133 lines
5.9 KiB
Plaintext
133 lines
5.9 KiB
Plaintext
<VirtualHost *:80>
|
|
DocumentRoot "/var/www/app"
|
|
ServerName app.boxi.ch
|
|
# ServerAlias www.${server_name}
|
|
|
|
ErrorLog /var/log/apache2/error.log
|
|
CustomLog /var/log/apache2/access.log combined
|
|
LogLevel debug
|
|
|
|
<Directory />
|
|
AllowOverride none
|
|
Options -Indexes -Includes
|
|
Require all granted
|
|
<LimitExcept GET POST HEAD>
|
|
deny from all
|
|
</LimitExcept>
|
|
</Directory>
|
|
|
|
<Directory "/var/www/app">
|
|
AllowOverride None
|
|
Options -Indexes -Includes
|
|
Require all granted
|
|
</Directory>
|
|
|
|
<Location /status >
|
|
SetHandler server-status
|
|
</Location>
|
|
|
|
<Location / >
|
|
Redirect / https://app.boxi.ch/
|
|
</Location>
|
|
</VirtualHost>
|
|
|
|
<IfModule mod_ssl.c>
|
|
<VirtualHost *:443>
|
|
DocumentRoot "/var/www/app"
|
|
ServerName app.boxi.ch
|
|
#ServerAlias www.${server_name}
|
|
|
|
LogLevel info
|
|
|
|
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
|
|
Header always set Content-Security-Policy "default-src 'self' ; \
|
|
script-src 'self' 'unsafe-inline' 'unsafe-eval'; \
|
|
style-src 'self' use.fontawesome.com 'unsafe-inline'; \
|
|
font-src 'self' data: use.fontawesome.com; \
|
|
base-uri 'self'; \
|
|
form-action 'self'; \
|
|
frame-ancestors 'none'; \
|
|
img-src 'self' data:; \
|
|
upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
|
|
Header always append X-Frame-Options SAMEORIGIN
|
|
Header always set X-Content-Type-Options nosniff
|
|
Header always set Referrer-Policy "same-origin"
|
|
# this feature is not yet used and must be extended if needed, currently only a sample config
|
|
Header always set Feature-Policy "payment 'none';"
|
|
|
|
<Directory />
|
|
AllowOverride none
|
|
Options -Indexes -Includes
|
|
Require all granted
|
|
<LimitExcept GET POST HEAD>
|
|
deny from all
|
|
</LimitExcept>
|
|
</Directory>
|
|
|
|
<Directory "/var/www/app">
|
|
AllowOverride None
|
|
Options -Indexes -Includes
|
|
Require all granted
|
|
</Directory>
|
|
|
|
<Location /status >
|
|
SetHandler server-status
|
|
</Location>
|
|
|
|
RequestHeader set X-Forwarded-User expr=%{REMOTE_USER}
|
|
RequestHeader set Authorization "Bearer %{oidc_access_token}e"
|
|
Header set User-Details "%{REMOTE_USER}e %{oidc_claim_email}e"
|
|
|
|
OIDCProviderMetadataURL ${KC_ADDR}/realms/${KC_REALM}/.well-known/openid-configuration
|
|
OIDCClientID ${OIDC_CLIENT_ID}
|
|
OIDCClientSecret ${OIDC_CLIENT_SECRET}
|
|
OIDCRefreshAccessTokenBeforeExpiry 10
|
|
OIDCRedirectURI ${OIDC_REDIRECT_URI}
|
|
OIDCCryptoPassphrase ${OIDC_CRYPTO_PASSPHRASE}
|
|
OIDCInfoHook ${OIDC_INFO_HOOK}
|
|
OIDCDefaultLoggedOutURL ${KC_ADDR}/realms/${KC_REALM}/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fapp.boxi.ch
|
|
OIDCRemoteUserClaim preferred_username
|
|
OIDCStateMaxNumberOfCookies 3 true
|
|
|
|
<Location /status >
|
|
SetHandler server-status
|
|
</Location>
|
|
|
|
<Location />
|
|
AuthType openid-connect
|
|
Require valid-user
|
|
</Location>
|
|
|
|
# If the browser is allowed to cache index.html, it starts loading assets/scripts/images before apache had a chance
|
|
# to check whether or not the user is even authenticated, leading to many failed requests.
|
|
# Disabling cache for index.html forces the browser to fetch it first, and therefore ensures that the full
|
|
# authentication mechanic is being run.
|
|
# See also https://github.com/zmartzone/mod_auth_openidc/issues/113
|
|
<filesMatch "index.html">
|
|
FileETag None
|
|
Header unset ETag
|
|
Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
|
|
Header set Pragma "no-cache"
|
|
Header set Expires "Mon, 21 Mar 1983 14:10:00 UTC"
|
|
</filesMatch>
|
|
|
|
#ProxyPass /ws ${FRONTEND_WS_URL}:${FRONTEND_PORT}/ws retry=0 timeout=86400
|
|
#ProxyPassReverse /ws ws://${FRONTEND_URL}:${FRONTEND_PORT}/ws
|
|
|
|
#ProxyPass /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ retry=0
|
|
#ProxyPassReverse /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/
|
|
|
|
#ProxyPass / ${FRONTEND_URL}:${FRONTEND_PORT}/ retry=0
|
|
#ProxyPassReverse / ${FRONTEND_URL}:${FRONTEND_PORT}
|
|
|
|
SSLEngine On
|
|
# SSLUseStapling On
|
|
SSLProtocol -all +TLSv1.2
|
|
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
|
|
SSLHonorCipherOrder on
|
|
SSLCertificateFile /etc/letsencrypt/live/app.boxi.ch/cert.pem
|
|
SSLCertificateKeyFile /etc/letsencrypt/live/app.boxi.ch/privkey.pem
|
|
SSLCertificateChainFile /etc/letsencrypt/live/app.boxi.ch/fullchain.pem
|
|
</VirtualHost>
|
|
</IfModule>
|