   service {'phabricator-phd':
     ensure  => 'running',
     enable  => true,
     require => [
       File['/etc/systemd/system/phabricator-phd.service'],
       Exec['systemd-daemon-reload'],
     ],
   }
 
   # Uses:
     # $phabricator_basepath
     # $phabricator_user
     # $phabricator_notification_*
     file {'/etc/systemd/system/phabricator-aphlict.service':
       ensure  => present,
       owner   => 'root',
       group   => 'root',
       mode    => '0644',
       content => template('profile/phabricator/phabricator-aphlict.service.erb'),
       notify  => Exec['systemd-daemon-reload'],
     }
 
     service {'phabricator-aphlict':
       ensure  => 'running',
       enable  => true,
       require => [
         File['/etc/systemd/system/phabricator-aphlict.service'],
         Exec['systemd-daemon-reload'],
       ],
     }
 
   package {'python-pygments':
     ensure => installed,
   }
 }
diff --git a/manifests/swh/deploy/webapp.pp b/manifests/swh/deploy/webapp.pp
index 9a5aca7..deed6af 100644
--- a/manifests/swh/deploy/webapp.pp
+++ b/manifests/swh/deploy/webapp.pp
@@ -1,184 +1,184 @@
 # WebApp deployment
 class profile::swh::deploy::webapp {
   $conf_directory = hiera('swh::deploy::webapp::conf_directory')
   $conf_file = hiera('swh::deploy::webapp::conf_file')
   $user = hiera('swh::deploy::webapp::user')
   $group = hiera('swh::deploy::webapp::group')
 
   $conf_storage_class = hiera('swh::deploy::webapp::conf::storage_class')
   $conf_storage_args = hiera('swh::deploy::webapp::conf::storage_args')
   $conf_log_dir = hiera('swh::deploy::webapp::conf::log_dir')
   $conf_secret_key = hiera('swh::deploy::webapp::conf::secret_key')
 
   $uwsgi_listen_address = hiera('swh::deploy::webapp::uwsgi::listen')
   $uwsgi_protocol = hiera('swh::deploy::webapp::uwsgi::protocol')
   $uwsgi_workers = hiera('swh::deploy::webapp::uwsgi::workers')
   $uwsgi_max_requests = hiera('swh::deploy::webapp::uwsgi::max_requests')
   $uwsgi_max_requests_delta = hiera('swh::deploy::webapp::uwsgi::max_requests_delta')
   $uwsgi_reload_mercy = hiera('swh::deploy::webapp::uwsgi::reload_mercy')
 
   $swh_packages = ['python3-swh.web.ui']
 
   $vhost_name = hiera('swh::deploy::webapp::vhost::name')
   $vhost_aliases = hiera('swh::deploy::webapp::vhost::aliases')
   $vhost_docroot = hiera('swh::deploy::webapp::vhost::docroot')
   $vhost_basic_auth_file = "${conf_directory}/http_auth"
   $vhost_basic_auth_content = hiera('swh::deploy::webapp::vhost::basic_auth_content')
   $vhost_ssl_protocol = hiera('swh::deploy::webapp::vhost::ssl_protocol')
   $vhost_ssl_honorcipherorder = hiera('swh::deploy::webapp::vhost::ssl_honorcipherorder')
   $vhost_ssl_cipher = hiera('swh::deploy::webapp::vhost::ssl_cipher')
 
   $open_endpoints = hiera_array('swh::deploy::webapp::open_endpoints')
 
   $endpoint_directories = $open_endpoints.map |$endpoint| {
     { path     => $endpoint,
       provider => 'location',
       allow    => 'from all',
       satisfy  => 'Any',
       headers  => ['add Access-Control-Allow-Origin "*"'],
     }
   }
 
   include ::uwsgi
 
   package {$swh_packages:
     ensure  => latest,
     require => Apt::Source['softwareheritage'],
     notify  => [
       Service['uwsgi'],
       Exec['update-static'],
     ],
   }
 
   file {$conf_directory:
     ensure => directory,
     owner  => 'root',
     group  => $group,
     mode   => '0755',
   }
 
   file {$conf_log_dir:
     ensure => directory,
     owner  => 'root',
     group  => $group,
     mode   => '0770',
   }
 
   file {$vhost_docroot:
     ensure => directory,
     owner  => 'root',
     group  => $group,
     mode   => '0755',
   }
 
   file {$conf_file:
     ensure  => present,
     owner   => 'root',
     group   => $group,
     mode    => '0640',
     content => template('profile/swh/deploy/webapp/webapp.ini.erb'),
     notify  => Service['uwsgi'],
   }
 
   ::uwsgi::site {'swh-webapp':
     ensure   => enabled,
     settings => {
       plugin              => 'python3',
       protocol            => $uwsgi_protocol,
       socket              => $uwsgi_listen_address,
       workers             => $uwsgi_workers,
       max_requests        => $uwsgi_max_requests,
       max_requests_delta  => $uwsgi_max_requests_delta,
       worker_reload_mercy => $uwsgi_reload_mercy,
       reload_mercy        => $uwsgi_reload_mercy,
       uid                 => $user,
       gid                 => $user,
       umask               => '022',
       module              => 'swh.web.ui.main',
       callable            => 'run_from_webserver',
     }
   }
 
   exec {'update-static':
     path        => ['/bin', '/usr/bin'],
     command     => "rsync -az --delete /usr/lib/python3/dist-packages/swh/web/ui/static/ ${vhost_docroot}/static/",
     refreshonly => true,
     require     => [
       File[$vhost_docroot],
       Package[$swh_packages],
     ],
   }
 
   include ::profile::ssl
-  include ::apache
+  include ::profile::apache::common
   include ::apache::mod::proxy
   include ::apache::mod::headers
 
   ::apache::mod {'proxy_uwsgi':}
 
   ::apache::vhost {"${vhost_name}_non-ssl":
     servername      => $vhost_name,
     serveraliases   => $vhost_aliases,
     port            => '80',
     docroot         => $vhost_docroot,
     redirect_status => 'permanent',
     redirect_dest   => "https://${vhost_name}/",
   }
 
   $ssl_cert_name = 'star_softwareheritage_org'
   $ssl_cert = $::profile::ssl::certificate_paths[$ssl_cert_name]
   $ssl_ca   = $::profile::ssl::ca_paths[$ssl_cert_name]
   $ssl_key  = $::profile::ssl::private_key_paths[$ssl_cert_name]
 
   ::apache::vhost {"${vhost_name}_ssl":
     servername           => $vhost_name,
     serveraliases        => $vhost_aliases,
     port                 => '443',
     ssl                  => true,
     ssl_protocol         => $vhost_ssl_protocol,
     ssl_honorcipherorder => $vhost_ssl_honorcipherorder,
     ssl_cipher           => $vhost_ssl_cipher,
     ssl_cert             => $ssl_cert,
     ssl_ca               => $ssl_ca,
     ssl_key              => $ssl_key,
     docroot              => $vhost_docroot,
     proxy_pass           => [
       { path => '/static',
         url  => '!',
       },
       { path => '/favicon.ico',
         url  => '!',
       },
       { path => '/',
         url  => "uwsgi://${uwsgi_listen_address}/",
       },
     ],
     directories          => [
       { path           => '/',
         provider       => 'location',
         auth_type      => 'Basic',
         auth_name      => 'Software Heritage development',
         auth_user_file => $vhost_basic_auth_file,
         auth_require   => 'valid-user',
       },
       { path    => "${vhost_docroot}/static",
         options => ['-Indexes'],
       },
     ] + $endpoint_directories,
     require              => [
       File[$vhost_basic_auth_file],
       File[$ssl_cert],
       File[$ssl_ca],
       File[$ssl_key],
       Exec['update-static'],
     ],
   }
 
   file {$vhost_basic_auth_file:
     ensure  => present,
     owner   => 'root',
     group   => 'www-data',
     mode    => '0640',
     content => $vhost_basic_auth_content,
   }
 }