diff options
Diffstat (limited to 'modules/apache')
39 files changed, 275 insertions, 109 deletions
diff --git a/modules/apache/manifests/base.pp b/modules/apache/manifests/base.pp index 1af8c256..4e1d6ed4 100644 --- a/modules/apache/manifests/base.pp +++ b/modules/apache/manifests/base.pp @@ -1,34 +1,34 @@ class apache::base { + include apache::var - # number of time the log file are rotated before being removed - $httpdlogs_rotate = '24' + $conf_d = '/etc/httpd/conf/conf.d' - $apache_user = 'apache' - $apache_group = 'apache' - - package { 'apache-mpm-prefork': } - - if ($lsbdistrelease == '1') or ($lsbdistid == 'MandrivaLinux') { - package { 'apache-conf': } - } else { - package { 'apache': } + package { 'apache': + alias => 'apache-server', } service { 'httpd': alias => 'apache', - subscribe => [ Package['apache-mpm-prefork'] ], + subscribe => [ Package['apache-server'] ], } - exec { 'service httpd configtest': + exec { 'apachectl configtest': refreshonly => true, notify => Service['apache'], } apache::config { - '/etc/httpd/conf.d/customization.conf': - content => template('apache/customization.conf'); + "${conf_d}/no_hidden_file_dir.conf": + content => template('apache/no_hidden_file_dir.conf'), + require => Package[$apache::var::pkg_conf]; + "${conf_d}/customization.conf": + content => template('apache/customization.conf'), + require => Package[$apache::var::pkg_conf]; '/etc/httpd/conf/vhosts.d/00_default_vhosts.conf': - content => template('apache/00_default_vhosts.conf'); + content => template('apache/00_default_vhosts.conf'), + require => Package[$apache::var::pkg_conf]; + '/etc/httpd/conf/modules.d/50_mod_deflate.conf': + content => template('apache/50_mod_deflate.conf'); } file { '/etc/logrotate.d/httpd': diff --git a/modules/apache/manifests/config.pp b/modules/apache/manifests/config.pp index a6e1e231..0ff0962c 100644 --- a/modules/apache/manifests/config.pp +++ b/modules/apache/manifests/config.pp @@ -1,6 +1,6 @@ define apache::config($content) { file { $name: content => $content, - notify => Exec['service httpd configtest'], + notify => Exec['apachectl configtest'], } } diff --git a/modules/apache/manifests/cve-2011-3192.pp b/modules/apache/manifests/cve-2011-3192.pp index 20b53216..1e39ac04 100644 --- a/modules/apache/manifests/cve-2011-3192.pp +++ b/modules/apache/manifests/cve-2011-3192.pp @@ -1,8 +1,9 @@ class apache::cve-2011-3192 { + include apache::base # temporary protection against CVE-2011-3192 - # http://httpd.apache.org/security/CVE-2011-3192.txt + # https://httpd.apache.org/security/CVE-2011-3192.txt apache::config { - '/etc/httpd/conf.d/CVE-2011-3192.conf': - content => template('apache/CVE-2011-3192.conf'), + "${apache::base::conf_d}/CVE-2011-3192.conf": + content => template('apache/CVE-2011-3192.conf'), } } diff --git a/modules/apache/manifests/init.pp b/modules/apache/manifests/init.pp index 5bfaa004..40779d4d 100644 --- a/modules/apache/manifests/init.pp +++ b/modules/apache/manifests/init.pp @@ -3,18 +3,23 @@ class apache { include apache::base apache::vhost::base { $name: location => $location, - } - } + } + apache::vhost::base { "ssl_${name}": + vhost => $name, + use_ssl => true, + location => $location, + } + } define vhost_redirect($url, - $vhost = false, + $vhost = false, $use_ssl = false) { include apache::base apache::vhost::base { $name: use_ssl => $use_ssl, - vhost => $vhost, + vhost => $vhost, content => template("apache/vhost_redirect.conf"), - } - } + } + } } diff --git a/modules/apache/manifests/mod/deflate.pp b/modules/apache/manifests/mod/deflate.pp deleted file mode 100644 index 0e2211aa..00000000 --- a/modules/apache/manifests/mod/deflate.pp +++ /dev/null @@ -1,4 +0,0 @@ -class apache::mod::deflate { - include apache::base - package { 'apache-mod_deflate': } -} diff --git a/modules/apache/manifests/mod/fastcgi.pp b/modules/apache/manifests/mod/fastcgi.pp index 4f10ccab..2b421291 100644 --- a/modules/apache/manifests/mod/fastcgi.pp +++ b/modules/apache/manifests/mod/fastcgi.pp @@ -2,3 +2,4 @@ class apache::mod::fastcgi { include apache::base package { 'apache-mod_fastcgi': } } + diff --git a/modules/apache/manifests/mod/fcgid.pp b/modules/apache/manifests/mod/fcgid.pp index 6c815681..b8186a64 100644 --- a/modules/apache/manifests/mod/fcgid.pp +++ b/modules/apache/manifests/mod/fcgid.pp @@ -1,4 +1,11 @@ class apache::mod::fcgid { include apache::base package { 'apache-mod_fcgid': } + + file { 'urlescape': + path => '/usr/local/bin/urlescape', + mode => '0755', + notify => Service['apache'], + content => template('apache/urlescape'), + } } diff --git a/modules/apache/manifests/mod/php.pp b/modules/apache/manifests/mod/php.pp index c5de893e..2c8d6733 100644 --- a/modules/apache/manifests/mod/php.pp +++ b/modules/apache/manifests/mod/php.pp @@ -4,7 +4,7 @@ class apache::mod::php { package { 'apache-mod_php': } - apache::config { '/etc/httpd/conf.d/mod_php.conf': + apache::config { "${apache::base::conf_d}/mod_php.conf": content => template('apache/mod/php.conf'), } } diff --git a/modules/apache/manifests/mod/ssl.pp b/modules/apache/manifests/mod/ssl.pp index 6e9be525..ab3d24e4 100644 --- a/modules/apache/manifests/mod/ssl.pp +++ b/modules/apache/manifests/mod/ssl.pp @@ -14,7 +14,7 @@ class apache::mod::ssl { apache::config { '/etc/httpd/conf/vhosts.d/01_default_ssl_vhost.conf': content => template('apache/01_default_ssl_vhost.conf'); - '/etc/httpd/conf.d/ssl.conf': - content => template('apache/mod/ssl.conf'); + "${apache::base::conf_d}/ssl_vhost.conf": + content => template('apache/mod/ssl_vhost.conf'); } } diff --git a/modules/apache/manifests/mod/wsgi.pp b/modules/apache/manifests/mod/wsgi.pp index d2ab72d2..7f4fb719 100644 --- a/modules/apache/manifests/mod/wsgi.pp +++ b/modules/apache/manifests/mod/wsgi.pp @@ -6,7 +6,7 @@ class apache::mod::wsgi { ensure => directory, } - apache::config { '/etc/httpd/conf.d/mod_wsgi.conf': + apache::config { "${apache::base::conf_d}/mod_wsgi.conf": content => template('apache/mod/wsgi.conf'), } } diff --git a/modules/apache/manifests/var.pp b/modules/apache/manifests/var.pp new file mode 100644 index 00000000..4a6d68eb --- /dev/null +++ b/modules/apache/manifests/var.pp @@ -0,0 +1,12 @@ +# $httpdlogs_rotate: +# number of time the log file are rotated before being removed +# $default_vhost_redirect: +# URL to redirect to in case of unknown vhost +class apache::var( + $httpdlogs_rotate = '24', + $apache_user = 'apache', + $apache_group = 'apache', + $default_vhost_redirect = '' +) { + $pkg_conf = 'apache' +} diff --git a/modules/apache/manifests/vhost/base.pp b/modules/apache/manifests/vhost/base.pp index a7e5720d..27a19998 100644 --- a/modules/apache/manifests/vhost/base.pp +++ b/modules/apache/manifests/vhost/base.pp @@ -7,10 +7,11 @@ define apache::vhost::base ($content = '', $access_logfile = false, $error_logfile = false, $options = [], - $enable_public_html = false) { + $enable_public_html = false, + $enable_location = true) { include apache::base $httpd_logdir = '/var/log/httpd' - $filename = "$name.conf" + $filename = "${name}.conf" if ! $vhost { $real_vhost = $name @@ -19,12 +20,12 @@ define apache::vhost::base ($content = '', } if ! $access_logfile { - $real_access_logfile = "$httpd_logdir/${real_vhost}-access_log" + $real_access_logfile = "${httpd_logdir}/${real_vhost}-access_log" } else { $real_access_logfile = $access_logfile } if ! $error_logfile { - $real_error_logfile = "$httpd_logdir/${real_vhost}-error_log" + $real_error_logfile = "${httpd_logdir}/${real_vhost}-error_log" } else { $real_error_logfile = $error_logfile } @@ -34,7 +35,7 @@ define apache::vhost::base ($content = '', if $wildcard_sslcert != true { openssl::self_signed_cert{ $real_vhost: directory => '/etc/ssl/apache/', - before => Apache::Config["/etc/httpd/conf/vhosts.d/$filename"], + before => Apache::Config["/etc/httpd/conf/vhosts.d/${filename}"], } } } @@ -43,8 +44,7 @@ define apache::vhost::base ($content = '', include apache::mod::public_html } - apache::config { "/etc/httpd/conf/vhosts.d/$filename": + apache::config { "/etc/httpd/conf/vhosts.d/${filename}": content => template('apache/vhost_base.conf') } } - diff --git a/modules/apache/manifests/vhost/catalyst_app.pp b/modules/apache/manifests/vhost/catalyst_app.pp index 54a00fb2..1ce40747 100644 --- a/modules/apache/manifests/vhost/catalyst_app.pp +++ b/modules/apache/manifests/vhost/catalyst_app.pp @@ -2,12 +2,22 @@ define apache::vhost::catalyst_app( $script, $location = '', $process = 4, $use_ssl = false, + $aliases = {}, $vhost = false) { - include apache::mod::fastcgi + include apache::mod::fcgid + if ($location) { + $aliases['/static'] = "${location}/root/static" + } + + $script_aliases = { + '/' => "$script/", + } + apache::vhost::base { $name: vhost => $vhost, use_ssl => $use_ssl, - content => template('apache/vhost_catalyst_app.conf'), + content => template('apache/vhost_fcgid.conf'), + aliases => $aliases, } } diff --git a/modules/apache/manifests/vhost/django_app.pp b/modules/apache/manifests/vhost/django_app.pp index 5613e384..91974acd 100644 --- a/modules/apache/manifests/vhost/django_app.pp +++ b/modules/apache/manifests/vhost/django_app.pp @@ -11,8 +11,8 @@ define apache::vhost::django_app ($module = false, # module is a ruby reserved keyword, cannot be used in templates $django_module = $module - file { "$name.wsgi": - path => "/usr/local/lib/wsgi/$name.wsgi", + file { "${name}.wsgi": + path => "/usr/local/lib/wsgi/${name}.wsgi", mode => '0755', notify => Service['apache'], content => template('apache/django.wsgi'), diff --git a/modules/apache/manifests/vhost/other_app.pp b/modules/apache/manifests/vhost/other_app.pp index 69b3ec56..f5a71574 100644 --- a/modules/apache/manifests/vhost/other_app.pp +++ b/modules/apache/manifests/vhost/other_app.pp @@ -1,6 +1,6 @@ define apache::vhost::other_app($vhost_file) { include apache::base - apache::config { "/etc/httpd/conf/vhosts.d/$name.conf": + apache::config { "/etc/httpd/conf/vhosts.d/${name}.conf": content => template($vhost_file), } } diff --git a/modules/apache/manifests/vhost/redirect_ssl.pp b/modules/apache/manifests/vhost/redirect_ssl.pp index 3458d59d..22a4d4f6 100644 --- a/modules/apache/manifests/vhost/redirect_ssl.pp +++ b/modules/apache/manifests/vhost/redirect_ssl.pp @@ -1,5 +1,5 @@ define apache::vhost::redirect_ssl() { - apache::vhost::base { "redirect_ssl_$name": + apache::vhost::base { "redirect_ssl_${name}": vhost => $name, content => template('apache/vhost_ssl_redirect.conf') } diff --git a/modules/apache/manifests/vhost/reverse_proxy.pp b/modules/apache/manifests/vhost/reverse_proxy.pp index a6570c2f..a32aaff0 100644 --- a/modules/apache/manifests/vhost/reverse_proxy.pp +++ b/modules/apache/manifests/vhost/reverse_proxy.pp @@ -1,6 +1,7 @@ define apache::vhost::reverse_proxy($url, $vhost = false, - $use_ssl = false) { + $use_ssl = false, + $content = '') { include apache::mod::proxy apache::vhost::base { $name: use_ssl => $use_ssl, diff --git a/modules/apache/manifests/webapp_other.pp b/modules/apache/manifests/webapp_other.pp index 277558b5..147a2370 100644 --- a/modules/apache/manifests/webapp_other.pp +++ b/modules/apache/manifests/webapp_other.pp @@ -1,7 +1,7 @@ define apache::webapp_other($webapp_file) { include apache::base $webappname = $name - apache::config { "/etc/httpd/conf/webapps.d/$webappname.conf": + apache::config { "/etc/httpd/conf/webapps.d/${webappname}.conf": content => template($webapp_file), } } diff --git a/modules/apache/templates/00_default_vhosts.conf b/modules/apache/templates/00_default_vhosts.conf index 25f59b5e..9a5f586c 100644 --- a/modules/apache/templates/00_default_vhosts.conf +++ b/modules/apache/templates/00_default_vhosts.conf @@ -3,5 +3,13 @@ <Location /> Allow from all </Location> - Redirect / http://www.<%= domain %>/ + <%- + default_redirect = scope.lookupvar('apache::var::default_vhost_redirect') + if default_redirect == '' + -%> + Redirect 404 / + ErrorDocument 404 "Page Not Found" + <%- else -%> + Redirect / <%= default_redirect %> + <%- end -%> </VirtualHost> diff --git a/modules/apache/templates/01_default_ssl_vhost.conf b/modules/apache/templates/01_default_ssl_vhost.conf index d2aa9f94..323bf145 100644 --- a/modules/apache/templates/01_default_ssl_vhost.conf +++ b/modules/apache/templates/01_default_ssl_vhost.conf @@ -15,7 +15,7 @@ # General setup for the virtual host DocumentRoot "/var/www/html" #ServerName localhost:443 -ServerAdmin root@<%= domain %> +ServerAdmin root@<%= @domain %> ErrorLog logs/ssl_error_log <IfModule mod_log_config.c> @@ -29,17 +29,19 @@ SSLEngine on # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. -SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW +SSLHonorCipherOrder On +SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS + # SSL Protocol support: # List the enable protocol levels with which clients will be able to -# connect. Disable SSLv2 access by default: -SSLProtocol all -SSLv2 +# connect. Disable SSLv2/v3 access by default: +SSLProtocol ALL -SSLv2 -SSLv3 -<%- if wildcard_sslcert == 'true' then -%> -SSLCertificateFile /etc/ssl/wildcard.<%= domain %>.crt -SSLCertificateKeyFile /etc/ssl/wildcard.<%= domain %>.key -SSLCACertificateFile /etc/ssl/wildcard.<%= domain %>.pem +<%- if @wildcard_sslcert == 'true' then -%> +SSLCertificateFile /etc/ssl/wildcard.<%= @domain %>.crt +SSLCertificateKeyFile /etc/ssl/wildcard.<%= @domain %>.key +SSLCACertificateFile /etc/ssl/wildcard.<%= @domain %>.pem SSLVerifyClient None <%- else -%> SSLCertificateFile /etc/ssl/apache/localhost.pem diff --git a/modules/apache/templates/50_mod_deflate.conf b/modules/apache/templates/50_mod_deflate.conf new file mode 100644 index 00000000..5192bf6e --- /dev/null +++ b/modules/apache/templates/50_mod_deflate.conf @@ -0,0 +1,36 @@ +<IfModule mod_deflate.c> + # Compress HTML, CSS, JavaScript, JSON, Text, XML and fonts + AddOutputFilterByType DEFLATE application/javascript + AddOutputFilterByType DEFLATE application/json + AddOutputFilterByType DEFLATE application/rss+xml + AddOutputFilterByType DEFLATE application/vnd.ms-fontobject + AddOutputFilterByType DEFLATE application/x-font + AddOutputFilterByType DEFLATE application/x-font-opentype + AddOutputFilterByType DEFLATE application/x-font-otf + AddOutputFilterByType DEFLATE application/x-font-truetype + AddOutputFilterByType DEFLATE application/x-font-ttf + AddOutputFilterByType DEFLATE application/x-javascript + AddOutputFilterByType DEFLATE application/xhtml+xml + AddOutputFilterByType DEFLATE application/xml + AddOutputFilterByType DEFLATE font/opentype + AddOutputFilterByType DEFLATE font/otf + AddOutputFilterByType DEFLATE font/ttf + AddOutputFilterByType DEFLATE image/svg+xml + AddOutputFilterByType DEFLATE image/x-icon + AddOutputFilterByType DEFLATE text/css + AddOutputFilterByType DEFLATE text/html + AddOutputFilterByType DEFLATE text/javascript + AddOutputFilterByType DEFLATE text/plain + AddOutputFilterByType DEFLATE text/xml + + # Level of compression (9=highest compression level) + DeflateCompressionLevel 1 + + # Do not compress certain file types + SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|heif|heic|webp|mp4|mov|mpg|webm|avi)$ no-gzip dont-vary + SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|bz2|xz|zst|lzo|lzma|sit|rar|cab|rpm)$ no-gzip dont-vary + SetEnvIfNoCase Request_URI \.pdf$ no-gzip dont-vary + + # Make sure proxies don't deliver the wrong content + Header append Vary User-Agent env=!dont-vary +</IfModule> diff --git a/modules/apache/templates/django.wsgi b/modules/apache/templates/django.wsgi index aa0b82c8..2188e1e7 100644 --- a/modules/apache/templates/django.wsgi +++ b/modules/apache/templates/django.wsgi @@ -6,8 +6,8 @@ if path not in sys.path: sys.path.append(path) <%- end -%> -<%- if django_module -%> -os.environ['DJANGO_SETTINGS_MODULE'] = '<%= django_module %>.settings' +<%- if @django_module -%> +os.environ['DJANGO_SETTINGS_MODULE'] = '<%= @django_module %>.settings' <%- else -%> os.environ['DJANGO_SETTINGS_MODULE'] = 'settings' <%- end -%> diff --git a/modules/apache/templates/logrotate b/modules/apache/templates/logrotate index f84ae9fe..823989eb 100644 --- a/modules/apache/templates/logrotate +++ b/modules/apache/templates/logrotate @@ -1,13 +1,23 @@ /var/log/httpd/*_log /var/log/httpd/apache_runtime_status /var/log/httpd/ssl_mutex { - rotate <%= httpdlogs_rotate %> +<% if @hostname == 'duvel' %> + rotate 60 + daily +<% elsif @hostname == 'friteuse' %> + # The virtual disk is very small so keep log sizes down + rotate 26 + weekly +<% elsif @hostname == 'sucuk' %> + rotate 52 + weekly +<% else %> + rotate <%= scope.lookupvar('apache::var::httpdlogs_rotate') %> monthly +<% end %> missingok notifempty + sharedscripts compress - prerotate - /etc/rc.d/init.d/httpd closelogs > /dev/null 2>&1 || : - endscript postrotate - /etc/rc.d/init.d/httpd closelogs > /dev/null 2>&1 || : + /bin/systemctl restart httpd.service > /dev/null 2>/dev/null || true endscript } diff --git a/modules/apache/templates/mod/php.conf b/modules/apache/templates/mod/php.conf index 6d64ffb8..8bc20078 100644 --- a/modules/apache/templates/mod/php.conf +++ b/modules/apache/templates/mod/php.conf @@ -1,5 +1,5 @@ # as php insist to have this value set, let's # look on the system for him -php_value date.timezone "<%= php_date_timezone %>" -php_admin_value sendmail_path "/usr/sbin/sendmail -t -i -f root@<%= domain %>" +php_value date.timezone "<%= @php_date_timezone %>" +php_admin_value sendmail_path "/usr/sbin/sendmail -t -i -f root@<%= @domain %>" diff --git a/modules/apache/templates/mod/ssl.conf b/modules/apache/templates/mod/ssl_vhost.conf index bcfe8201..bcfe8201 100644 --- a/modules/apache/templates/mod/ssl.conf +++ b/modules/apache/templates/mod/ssl_vhost.conf diff --git a/modules/apache/templates/mod/wsgi.conf b/modules/apache/templates/mod/wsgi.conf index 0ecba31a..18678bc6 100644 --- a/modules/apache/templates/mod/wsgi.conf +++ b/modules/apache/templates/mod/wsgi.conf @@ -1,4 +1,4 @@ -# http://code.google.com/p/modwsgi/wiki/ApplicationIssues +# https://code.google.com/p/modwsgi/wiki/ApplicationIssues # mainly for viewvc at the moment , when doing a diff WSGIRestrictStdout Off # again viewvc : @@ -7,6 +7,6 @@ WSGIRestrictStdout Off # WSGIRestrictSignal Off # reenabled, as this prevent apache from restarting properly -# make sure transifex client work fine, as we need wsgi to pass autorisation +# make sure transifex client work fine, as we need wsgi to pass authorisation # header to django ( otherwise, this just show error 401 ) WSGIPassAuthorization On diff --git a/modules/apache/templates/no_hidden_file_dir.conf b/modules/apache/templates/no_hidden_file_dir.conf new file mode 100644 index 00000000..dce78912 --- /dev/null +++ b/modules/apache/templates/no_hidden_file_dir.conf @@ -0,0 +1,4 @@ +# +# dont serve up any hidden files or dirs like .git*, .svn, ... +# +RedirectMatch 404 /\..*$ diff --git a/modules/apache/templates/urlescape b/modules/apache/templates/urlescape new file mode 100644 index 00000000..8feb7fa4 --- /dev/null +++ b/modules/apache/templates/urlescape @@ -0,0 +1,9 @@ +#!/usr/bin/python3 -u +# URL escape each path given on stdin +import sys +import urllib.parse +while True: + l = sys.stdin.readline() + if not l: + break + print(urllib.parse.quote(l.rstrip("\n"))) diff --git a/modules/apache/templates/vhost_base.conf b/modules/apache/templates/vhost_base.conf index 2d89dccc..da26b683 100644 --- a/modules/apache/templates/vhost_base.conf +++ b/modules/apache/templates/vhost_base.conf @@ -1,4 +1,4 @@ -<%- if use_ssl then +<%- if @use_ssl then port = 443 else port = 80 @@ -6,28 +6,19 @@ end -%> <VirtualHost *:<%= port %>> -<%- if use_ssl then -%> - SSLEngine on - <%- if wildcard_sslcert == 'true' then -%> - SSLCertificateFile /etc/ssl/wildcard.<%= domain %>.crt - SSLCertificateKeyFile /etc/ssl/wildcard.<%= domain %>.key - SSLCACertificateFile /etc/ssl/wildcard.<%= domain %>.pem - SSLVerifyClient None - <%- else -%> - SSLCertificateFile /etc/ssl/apache/<%= real_vhost %>.pem - SSLCertificateKeyFile /etc/ssl/apache/<%= real_vhost %>.pem - <%- end -%> +<%- if @use_ssl then -%> +<%= scope.function_template(["apache/vhost_ssl.conf"]) %> <%- end -%> - ServerName <%= real_vhost %> -<%- server_aliases.each do |key| -%> + ServerName <%= @real_vhost %> +<%- @server_aliases.each do |key| -%> ServerAlias <%= key %> <%- end -%> - DocumentRoot <%= location %> + DocumentRoot <%= @location %> - CustomLog <%= real_access_logfile %> combined - ErrorLog <%= real_error_logfile %> + CustomLog <%= @real_access_logfile %> combined + ErrorLog <%= @real_error_logfile %> -<%- if enable_public_html -%> +<%- if @enable_public_html -%> #TODO add the rest UserDir public_html <%- else -%> @@ -36,20 +27,27 @@ end </IfModule> <%- end -%> -<%- aliases.keys.sort {|a,b| a.size <=> b.size }.reverse.each do |key| -%> - Alias <%= key %> <%= aliases[key] %> +<%- @aliases.keys.sort {|a,b| a.size <=> b.size }.reverse.each do |key| -%> + Alias <%= key %> <%= @aliases[key] %> <%- end -%> - <%= content %> + <%= @content %> -<%- if options.length > 0 -%> - <Directory <%= location %>> - Options <%= options.join(" ") %> +<%- if @options.length > 0 -%> + <Directory <%= @location %>> + Options <%= @options.join(" ") %> </Directory> <%- end -%> +<%- if @enable_location -%> <Location /> - Allow from all + <IfModule mod_authz_core.c> + Require all granted + </IfModule> + <IfModule !mod_authz_core.c> + Allow from all + </IfModule> </Location> +<%- end -%> </VirtualHost> diff --git a/modules/apache/templates/vhost_catalyst_app.conf b/modules/apache/templates/vhost_catalyst_app.conf deleted file mode 100644 index eaa652d7..00000000 --- a/modules/apache/templates/vhost_catalyst_app.conf +++ /dev/null @@ -1,5 +0,0 @@ -<%- if location != '' then -%> -Alias /static <%= location %>/root/static -<%- end -%> -Alias / <%= script %>/ -FastCgiServer <%= script %> -processes <%= process %> -idle-timeout 30 diff --git a/modules/apache/templates/vhost_django_app.conf b/modules/apache/templates/vhost_django_app.conf index 3310045e..d85cf7a9 100644 --- a/modules/apache/templates/vhost_django_app.conf +++ b/modules/apache/templates/vhost_django_app.conf @@ -1 +1 @@ -WSGIScriptAlias / /usr/local/lib/wsgi/<%= name %>.wsgi +WSGIScriptAlias / /usr/local/lib/wsgi/<%= @name %>.wsgi diff --git a/modules/apache/templates/vhost_fcgid.conf b/modules/apache/templates/vhost_fcgid.conf new file mode 100644 index 00000000..fefa4a49 --- /dev/null +++ b/modules/apache/templates/vhost_fcgid.conf @@ -0,0 +1,6 @@ +AddHandler fcgid-script .pl +<%- @script_aliases.keys.sort {|a,b| a.size <=> b.size }.reverse.each do |key| -%> + ScriptAlias <%= key %> <%= @script_aliases[key] %> +<%- end -%> +FcgidMinProcessesPerClass <%= @process %> +FcgidIdleTimeout 30 diff --git a/modules/apache/templates/vhost_fcgid_norobot.conf b/modules/apache/templates/vhost_fcgid_norobot.conf new file mode 100644 index 00000000..0643cac9 --- /dev/null +++ b/modules/apache/templates/vhost_fcgid_norobot.conf @@ -0,0 +1,45 @@ +AddHandler fcgid-script .pl +<%- @script_aliases.keys.sort {|a,b| a.size <=> b.size }.reverse.each do |key| -%> + ScriptAlias <%= key %> <%= @script_aliases[key] %> +<%- end -%> +FcgidMinProcessesPerClass <%= @process %> +FcgidIdleTimeout 30 + +# These robots were scraping the whole of svnweb in 2024-04, causing severe +# load, so they are banned. It's not clear whether they obey robots.txt or +# not (we didn't give them enough of a chance to find out), so we could +# consider giving them a chance to redeem themselves at some point in the +# future. +RewriteEngine on +RewriteCond %{HTTP_USER_AGENT} ClaudeBot|Amazonbot +RewriteRule . - [R=403,L] + +# Block expensive SVN operations on all common robots ("spider" covers a +# bunch). "Expensive" is considered to be most operations other than showing a +# directory or downloading a specific version of a file. +# Note: eliminating view=log and annotate= doesn't make much difference to the +# CPU load when robots are hitting the server in real world operation. +#RewriteCond %{QUERY_STRING} pathrev=|r1= +# Treat anything other than a plain path as "expensive" +RewriteCond %{QUERY_STRING} . +RewriteCond %{HTTP_USER_AGENT} "Googlebot|GoogleOther|bingbot|Yahoo! Slurp|ClaudeBot|Amazonbot|YandexBot|SemrushBot|Barkrowler|DataForSeoBot|PetalBot|facebookexternalhit|GPTBot|ImagesiftBot|spider|Spider|iPod|Trident|Presto" +RewriteRule . - [R=403,L] + +# Only let expensive operations through when a cookie is set. If no cookie is +# set, redirect to a page where it will be set using JavaScript and redirect +# back. This will block requests from user agents that do not support +# JavaScript, which includes many robots. +RewriteMap urlescape prg:/usr/local/bin/urlescape +#RewriteCond %{QUERY_STRING} pathrev=|r1= +# Treat anything other than a plain path as "expensive" +RewriteCond %{QUERY_STRING} . +RewriteCond %{REQUEST_URI} !/_check +RewriteCond %{HTTP_COOKIE} !session=([^;]+) [novary] +RewriteRule . %{REQUEST_SCHEME}://%{SERVER_NAME}:%{SERVER_PORT}/_check?to=%{REQUEST_URI}?${urlescape:%{QUERY_STRING}} [R=302,L] + +# Block abusive spiders by IP address who don't identify themselves in the +# User-Agent: string +RewriteCond expr "-R '47.76.0.0/14' || -R '47.80.0.0/14' || -R '47.208.0.0/16' || -R '47.238.0.0/16' || -R '8.210.0.0/16' || -R '8.218.0.0/16' || -R '188.239.0.0/18' || -R '166.108.192.0/18' || -R '124.243.160.0/19' || -R '101.46.0.0/20'" +RewriteRule . - [R=403,L] + +ErrorDocument 403 "<html><body>Impolite robots are not allowed</body></html>" diff --git a/modules/apache/templates/vhost_redirect.conf b/modules/apache/templates/vhost_redirect.conf index 0f256881..c787311e 100644 --- a/modules/apache/templates/vhost_redirect.conf +++ b/modules/apache/templates/vhost_redirect.conf @@ -1,2 +1,2 @@ -Redirect / <%= url %> +Redirect / <%= @url %> diff --git a/modules/apache/templates/vhost_reverse_proxy.conf b/modules/apache/templates/vhost_reverse_proxy.conf index 23dc7545..4859bda3 100644 --- a/modules/apache/templates/vhost_reverse_proxy.conf +++ b/modules/apache/templates/vhost_reverse_proxy.conf @@ -1,3 +1,5 @@ +<%= @content %> + ProxyRequests Off ProxyPreserveHost On @@ -5,9 +7,9 @@ Order deny,allow Allow from all </Proxy> -<%- if url =~ /^https/ -%> +<%- if @url =~ /^https/ -%> SSLProxyEngine On <%- end -%> - ProxyPass / <%= url %> - ProxyPassReverse / <%= url %> + ProxyPass / <%= @url %> + ProxyPassReverse / <%= @url %> diff --git a/modules/apache/templates/vhost_simple.conf b/modules/apache/templates/vhost_simple.conf index ec39b192..77b55287 100644 --- a/modules/apache/templates/vhost_simple.conf +++ b/modules/apache/templates/vhost_simple.conf @@ -1,9 +1,14 @@ <VirtualHost *:80> - ServerName <%= name %> - DocumentRoot <%= location %> + ServerName <%= @name %> + DocumentRoot <%= @location %> <Location /> - Allow from all + <IfModule mod_authz_core.c> + Require all granted + </IfModule> + <IfModule !mod_authz_core.c> + Allow from all + </IfModule> </Location> </VirtualHost> diff --git a/modules/apache/templates/vhost_ssl.conf b/modules/apache/templates/vhost_ssl.conf new file mode 100644 index 00000000..0cb52eca --- /dev/null +++ b/modules/apache/templates/vhost_ssl.conf @@ -0,0 +1,13 @@ + SSLEngine on + SSLProtocol ALL -SSLv2 -SSLv3 + SSLHonorCipherOrder On + SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS + <%- if @wildcard_sslcert == 'true' then -%> + SSLCertificateFile /etc/ssl/wildcard.<%= @domain %>.crt + SSLCertificateKeyFile /etc/ssl/wildcard.<%= @domain %>.key + SSLCACertificateFile /etc/ssl/wildcard.<%= @domain %>.pem + SSLVerifyClient None + <%- else -%> + SSLCertificateFile /etc/ssl/apache/<%= @real_vhost %>.pem + SSLCertificateKeyFile /etc/ssl/apache/<%= @real_vhost %>.pem + <%- end -%> diff --git a/modules/apache/templates/vhost_ssl_redirect.conf b/modules/apache/templates/vhost_ssl_redirect.conf index d13c3093..23a7eabe 100644 --- a/modules/apache/templates/vhost_ssl_redirect.conf +++ b/modules/apache/templates/vhost_ssl_redirect.conf @@ -1 +1 @@ -Redirect / https://<%= name %>/ +Redirect / https://<%= @name %>/ diff --git a/modules/apache/templates/vhost_wsgi.conf b/modules/apache/templates/vhost_wsgi.conf index 34926411..2f1ba585 100644 --- a/modules/apache/templates/vhost_wsgi.conf +++ b/modules/apache/templates/vhost_wsgi.conf @@ -1,3 +1,3 @@ -WSGIScriptAlias / <%= wsgi_path %> +WSGIScriptAlias / <%= @wsgi_path %> |