<VirtualHost *:3690>
    LogLevel trace6
    RewriteEngine On
    ErrorDocument 401 /auth/failed

    RewriteCond %{REQUEST_URI} !^/auth/
    RewriteCond %{REQUEST_URI} !^/2fa/
    RewriteCond %{HTTP_COOKIE} !^.*2FA_Auth=([a-zA-Z0-9]+)
    RewriteRule ^(.*)$ https://repo2fa.svnplus.com/auth/auth?$1?%{QUERY_STRING} [L,R=401]

    RewriteCond %{REQUEST_URI} !^/auth/
    RewriteCond %{REQUEST_URI} !^/2fa/
    RewriteCond %{HTTP_COOKIE} ^.*2FA_Auth=([a-zA-Z0-9]+)
    RewriteCond /opt/2fa/state/%1 !-f
    RewriteRule ^(.*)$ https://repo2fa.svnplus.com/auth/auth?$1?%{QUERY_STRING} [L,R=401]

    ScriptAlias /auth/ /opt/2fa/script/

    <Directory /opt/2fa/script>
        AuthType Digest
        AuthName "SVNPlus Subversion repository"
        AuthDigestDomain /
        AuthDigestProvider file
        AuthUserFile /opt/passwd
        Require valid-user
    </Directory>

    <Location /repo>
        DAV svn
        SVNParentPath /opt/repo

        AuthName "SVNPlus Subversion repository"
        AuthType Digest
        AuthUserFile /opt/passwd

        AuthzSVNReposRelativeAccessFile authz
        Satisfy Any
        Require valid-user
    </Location>
</VirtualHost>