{
  my $vhost = $nextcloud{'VirtualHost'} || '';
  my $wellknown = $nextcloud{'Wellknown'} || 'disabled';

  my $config = '
  <Directory "/usr/share/nextcloud">
    Options +FollowSymLinks
    AllowOverride All
    Require all granted

    <IfModule mod_dav.c>
      Dav off
    </IfModule>

    <IfModule mod_headers.c>
      Header always set Strict-Transport-Security "max-age=15552000"
    </IfModule>

    <FilesMatch \.php$>
      SetHandler "proxy:unix:/var/run/rh-php80-php-fpm/nethserver-nextcloud-php80.sock|fcgi://localhost"
    </FilesMatch>

    SetEnv HOME /usr/share/nextcloud
    SetEnv HTTP_HOME /usr/share/nextcloud
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
  </Directory>

  <Directory "/usr/share/nextcloud/data/">
    # just in case if .htaccess gets disabled
    Require all denied
  </Directory>';

    if ($vhost ne '') {
        $OUT .= "<VirtualHost *:80>\n";
        $OUT .= "    IncludeOptional conf.d/default-virtualhost.inc\n";
        $OUT .= "</VirtualHost>\n\n";

        $OUT .= "<VirtualHost *:80>\n";
        $OUT .= "   ServerName $vhost\n";
        $OUT .= "   RedirectMatch 301 ^(?!/.well-known/acme-challenge/).* https://$vhost\n";
        $OUT .= "</VirtualHost>\n\n";

        $OUT .= "<VirtualHost *:80>\n";
        $OUT .= "  ServerName $vhost\n";
        $OUT .= "  Redirect / https://$vhost/\n";
        $OUT .= "</VirtualHost>\n\n";

        $OUT .= "<VirtualHost *:443>\n";
        $OUT .= "  ServerName $vhost\n";
        $OUT .= "  SSLEngine on\n";
        $OUT .= "  RewriteCond %\{HTTPS\} !=on\n";
        $OUT .= "  RewriteRule (.*) https://%\{SERVER_NAME\}%\{REQUEST_URI\} [END,QSA,R=permanent]\n\n";
        $OUT .= "  Alias / \"/usr/share/nextcloud/\"";
        $OUT .= $config;
        $OUT .= "\n</VirtualHost>\n";
    } else {
        $OUT .= "  Alias /nextcloud \"/usr/share/nextcloud/\"";
        $OUT .= $config;
    }

    if ($wellknown eq 'enabled' && $vhost eq '') {
        $OUT .= "  \n\n# Enable webdav redirect\n";
        $OUT .= "  Redirect 301 /.well-known/carddav /nextcloud/remote.php/dav/\n";
        $OUT .= "  Redirect 301 /.well-known/caldav /nextcloud/remote.php/dav/\n";
        $OUT .= "  Redirect 301 /.well-known/webfinger /nextcloud/index.php/.well-known/webfinger\n";
        $OUT .= "  Redirect 301 /.well-known/nodeinfo /nextcloud/index.php/.well-known/nodeinfo\n";
   }
}
