hestiacp/install/deb/templates/mail/apache2/default.stpl

<VirtualHost %ip%:%web_ssl_port%>
    ServerName %domain%
    ServerAlias %alias
    Alias / /var/lib/roundcube/
    Alias /error/ %home%/%user%/web/%root_domain%/document_errors/
    Alias /Microsoft-Server-ActiveSync /usr/share/z-push/index.php
    AliasMatch (?i)/Autodiscover/Autodiscover.xml "/usr/share/z-push/autodiscover/autodiscover.php"
    #SuexecUserGroup %user% %group%
    
    SSLEngine on
    SSLVerifyClient none
    SSLCertificateFile         %home%/%user%/conf/mail/%root_domain%/ssl/%root_domain%.crt
    SSLCertificateKeyFile      %home%/%user%/conf/mail/%root_domain%/ssl/%root_domain%.key

   IncludeOptional %home%/%user%/conf/web/%root_domain%/apache2.forcessl.conf*
    
    <Directory "/usr/share/tinymce/www/">
      Options Indexes MultiViews FollowSymLinks
      AllowOverride None
      Order allow,deny
      allow from all
    </Directory>

    <Directory /var/lib/roundcube/>
        Options +FollowSymLinks
        # This is needed to parse /var/lib/roundcube/.htaccess. See its
        # content before setting AllowOverride to None.
        AllowOverride All
        order allow,deny
        allow from all
    </Directory>

    <Directory /usr/share/z-push>
        # Don't list a directory index, follow symlinks (maybe state dir is somewhere linked)
        DirectoryIndex index.php
        Options -Indexes +FollowSymLinks

        # Security
        # Don't allow .htaccess Overrides, disallow access to files
        AllowOverride none
        <IfModule !mod_authz_core.c>
            Order allow,deny
            allow from all
        </IfModule>
        <IfModule mod_authz_core.c>
            Require all granted
        </IfModule>

        <Files "config.php">
          <IfModule !mod_authz_core.c>
            Deny from All
          </IfModule>
          <IfModule mod_authz_core.c>
            Require all denied
          </IfModule>
        </Files>
    </Directory>

    # Protecting basic directories:
    <Directory /var/lib/roundcube/config>
            Options -FollowSymLinks
            AllowOverride None
    </Directory>

    <Directory /var/lib/roundcube/temp>
            Options -FollowSymLinks
            AllowOverride None
        Order allow,deny
        Deny from all
    </Directory>

    <Directory /var/lib/roundcube/logs>
            Options -FollowSymLinks
            AllowOverride None
        Order allow,deny
        Deny from all
    </Directory>

    IncludeOptional %home%/%user%/conf/mail/%root_domain%/%web_system%.ssl.conf_*

</VirtualHost>