This is what I have in my 000-default-ssl.conf (although it can go in any enabled site conf file):
<VirtualHost *:443>
ServerName tiddlywiki.yourserver.com
ServerAlias yourserver.com
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
<Proxy *>
Order Deny,Allow
Require all granted (This line for Apache 2.4)
Allow access all (This line for Apache 2.2)
</Proxy>
RewriteEngine On
RewriteCond %{LA-U:REMOTE_USER} !^${TW5USER}$
RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|PUT|DELETE|POST)
RewriteRule .* - [R=405,L]
Header merge Cache-Control no-cache
Header set Access-Control-Allow-Origin "*"
AllowEncodedSlashes On
AllowCONNECT 443 8000 (This might not be necessary, specify the port Node is using)
ProxyRequests On
ProxyPass "/" "http://127.0.0.1:8000/" (Specify your IP and the port Node is using)
ProxyPassReverse "/" "http://127.0.0.1:8000" (Specify your IP and the port Node is using)
ProxyVia On (This might not be necessary)
ProxyPreserveHost On
SSLEngine On
SSLCertificateFile /etc/yourcert.pem
SSLCertificateKeyFile /etc/yourprivkey.pem
</VirtualHost>