ApacheOIDC/apache2.conf

# This is the main Apache server configuration file.  It contains the
# configuration directives that give the server its instructions.
# See http://httpd.apache.org/docs/2.4/ for detailed information about
# the directives and /usr/share/doc/apache2/README.Debian about Debian specific
# hints.
#
#
# Summary of how the Apache 2 configuration works in Debian:
# The Apache 2 web server configuration in Debian is quite different to
# upstream's suggested way to configure the web server. This is because Debian's
# default Apache2 installation attempts to make adding and removing modules,
# virtual hosts, and extra configuration directives as flexible as possible, in
# order to make automating the changes and administering the server as easy as
# possible.

# It is split into several files forming the configuration hierarchy outlined
# below, all located in the /etc/apache2/ directory:
#
#    /etc/apache2/
#    |-- apache2.conf
#    |    `--  ports.conf
#    |-- mods-enabled
#    |    |-- *.load
#    |    `-- *.conf
#    |-- conf-enabled
#    |    `-- *.conf
#     `-- sites-enabled
#         `-- *.conf
#
#
# * apache2.conf is the main configuration file (this file). It puts the pieces
#   together by including all remaining configuration files when starting up the
#   web server.
#
# * ports.conf is always included from the main configuration file. It is
#   supposed to determine listening ports for incoming connections which can be
#   customized anytime.
#
# * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/
#   directories contain particular configuration snippets which manage modules,
#   global configuration fragments, or virtual host configurations,
#   respectively.
#
#   They are activated by symlinking available configuration files from their
#   respective *-available/ counterparts. These should be managed by using our
#   helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See
#   their respective man pages for detailed information.
#
# * The binary is called apache2. Due to the use of environment variables, in
#   the default configuration, apache2 needs to be started/stopped with
#   /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not
#   work with the default configuration.


# Global configuration
#

#
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# NOTE!  If you intend to place this on an NFS (or otherwise network)
# mounted filesystem then please read the Mutex documentation (available
# at <URL:http://httpd.apache.org/docs/2.4/mod/core.html#mutex>);
# you will save yourself a lot of trouble.
#
# Do NOT add a slash at the end of the directory path.
#
#ServerRoot "/etc/apache2"

#
# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
#
#Mutex file:${APACHE_LOCK_DIR} default

#
# The directory where shm and other runtime files will be stored.
#

DefaultRuntimeDir ${APACHE_RUN_DIR}

#
# PidFile: The file in which the server should record its process
# identification number when it starts.
# This needs to be set in /etc/apache2/envvars
#
PidFile ${APACHE_PID_FILE}

#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 300

#
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On

#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 5


# These need to be set in /etc/apache2/envvars
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

#
# HostnameLookups: Log the names of clients or just their IP addresses
# e.g., www.apache.org (on) or 204.62.129.132 (off).
# The default is off because it'd be overall better for the net if people
# had to knowingly turn this feature on, since enabling it means that
# each client request will result in AT LEAST one lookup request to the
# nameserver.
#
HostnameLookups Off

# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog /dev/stderr

#
# LogLevel: Control the severity of messages logged to the error_log.
# Available values: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the log level for particular modules, e.g.
# "LogLevel info ssl:warn"
#
LogLevel ${APACHE_DEBUG_LEVEL}

# Include module configuration:
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

# Include list of ports to listen on
Include ports.conf


# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and /var/www.
# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.
<Directory />
    Options FollowSymLinks
    AllowOverride None
    Require all denied
</Directory>

<Directory /usr/share>
    AllowOverride None
    Require all granted
</Directory>

<Directory /var/www/>
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

#<Directory /srv/>
#    Options Indexes FollowSymLinks
#    AllowOverride None
#    Require all granted
#</Directory>




# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives.  See also the AllowOverride
# directive.
#
AccessFileName .htaccess

#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
    Require all denied
</FilesMatch>


#
# The following directives define some format nicknames for use with
# a CustomLog directive.
#
# These deviate from the Common Log Format definitions in that they use %O
# (the actual bytes sent including headers) instead of %b (the size of the
# requested file), because the latter makes it impossible to detect partial
# requests.
#
# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
# Use mod_remoteip instead.
#
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

# Include of directories ignores editors' and dpkg's backup files,
# see README.Debian for details.

# Include generic snippets of statements
IncludeOptional conf-enabled/*.conf


IncludeOptional /config/global-*.conf

# Include the virtual host configurations:
#IncludeOptional sites-enabled/*.conf

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

# hide Apache version and OS information
ServerTokens Prod
ServerSignature Off

LimitRequestFieldSize 32760

ServerName ${SERVER_NAME}

#Listen 80
<VirtualHost *:80>
    DocumentRoot "/var/www/html/app"
    LogLevel  ${APACHE_DEBUG_LEVEL}

    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self' ; \
                                        script-src 'self' 'unsafe-inline' 'unsafe-eval'; \
                                        style-src 'self' fonts.googleapis.com use.fontawesome.com 'unsafe-inline'; \
                                        font-src 'self' data: fonts.googleapis.com fonts.googleapis.com use.fontawesome.com fonts.gstatic.com; \
                                        base-uri 'self'; \
                                        form-action 'self'; \
                                        frame-ancestors 'none'; \
                                        img-src 'self' api.mapbox.com data:; \
                                        #upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
    Header always append X-Frame-Options SAMEORIGIN
    Header always set X-Content-Type-Options nosniff
    Header always set Referrer-Policy "same-origin"
    # this feature is not yet used and must be extended if needed, currently only a sample config
    Header always set Feature-Policy "payment 'none';"

    AddType text/css .css
    AddType text/html .html .htm
    AddType application/javascript .js .jsonp
    AddType application/json .json
    AddType image/svg+xml .svg .svgz
    AddType application/octet-stream .xyz
    AddEncoding gzip .svgz

    RequestHeader set X-Forwarded-User expr=%{REMOTE_USER}
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set Authorization "Bearer %{oidc_access_token}e"
    Header set User-Details "%{REMOTE_USER}e %{oidc_claim_email}e"

    # mods-available/auth_openidc.conf
    #OIDCOAuthServerMetadataURL ${OIDC_PROVIDER_METADATA_URL}
    OIDCProviderMetadataURL ${KC_ADDR}/realms/${KC_REALM}/.well-known/openid-configuration
    OIDCClientID ${OIDC_CLIENT_ID}
    OIDCClientSecret ${OIDC_CLIENT_SECRET}
    #OIDCAuthRequestParams ${OIDC_AUDIENCE}
    #OIDCScope "${OIDC_SCOPE}"

    #OIDCSessionInactivityTimeout 1800
    #OIDCSessionMaxDuration 28800
    #OIDCUserInfoRefreshInterval 60
    OIDCRefreshAccessTokenBeforeExpiry 10

    OIDCRedirectURI ${OIDC_REDIRECT_URI}
    OIDCCryptoPassphrase ${OIDC_CRYPTO_PASSPHRASE}
    OIDCInfoHook ${OIDC_INFO_HOOK}
    OIDCDefaultLoggedOutURL ${KC_ADDR}/realms/${KC_REALM}/protocol/openid-connect/logout?redirect_uri=http%3A%2F%2Fkubernetes.docker.internal%3A8800

    # maps the prefered_username claim to the REMOTE_USER environment variable
    OIDCRemoteUserClaim preferred_username

    OIDCCookieSameSite On  # used for localdeployment -> set cookie with SameSite=lax
    OIDCStateMaxNumberOfCookies 3 true

#     <Location /ws>
#         Satisfy Any
#         AuthType None
#         Require  all granted
#         Allow from all
#
#         RewriteEngine on
#         RewriteCond $1 .*/ws/.*
#         RewriteRule    "^(/ws/(.*))$"  "ws://host.docker.internal:4200/ws/$2"  [P,L]
#
#         ProxyPass ws://.*/ws
#         ProxyPassReverse ws://host.docker.internal:4200/ws
#         LogLevel debug
#     </Location>

    <Location />
       AuthType openid-connect
       Require valid-user
    </Location>

    # If the browser is allowed to cache index.html, it starts loading assets/scripts/images before apache had a chance
    # to check whether or not the user is even authenticated, leading to many failed requests.
    # Disabling cache for index.html forces the browser to fetch it first, and therefore ensures that the full
    # authentication mechanic is being run.
    # See also https://github.com/zmartzone/mod_auth_openidc/issues/113
    <filesMatch "index.html">
      FileETag None
      Header unset ETag
      Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
      Header set Pragma "no-cache"
      Header set Expires "Mon, 21 Mar 1983 14:10:00 UTC"
    </filesMatch>

    # When loading non html assets (i.e. scripts, images etc) we do not want to start the full authentication process,
    # we simply return a 401. Otherwise return unauthorized error if not authenticated for all HTML requests.
    # By default it is a 302 redirect to id.7mal8.ch, which can lead to a build-up of mod_auth_openidc_state cookies
    # during XHR calls or resource loads.
    # See also PURPID-647
    # <If "! req('Accept') =~ /text\x2Fhtml/">
    #    OIDCUnAuthAction 401
    # </If>


    ProxyPass /ws ${FRONTEND_WS_URL}:${FRONTEND_PORT}/ws retry=0 timeout=86400
    ProxyPassReverse /ws ws://${FRONTEND_URL}:${FRONTEND_PORT}/ws

    ProxyPass /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ retry=0
    ProxyPassReverse /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/

    ProxyPass / ${FRONTEND_URL}:${FRONTEND_PORT}/ retry=0
    ProxyPassReverse / ${FRONTEND_URL}:${FRONTEND_PORT}

    # This entry must be below any other custom configuration to the location
    # otherwise the server status page will be accessible to any authenticated user
    <Location /server-status>
      SetHandler server-status
      <RequireAll>
        Require claim email~^(.*)@boxi.ch$
      </RequireAll>
    </Location>
</VirtualHost>