# This is the main Apache server configuration file. It contains the # configuration directives that give the server its instructions. # See http://httpd.apache.org/docs/2.4/ for detailed information about # the directives and /usr/share/doc/apache2/README.Debian about Debian specific # hints. # # # Summary of how the Apache 2 configuration works in Debian: # The Apache 2 web server configuration in Debian is quite different to # upstream's suggested way to configure the web server. This is because Debian's # default Apache2 installation attempts to make adding and removing modules, # virtual hosts, and extra configuration directives as flexible as possible, in # order to make automating the changes and administering the server as easy as # possible. # It is split into several files forming the configuration hierarchy outlined # below, all located in the /etc/apache2/ directory: # # /etc/apache2/ # |-- apache2.conf # | `-- ports.conf # |-- mods-enabled # | |-- *.load # | `-- *.conf # |-- conf-enabled # | `-- *.conf # `-- sites-enabled # `-- *.conf # # # * apache2.conf is the main configuration file (this file). It puts the pieces # together by including all remaining configuration files when starting up the # web server. # # * ports.conf is always included from the main configuration file. It is # supposed to determine listening ports for incoming connections which can be # customized anytime. # # * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/ # directories contain particular configuration snippets which manage modules, # global configuration fragments, or virtual host configurations, # respectively. # # They are activated by symlinking available configuration files from their # respective *-available/ counterparts. These should be managed by using our # helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See # their respective man pages for detailed information. # # * The binary is called apache2. Due to the use of environment variables, in # the default configuration, apache2 needs to be started/stopped with # /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not # work with the default configuration. # Global configuration # # # ServerRoot: The top of the directory tree under which the server's # configuration, error, and log files are kept. # # NOTE! If you intend to place this on an NFS (or otherwise network) # mounted filesystem then please read the Mutex documentation (available # at ); # you will save yourself a lot of trouble. # # Do NOT add a slash at the end of the directory path. # #ServerRoot "/etc/apache2" # # The accept serialization lock file MUST BE STORED ON A LOCAL DISK. # #Mutex file:${APACHE_LOCK_DIR} default # # The directory where shm and other runtime files will be stored. # DefaultRuntimeDir ${APACHE_RUN_DIR} # # PidFile: The file in which the server should record its process # identification number when it starts. # This needs to be set in /etc/apache2/envvars # PidFile ${APACHE_PID_FILE} # # Timeout: The number of seconds before receives and sends time out. # Timeout 300 # # KeepAlive: Whether or not to allow persistent connections (more than # one request per connection). Set to "Off" to deactivate. # KeepAlive On # # MaxKeepAliveRequests: The maximum number of requests to allow # during a persistent connection. Set to 0 to allow an unlimited amount. # We recommend you leave this number high, for maximum performance. # MaxKeepAliveRequests 100 # # KeepAliveTimeout: Number of seconds to wait for the next request from the # same client on the same connection. # KeepAliveTimeout 5 # These need to be set in /etc/apache2/envvars User ${APACHE_RUN_USER} Group ${APACHE_RUN_GROUP} # # HostnameLookups: Log the names of clients or just their IP addresses # e.g., www.apache.org (on) or 204.62.129.132 (off). # The default is off because it'd be overall better for the net if people # had to knowingly turn this feature on, since enabling it means that # each client request will result in AT LEAST one lookup request to the # nameserver. # HostnameLookups Off # ErrorLog: The location of the error log file. # If you do not specify an ErrorLog directive within a # container, error messages relating to that virtual host will be # logged here. If you *do* define an error logfile for a # container, that host's errors will be logged there and not here. # ErrorLog /dev/stderr # # LogLevel: Control the severity of messages logged to the error_log. # Available values: trace8, ..., trace1, debug, info, notice, warn, # error, crit, alert, emerg. # It is also possible to configure the log level for particular modules, e.g. # "LogLevel info ssl:warn" # LogLevel ${APACHE_DEBUG_LEVEL} # Include module configuration: IncludeOptional mods-enabled/*.load IncludeOptional mods-enabled/*.conf # Include list of ports to listen on Include ports.conf # Sets the default security model of the Apache2 HTTPD server. It does # not allow access to the root filesystem outside of /usr/share and /var/www. # The former is used by web applications packaged in Debian, # the latter may be used for local directories served by the web server. If # your system is serving content from a sub-directory in /srv you must allow # access here, or in any related virtual host. Options FollowSymLinks AllowOverride None Require all denied AllowOverride None Require all granted Options Indexes FollowSymLinks AllowOverride None Require all granted # # Options Indexes FollowSymLinks # AllowOverride None # Require all granted # # AccessFileName: The name of the file to look for in each directory # for additional configuration directives. See also the AllowOverride # directive. # AccessFileName .htaccess # # The following lines prevent .htaccess and .htpasswd files from being # viewed by Web clients. # Require all denied # # The following directives define some format nicknames for use with # a CustomLog directive. # # These deviate from the Common Log Format definitions in that they use %O # (the actual bytes sent including headers) instead of %b (the size of the # requested file), because the latter makes it impossible to detect partial # requests. # # Note that the use of %{X-Forwarded-For}i instead of %h is not recommended. # Use mod_remoteip instead. # LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined LogFormat "%h %l %u %t \"%r\" %>s %O" common LogFormat "%{Referer}i -> %U" referer LogFormat "%{User-agent}i" agent # Include of directories ignores editors' and dpkg's backup files, # see README.Debian for details. # Include generic snippets of statements IncludeOptional conf-enabled/*.conf IncludeOptional /config/global-*.conf # Include the virtual host configurations: #IncludeOptional sites-enabled/*.conf # vim: syntax=apache ts=4 sw=4 sts=4 sr noet # hide Apache version and OS information ServerTokens Prod ServerSignature Off LimitRequestFieldSize 32760 ServerName ${SERVER_NAME} #Listen 80 DocumentRoot "/var/www/html/app" LogLevel ${APACHE_DEBUG_LEVEL} Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" Header always set Content-Security-Policy "default-src 'self' ; \ script-src 'self' 'unsafe-inline' 'unsafe-eval'; \ style-src 'self' fonts.googleapis.com use.fontawesome.com 'unsafe-inline'; \ font-src 'self' data: fonts.googleapis.com fonts.googleapis.com use.fontawesome.com fonts.gstatic.com; \ base-uri 'self'; \ form-action 'self'; \ frame-ancestors 'none'; \ img-src 'self' api.mapbox.com data:; \ #upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i" Header always append X-Frame-Options SAMEORIGIN Header always set X-Content-Type-Options nosniff Header always set Referrer-Policy "same-origin" # this feature is not yet used and must be extended if needed, currently only a sample config Header always set Feature-Policy "payment 'none';" AddType text/css .css AddType text/html .html .htm AddType application/javascript .js .jsonp AddType application/json .json AddType image/svg+xml .svg .svgz AddType application/octet-stream .xyz AddEncoding gzip .svgz RequestHeader set X-Forwarded-User expr=%{REMOTE_USER} RequestHeader set X-Forwarded-Proto "https" RequestHeader set Authorization "Bearer %{oidc_access_token}e" Header set User-Details "%{REMOTE_USER}e %{oidc_claim_email}e" # mods-available/auth_openidc.conf #OIDCOAuthServerMetadataURL ${OIDC_PROVIDER_METADATA_URL} OIDCProviderMetadataURL ${KC_ADDR}/realms/${KC_REALM}/.well-known/openid-configuration OIDCClientID ${OIDC_CLIENT_ID} OIDCClientSecret ${OIDC_CLIENT_SECRET} #OIDCAuthRequestParams ${OIDC_AUDIENCE} #OIDCScope "${OIDC_SCOPE}" #OIDCSessionInactivityTimeout 1800 #OIDCSessionMaxDuration 28800 #OIDCUserInfoRefreshInterval 60 OIDCRefreshAccessTokenBeforeExpiry 10 OIDCRedirectURI ${OIDC_REDIRECT_URI} OIDCCryptoPassphrase ${OIDC_CRYPTO_PASSPHRASE} OIDCInfoHook ${OIDC_INFO_HOOK} OIDCDefaultLoggedOutURL ${KC_ADDR}/realms/${KC_REALM}/protocol/openid-connect/logout?redirect_uri=http%3A%2F%2Fkubernetes.docker.internal%3A8800 # maps the prefered_username claim to the REMOTE_USER environment variable OIDCRemoteUserClaim preferred_username OIDCCookieSameSite On # used for localdeployment -> set cookie with SameSite=lax OIDCStateMaxNumberOfCookies 3 true # # Satisfy Any # AuthType None # Require all granted # Allow from all # # RewriteEngine on # RewriteCond $1 .*/ws/.* # RewriteRule "^(/ws/(.*))$" "ws://host.docker.internal:4200/ws/$2" [P,L] # # ProxyPass ws://.*/ws # ProxyPassReverse ws://host.docker.internal:4200/ws # LogLevel debug # AuthType openid-connect Require valid-user # If the browser is allowed to cache index.html, it starts loading assets/scripts/images before apache had a chance # to check whether or not the user is even authenticated, leading to many failed requests. # Disabling cache for index.html forces the browser to fetch it first, and therefore ensures that the full # authentication mechanic is being run. # See also https://github.com/zmartzone/mod_auth_openidc/issues/113 FileETag None Header unset ETag Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate" Header set Pragma "no-cache" Header set Expires "Mon, 21 Mar 1983 14:10:00 UTC" # When loading non html assets (i.e. scripts, images etc) we do not want to start the full authentication process, # we simply return a 401. Otherwise return unauthorized error if not authenticated for all HTML requests. # By default it is a 302 redirect to id.7mal8.ch, which can lead to a build-up of mod_auth_openidc_state cookies # during XHR calls or resource loads. # See also PURPID-647 # # OIDCUnAuthAction 401 # ProxyPass /ws ${FRONTEND_WS_URL}:${FRONTEND_PORT}/ws retry=0 timeout=86400 ProxyPassReverse /ws ws://${FRONTEND_URL}:${FRONTEND_PORT}/ws ProxyPass /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ retry=0 ProxyPassReverse /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ ProxyPass / ${FRONTEND_URL}:${FRONTEND_PORT}/ retry=0 ProxyPassReverse / ${FRONTEND_URL}:${FRONTEND_PORT} # This entry must be below any other custom configuration to the location # otherwise the server status page will be accessible to any authenticated user SetHandler server-status Require claim email~^(.*)@boxi.ch$