From 255d78da2053cc1227819446f278bbc1bf86ec7c Mon Sep 17 00:00:00 2001
From: Stephen Smoogen <smooge@redhat.com>
Date: Fri, 23 Jun 2017 17:33:52 +0000
Subject: [PATCH] at this point it is clear that I have no idea and neither do
 the google pages I am looking at

---
 .../templates/httpd/nagios.conf.j2            | 31 ++++++++-----------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/roles/nagios_server/templates/httpd/nagios.conf.j2 b/roles/nagios_server/templates/httpd/nagios.conf.j2
index c19564744a..f73480de88 100644
--- a/roles/nagios_server/templates/httpd/nagios.conf.j2
+++ b/roles/nagios_server/templates/httpd/nagios.conf.j2
@@ -29,33 +29,28 @@ Alias /nagios /usr/share/nagios/html/
 </Directory>
 
 {% else %}
-<Directory "/usr/lib64/nagios/cgi-bin/">
-  SSLRequireSSL
-  Options ExecCGI
-  AllowOverride None
-  AuthName "Nagios GSSAPI Login"
-  GssapiCredStore keytab:/etc/krb5.HTTP_nagios-external{{env_suffix}}.fedoraproject.org.keytab
-  AuthType GSSAPI
-  # This is off because Apache (and thus mod_auth_gssapi) doesn't know this is proxied over TLS
-  GssapiSSLonly Off
-  GssapiLocalName on
-  Require valid-user
-</Directory>
 
 Alias /nagios "/usr/share/nagios/html"
-<Directory "/usr/share/nagios/html">
-  SSLRequireSSL
-  Options None
-  AllowOverride None
+
+<Location ~ /nagios/>
   AuthName "Nagios GSSAPI Login"
   GssapiCredStore keytab:/etc/krb5.HTTP_nagios-external{{env_suffix}}.fedoraproject.org.keytab
   AuthType GSSAPI
-  # This is off because Apache (and thus mod_auth_gssapi) doesn't know this is proxied over TLS
-  GssapiSSLonly Off
+  GssapiSSLonly On
   GssapiLocalName on
+  GssapiPublishErrors On
   Require valid-user
+</Location>
+
+<Location ~ "/nagios/cgi-bin/">
+  Options ExecCGI
+</Location>
+
+<Directory "/usr/share/nagios/html">
+  Options None
 </Directory>
 
+
 {% endif %}