diff --git a/Dockerfile b/Dockerfile index 2307dce..9dd2115 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,6 +27,7 @@ RUN apt-get update && \ sed -i 's/#Mutex/Mutex/g' /etc/apache2/mods-enabled/ssl.conf ADD apache2.conf /etc/apache2/apache2.conf +ADD ssl.conf /etc/apache2/mods-enabled/ssl.conf ENV APACHE_RUN_GROUP www-data ENV APACHE_RUN_USER www-data @@ -65,6 +66,7 @@ RUN mkdir -p /var/run/apache2 /var/www/html/app && \ mkdir -p /config/global.d && \ mkdir -p /config/vhost-80.d && \ mkdir -p /config/vhost-443.d && \ + mkdir -p /var/run/apache2/mod_auth_openidc/cache && \ chmod -R 755 /var/www/html/app /var/lock/apache2 && \ chown -R www-data /var/run/apache2 /var/log/apache2 /var/www/html/app /var/lock/apache2 && \ rm /etc/apache2/sites-enabled/000-default.conf diff --git a/apache2.conf b/apache2.conf index d825c15..266105f 100644 --- a/apache2.conf +++ b/apache2.conf @@ -1,358 +1,51 @@ -# This is the main Apache server configuration file. It contains the -# configuration directives that give the server its instructions. -# See http://httpd.apache.org/docs/2.4/ for detailed information about -# the directives and /usr/share/doc/apache2/README.Debian about Debian specific -# hints. -# -# -# Summary of how the Apache 2 configuration works in Debian: -# The Apache 2 web server configuration in Debian is quite different to -# upstream's suggested way to configure the web server. This is because Debian's -# default Apache2 installation attempts to make adding and removing modules, -# virtual hosts, and extra configuration directives as flexible as possible, in -# order to make automating the changes and administering the server as easy as -# possible. - -# It is split into several files forming the configuration hierarchy outlined -# below, all located in the /etc/apache2/ directory: -# -# /etc/apache2/ -# |-- apache2.conf -# | `-- ports.conf -# |-- mods-enabled -# | |-- *.load -# | `-- *.conf -# |-- conf-enabled -# | `-- *.conf -# `-- sites-enabled -# `-- *.conf -# -# -# * apache2.conf is the main configuration file (this file). It puts the pieces -# together by including all remaining configuration files when starting up the -# web server. -# -# * ports.conf is always included from the main configuration file. It is -# supposed to determine listening ports for incoming connections which can be -# customized anytime. -# -# * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/ -# directories contain particular configuration snippets which manage modules, -# global configuration fragments, or virtual host configurations, -# respectively. -# -# They are activated by symlinking available configuration files from their -# respective *-available/ counterparts. These should be managed by using our -# helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See -# their respective man pages for detailed information. -# -# * The binary is called apache2. Due to the use of environment variables, in -# the default configuration, apache2 needs to be started/stopped with -# /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not -# work with the default configuration. - - -# Global configuration -# - -# -# ServerRoot: The top of the directory tree under which the server's -# configuration, error, and log files are kept. -# -# NOTE! If you intend to place this on an NFS (or otherwise network) -# mounted filesystem then please read the Mutex documentation (available -# at ); -# you will save yourself a lot of trouble. -# -# Do NOT add a slash at the end of the directory path. -# -#ServerRoot "/etc/apache2" - -# -# The accept serialization lock file MUST BE STORED ON A LOCAL DISK. -# -#Mutex file:${APACHE_LOCK_DIR} default - -# -# The directory where shm and other runtime files will be stored. -# - -DefaultRuntimeDir ${APACHE_RUN_DIR} - -# -# PidFile: The file in which the server should record its process -# identification number when it starts. -# This needs to be set in /etc/apache2/envvars -# -PidFile ${APACHE_PID_FILE} - -# -# Timeout: The number of seconds before receives and sends time out. -# -Timeout 300 - -# -# KeepAlive: Whether or not to allow persistent connections (more than -# one request per connection). Set to "Off" to deactivate. -# -KeepAlive On - -# -# MaxKeepAliveRequests: The maximum number of requests to allow -# during a persistent connection. Set to 0 to allow an unlimited amount. -# We recommend you leave this number high, for maximum performance. -# -MaxKeepAliveRequests 100 - -# -# KeepAliveTimeout: Number of seconds to wait for the next request from the -# same client on the same connection. -# -KeepAliveTimeout 5 - - -# These need to be set in /etc/apache2/envvars -User ${APACHE_RUN_USER} -Group ${APACHE_RUN_GROUP} - -# -# HostnameLookups: Log the names of clients or just their IP addresses -# e.g., www.apache.org (on) or 204.62.129.132 (off). -# The default is off because it'd be overall better for the net if people -# had to knowingly turn this feature on, since enabling it means that -# each client request will result in AT LEAST one lookup request to the -# nameserver. -# -HostnameLookups Off - -# ErrorLog: The location of the error log file. -# If you do not specify an ErrorLog directive within a -# container, error messages relating to that virtual host will be -# logged here. If you *do* define an error logfile for a -# container, that host's errors will be logged there and not here. -# -ErrorLog /dev/stderr - -# -# LogLevel: Control the severity of messages logged to the error_log. -# Available values: trace8, ..., trace1, debug, info, notice, warn, -# error, crit, alert, emerg. -# It is also possible to configure the log level for particular modules, e.g. -# "LogLevel info ssl:warn" -# -LogLevel ${APACHE_DEBUG_LEVEL} - -# Include module configuration: IncludeOptional mods-enabled/*.load IncludeOptional mods-enabled/*.conf -# Include list of ports to listen on -Include ports.conf - - -# Sets the default security model of the Apache2 HTTPD server. It does -# not allow access to the root filesystem outside of /usr/share and /var/www. -# The former is used by web applications packaged in Debian, -# the latter may be used for local directories served by the web server. If -# your system is serving content from a sub-directory in /srv you must allow -# access here, or in any related virtual host. - - Options FollowSymLinks - AllowOverride None - Require all denied - - - - AllowOverride None - Require all granted - - - - Options Indexes FollowSymLinks - AllowOverride None - Require all granted - - -# -# Options Indexes FollowSymLinks -# AllowOverride None -# Require all granted -# - - - - -# AccessFileName: The name of the file to look for in each directory -# for additional configuration directives. See also the AllowOverride -# directive. -# -AccessFileName .htaccess - -# -# The following lines prevent .htaccess and .htpasswd files from being -# viewed by Web clients. -# - - Require all denied - - - -# -# The following directives define some format nicknames for use with -# a CustomLog directive. -# -# These deviate from the Common Log Format definitions in that they use %O -# (the actual bytes sent including headers) instead of %b (the size of the -# requested file), because the latter makes it impossible to detect partial -# requests. -# -# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended. -# Use mod_remoteip instead. -# -LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined -LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined -LogFormat "%h %l %u %t \"%r\" %>s %O" common -LogFormat "%{Referer}i -> %U" referer -LogFormat "%{User-agent}i" agent - -# Include of directories ignores editors' and dpkg's backup files, -# see README.Debian for details. - -# Include generic snippets of statements -IncludeOptional conf-enabled/*.conf - - -IncludeOptional /config/global-*.conf - -# Include the virtual host configurations: -#IncludeOptional sites-enabled/*.conf - -# vim: syntax=apache ts=4 sw=4 sts=4 sr noet - -# hide Apache version and OS information +ServerName app.boxi.ch +ServerAdmin online@boxi.ch ServerTokens Prod ServerSignature Off -LimitRequestFieldSize 32760 +DocumentRoot "/var/www" -ServerName ${SERVER_NAME} +IncludeOptional /etc/apache2/conf.d/*.conf -#Listen 80 - - DocumentRoot "/var/www/html/app" - LogLevel ${APACHE_DEBUG_LEVEL} +AddDefaultCharset UTF-8 +EnableSendfile on - Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" - Header always set Content-Security-Policy "default-src 'self' ; \ - script-src 'self' 'unsafe-inline' 'unsafe-eval'; \ - style-src 'self' fonts.googleapis.com use.fontawesome.com 'unsafe-inline'; \ - font-src 'self' data: fonts.googleapis.com fonts.googleapis.com use.fontawesome.com fonts.gstatic.com; \ - base-uri 'self'; \ - form-action 'self'; \ - frame-ancestors 'none'; \ - img-src 'self' api.mapbox.com data:; \ - #upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i" - Header always append X-Frame-Options SAMEORIGIN - Header always set X-Content-Type-Options nosniff - Header always set Referrer-Policy "same-origin" - # this feature is not yet used and must be extended if needed, currently only a sample config - Header always set Feature-Policy "payment 'none';" +FileETag None +TraceEnable off +Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure +Header always append X-Frame-Options SAMEORIGIN +Header set X-XSS-Protection "1; mode=block" +RewriteEngine On +RewriteCond %{THE_REQUEST} !HTTP/1.1$ +RewriteRule .* - [F] +Timeout 60 - AddType text/css .css - AddType text/html .html .htm - AddType application/javascript .js .jsonp - AddType application/json .json - AddType image/svg+xml .svg .svgz - AddType application/octet-stream .xyz - AddEncoding gzip .svgz +Mutex posixsem - RequestHeader set X-Forwarded-User expr=%{REMOTE_USER} - RequestHeader set X-Forwarded-Proto "https" - RequestHeader set Authorization "Bearer %{oidc_access_token}e" - Header set User-Details "%{REMOTE_USER}e %{oidc_claim_email}e" +OIDCCacheType file +OIDCCacheDir ${APACHE_RUN_DIR}/mod_auth_openidc/cache - # mods-available/auth_openidc.conf - #OIDCOAuthServerMetadataURL ${OIDC_PROVIDER_METADATA_URL} - OIDCProviderMetadataURL ${KC_ADDR}/realms/${KC_REALM}/.well-known/openid-configuration - OIDCClientID ${OIDC_CLIENT_ID} - OIDCClientSecret ${OIDC_CLIENT_SECRET} - #OIDCAuthRequestParams ${OIDC_AUDIENCE} - #OIDCScope "${OIDC_SCOPE}" + + DirectoryIndex index.html + + + Require all denied + - #OIDCSessionInactivityTimeout 1800 - #OIDCSessionMaxDuration 28800 - #OIDCUserInfoRefreshInterval 60 - OIDCRefreshAccessTokenBeforeExpiry 10 + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %b" common - OIDCRedirectURI ${OIDC_REDIRECT_URI} - OIDCCryptoPassphrase ${OIDC_CRYPTO_PASSPHRASE} - OIDCInfoHook ${OIDC_INFO_HOOK} - OIDCDefaultLoggedOutURL ${KC_ADDR}/realms/${KC_REALM}/protocol/openid-connect/logout?redirect_uri=http%3A%2F%2Fkubernetes.docker.internal%3A8800 + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio + + - # maps the prefered_username claim to the REMOTE_USER environment variable - OIDCRemoteUserClaim preferred_username +ErrorLog /dev/stderr +CustomLog /dev/stdout combined +LogLevel debug - OIDCCookieSameSite On # used for localdeployment -> set cookie with SameSite=lax - OIDCStateMaxNumberOfCookies 3 true - -# -# Satisfy Any -# AuthType None -# Require all granted -# Allow from all -# -# RewriteEngine on -# RewriteCond $1 .*/ws/.* -# RewriteRule "^(/ws/(.*))$" "ws://host.docker.internal:4200/ws/$2" [P,L] -# -# ProxyPass ws://.*/ws -# ProxyPassReverse ws://host.docker.internal:4200/ws -# LogLevel debug -# - - - AuthType openid-connect - Require valid-user - - - # If the browser is allowed to cache index.html, it starts loading assets/scripts/images before apache had a chance - # to check whether or not the user is even authenticated, leading to many failed requests. - # Disabling cache for index.html forces the browser to fetch it first, and therefore ensures that the full - # authentication mechanic is being run. - # See also https://github.com/zmartzone/mod_auth_openidc/issues/113 - - FileETag None - Header unset ETag - Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate" - Header set Pragma "no-cache" - Header set Expires "Mon, 21 Mar 1983 14:10:00 UTC" - - - # When loading non html assets (i.e. scripts, images etc) we do not want to start the full authentication process, - # we simply return a 401. Otherwise return unauthorized error if not authenticated for all HTML requests. - # By default it is a 302 redirect to id.7mal8.ch, which can lead to a build-up of mod_auth_openidc_state cookies - # during XHR calls or resource loads. - # See also PURPID-647 - # - # OIDCUnAuthAction 401 - # - - - ProxyPass /ws ${FRONTEND_WS_URL}:${FRONTEND_PORT}/ws retry=0 timeout=86400 - ProxyPassReverse /ws ws://${FRONTEND_URL}:${FRONTEND_PORT}/ws - - ProxyPass /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ retry=0 - ProxyPassReverse /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ - - ProxyPass / ${FRONTEND_URL}:${FRONTEND_PORT}/ retry=0 - ProxyPassReverse / ${FRONTEND_URL}:${FRONTEND_PORT} - - # This entry must be below any other custom configuration to the location - # otherwise the server status page will be accessible to any authenticated user - - SetHandler server-status - - Require claim email~^(.*)@boxi.ch$ - - - +IncludeOptional sites-enabled/* diff --git a/ssl.conf b/ssl.conf new file mode 100644 index 0000000..77205fc --- /dev/null +++ b/ssl.conf @@ -0,0 +1,118 @@ +# +# This is the Apache server configuration file providing SSL support. +# It contains the configuration directives to instruct the server how to +# serve pages over an https connection. For detailed information about these +# directives see +# +# Do NOT simply read the instructions in here without understanding +# what they do. They're here only as hints or reminders. If you are unsure +# consult the online docs. You have been warned. +# +# Required modules: mod_log_config, mod_setenvif, mod_ssl, +# socache_shmcb_module (for default value of SSLSessionCache) +LoadModule ssl_module modules/mod_ssl.so +LoadModule socache_shmcb_module modules/mod_socache_shmcb.so + +# +# Pseudo Random Number Generator (PRNG): +# Configure one or more sources to seed the PRNG of the SSL library. +# The seed data should be of good random quality. +# WARNING! On some platforms /dev/random blocks if not enough entropy +# is available. This means you then cannot use the /dev/random device +# because it would lead to very long connection times (as long as +# it requires to make more entropy available). But usually those +# platforms additionally provide a /dev/urandom device which doesn't +# block. So, if available, use this one instead. Read the mod_ssl User +# Manual for more details. +# +#SSLRandomSeed startup file:/dev/random 512 +SSLRandomSeed startup file:/dev/urandom 512 +SSLRandomSeed connect builtin +#SSLRandomSeed connect file:/dev/random 512 +#SSLRandomSeed connect file:/dev/urandom 512 + + +# +# When we also provide SSL we have to listen to the +# standard HTTP port (see above) and to the HTTPS port +# +Listen 443 + +## +## SSL Global Context +## +## All SSL configuration in this context applies both to +## the main server and all SSL-enabled virtual hosts. +## + +# SSL Cipher Suite: +# List the ciphers that the client is permitted to negotiate, +# and that httpd will negotiate as the client of a proxied server. +# See the OpenSSL documentation for a complete list of ciphers, and +# ensure these follow appropriate best practices for this deployment. +# httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers, +# while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a. +SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!ADH +SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!ADH + +# By the end of 2016, only TLSv1.2 ciphers should remain in use. +# Older ciphers should be disallowed as soon as possible, while the +# kRSA ciphers do not offer forward secrecy. These changes inhibit +# older clients (such as IE6 SP2 or IE8 on Windows XP, or other legacy +# non-browser tooling) from successfully connecting. +# +# To restrict mod_ssl to use only TLSv1.2 ciphers, and disable +# those protocols which do not support forward secrecy, replace +# the SSLCipherSuite and SSLProxyCipherSuite directives above with +# the following two directives, as soon as practical. +# SSLCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA +# SSLProxyCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA + +# User agents such as web browsers are not configured for the user's +# own preference of either security or performance, therefore this +# must be the prerogative of the web server administrator who manages +# cpu load versus confidentiality, so enforce the server's cipher order. +SSLHonorCipherOrder on + +# SSL Protocol support: +# List the protocol versions which clients are allowed to connect with. +# Disable SSLv3 by default (cf. RFC 7525 3.1.1). TLSv1 (1.0) should be +# disabled as quickly as practical. By the end of 2016, only the TLSv1.2 +# protocol or later should remain in use. +SSLProtocol all -SSLv3 +SSLProxyProtocol all -SSLv3 + +# Pass Phrase Dialog: +# Configure the pass phrase gathering process. +# The filtering dialog program (`builtin' is an internal +# terminal dialog) has to provide the pass phrase on stdout. +SSLPassPhraseDialog builtin + +# Inter-Process Session Cache: +# Configure the SSL Session Cache: First the mechanism +# to use and second the expiring timeout (in seconds). +#SSLSessionCache "dbm:/run/apache2/ssl_scache" +SSLSessionCache "shmcb:/var/cache/mod_ssl/scache(512000)" +SSLSessionCacheTimeout 300 + +# OCSP Stapling (requires OpenSSL 0.9.8h or later) +# +# This feature is disabled by default and requires at least +# the two directives SSLUseStapling and SSLStaplingCache. +# Refer to the documentation on OCSP Stapling in the SSL/TLS +# How-To for more information. +# +# Enable stapling for all SSL-enabled servers: +#SSLUseStapling On + +# Define a relatively small cache for OCSP Stapling using +# the same mechanism that is used for the SSL session cache +# above. If stapling is used with more than a few certificates, +# the size may need to be increased. (AH01929 will be logged.) +#SSLStaplingCache "shmcb:/run/apache2/ssl_stapling(32768)" + +# Seconds before valid OCSP responses are expired from the cache +#SSLStaplingStandardCacheTimeout 3600 + +# Seconds before invalid OCSP responses are expired from the cache +#SSLStaplingErrorCacheTimeout 600