diaspora.conf

# Make sure mod_ssl, mod_rewrite, mod_headers, mod_proxy,
# mod_proxy_http and mod_proxy_balancer are enabled

<VirtualHost *:80>
  ServerName diaspora.example.org
  ServerAlias www.diaspora.example.org
  
  RedirectPermanent / https://diaspora.examle.org/
</VirtualHost>
<VirtualHost *:443>
 ServerName diaspora.example.org
 ServerAlias www.diaspora.example.org
 
 DocumentRoot /path/to/diaspora/public

 RewriteEngine On

 RewriteCond %{HTTP_HOST} !^diaspora\.example\.org [NC]
 RewriteRule ^/(.*)$ https://diaspora\.example\.org/$1 [L,R,QSA]

 RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
 RewriteRule ^/(.*)$ balancer://upstream%{REQUEST_URI} [P,QSA,L]

 <Proxy balancer://upstream>
  BalancerMember http://127.0.0.1:3000
 </Proxy>

 ProxyRequests Off
 ProxyVia On  
 ProxyPreserveHost On
 RequestHeader set X_FORWARDED_PROTO https

 <Proxy *>
  # Apache < 2.4
  Order allow,deny
  Allow from all
  # Apache >= 2.4
  #Require all granted
 </Proxy>

 <Directory /path/to/diaspora/public>
  Options -MultiViews
  # Apache < 2.4
  Allow from all
  AllowOverride all
  # Apache >= 2.4
  #Require all granted
 </Directory>

 SSLEngine On
 SSLCertificateFile /path/to/cert
 SSLCertificateKeyFile /path/to/private_key
 
 # maybe not needed, need for example for startssl to point to a local
 # copy of https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
 SSLCertificateChainFile /path/to/chain_file


 # Based on https://wiki.mozilla.org/Security/Server_Side_TLS - consider as global configuration
 SSLProtocol             all -SSLv2 -SSLv3
 SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK
 SSLHonorCipherOrder on
 SSLCompression off
</VirtualHost>