mailman3-httpd.conf

Alias /static "@VARDIR@/web/static"

<Directory "@VARDIR@/web/static">
    Require all granted
</Directory>

<IfModule mod_headers.c>
    # discard received X-Forwarded-For header to avoid logging more than one IP address in mailman's access_log
    RequestHeader unset X-Forwarded-For

    RequestHeader unset X-Forwarded-Proto
    <If "%{HTTPS} =~ /on/">
        RequestHeader set X-Forwarded-Proto "https"
    </If>
</IfModule>

<IfModule mod_proxy.c>
    ProxyPreserveHost On
    ProxyTimeout 60
    ProxyPass "/mailman3"     "http://127.0.0.1:@WEBPORT@/mailman3"
    ProxyPass "/archives"     "http://127.0.0.1:@WEBPORT@/archives"
    ProxyPass "/accounts"     "http://127.0.0.1:@WEBPORT@/accounts"
    ProxyPass "/admin"        "http://127.0.0.1:@WEBPORT@/admin"
    ProxyPass "/user-profile" "http://127.0.0.1:@WEBPORT@/user-profile"
    ProxyPass "/postorius"    "http://127.0.0.1:@WEBPORT@/postorius"
    ProxyPass "/hyperkitty"   "http://127.0.0.1:@WEBPORT@/hyperkitty"
</IfModule>

<LocationMatch ^/(mailman3|archives|accounts|user-profile|postorius|hyperkitty)>
    <IfModule mod_ssl.c>
        SSLRequireSSL
    </IfModule>
</LocationMatch>

<Location /admin>
    # Django admin portal
    <IfModule mod_ssl.c>
        SSLRequireSSL
    </IfModule>

    Require local
    # add your local IP ranges
    # Require ip 192.168.1.0/24
</Location>