FreeBSD: apache.manage_security

apache/files/FreeBSD/apache-2.4.config.jinja

@@ -519,5 +519,12 @@ SSLRandomSeed startup builtin
 SSLRandomSeed connect builtin
 </IfModule>
 
+# Default Values
+ServerTokens Prod
+ServerSignature Off
+TraceEnable Off
+# Well, IncludeOptional behaved lile Include
+IncludeOptional etc/apache24/extra/security.con[f]
+
 Include etc/apache24/Includes/*.conf
 

apache/files/FreeBSD/security.conf.jinja

@@ -0,0 +1,3 @@
+{% for option, value in salt['pillar.get']('apache:security', {}).items() -%}
+{{ option }} {{ value }}
+{% endfor %}

apache/manage_security.sls

@@ -1,10 +1,10 @@
-{% if grains['os_family']=="Debian" %}
-
 {% from "apache/map.jinja" import apache with context %}
 
 include:
   - apache
 
+{% if grains['os_family']=="Debian" %}
+
 {% if salt['file.file_exists' ]('/etc/apache2/conf-available/security.conf') %}
 apache_security-block:
   file.blockreplace:
@@ -30,4 +30,14 @@ apache_manage-security-{{ option }}:
 
 {% endif %}
 
+{% elif grains['os_family']=="FreeBSD" %}
+{{ apache.confdir }}/security.conf:
+  file.managed:
+    - source: salt://apache/files/{{ salt['grains.get']('os_family') }}/security.conf.jinja
+    - mode: 644
+    - template: jinja
+    - require:
+      - pkg: apache
+    - watch_in:
+      - module: apache-restart
 {% endif %}