svn commit: r1879984 - /spamassassin/trunk/build/automc/apache2-le-ssl.conf

[he...@apache.org]

Author: hege
Date: Fri Jul 17 06:35:36 2020
New Revision: 1879984

URL: http://svn.apache.org/viewvc?rev=1879984&view=rev
Log:
Update for new sa-vm

Modified:
    spamassassin/trunk/build/automc/apache2-le-ssl.conf

Modified: spamassassin/trunk/build/automc/apache2-le-ssl.conf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/build/automc/apache2-le-ssl.conf?rev=1879984&r1=1879983&r2=1879984&view=diff
==============================================================================
--- spamassassin/trunk/build/automc/apache2-le-ssl.conf (original)
+++ spamassassin/trunk/build/automc/apache2-le-ssl.conf Fri Jul 17 06:35:36 2020
@@ -1,3 +1,25 @@
+
+Listen 80
+
+<IfModule mod_ssl.c>
+  Listen 443
+</IfModule>
+
+SSLStaplingCache "shmcb:/var/log/apache2/stapling-cache(32768)"
+
+<VirtualHost *:80>
+  ServerName ruleqa.spamassassin.org
+  ServerAlias ruleqa-trunk.spamassassin.org
+  ServerAlias ruleqa-stable.spamassassin.org
+
+  ErrorLog ${APACHE_LOG_DIR}/ruleqa.spamassassin.org-error.log
+  CustomLog ${APACHE_LOG_DIR}/ruleqa.spamassassin.org-access.log combined
+
+  RewriteEngine On
+  RewriteCond %{HTTPS} !=on
+  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
+</VirtualHost>
+
 <IfModule mod_ssl.c>
 <VirtualHost *:443>
   ServerName ruleqa.spamassassin.org
@@ -7,19 +29,35 @@
   ErrorLog ${APACHE_LOG_DIR}/ruleqa.spamassassin.org-ssl-error.log
   CustomLog ${APACHE_LOG_DIR}/ruleqa.spamassassin.org-ssl-access.log combined
 
-  <Directory /var/www/ruleqa.spamassassin.org>
-    options indexes FollowSymLinks
-    AllowOverride indexes
-  </Directory>
   DocumentRoot /var/www/ruleqa.spamassassin.org
   ServerAdmin webmaster@spamassassin.org
 
+  SSLEngine on
+  SSLCertificateFile /etc/letsencrypt/live/spamassassin.org/fullchain.pem
+  SSLCertificateKeyFile /etc/letsencrypt/live/spamassassin.org/privkey.pem
+  # https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1f&hsts=false&guideline=5.4
+  # intermediate configuration
+  SSLProtocol           all -SSLv3 -TLSv1 -TLSv1.1
+  SSLCipherSuite        ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+  SSLHonorCipherOrder   off
+  SSLSessionTickets     off
+  SSLUseStapling        On
+
+  <Directory /var/www/ruleqa.spamassassin.org>
+    Options Indexes FollowSymLinks ExecCGI
+    AllowOverride Indexes
+    Require all granted
+  </Directory>
+
   <Directory /usr/local/spamassassin/automc/svn/masses/rule-qa/automc>
     AllowOverride None
-    Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch 
-    Include /etc/apache2/custom.d/globalblacklist.conf
+    Options ExecCGI SymLinksIfOwnerMatch
+    Require all granted
   </Directory>
 
+  ScriptAlias /ruleqa.cgi /usr/local/spamassassin/automc/svn/masses/rule-qa/automc/ruleqa.cgi
+
+  RewriteEngine On
   # debugging:
   # RewriteLogLevel 9
   # RewriteLog /var/apache2/logs/rewrite_log
@@ -27,29 +65,36 @@
   # "%2F" is used to grep rule subsets, allow it
   AllowEncodedSlashes On
 
-  # strip out known-local files and loops; all else goes to the ruleqa code
-  RewriteEngine On
+  # Redirect nagios to simple ok page
+  RewriteCond %{HTTP_USER_AGENT} ^check_http
+  RewriteRule .* /ok.html [L]
+
+  # Disallow some pesky robots
+  RewriteCond %{REMOTE_ADDR} !^(?:127\.0\.0\.1|10\..*)$
+  RewriteCond %{REQUEST_URI} !=/robots.txt
+  RewriteCond %{HTTP_USER_AGENT} "(?:Bot|Spider|Crawl)" [NC,OR]
+  RewriteCond %{HTTP_USER_AGENT} "(?:Chrome/4|Firefox/4)"
+  RewriteRule ^ - [F]
+
+  # Serve cached index for all except ourselves (/usr/local/bin/updateRuleqaIndex.sh)
+  RewriteCond %{REQUEST_URI} ^/$
+  RewriteCond %{QUERY_STRING} ^$
+  RewriteCond %{REMOTE_ADDR} !^(?:127\.0\.0\.1|10\..*)$
+  RewriteRule .* /index_cached.html [L]
 
-  # index: straight through
+  # Index: straight through
   RewriteRule ^/$ /ruleqa.cgi [PT,L]
 
-  RewriteRule ^/ruleqa.css$ /ruleqa.css [PT,L]
+  # Aliases
+  RewriteRule ^/ruleqa\.css$ /usr/local/spamassassin/automc/svn/masses/rule-qa/automc/ruleqa.css [L]
+  RewriteRule ^/sorttable\.js$ /usr/local/spamassassin/automc/svn/masses/rule-qa/automc/sorttable.js [L]
 
-  # satisfy local files
+  # Satisfy local files
   RewriteCond /var/www/ruleqa.spamassassin.org/%{REQUEST_FILENAME} !-d
   RewriteCond /var/www/ruleqa.spamassassin.org/%{REQUEST_FILENAME} !-f
-
-  # otherwise the CGI
-  RewriteCond %{REQUEST_URI} !^/ruleqa\.cgi
-  RewriteRule ^/(.*) /ruleqa.cgi/$1 [PT,L]
-
-  Alias /ruleqa.css /usr/local/spamassassin/automc/svn/masses/rule-qa/automc/ruleqa.css
-  Alias /sorttable.js /usr/local/spamassassin/automc/svn/masses/rule-qa/automc/sorttable.js
-  ScriptAlias /ruleqa.cgi /usr/local/spamassassin/automc/svn/masses/rule-qa/automc/ruleqa.cgi
-
-SSLCertificateFile /etc/letsencrypt/live/spamassassin.org/fullchain.pem
-SSLCertificateKeyFile /etc/letsencrypt/live/spamassassin.org/privkey.pem
-Include /etc/letsencrypt/options-ssl-apache.conf
+  # Otherwise the CGI, only send known urls
+  RewriteCond %{REQUEST_URI} !^/ruleqa\.cgi$
+  RewriteRule ^/((?:20\d\d|last-|\d+-days-ago|today).*) /ruleqa.cgi/$1 [PT,L]
 </VirtualHost>
 </IfModule>