Infrastructure/ansible
3
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

copr-dist-git: add exception for acme challenge, fix indenting

Browse source
This commit is contained in:
clime 2018-06-29 11:03:44 +02:00
parent 04f75f2423
commit 0adb8eaabc
1 changed files with 27 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

52
roles/copr/dist_git/templates/ssl.conf.j2
View file

@ -1,44 +1,46 @@
<VirtualHost *:80> <VirtualHost *:80>
RewriteRule "^/?(.*)" "https://%{HTTP_HOST}/$1" [L,R=301,NE] RewriteEngine on
RewriteRule ^/\.well-known/(.*) /srv/web/acme-challenge/.well-known/$1 [L]
RewriteRule "^/?(.*)" "https://%{HTTP_HOST}/$1" [L,R=301,NE]
</VirtualHost> </VirtualHost>
Listen 443 https Listen 443 https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache shmcb:/run/httpd/sslcache(512000) SSLSessionCache shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout 300 SSLSessionCacheTimeout 300
SSLRandomSeed startup file:/dev/urandom 256 SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin SSLRandomSeed connect builtin
SSLCryptoDevice builtin SSLCryptoDevice builtin
<VirtualHost _default_:443> <VirtualHost _default_:443>
SSLCertificateFile /etc/letsencrypt/live/{{ inventory_hostname }}/cert.pem SSLCertificateFile /etc/letsencrypt/live/{{ inventory_hostname }}/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/{{ inventory_hostname }}/privkey.pem SSLCertificateKeyFile /etc/letsencrypt/live/{{ inventory_hostname }}/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/{{ inventory_hostname }}/fullchain.pem SSLCertificateChainFile /etc/letsencrypt/live/{{ inventory_hostname }}/fullchain.pem
ErrorLog logs/ssl_error_log ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log TransferLog logs/ssl_access_log
LogLevel warn LogLevel warn
SSLEngine on SSLEngine on
SSLProtocol all -SSLv3 SSLProtocol all -SSLv3
SSLProxyProtocol all -SSLv3 SSLProxyProtocol all -SSLv3
SSLHonorCipherOrder on SSLHonorCipherOrder on
SSLCipherSuite PROFILE=SYSTEM SSLCipherSuite PROFILE=SYSTEM
SSLProxyCipherSuite PROFILE=SYSTEM SSLProxyCipherSuite PROFILE=SYSTEM
<FilesMatch "\.(cgi|shtml|phtml|php)$"> <FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars SSLOptions +StdEnvVars
</FilesMatch> </FilesMatch>
<Directory "/var/www/cgi-bin"> <Directory "/var/www/cgi-bin">
SSLOptions +StdEnvVars SSLOptions +StdEnvVars
</Directory> </Directory>
BrowserMatch "MSIE [2-5]" \ BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \ nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0 downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \ CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost> </VirtualHost>