remove ng stuff (#255)
* remove -ng stuff * remove ng from template * remove -ng from readme * manage listen directive with disabled vhosts * add json filter * remove hardcoded path
This commit is contained in:
karim Hamza
Niels Abspoel
parent
9662e8b4ab
commit
ba2368907d
149
README-ng.rst
149
README-ng.rst
@ -1,149 +0,0 @@
|
|||||||
======
|
|
||||||
apache
|
|
||||||
======
|
|
||||||
|
|
||||||
Formulas to set up and configure the Apache HTTP server.
|
|
||||||
|
|
||||||
This Formula uses the concepts of ``directive`` and ``container`` in pillars
|
|
||||||
|
|
||||||
* ``directive`` is an httpd directive https://httpd.apache.org/docs/2.4/en/mod/directives.html
|
|
||||||
* ``container`` is what described the `configuration sections` https://httpd.apache.org/docs/2.4/en/sections.html
|
|
||||||
|
|
||||||
see examples below for more explanation
|
|
||||||
|
|
||||||
Also it includes and enforce some hardening rules to prevent security issues
|
|
||||||
|
|
||||||
See `<Hardening.md>`_ and `<apache/hardening-values.yaml>`_.
|
|
||||||
|
|
||||||
.. note::
|
|
||||||
|
|
||||||
See the full `Salt Formulas installation and usage instructions
|
|
||||||
<http://docs.saltstack.com/en/latest/topics/development/conventions/formulas.html>`_.
|
|
||||||
|
|
||||||
Available states
|
|
||||||
================
|
|
||||||
|
|
||||||
.. contents::
|
|
||||||
:local:
|
|
||||||
|
|
||||||
``apache``
|
|
||||||
----------
|
|
||||||
|
|
||||||
Installs the Apache package and starts the service.
|
|
||||||
|
|
||||||
``apache.config-ng``
|
|
||||||
-----------------
|
|
||||||
|
|
||||||
Configures apache server.
|
|
||||||
|
|
||||||
The configuration is done by merging the pillar content with defaults
|
|
||||||
present in the state `<apache/defaults/RedHat/defaults-apache-2.4.yaml>`_
|
|
||||||
|
|
||||||
.. code:: yaml
|
|
||||||
|
|
||||||
apache:
|
|
||||||
server_apache_config:
|
|
||||||
directives:
|
|
||||||
- Timeout: 5
|
|
||||||
containers:
|
|
||||||
IfModule:
|
|
||||||
-
|
|
||||||
item: 'mime_module'
|
|
||||||
directives:
|
|
||||||
- AddType: 'application/x-font-ttf ttc ttf'
|
|
||||||
- AddType: 'application/x-font-opentype otf'
|
|
||||||
- AddType: 'application/x-font-woff woff2'
|
|
||||||
|
|
||||||
|
|
||||||
``apache.modules-ng``
|
|
||||||
------------------
|
|
||||||
|
|
||||||
Enables and disables Apache modules.
|
|
||||||
|
|
||||||
``apache.vhosts.vhost-ng``
|
|
||||||
--------------------------
|
|
||||||
|
|
||||||
Configures Apache name-based virtual hosts and creates virtual host directories using data from Pillar.
|
|
||||||
|
|
||||||
All necessary data must be provided in the pillar
|
|
||||||
|
|
||||||
Exceptions are :
|
|
||||||
|
|
||||||
* ``CustomLog`` default is ``/path/apache/log/ServerName-access.log combined``
|
|
||||||
|
|
||||||
* if ``Logformat`` is defined in pillar, ``CustomLog`` is enforced to ``/path/apache/log/ServerName-access.log Logformat``
|
|
||||||
|
|
||||||
* ``ErrorLog`` is enforced to ``/path/apache/log/ServerName-error.log``
|
|
||||||
|
|
||||||
Example Pillar:
|
|
||||||
|
|
||||||
Create two vhosts ``example.com.conf`` and ``test.example.com.conf``
|
|
||||||
|
|
||||||
.. code:: yaml
|
|
||||||
|
|
||||||
apache:
|
|
||||||
VirtualHost:
|
|
||||||
example.com: # <-- this is an id decalaration used in salt and default ServerName
|
|
||||||
item: '*:80'
|
|
||||||
directives:
|
|
||||||
- RewriteEngine: 'on'
|
|
||||||
- Header: 'set Access-Control-Allow-Methods GET,PUT,POST,DELETE,OPTIONS'
|
|
||||||
containers:
|
|
||||||
Location:
|
|
||||||
item: '/test.html'
|
|
||||||
directives:
|
|
||||||
- Require: 'all granted'
|
|
||||||
site_id_declaration:
|
|
||||||
item: '10.10.1.1:8080'
|
|
||||||
directives:
|
|
||||||
- ServerName: 'test.example.com'
|
|
||||||
- LogFormat: '"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %{ms}T"'
|
|
||||||
|
|
||||||
Files produced by these pillars :
|
|
||||||
|
|
||||||
``example.com.conf``
|
|
||||||
|
|
||||||
.. code:: bash
|
|
||||||
|
|
||||||
<VirtualHost *:80>
|
|
||||||
ServerName example.com
|
|
||||||
CustomLog /var/log/httpd/example.com-access.log combined
|
|
||||||
ErrorLog /var/log/httpd/example.com-error.log
|
|
||||||
RewriteEngine on
|
|
||||||
Header set Access-Control-Allow-Methods GET,PUT,POST,DELETE,OPTIONS
|
|
||||||
<Location /test.html>
|
|
||||||
Require all granted
|
|
||||||
</Location>
|
|
||||||
</VirtualHost>
|
|
||||||
|
|
||||||
|
|
||||||
``test.example.com.conf``
|
|
||||||
|
|
||||||
.. code:: bash
|
|
||||||
|
|
||||||
<VirtualHost 10.10.1.1:8080>
|
|
||||||
ServerName test.example.com
|
|
||||||
CustomLog /var/log/httpd/test.example.com-access.log "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %{ms}T"
|
|
||||||
ErrorLog /var/log/httpd/test.example.com-error.log
|
|
||||||
</VirtualHost>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
this will delete ``test.example.com.conf``
|
|
||||||
|
|
||||||
.. code:: yaml
|
|
||||||
|
|
||||||
apache:
|
|
||||||
VirtualHost:
|
|
||||||
test.example.com:
|
|
||||||
item: '10.10.1.1:8080'
|
|
||||||
absent: True # <-- delete test.example.com.conf
|
|
||||||
directives:
|
|
||||||
- ServerName: 'test.example.com'
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
``apache.uninstall``
|
|
||||||
----------
|
|
||||||
|
|
||||||
Stops the Apache service and uninstalls the package.
|
|
||||||
280
README.rst
280
README.rst
@ -2,11 +2,19 @@
|
|||||||
apache
|
apache
|
||||||
======
|
======
|
||||||
|
|
||||||
|
|
||||||
.. note:: See `<README-ng.rst>`_ for new gen of the state.
|
|
||||||
|
|
||||||
Formulas to set up and configure the Apache HTTP server.
|
Formulas to set up and configure the Apache HTTP server.
|
||||||
|
|
||||||
|
This Formula uses the concepts of ``directive`` and ``container`` in pillars
|
||||||
|
|
||||||
|
* ``directive`` is an httpd directive https://httpd.apache.org/docs/2.4/en/mod/directives.html
|
||||||
|
* ``container`` is what described the `configuration sections` https://httpd.apache.org/docs/2.4/en/sections.html
|
||||||
|
|
||||||
|
see examples below for more explanation
|
||||||
|
|
||||||
|
Also it includes and enforce some hardening rules to prevent security issues
|
||||||
|
|
||||||
|
See `<Hardening.md>`_ and `<apache/hardening-values.yaml>`_.
|
||||||
|
|
||||||
.. note::
|
.. note::
|
||||||
|
|
||||||
See the full `Salt Formulas installation and usage instructions
|
See the full `Salt Formulas installation and usage instructions
|
||||||
@ -26,218 +34,116 @@ Installs the Apache package and starts the service.
|
|||||||
``apache.config``
|
``apache.config``
|
||||||
-----------------
|
-----------------
|
||||||
|
|
||||||
Configures apache based on os_family
|
Configures apache server.
|
||||||
|
|
||||||
``apache.certificates``
|
The configuration is done by merging the pillar content with defaults
|
||||||
-----------------
|
present in the state `<apache/defaults/RedHat/defaults-apache-2.4.yaml>`_
|
||||||
|
|
||||||
Deploy SSL certificates from pillars
|
.. code:: yaml
|
||||||
|
|
||||||
``apache.mod_mpm``
|
apache:
|
||||||
------------------
|
server_apache_config:
|
||||||
|
directives:
|
||||||
|
- Timeout: 5
|
||||||
|
containers:
|
||||||
|
IfModule:
|
||||||
|
-
|
||||||
|
item: 'mime_module'
|
||||||
|
directives:
|
||||||
|
- AddType: 'application/x-font-ttf ttc ttf'
|
||||||
|
- AddType: 'application/x-font-opentype otf'
|
||||||
|
- AddType: 'application/x-font-woff woff2'
|
||||||
|
|
||||||
Configures the apache mpm modules on Debian ``mpm_prefork``, ``mpm_worker`` or ``mpm_event`` (Debian Only)
|
|
||||||
|
|
||||||
``apache.modules``
|
``apache.modules``
|
||||||
------------------
|
------------------
|
||||||
|
|
||||||
Enables and disables Apache modules.
|
Enables and disables Apache modules.
|
||||||
|
|
||||||
``apache.mod_rewrite``
|
``apache.vhosts.vhost``
|
||||||
----------------------
|
|
||||||
|
|
||||||
Enabled the Apache module mod_rewrite (Debian and FreeBSD only)
|
|
||||||
|
|
||||||
``apache.mod_proxy``
|
|
||||||
-------------------
|
|
||||||
|
|
||||||
Enables the Apache module mod_proxy. (Debian and FreeBSD only)
|
|
||||||
|
|
||||||
``apache.mod_proxy_http``
|
|
||||||
-------------------------
|
|
||||||
|
|
||||||
Enables the Apache module mod_proxy_http and requires the Apache module mod_proxy to be enabled. (Debian Only)
|
|
||||||
|
|
||||||
``apache.mod_proxy_fcgi``
|
|
||||||
-------------------------
|
|
||||||
|
|
||||||
Enables the Apache module mod_proxy_fcgi and requires the Apache module mod_proxy to be enabled. (Debian Only)
|
|
||||||
|
|
||||||
``apache.mod_wsgi``
|
|
||||||
-------------------
|
|
||||||
|
|
||||||
Installs the mod_wsgi package and enables the Apache module.
|
|
||||||
|
|
||||||
``apache.mod_actions``
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
Enables the Apache module mod_actions. (Debian Only)
|
|
||||||
|
|
||||||
``apache.mod_headers``
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
Enables the Apache module mod_headers. (Debian Only)
|
|
||||||
|
|
||||||
``apache.mod_pagespeed``
|
|
||||||
------------------------
|
|
||||||
|
|
||||||
Installs and Enables the mod_pagespeed module. (Debian and RedHat Only)
|
|
||||||
|
|
||||||
``apache.mod_perl2``
|
|
||||||
-------------------
|
|
||||||
|
|
||||||
Installs and enables the mod_perl2 module (Debian and FreeBSD only)
|
|
||||||
|
|
||||||
``apache.mod_geoip``
|
|
||||||
-------------------
|
|
||||||
|
|
||||||
Installs and enables the mod_geoIP (RedHat only)
|
|
||||||
|
|
||||||
``apache.mod_php5``
|
|
||||||
-------------------
|
|
||||||
|
|
||||||
Installs and enables the mod_php5 module
|
|
||||||
|
|
||||||
``apache.mod_cgi``
|
|
||||||
---------------------
|
|
||||||
|
|
||||||
Enables mod_cgi. (FreeBSD only)
|
|
||||||
|
|
||||||
``apache.mod_fcgid``
|
|
||||||
--------------------
|
|
||||||
|
|
||||||
Installs and enables the mod_fcgid module (Debian only)
|
|
||||||
|
|
||||||
``apache.mod_fastcgi``
|
|
||||||
--------------------
|
|
||||||
|
|
||||||
Installs and enables the mod_fastcgi module
|
|
||||||
|
|
||||||
``apache.mod_dav_svn``
|
|
||||||
--------------------
|
|
||||||
|
|
||||||
Installs and enables the mod_dav_svn module (Debian only)
|
|
||||||
|
|
||||||
``apache.mod_security``
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
Installs an enables the `Apache mod_security2 WAF`<http://modsecurity.org/>`_
|
|
||||||
using data from Pillar. (Debian and RedHat Only)
|
|
||||||
|
|
||||||
Allows you to install the basic Core Rules (CRS) and some basic configuration for mod_security2
|
|
||||||
|
|
||||||
``apache.mod_security.rules``
|
|
||||||
-----------------------------
|
|
||||||
|
|
||||||
This state can create symlinks based on basic Core Rules package. (Debian only)
|
|
||||||
Or it can distribute a mod_security rule file and place it /etc/modsecurity/
|
|
||||||
|
|
||||||
``apache.mod_socache_shmcb``
|
|
||||||
---------------------
|
|
||||||
|
|
||||||
Enables mod_socache_shmcb. (FreeBSD only)
|
|
||||||
|
|
||||||
``apache.mod_ssl``
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
Installs and enables the mod_ssl module (Debian, RedHat and FreeBSD only)
|
|
||||||
|
|
||||||
``apache.mod_suexec``
|
|
||||||
---------------------
|
|
||||||
|
|
||||||
Enables mod_suexec. (FreeBSD only)
|
|
||||||
|
|
||||||
``apache.mod_vhost_alias``
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
Enables the Apache module vhost_alias (Debian Only)
|
|
||||||
|
|
||||||
``apache.mod_remoteip``
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
Enables and configures the Apache module mod_remoteip using data from Pillar. (Debian Only)
|
|
||||||
|
|
||||||
``apache.mod_xsendfile``
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
Installs and enables mod_xsendfile module. (Debian Only)
|
|
||||||
|
|
||||||
``apache.own_default_vhost``
|
|
||||||
--------------------------
|
|
||||||
|
|
||||||
Replace default vhost with own version. By default, it's 503 code. (Debian Only)
|
|
||||||
|
|
||||||
``apache.no_default_vhost``
|
|
||||||
--------------------------
|
|
||||||
|
|
||||||
Remove the default vhost. (Debian Only)
|
|
||||||
|
|
||||||
``apache.vhosts.standard``
|
|
||||||
--------------------------
|
--------------------------
|
||||||
|
|
||||||
Configures Apache name-based virtual hosts and creates virtual host directories using data from Pillar.
|
Configures Apache name-based virtual hosts and creates virtual host directories using data from Pillar.
|
||||||
|
|
||||||
|
All necessary data must be provided in the pillar
|
||||||
|
|
||||||
|
Exceptions are :
|
||||||
|
|
||||||
|
* ``CustomLog`` default is ``/path/apache/log/ServerName-access.log combined``
|
||||||
|
|
||||||
|
* if ``Logformat`` is defined in pillar, ``CustomLog`` is enforced to ``/path/apache/log/ServerName-access.log Logformat``
|
||||||
|
|
||||||
|
* ``ErrorLog`` is enforced to ``/path/apache/log/ServerName-error.log``
|
||||||
|
|
||||||
Example Pillar:
|
Example Pillar:
|
||||||
|
|
||||||
.. code:: yaml
|
Create two vhosts ``example.com.conf`` and ``test.example.com.conf``
|
||||||
|
|
||||||
apache:
|
|
||||||
sites:
|
|
||||||
example.com: # must be unique; used as an ID declaration in Salt; also passed to the template context as {{ id }}
|
|
||||||
template_file: salt://apache/vhosts/standard.tmpl
|
|
||||||
|
|
||||||
When using the provided templates, one can use a space separated list
|
|
||||||
of interfaces to bind to. For example, to bind both IPv4 and IPv6:
|
|
||||||
|
|
||||||
.. code:: yaml
|
.. code:: yaml
|
||||||
|
|
||||||
apache:
|
apache:
|
||||||
sites:
|
VirtualHost:
|
||||||
example.com:
|
example.com: # <-- this is an id decalaration used in salt and default ServerName
|
||||||
interface: '1.2.3.4 [2001:abc:def:100::3]'
|
item: '*:80'
|
||||||
|
directives:
|
||||||
|
- RewriteEngine: 'on'
|
||||||
|
- Header: 'set Access-Control-Allow-Methods GET,PUT,POST,DELETE,OPTIONS'
|
||||||
|
containers:
|
||||||
|
Location:
|
||||||
|
item: '/test.html'
|
||||||
|
directives:
|
||||||
|
- Require: 'all granted'
|
||||||
|
site_id_declaration:
|
||||||
|
item: '10.10.1.1:8080'
|
||||||
|
directives:
|
||||||
|
- ServerName: 'test.example.com'
|
||||||
|
- LogFormat: '"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %{ms}T"'
|
||||||
|
|
||||||
``apache.manage_security``
|
Files produced by these pillars :
|
||||||
--------------------------
|
|
||||||
|
|
||||||
Configures Apache's security.conf options by reassinging them using data from Pillar.
|
``example.com.conf``
|
||||||
|
|
||||||
``apache.server_status``
|
.. code:: bash
|
||||||
--------------------------
|
|
||||||
|
|
||||||
Configures Apache's server_status handler for localhost
|
<VirtualHost *:80>
|
||||||
|
ServerName example.com
|
||||||
|
CustomLog /var/log/httpd/example.com-access.log combined
|
||||||
|
ErrorLog /var/log/httpd/example.com-error.log
|
||||||
|
RewriteEngine on
|
||||||
|
Header set Access-Control-Allow-Methods GET,PUT,POST,DELETE,OPTIONS
|
||||||
|
<Location /test.html>
|
||||||
|
Require all granted
|
||||||
|
</Location>
|
||||||
|
</VirtualHost>
|
||||||
|
|
||||||
|
|
||||||
|
``test.example.com.conf``
|
||||||
|
|
||||||
|
.. code:: bash
|
||||||
|
|
||||||
|
<VirtualHost 10.10.1.1:8080>
|
||||||
|
ServerName test.example.com
|
||||||
|
CustomLog /var/log/httpd/test.example.com-access.log "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %{ms}T"
|
||||||
|
ErrorLog /var/log/httpd/test.example.com-error.log
|
||||||
|
</VirtualHost>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
this will delete ``test.example.com.conf``
|
||||||
|
|
||||||
|
.. code:: yaml
|
||||||
|
|
||||||
|
apache:
|
||||||
|
VirtualHost:
|
||||||
|
test.example.com:
|
||||||
|
item: '10.10.1.1:8080'
|
||||||
|
absent: True # <-- delete test.example.com.conf
|
||||||
|
directives:
|
||||||
|
- ServerName: 'test.example.com'
|
||||||
|
|
||||||
``apache.debian_full``
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
Installs and configures Apache on Debian and Ubuntu systems.
|
|
||||||
|
|
||||||
``apache.uninstall``
|
``apache.uninstall``
|
||||||
----------
|
----------
|
||||||
|
|
||||||
Stops the Apache service and uninstalls the package.
|
Stops the Apache service and uninstalls the package.
|
||||||
|
|
||||||
These states are ordered using the ``order`` declaration. Different stages
|
|
||||||
are divided into the following number ranges:
|
|
||||||
|
|
||||||
1) apache will use 1-500 for ordering
|
|
||||||
2) apache will reserve 1 -100 as unused
|
|
||||||
3) apache will reserve 101-150 for pre pkg install
|
|
||||||
4) apache will reserve 151-200 for pkg install
|
|
||||||
5) apache will reserve 201-250 for pkg configure
|
|
||||||
6) apache will reserve 251-300 for downloads, git stuff, load data
|
|
||||||
7) apache will reserve 301-400 for unknown purposes
|
|
||||||
8) apache will reserve 401-450 for service restart-reloads
|
|
||||||
9) apache WILL reserve 451-460 for service.running
|
|
||||||
10) apache will reserve 461-500 for cmd requiring operational services
|
|
||||||
|
|
||||||
Example Pillar:
|
|
||||||
|
|
||||||
.. code:: yaml
|
|
||||||
|
|
||||||
apache:
|
|
||||||
register-site:
|
|
||||||
# any name as an array index, and you can duplicate this section
|
|
||||||
{{UNIQUE}}:
|
|
||||||
name: 'my name'
|
|
||||||
path: 'salt://path/to/sites-available/conf/file'
|
|
||||||
state: 'enabled'
|
|
||||||
|
|||||||
@ -1,118 +0,0 @@
|
|||||||
{% from "apache/map.jinja" import apache with context %}
|
|
||||||
{% import_yaml "apache/hardening-values.yaml" as hardening_values %}
|
|
||||||
{% import_yaml "apache/defaults/" ~ salt['grains.get']('os_family') ~ "/defaults-apache-" ~ apache.version ~ ".yaml" as global_defaults %}
|
|
||||||
|
|
||||||
include:
|
|
||||||
- apache
|
|
||||||
- apache.mod_ssl
|
|
||||||
- apache.hardening
|
|
||||||
|
|
||||||
{# merge defaults with pillar content #}
|
|
||||||
{% set pillar_server_config = salt['pillar.get']('apache:server_apache_config', {}) %}
|
|
||||||
{% set server_config = salt['apache_directives.merge_container_with_additional_data'](
|
|
||||||
global_defaults.server_apache_config,
|
|
||||||
pillar_server_config) %}
|
|
||||||
|
|
||||||
{# enforce directives values #}
|
|
||||||
{% for directive, directive_data in hardening_values.enforced_directives.items() %}
|
|
||||||
{% set server_config = salt['apache_directives.enforce_directive_value'](directive,
|
|
||||||
directive_data,
|
|
||||||
container_name='server',
|
|
||||||
container_data=server_config) %}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{# merge server config with hardened sections #}
|
|
||||||
{% set server_config = salt['apache_directives.enforce_security_directives_into_containers'](
|
|
||||||
server_config,
|
|
||||||
hardening_values.enforced_containers ) %}
|
|
||||||
|
|
||||||
{# remove containers #}
|
|
||||||
{% for container_name_to_remove, items_names in hardening_values.containers_to_remove.items() %}
|
|
||||||
{% for item_name in items_names %}
|
|
||||||
{% set server_config = salt['apache_directives.remove_container'](
|
|
||||||
server_config,
|
|
||||||
container_name_to_remove,
|
|
||||||
item_name) %}
|
|
||||||
{% endfor %}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{# add supplemental security directives in server configuration #}
|
|
||||||
{% for d_directive in hardening_values.server_supplemental_directives %}
|
|
||||||
{% for directive, value in d_directive.items() %}
|
|
||||||
{% set server_config = salt['apache_directives.append_to_container_directives'](
|
|
||||||
directive,
|
|
||||||
value,
|
|
||||||
server_config) %}
|
|
||||||
{% endfor %}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{% if grains['os_family']=="RedHat" %}
|
|
||||||
|
|
||||||
{{ apache.logdir }}:
|
|
||||||
file.directory:
|
|
||||||
- makedirs: True
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- user: root
|
|
||||||
- group: {{ apache.group }}
|
|
||||||
- dir_mode: 750
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
|
|
||||||
{{ apache.configfile }}:
|
|
||||||
file.managed:
|
|
||||||
- template: jinja
|
|
||||||
- source:
|
|
||||||
- salt://apache/files/{{ salt['grains.get']('os_family') }}/apache-{{ apache.version }}-ng.config.jinja
|
|
||||||
- user: root
|
|
||||||
- group: root
|
|
||||||
- mode: 644
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
- context:
|
|
||||||
apache: {{ apache }}
|
|
||||||
server_config: {{ server_config | json }}
|
|
||||||
|
|
||||||
{{ apache.vhostdir_ng }}:
|
|
||||||
file.directory:
|
|
||||||
- makedirs: True
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- user: root
|
|
||||||
- group: root
|
|
||||||
- dir_mode: 755
|
|
||||||
- file_mode: 644
|
|
||||||
- recurse:
|
|
||||||
- user
|
|
||||||
- group
|
|
||||||
- mode
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
|
|
||||||
|
|
||||||
/etc/httpd/conf.d/welcome.conf:
|
|
||||||
file.managed:
|
|
||||||
- source:
|
|
||||||
- salt://apache/files/{{ salt['grains.get']('os_family') }}/welcome.conf
|
|
||||||
- user: root
|
|
||||||
- group: root
|
|
||||||
- mode: 644
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- service: apache
|
|
||||||
{% endif %}
|
|
||||||
@ -1,13 +1,61 @@
|
|||||||
{% from "apache/map.jinja" import apache with context %}
|
{% from "apache/map.jinja" import apache with context %}
|
||||||
|
{% import_yaml "apache/hardening-values.yaml" as hardening_values %}
|
||||||
|
{% import_yaml "apache/defaults/" ~ salt['grains.get']('os_family') ~ "/defaults-apache-" ~ apache.version ~ ".yaml" as global_defaults %}
|
||||||
|
|
||||||
include:
|
include:
|
||||||
- apache
|
- apache
|
||||||
|
- apache.mod_ssl
|
||||||
|
- apache.hardening
|
||||||
|
|
||||||
|
{# merge defaults with pillar content #}
|
||||||
|
{% set pillar_server_config = salt['pillar.get']('apache:server_apache_config', {}) %}
|
||||||
|
{% set server_config = salt['apache_directives.merge_container_with_additional_data'](
|
||||||
|
global_defaults.server_apache_config,
|
||||||
|
pillar_server_config) %}
|
||||||
|
|
||||||
|
{# enforce directives values #}
|
||||||
|
{% for directive, directive_data in hardening_values.enforced_directives.items() %}
|
||||||
|
{% set server_config = salt['apache_directives.enforce_directive_value'](directive,
|
||||||
|
directive_data,
|
||||||
|
container_name='server',
|
||||||
|
container_data=server_config) %}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
{# merge server config with hardened sections #}
|
||||||
|
{% set server_config = salt['apache_directives.enforce_security_directives_into_containers'](
|
||||||
|
server_config,
|
||||||
|
hardening_values.enforced_containers ) %}
|
||||||
|
|
||||||
|
{# remove containers #}
|
||||||
|
{% for container_name_to_remove, items_names in hardening_values.containers_to_remove.items() %}
|
||||||
|
{% for item_name in items_names %}
|
||||||
|
{% set server_config = salt['apache_directives.remove_container'](
|
||||||
|
server_config,
|
||||||
|
container_name_to_remove,
|
||||||
|
item_name) %}
|
||||||
|
{% endfor %}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
{# add supplemental security directives in server configuration #}
|
||||||
|
{% for d_directive in hardening_values.server_supplemental_directives %}
|
||||||
|
{% for directive, value in d_directive.items() %}
|
||||||
|
{% set server_config = salt['apache_directives.append_to_container_directives'](
|
||||||
|
directive,
|
||||||
|
value,
|
||||||
|
server_config) %}
|
||||||
|
{% endfor %}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
{% if grains['os_family']=="RedHat" %}
|
||||||
|
|
||||||
{{ apache.logdir }}:
|
{{ apache.logdir }}:
|
||||||
file.directory:
|
file.directory:
|
||||||
- makedirs: True
|
- makedirs: True
|
||||||
- require:
|
- require:
|
||||||
- pkg: apache
|
- pkg: apache
|
||||||
|
- user: root
|
||||||
|
- group: {{ apache.group }}
|
||||||
|
- dir_mode: 750
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
- module: apache-restart
|
||||||
- require_in:
|
- require_in:
|
||||||
@ -20,6 +68,9 @@ include:
|
|||||||
- template: jinja
|
- template: jinja
|
||||||
- source:
|
- source:
|
||||||
- salt://apache/files/{{ salt['grains.get']('os_family') }}/apache-{{ apache.version }}.config.jinja
|
- salt://apache/files/{{ salt['grains.get']('os_family') }}/apache-{{ apache.version }}.config.jinja
|
||||||
|
- user: root
|
||||||
|
- group: root
|
||||||
|
- mode: 644
|
||||||
- require:
|
- require:
|
||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
@ -29,13 +80,22 @@ include:
|
|||||||
- module: apache-reload
|
- module: apache-reload
|
||||||
- service: apache
|
- service: apache
|
||||||
- context:
|
- context:
|
||||||
apache: {{ apache | json }}
|
apache: {{ apache | json}}
|
||||||
|
server_config: {{ server_config | json }}
|
||||||
|
|
||||||
{{ apache.vhostdir }}:
|
{{ apache.vhostdir }}:
|
||||||
file.directory:
|
file.directory:
|
||||||
- makedirs: True
|
- makedirs: True
|
||||||
- require:
|
- require:
|
||||||
- pkg: apache
|
- pkg: apache
|
||||||
|
- user: root
|
||||||
|
- group: root
|
||||||
|
- dir_mode: 755
|
||||||
|
- file_mode: 644
|
||||||
|
- recurse:
|
||||||
|
- user
|
||||||
|
- group
|
||||||
|
- mode
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
- module: apache-restart
|
||||||
- require_in:
|
- require_in:
|
||||||
@ -43,98 +103,16 @@ include:
|
|||||||
- module: apache-reload
|
- module: apache-reload
|
||||||
- service: apache
|
- service: apache
|
||||||
|
|
||||||
{% if grains['os_family']=="Debian" %}
|
|
||||||
/etc/apache2/envvars:
|
|
||||||
file.managed:
|
|
||||||
- template: jinja
|
|
||||||
- source:
|
|
||||||
- salt://apache/files/{{ salt['grains.get']('os_family') }}/envvars-{{ apache.version }}.jinja
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
|
|
||||||
{{ apache.portsfile }}:
|
|
||||||
file.managed:
|
|
||||||
- template: jinja
|
|
||||||
- source:
|
|
||||||
- salt://apache/files/{{ salt['grains.get']('os_family') }}/ports-{{ apache.version }}.conf.jinja
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
- context:
|
|
||||||
apache: {{ apache | json }}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if grains['os_family']=="RedHat" %}
|
|
||||||
{{ apache.confdir }}/welcome.conf:
|
{{ apache.confdir }}/welcome.conf:
|
||||||
file.absent:
|
file.managed:
|
||||||
|
- source:
|
||||||
|
- salt://apache/files/{{ salt['grains.get']('os_family') }}/welcome.conf
|
||||||
|
- user: root
|
||||||
|
- group: root
|
||||||
|
- mode: 644
|
||||||
- require:
|
- require:
|
||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
- service: apache
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
{% if grains['os_family']=="Suse" or salt['grains.get']('os') == 'SUSE' %}
|
|
||||||
/etc/apache2/global.conf:
|
|
||||||
file.managed:
|
|
||||||
- template: jinja
|
|
||||||
- source:
|
|
||||||
- salt://apache/files/{{ salt['grains.get']('os_family') }}/global.config.jinja
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
- context:
|
|
||||||
apache: {{ apache | json }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if grains['os_family']=="FreeBSD" %}
|
|
||||||
/usr/local/etc/{{ apache.service }}/envvars.d/by_salt.env:
|
|
||||||
file.managed:
|
|
||||||
- template: jinja
|
|
||||||
- source:
|
|
||||||
- salt://apache/files/{{ salt['grains.get']('os_family') }}/envvars-{{ apache.version }}.jinja
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
|
|
||||||
{{ apache.portsfile }}:
|
|
||||||
file.managed:
|
|
||||||
- template: jinja
|
|
||||||
- source:
|
|
||||||
- salt://apache/files/{{ salt['grains.get']('os_family') }}/ports-{{ apache.version }}.conf.jinja
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
- context:
|
|
||||||
apache: {{ apache | json }}
|
|
||||||
{% endif %}
|
|
||||||
|
|||||||
@ -1,40 +0,0 @@
|
|||||||
#
|
|
||||||
# This file is managed by Salt! Do not edit by hand!
|
|
||||||
#
|
|
||||||
{%- from "apache/map.jinja" import apache with context %}
|
|
||||||
{%- import_yaml "apache/hardening-values.yaml" as hardening_values %}
|
|
||||||
{%- from "apache/lib.sls" import directives_output, container_output with context %}
|
|
||||||
|
|
||||||
{%- set list_interfaces_ports = [] %}
|
|
||||||
{%- for name, vhost in salt['pillar.get']('apache:VirtualHost', {}).items() %}
|
|
||||||
{%- set items = vhost.item.split() %}
|
|
||||||
{%- for item in items if item not in list_interfaces_ports %}
|
|
||||||
{%- do list_interfaces_ports.append(item) %}
|
|
||||||
{%- endfor %}
|
|
||||||
{%- endfor %}
|
|
||||||
|
|
||||||
{%- for item in list_interfaces_ports %}
|
|
||||||
Listen {{ item }}
|
|
||||||
{% else %}
|
|
||||||
Listen *:80
|
|
||||||
{%- endfor %}
|
|
||||||
|
|
||||||
{{ directives_output(server_config, 0) }}
|
|
||||||
|
|
||||||
Include conf.modules.d/*.conf
|
|
||||||
|
|
||||||
User {{ apache.user }}
|
|
||||||
Group {{ apache.group }}
|
|
||||||
|
|
||||||
|
|
||||||
{%- for container_name, container_data_list in server_config.get('containers', {}).items() %}
|
|
||||||
{%- for container_data in container_data_list %}
|
|
||||||
{{ container_output(container_name, container_data) }}
|
|
||||||
{%- endfor %}
|
|
||||||
{%- endfor %}
|
|
||||||
|
|
||||||
|
|
||||||
IncludeOptional {{ apache.confdir }}/*.conf
|
|
||||||
{%- if apache.vhostdir_ng != apache.confdir %}
|
|
||||||
IncludeOptional {{ apache.vhostdir_ng }}/*.conf
|
|
||||||
{%- endif %}
|
|
||||||
@ -1,400 +1,42 @@
|
|||||||
#
|
#
|
||||||
# This file is managed by Salt! Do not edit by hand!
|
# This file is managed by Salt! Do not edit by hand!
|
||||||
#
|
#
|
||||||
{% from "apache/map.jinja" import apache with context %}
|
{%- from "apache/map.jinja" import apache with context %}
|
||||||
#
|
{%- import_yaml "apache/hardening-values.yaml" as hardening_values %}
|
||||||
# This is the main Apache HTTP server configuration file. It contains the
|
{%- from "apache/lib.sls" import directives_output, container_output with context %}
|
||||||
# configuration directives that give the server its instructions.
|
|
||||||
# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
|
|
||||||
# In particular, see
|
|
||||||
# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
|
|
||||||
# for a discussion of each configuration directive.
|
|
||||||
#
|
|
||||||
# Do NOT simply read the instructions in here without understanding
|
|
||||||
# what they do. They're here only as hints or reminders. If you are unsure
|
|
||||||
# consult the online docs. You have been warned.
|
|
||||||
#
|
|
||||||
# Configuration and logfile names: If the filenames you specify for many
|
|
||||||
# of the server's control files begin with "/" (or "drive:/" for Win32), the
|
|
||||||
# server will use that explicit path. If the filenames do *not* begin
|
|
||||||
# with "/", the value of ServerRoot is prepended -- so 'log/access_log'
|
|
||||||
# with ServerRoot set to '/www' will be interpreted by the
|
|
||||||
# server as '/www/log/access_log', where as '/log/access_log' will be
|
|
||||||
# interpreted as '/log/access_log'.
|
|
||||||
|
|
||||||
#
|
{%- set list_interfaces_ports = [] %}
|
||||||
# ServerRoot: The top of the directory tree under which the server's
|
{%- for name, vhost in salt['pillar.get']('apache:VirtualHost', {}).items() %}
|
||||||
# configuration, error, and log files are kept.
|
{%- if not vhost.get('absent', False) %}
|
||||||
#
|
{%- set items = vhost.item.split() %}
|
||||||
# Do not add a slash at the end of the directory path. If you point
|
{%- for item in items if item not in list_interfaces_ports %}
|
||||||
# ServerRoot at a non-local disk, be sure to specify a local disk on the
|
{%- do list_interfaces_ports.append(item) %}
|
||||||
# Mutex directive, if file-based mutexes are used. If you wish to share the
|
{%- endfor %}
|
||||||
# same ServerRoot for multiple httpd daemons, you will need to change at
|
|
||||||
# least PidFile.
|
|
||||||
#
|
|
||||||
ServerRoot "{{ apache.get('serverroot', '/etc/httpd') }}"
|
|
||||||
|
|
||||||
#
|
|
||||||
# Listen: Allows you to bind Apache to specific IP addresses and/or
|
|
||||||
# ports, instead of the default. See also the <VirtualHost>
|
|
||||||
# directive.
|
|
||||||
#
|
|
||||||
# Change this to Listen on specific IP addresses as shown below to
|
|
||||||
# prevent Apache from glomming onto all bound IP addresses.
|
|
||||||
#
|
|
||||||
#Listen 12.34.56.78:80
|
|
||||||
|
|
||||||
{% if salt['pillar.get']('apache:sites') is mapping %}
|
|
||||||
{%- set listen_directives = [] %}
|
|
||||||
{%- for id, site in salt['pillar.get']('apache:sites').items() %}
|
|
||||||
{%- set interfaces = site.get('interface', '*').split() %}
|
|
||||||
{%- set port = site.get('port', 80) %}
|
|
||||||
{%- for interface in interfaces %}
|
|
||||||
{%- if not site.get('exclude_listen_directive', False) and not port == '*' %}
|
|
||||||
{%- set listen_directive = interface ~ ':' ~ port %}
|
|
||||||
{%- if listen_directive not in listen_directives %}
|
|
||||||
{%- do listen_directives.append(listen_directive) %}
|
|
||||||
{%- endif %}
|
|
||||||
{%- endif %}
|
|
||||||
{%- endfor %}
|
|
||||||
{%- endfor %}
|
|
||||||
{%- for listen in listen_directives %}
|
|
||||||
Listen {{ listen }}
|
|
||||||
{%- endfor %}
|
|
||||||
{%- else %}
|
|
||||||
Listen 80
|
|
||||||
|
|
||||||
<IfModule mod_ssl.c>
|
|
||||||
Listen 443
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
<IfModule mod_gnutls.c>
|
|
||||||
Listen 443
|
|
||||||
</IfModule>
|
|
||||||
{%- endif %}
|
{%- endif %}
|
||||||
|
|
||||||
#
|
|
||||||
# Dynamic Shared Object (DSO) Support
|
|
||||||
#
|
|
||||||
# To be able to use the functionality of a module which was built as a DSO you
|
|
||||||
# have to place corresponding `LoadModule' lines at this location so the
|
|
||||||
# directives contained in it are actually available _before_ they are used.
|
|
||||||
# Statically compiled modules (those listed by `httpd -l') do not need
|
|
||||||
# to be loaded here.
|
|
||||||
#
|
|
||||||
# Example:
|
|
||||||
# LoadModule foo_module modules/mod_foo.so
|
|
||||||
#
|
|
||||||
Include conf.modules.d/*.conf
|
|
||||||
|
|
||||||
#
|
|
||||||
# If you wish httpd to run as a different user or group, you must run
|
|
||||||
# httpd as root initially and it will switch.
|
|
||||||
#
|
|
||||||
# User/Group: The name (or #number) of the user/group to run httpd as.
|
|
||||||
# It is usually good practice to create a dedicated user and group for
|
|
||||||
# running httpd, as with most system services.
|
|
||||||
#
|
|
||||||
User apache
|
|
||||||
Group apache
|
|
||||||
|
|
||||||
# 'Main' server configuration
|
|
||||||
#
|
|
||||||
# The directives in this section set up the values used by the 'main'
|
|
||||||
# server, which responds to any requests that aren't handled by a
|
|
||||||
# <VirtualHost> definition. These values also provide defaults for
|
|
||||||
# any <VirtualHost> containers you may define later in the file.
|
|
||||||
#
|
|
||||||
# All of these directives may appear inside <VirtualHost> containers,
|
|
||||||
# in which case these default settings will be overridden for the
|
|
||||||
# virtual host being defined.
|
|
||||||
#
|
|
||||||
|
|
||||||
#
|
|
||||||
# ServerAdmin: Your address, where problems with the server should be
|
|
||||||
# e-mailed. This address appears on some server-generated pages, such
|
|
||||||
# as error documents. e.g. admin@your-domain.com
|
|
||||||
#
|
|
||||||
ServerAdmin root@localhost
|
|
||||||
|
|
||||||
#
|
|
||||||
# ServerName gives the name and port that the server uses to identify itself.
|
|
||||||
# This can often be determined automatically, but we recommend you specify
|
|
||||||
# it explicitly to prevent problems during startup.
|
|
||||||
#
|
|
||||||
# If your host doesn't have a registered DNS name, enter its IP address here.
|
|
||||||
#
|
|
||||||
#ServerName www.example.com:80
|
|
||||||
|
|
||||||
#
|
|
||||||
# Deny access to the entirety of your server's filesystem. You must
|
|
||||||
# explicitly permit access to web content directories in other
|
|
||||||
# <Directory> blocks below.
|
|
||||||
#
|
|
||||||
<Directory />
|
|
||||||
AllowOverride none
|
|
||||||
Require all denied
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
#
|
|
||||||
# Note that from this point forward you must specifically allow
|
|
||||||
# particular features to be enabled - so if something's not working as
|
|
||||||
# you might expect, make sure that you have specifically enabled it
|
|
||||||
# below.
|
|
||||||
#
|
|
||||||
|
|
||||||
#
|
|
||||||
# DocumentRoot: The directory out of which you will serve your
|
|
||||||
# documents. By default, all requests are taken from this directory, but
|
|
||||||
# symbolic links and aliases may be used to point to other locations.
|
|
||||||
#
|
|
||||||
DocumentRoot "{{ apache.get('docroot', apache.wwwdir + '/html') }}"
|
|
||||||
|
|
||||||
#
|
|
||||||
# Relax access to content within {{ apache.wwwdir }}.
|
|
||||||
#
|
|
||||||
<Directory "{{ apache.wwwdir }}">
|
|
||||||
AllowOverride None
|
|
||||||
# Allow open access:
|
|
||||||
Require all granted
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
# Further relax access to the default document root:
|
|
||||||
<Directory "{{ apache.get('docroot', apache.wwwdir + '/html') }}">
|
|
||||||
#
|
|
||||||
# Possible values for the Options directive are "None", "All",
|
|
||||||
# or any combination of:
|
|
||||||
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
|
|
||||||
#
|
|
||||||
# Note that "MultiViews" must be named *explicitly* --- "Options All"
|
|
||||||
# doesn't give it to you.
|
|
||||||
#
|
|
||||||
# The Options directive is both complicated and important. Please see
|
|
||||||
# http://httpd.apache.org/docs/2.4/mod/core.html#options
|
|
||||||
# for more information.
|
|
||||||
#
|
|
||||||
Options Indexes FollowSymLinks
|
|
||||||
|
|
||||||
#
|
|
||||||
# AllowOverride controls what directives may be placed in .htaccess files.
|
|
||||||
# It can be "All", "None", or any combination of the keywords:
|
|
||||||
# Options FileInfo AuthConfig Limit
|
|
||||||
#
|
|
||||||
AllowOverride None
|
|
||||||
|
|
||||||
#
|
|
||||||
# Controls who can get stuff from this server.
|
|
||||||
#
|
|
||||||
Require all granted
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
#
|
|
||||||
# DirectoryIndex: sets the file that Apache will serve if a directory
|
|
||||||
# is requested.
|
|
||||||
#
|
|
||||||
<IfModule dir_module>
|
|
||||||
DirectoryIndex index.html
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
#
|
|
||||||
# The following lines prevent .htaccess and .htpasswd files from being
|
|
||||||
# viewed by Web clients.
|
|
||||||
#
|
|
||||||
<Files ".ht*">
|
|
||||||
Require all denied
|
|
||||||
</Files>
|
|
||||||
|
|
||||||
#
|
|
||||||
# ErrorLog: The location of the error log file.
|
|
||||||
# If you do not specify an ErrorLog directive within a <VirtualHost>
|
|
||||||
# container, error messages relating to that virtual host will be
|
|
||||||
# logged here. If you *do* define an error logfile for a <VirtualHost>
|
|
||||||
# container, that host's errors will be logged there and not here.
|
|
||||||
#
|
|
||||||
ErrorLog "{{ apache.logdir }}/error_log"
|
|
||||||
|
|
||||||
#
|
|
||||||
# LogLevel: Control the number of messages logged to the error_log.
|
|
||||||
# Possible values include: debug, info, notice, warn, error, crit,
|
|
||||||
# alert, emerg.
|
|
||||||
#
|
|
||||||
LogLevel warn
|
|
||||||
|
|
||||||
<IfModule log_config_module>
|
|
||||||
#
|
|
||||||
# The following directives define some format nicknames for use with
|
|
||||||
# a CustomLog directive (see below).
|
|
||||||
#
|
|
||||||
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
|
|
||||||
LogFormat "%h %l %u %t \"%r\" %>s %b" common
|
|
||||||
{%- for log_format in salt['pillar.get']('apache:log_formats', []) %}
|
|
||||||
LogFormat {{ log_format }}
|
|
||||||
{%- endfor %}
|
|
||||||
|
|
||||||
<IfModule logio_module>
|
|
||||||
# You need to enable mod_logio.c to use %I and %O
|
|
||||||
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
#
|
|
||||||
# The location and format of the access logfile (Common Logfile Format).
|
|
||||||
# If you do not define any access logfiles within a <VirtualHost>
|
|
||||||
# container, they will be logged here. Contrariwise, if you *do*
|
|
||||||
# define per-<VirtualHost> access logfiles, transactions will be
|
|
||||||
# logged therein and *not* in this file.
|
|
||||||
#
|
|
||||||
#CustomLog "logs/access_log" common
|
|
||||||
|
|
||||||
#
|
|
||||||
# If you prefer a logfile with access, agent, and referer information
|
|
||||||
# (Combined Logfile Format) you can use the following directive.
|
|
||||||
#
|
|
||||||
CustomLog "{{ apache.logdir }}/access_log" combined
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
<IfModule alias_module>
|
|
||||||
#
|
|
||||||
# Redirect: Allows you to tell clients about documents that used to
|
|
||||||
# exist in your server's namespace, but do not anymore. The client
|
|
||||||
# will make a new request for the document at its new location.
|
|
||||||
# Example:
|
|
||||||
# Redirect permanent /foo http://www.example.com/bar
|
|
||||||
|
|
||||||
#
|
|
||||||
# Alias: Maps web paths into filesystem paths and is used to
|
|
||||||
# access content that does not live under the DocumentRoot.
|
|
||||||
# Example:
|
|
||||||
# Alias /webpath /full/filesystem/path
|
|
||||||
#
|
|
||||||
# If you include a trailing / on /webpath then the server will
|
|
||||||
# require it to be present in the URL. You will also likely
|
|
||||||
# need to provide a <Directory> section to allow access to
|
|
||||||
# the filesystem path.
|
|
||||||
|
|
||||||
#
|
|
||||||
# ScriptAlias: This controls which directories contain server scripts.
|
|
||||||
# ScriptAliases are essentially the same as Aliases, except that
|
|
||||||
# documents in the target directory are treated as applications and
|
|
||||||
# run by the server when requested rather than as documents sent to the
|
|
||||||
# client. The same rules about trailing "/" apply to ScriptAlias
|
|
||||||
# directives as to Alias.
|
|
||||||
#
|
|
||||||
ScriptAlias /cgi-bin/ "{{ apache.wwwdir }}/cgi-bin/"
|
|
||||||
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
#
|
|
||||||
# "{{ apache.wwwdir }}/cgi-bin/" should be changed to whatever your ScriptAliased
|
|
||||||
# CGI directory exists, if you have that configured.
|
|
||||||
#
|
|
||||||
<Directory "{{ apache.wwwdir }}/cgi-bin/">
|
|
||||||
AllowOverride None
|
|
||||||
Options None
|
|
||||||
Require all granted
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
<IfModule mime_module>
|
|
||||||
#
|
|
||||||
# TypesConfig points to the file containing the list of mappings from
|
|
||||||
# filename extension to MIME-type.
|
|
||||||
#
|
|
||||||
TypesConfig /etc/mime.types
|
|
||||||
|
|
||||||
#
|
|
||||||
# AddType allows you to add to or override the MIME configuration
|
|
||||||
# file specified in TypesConfig for specific file types.
|
|
||||||
#
|
|
||||||
#AddType application/x-gzip .tgz
|
|
||||||
#
|
|
||||||
# AddEncoding allows you to have certain browsers uncompress
|
|
||||||
# information on the fly. Note: Not all browsers support this.
|
|
||||||
#
|
|
||||||
#AddEncoding x-compress .Z
|
|
||||||
#AddEncoding x-gzip .gz .tgz
|
|
||||||
#
|
|
||||||
# If the AddEncoding directives above are commented-out, then you
|
|
||||||
# probably should define those extensions to indicate media types:
|
|
||||||
#
|
|
||||||
AddType application/x-compress .Z
|
|
||||||
AddType application/x-gzip .gz .tgz
|
|
||||||
|
|
||||||
#
|
|
||||||
# AddHandler allows you to map certain file extensions to "handlers":
|
|
||||||
# actions unrelated to filetype. These can be either built into the server
|
|
||||||
# or added with the Action directive (see below)
|
|
||||||
#
|
|
||||||
# To use CGI scripts outside of ScriptAliased directories:
|
|
||||||
# (You will also need to add "ExecCGI" to the "Options" directive.)
|
|
||||||
#
|
|
||||||
#AddHandler cgi-script .cgi
|
|
||||||
|
|
||||||
# For type maps (negotiated resources):
|
|
||||||
#AddHandler type-map var
|
|
||||||
|
|
||||||
#
|
|
||||||
# Filters allow you to process content before it is sent to the client.
|
|
||||||
#
|
|
||||||
# To parse .shtml files for server-side includes (SSI):
|
|
||||||
# (You will also need to add "Includes" to the "Options" directive.)
|
|
||||||
#
|
|
||||||
AddType text/html .shtml
|
|
||||||
AddOutputFilter INCLUDES .shtml
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
#
|
|
||||||
# Specify a default charset for all content served; this enables
|
|
||||||
# interpretation of all content as UTF-8 by default. To use the
|
|
||||||
# default browser choice (ISO-8859-1), or to allow the META tags
|
|
||||||
# in HTML content to override this choice, comment out this
|
|
||||||
# directive:
|
|
||||||
#
|
|
||||||
AddDefaultCharset {{ apache.default_charset }}
|
|
||||||
|
|
||||||
<IfModule mime_magic_module>
|
|
||||||
#
|
|
||||||
# The mod_mime_magic module allows the server to use various hints from the
|
|
||||||
# contents of the file itself to determine its type. The MIMEMagicFile
|
|
||||||
# directive tells the module where the hint definitions are located.
|
|
||||||
#
|
|
||||||
MIMEMagicFile conf/magic
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
#
|
|
||||||
# Customizable error responses come in three flavors:
|
|
||||||
# 1) plain text 2) local redirects 3) external redirects
|
|
||||||
#
|
|
||||||
# Some examples:
|
|
||||||
#ErrorDocument 500 "The server made a boo boo."
|
|
||||||
#ErrorDocument 404 /missing.html
|
|
||||||
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
|
|
||||||
#ErrorDocument 402 http://www.example.com/subscription_info.html
|
|
||||||
#
|
|
||||||
|
|
||||||
#
|
|
||||||
# EnableMMAP and EnableSendfile: On systems that support it,
|
|
||||||
# memory-mapping or the sendfile syscall may be used to deliver
|
|
||||||
# files. This usually improves server performance, but must
|
|
||||||
# be turned off when serving from networked-mounted
|
|
||||||
# filesystems or if support for these functions is otherwise
|
|
||||||
# broken on your system.
|
|
||||||
# Defaults if commented: EnableMMAP On, EnableSendfile Off
|
|
||||||
#
|
|
||||||
#EnableMMAP off
|
|
||||||
EnableSendfile on
|
|
||||||
|
|
||||||
{%- for directive, dvalue in salt['pillar.get']('apache:global', {}).items() %}
|
|
||||||
{{ directive }} {{ dvalue }}
|
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
|
|
||||||
# Supplemental configuration
|
{%- for item in list_interfaces_ports %}
|
||||||
#
|
Listen {{ item }}
|
||||||
# Load config files in the "/etc/httpd/conf.d" directory, if any.
|
{% else %}
|
||||||
IncludeOptional {{ apache.confdir }}/*.conf
|
Listen *:80
|
||||||
{% if apache.vhostdir != apache.confdir %}
|
{%- endfor %}
|
||||||
IncludeOptional {{ apache.vhostdir }}/*.conf
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
# Added for security enhancements
|
{{ directives_output(server_config, 0) }}
|
||||||
TraceEnable off
|
|
||||||
ServerSignature off
|
Include conf.modules.d/*.conf
|
||||||
ServerTokens Prod
|
|
||||||
|
User {{ apache.user }}
|
||||||
|
Group {{ apache.group }}
|
||||||
|
|
||||||
|
|
||||||
|
{%- for container_name, container_data_list in server_config.get('containers', {}).items() %}
|
||||||
|
{%- for container_data in container_data_list %}
|
||||||
|
{{ container_output(container_name, container_data) }}
|
||||||
|
{%- endfor %}
|
||||||
|
{%- endfor %}
|
||||||
|
|
||||||
|
|
||||||
|
IncludeOptional {{ apache.confdir }}/*.conf
|
||||||
|
{%- if apache.vhostdir != apache.confdir %}
|
||||||
|
IncludeOptional {{ apache.vhostdir }}/*.conf
|
||||||
|
{%- endif %}
|
||||||
|
|||||||
@ -1,86 +0,0 @@
|
|||||||
{%- import_yaml "apache/hardening-values.yaml" as hardening_values %}
|
|
||||||
|
|
||||||
{% if grains['os_family']=="Debian" %}
|
|
||||||
|
|
||||||
include:
|
|
||||||
- apache
|
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:enabled', []) %}
|
|
||||||
a2enmod {{ module }}:
|
|
||||||
cmd.run:
|
|
||||||
- unless: ls /etc/apache2/mods-enabled/{{ module }}.load
|
|
||||||
- order: 225
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
|
||||||
a2dismod -f {{ module }}:
|
|
||||||
cmd.run:
|
|
||||||
- onlyif: ls /etc/apache2/mods-enabled/{{ module }}.load
|
|
||||||
- order: 225
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{% elif grains['os_family']=="RedHat" %}
|
|
||||||
|
|
||||||
include:
|
|
||||||
- apache
|
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:enabled', default=hardening_values.modules.enforce_enabled, merge=True) if module not in hardening_values.modules.enforce_disabled %}
|
|
||||||
find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^#\)\(\s*LoadModule.{{ module }}_module\)/\2/g' {} \;:
|
|
||||||
cmd.run:
|
|
||||||
- unless: httpd -M 2> /dev/null | grep "[[:space:]]{{ module }}_module"
|
|
||||||
- order: 225
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:disabled', default=hardening_values.modules.enforce_disabled, merge=True) if module not in hardening_values.modules.enforce_enabled %}
|
|
||||||
find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^\s*LoadModule.{{ module }}_module\)/#\1/g' {} \;:
|
|
||||||
cmd.run:
|
|
||||||
- onlyif: httpd -M 2> /dev/null | grep "[[:space:]]{{ module }}_module"
|
|
||||||
- order: 225
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
{% elif salt['grains.get']('os_family') == 'Suse' or salt['grains.get']('os') == 'SUSE' %}
|
|
||||||
|
|
||||||
include:
|
|
||||||
- apache
|
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:enabled', []) %}
|
|
||||||
a2enmod {{ module }}:
|
|
||||||
cmd.run:
|
|
||||||
- unless: egrep "^APACHE_MODULES=" /etc/sysconfig/apache2 | grep {{ module }}
|
|
||||||
- order: 225
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
|
||||||
a2dismod -f {{ module }}:
|
|
||||||
cmd.run:
|
|
||||||
- onlyif: egrep "^APACHE_MODULES=" /etc/sysconfig/apache2 | grep {{ module }}
|
|
||||||
- order: 225
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-restart
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
@ -1,3 +1,5 @@
|
|||||||
|
{%- import_yaml "apache/hardening-values.yaml" as hardening_values %}
|
||||||
|
|
||||||
{% if grains['os_family']=="Debian" %}
|
{% if grains['os_family']=="Debian" %}
|
||||||
|
|
||||||
include:
|
include:
|
||||||
@ -12,10 +14,6 @@ a2enmod {{ module }}:
|
|||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
- module: apache-restart
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
||||||
@ -27,10 +25,6 @@ a2dismod -f {{ module }}:
|
|||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
- module: apache-restart
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
{% elif grains['os_family']=="RedHat" %}
|
{% elif grains['os_family']=="RedHat" %}
|
||||||
@ -38,7 +32,7 @@ a2dismod -f {{ module }}:
|
|||||||
include:
|
include:
|
||||||
- apache
|
- apache
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:enabled', []) %}
|
{% for module in salt['pillar.get']('apache:modules:enabled', default=hardening_values.modules.enforce_enabled, merge=True) if module not in hardening_values.modules.enforce_disabled %}
|
||||||
find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^#\)\(\s*LoadModule.{{ module }}_module\)/\2/g' {} \;:
|
find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^#\)\(\s*LoadModule.{{ module }}_module\)/\2/g' {} \;:
|
||||||
cmd.run:
|
cmd.run:
|
||||||
- unless: httpd -M 2> /dev/null | grep "[[:space:]]{{ module }}_module"
|
- unless: httpd -M 2> /dev/null | grep "[[:space:]]{{ module }}_module"
|
||||||
@ -47,13 +41,9 @@ find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^#\)\(\s*LoadModule
|
|||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
- module: apache-restart
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
{% for module in salt['pillar.get']('apache:modules:disabled', default=hardening_values.modules.enforce_disabled, merge=True) if module not in hardening_values.modules.enforce_enabled %}
|
||||||
find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^\s*LoadModule.{{ module }}_module\)/#\1/g' {} \;:
|
find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^\s*LoadModule.{{ module }}_module\)/#\1/g' {} \;:
|
||||||
cmd.run:
|
cmd.run:
|
||||||
- onlyif: httpd -M 2> /dev/null | grep "[[:space:]]{{ module }}_module"
|
- onlyif: httpd -M 2> /dev/null | grep "[[:space:]]{{ module }}_module"
|
||||||
@ -62,12 +52,10 @@ find /etc/httpd/ -name '*.conf' -type f -exec sed -i -e 's/\(^\s*LoadModule.{{ m
|
|||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
- module: apache-restart
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
{% elif salt['grains.get']('os_family') == 'Suse' or salt['grains.get']('os') == 'SUSE' %}
|
{% elif salt['grains.get']('os_family') == 'Suse' or salt['grains.get']('os') == 'SUSE' %}
|
||||||
|
|
||||||
include:
|
include:
|
||||||
@ -82,10 +70,6 @@ a2enmod {{ module }}:
|
|||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
- module: apache-restart
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
{% for module in salt['pillar.get']('apache:modules:disabled', []) %}
|
||||||
@ -97,10 +81,6 @@ a2dismod -f {{ module }}:
|
|||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
- module: apache-restart
|
- module: apache-restart
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|||||||
@ -44,8 +44,7 @@ RedHat:
|
|||||||
mod_geoip: mod_geoip
|
mod_geoip: mod_geoip
|
||||||
mod_geoip_database: GeoIP
|
mod_geoip_database: GeoIP
|
||||||
|
|
||||||
vhostdir: /etc/httpd/vhosts.d
|
vhostdir: /etc/httpd/conf.d
|
||||||
vhostdir_ng: /etc/httpd/conf.d
|
|
||||||
confdir: /etc/httpd/conf.d
|
confdir: /etc/httpd/conf.d
|
||||||
confext: .conf
|
confext: .conf
|
||||||
default_site: default
|
default_site: default
|
||||||
|
|||||||
@ -1,41 +0,0 @@
|
|||||||
{% from "apache/map.jinja" import apache with context %}
|
|
||||||
|
|
||||||
include:
|
|
||||||
- apache
|
|
||||||
|
|
||||||
{% if grains.os_family == 'Debian' %}
|
|
||||||
|
|
||||||
{% set dirpath = '/etc/apache2/sites-enabled' %}
|
|
||||||
|
|
||||||
{# Add . and .. to make it easier to not clean those #}
|
|
||||||
{% set valid_sites = ['.', '..', ] %}
|
|
||||||
|
|
||||||
{# Take sites from apache.vhosts.standard #}
|
|
||||||
{% for id, site in salt['pillar.get']('apache:sites', {}).items() %}
|
|
||||||
{% do valid_sites.append('{}{}'.format(id, apache.confext)) %}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{# Take sites from apache.register_site #}
|
|
||||||
{% for id, site in salt['pillar.get']('apache:register-site', {}) %}
|
|
||||||
{% do valid_sites.append('{}{}'.format(site.name, apache.confext)) %}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
|
|
||||||
{% for filename in salt['file.readdir']('/etc/apache2/sites-enabled/') %}
|
|
||||||
{% if filename not in valid_sites %}
|
|
||||||
|
|
||||||
a2dissite {{ filename }}:
|
|
||||||
cmd.run:
|
|
||||||
- onlyif: "test -L {{ dirpath}}/{{ filename }} || test -f {{ dirpath}}/{{ filename }}"
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-reload
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
|
|
||||||
{% endif %}{# Debian #}
|
|
||||||
@ -1,37 +0,0 @@
|
|||||||
#
|
|
||||||
# This file is managed by Salt! Do not edit by hand!
|
|
||||||
#
|
|
||||||
{# Define default values here so the template below can just focus on layout #}
|
|
||||||
{%- set sitename = site.get('ServerName', id) -%}
|
|
||||||
|
|
||||||
{%- set vals = {
|
|
||||||
'interfaces': site.get('interface', '*').split(),
|
|
||||||
'port': site.get('port', '80'),
|
|
||||||
|
|
||||||
'ServerName': sitename,
|
|
||||||
'ServerAlias': site.get('ServerAlias', ''),
|
|
||||||
|
|
||||||
'ServerAdmin': site.get('ServerAdmin', 'webmaster@{0}'.format(sitename)),
|
|
||||||
|
|
||||||
'LogLevel': site.get('LogLevel', 'warn'),
|
|
||||||
'ErrorLog': site.get('ErrorLog', '{0}/{1}-error.log'.format(map.logdir, sitename)),
|
|
||||||
'CustomLog': site.get('CustomLog', '{0}/{1}-access.log'.format(map.logdir, sitename)),
|
|
||||||
'LogFormat': site.get('LogFormat', '"%h %l %u %t \\\"%r\\\" %>s %b"'),
|
|
||||||
|
|
||||||
|
|
||||||
'DocumentRoot': site.get('DocumentRoot', '{0}/{1}'.format(map.wwwdir, sitename))
|
|
||||||
} -%}
|
|
||||||
|
|
||||||
<VirtualHost {% for intf in vals.interfaces %} {{intf}}:{{ vals.port }}{% endfor -%}>
|
|
||||||
ServerName {{ vals.ServerName }}
|
|
||||||
{% if site.get('ServerAlias') != False %}ServerAlias {{ vals.ServerAlias }}{% endif %}
|
|
||||||
{% if site.get('ServerAdmin') != False %}ServerAdmin {{ vals.ServerAdmin }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('DocumentRoot') != False -%}DocumentRoot {{ vals.DocumentRoot }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('LogLevel') != False -%}LogLevel {{ vals.LogLevel }}{% endif %}
|
|
||||||
{% if site.get('ErrorLog') != False -%}ErrorLog {{ vals.ErrorLog }}{% endif %}
|
|
||||||
{% if site.get('LogFormat') != False -%}LogFormat {{ vals.LogFormat }}{% endif %}
|
|
||||||
{% if site.get('CustomLog') != False -%}LogFormat {{ vals.LogFormat }} {{ sitename }}
|
|
||||||
CustomLog {{ vals.CustomLog }} {{ sitename }}{% endif %}
|
|
||||||
</VirtualHost>
|
|
||||||
@ -1,131 +0,0 @@
|
|||||||
#
|
|
||||||
# This file is managed by Salt! Do not edit by hand!
|
|
||||||
#
|
|
||||||
{# Define default values here so the template below can just focus on layout #}
|
|
||||||
{% from "apache/map.jinja" import apache with context %}
|
|
||||||
{% set sitename = site.get('ServerName', id) %}
|
|
||||||
{% set vals = {
|
|
||||||
'interfaces': site.get('interface', '*').split(),
|
|
||||||
'port': site.get('port', '80'),
|
|
||||||
|
|
||||||
'ServerName': sitename,
|
|
||||||
'ServerAlias': site.get('ServerAlias', ''),
|
|
||||||
|
|
||||||
'ServerAdmin': site.get('ServerAdmin', 'webmaster@{0}'.format(sitename)),
|
|
||||||
|
|
||||||
'UseCanonicalName': site.get('UseCanonicalName'),
|
|
||||||
|
|
||||||
'LogLevel': site.get('LogLevel', 'warn'),
|
|
||||||
'ErrorLog': site.get('ErrorLog', '{0}/{1}-error.log'.format(map.logdir, sitename)),
|
|
||||||
'LogFormat': site.get('LogFormat', '"%a %l %u %t \\"%r\\" %>s %O \\"%{Referer}i\\" \\"%{User-Agent}i\\""'),
|
|
||||||
'CustomLog': site.get('CustomLog', '{0}/{1}-access.log'.format(map.logdir, sitename)),
|
|
||||||
|
|
||||||
'ProxyRequests': site.get('ProxyRequests', 'Off'),
|
|
||||||
'ProxyPreserveHost': site.get('ProxyPreserveHost', 'On'),
|
|
||||||
'ProxyRoute': site.get('ProxyRoute', {}),
|
|
||||||
|
|
||||||
'Location': {
|
|
||||||
'Order': 'allow,deny',
|
|
||||||
'Allow': 'from all',
|
|
||||||
'Require': 'all granted',
|
|
||||||
},
|
|
||||||
'LocationMatch': {
|
|
||||||
'Order': 'allow,deny',
|
|
||||||
'Allow': 'from all',
|
|
||||||
'Require': 'all granted',
|
|
||||||
},
|
|
||||||
} %}
|
|
||||||
<VirtualHost {%- for intf in vals.interfaces %} {{intf}}:{{ vals.port }}{% endfor -%}>
|
|
||||||
ServerName {{ vals.ServerName }}
|
|
||||||
{% if site.get('ServerAlias') != False %}ServerAlias {{ vals.ServerAlias }}{% endif %}
|
|
||||||
{% if site.get('ServerAdmin') != False %}ServerAdmin {{ vals.ServerAdmin }}{% endif %}
|
|
||||||
{% if site.get('UseCanonicalName') %}UseCanonicalName {{ vals.UseCanonicalName }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('LogLevel') != False %}LogLevel {{ vals.LogLevel }}{% endif %}
|
|
||||||
{% if site.get('ErrorLog') != False %}ErrorLog {{ vals.ErrorLog }}{% endif %}
|
|
||||||
{% if site.get('LogFormat') != False -%}LogFormat {{ vals.LogFormat }}{% endif %}
|
|
||||||
{% if site.get('CustomLog') != False -%}LogFormat {{ vals.LogFormat }} {{ sitename }}
|
|
||||||
CustomLog {{ vals.CustomLog }} {{ sitename }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('SSLCertificateFile') %}SSLEngine on
|
|
||||||
SSLCertificateFile {{ site.SSLCertificateFile }}
|
|
||||||
{% if site.get('SSLCertificateKeyFile') %}SSLCertificateKeyFile {{ site.SSLCertificateKeyFile }}{% endif %}
|
|
||||||
{% if site.get('SSLCertificateChainFile') %}SSLCertificateChainFile {{ site.SSLCertificateChainFile}}{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
{% if site.get('Rewrite') %}RewriteEngine on
|
|
||||||
{{ site.Rewrite }}
|
|
||||||
{% endif %}
|
|
||||||
{% if site.get('SSLProxyEngine') %}SSLProxyEngine {{ site.SSLProxyEngine }}{% endif %}
|
|
||||||
ProxyRequests {{ vals.ProxyRequests }}
|
|
||||||
ProxyPreserveHost {{ vals.ProxyPreserveHost }}
|
|
||||||
{% if site.get('ProxyErrorOverride') %}ProxyErrorOverride {{ site.ProxyErrorOverride }} {% endif %}
|
|
||||||
{% if site.get('ProxyErrorDir') %}ProxyPass /{{ site.ProxyErrorDir }}/ ! {% endif %}
|
|
||||||
{% for proxy, proxyargs in vals.ProxyRoute|dictsort|reverse %}
|
|
||||||
{% set proxyvals = {
|
|
||||||
'ProxyPassSource': proxyargs.get('ProxyPassSource', '/'),
|
|
||||||
'ProxyPassTarget': proxyargs.get('ProxyPassTarget', 'https://{0}'.format(sitename)),
|
|
||||||
'ProxyPassTargetOptions': proxyargs.get('ProxyPassTargetOptions', ''),
|
|
||||||
'ProxyPassReverseSource': proxyargs.get('ProxyPassReverseSource', '/'),
|
|
||||||
'ProxyPassReverseTarget': proxyargs.get('ProxyPassReverseTarget', proxyargs.get('ProxyPassTarget', 'https://{0}'.format(sitename))),
|
|
||||||
} %}
|
|
||||||
######### {{proxy}} #########
|
|
||||||
ProxyPass {{ proxyvals.ProxyPassSource }} {{ proxyvals.ProxyPassTarget }} {{ proxyvals.ProxyPassTargetOptions }}
|
|
||||||
ProxyPassReverse {{ proxyvals.ProxyPassReverseSource }} {{ proxyvals.ProxyPassReverseTarget }}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{%- for path, loc in site.get('Location', {}).items() %}
|
|
||||||
{%- set lvals = {
|
|
||||||
'Order': loc.get('Order', vals.Location.Order),
|
|
||||||
'Allow': loc.get('Allow', vals.Location.Allow),
|
|
||||||
'Require': loc.get('Require', vals.Location.Require),
|
|
||||||
'Dav': loc.get('Dav', False),
|
|
||||||
} %}
|
|
||||||
<Location "{{ path }}">
|
|
||||||
{% if apache.version == '2.4' %}
|
|
||||||
{%- if lvals.get('Require') != False %}Require {{lvals.Require}}{% endif %}
|
|
||||||
{% else %}
|
|
||||||
{%- if lvals.get('Order') != False %}Order {{ lvals.Order }}{% endif %}
|
|
||||||
{%- if lvals.get('Allow') != False %}Allow {{ lvals.Allow }}{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
{%- if loc.get('Formula_Append') %} {{ loc.Formula_Append|indent(8) }} {% endif %}
|
|
||||||
</Location>
|
|
||||||
{% endfor %}
|
|
||||||
{%- for regpath, locmat in site.get('LocationMatch', {}).items() %}
|
|
||||||
{%- set lmvals = {
|
|
||||||
'Order': locmat.get('Order', vals.LocationMatch.Order),
|
|
||||||
'Allow': locmat.get('Allow', vals.LocationMatch.Allow),
|
|
||||||
'Require': locmat.get('Require', vals.LocationMatch.Require),
|
|
||||||
'Dav': locmat.get('Dav', False),
|
|
||||||
} %}
|
|
||||||
<LocationMatch "{{ regpath }}">
|
|
||||||
{% if apache.version == '2.4' %}
|
|
||||||
{%- if lmvals.get('Require') != False %}Require {{lmvals.Require}}{% endif %}
|
|
||||||
{% else %}
|
|
||||||
{%- if lmvals.get('Order') != False %}Order {{ lmvals.Order }}{% endif %}
|
|
||||||
{%- if lmvals.get('Allow') != False %}Allow {{ lmvals.Allow }}{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
{%- if locmat.get('Formula_Append') %} {{ locmat.Formula_Append|indent(8) }} {% endif %}
|
|
||||||
</LocationMatch>
|
|
||||||
{% endfor %}
|
|
||||||
{%- for proxypath, prox in site.get('Proxy_control', {}).items() %}
|
|
||||||
{%- set proxvals = {
|
|
||||||
'AllowAll': prox.get('AllowAll', vals.AllowAll),
|
|
||||||
'AllowCountry': prox.get('AllowCountry', vals.AllowCountry),
|
|
||||||
'AllowIP': prox.get('AllowIP', vals.AllowIP),
|
|
||||||
} %}
|
|
||||||
<Proxy "{{ proxypath }}">
|
|
||||||
{%- if proxvals.get('AllowAll') != False %}
|
|
||||||
Require all granted
|
|
||||||
{%- else %}
|
|
||||||
{% if proxvals.get('AllowCountry') != False %}{% set country_list = proxvals.get('AllowCountry', {}) %}GeoIPEnable On
|
|
||||||
{% for every_country in country_list %}SetEnvIf GEOIP_COUNTRY_CODE {{ every_country }} AllowCountry
|
|
||||||
{% endfor %}Require env AllowCountry {% endif %}
|
|
||||||
{% if proxvals.get('AllowIP') is defined %} {% set ip_list = proxvals.get('AllowIP', {}) %}
|
|
||||||
Require ip {% for every_ip in ip_list %}{{ every_ip }} {% endfor %} {% endif %}
|
|
||||||
{%- endif %}
|
|
||||||
</Proxy>
|
|
||||||
{%- endfor %}
|
|
||||||
{% if site.get('Formula_Append') %}
|
|
||||||
{{ site.Formula_Append|indent(4) }}
|
|
||||||
{% endif %}
|
|
||||||
</VirtualHost>
|
|
||||||
@ -1,51 +0,0 @@
|
|||||||
#
|
|
||||||
# This file is managed by Salt! Do not edit by hand!
|
|
||||||
#
|
|
||||||
{# Define default values here so the template below can just focus on layout #}
|
|
||||||
{%- from "apache/map.jinja" import apache with context %}
|
|
||||||
{%- set sitename = site.get('ServerName', id) %}
|
|
||||||
|
|
||||||
{%- set vals = {
|
|
||||||
'interfaces': site.get('interface', '*').split(),
|
|
||||||
'port': site.get('port', '80'),
|
|
||||||
|
|
||||||
'ServerName': sitename,
|
|
||||||
'ServerAlias': site.get('ServerAlias', ''),
|
|
||||||
|
|
||||||
'ServerAdmin': site.get('ServerAdmin', 'webmaster@{0}'.format(sitename)),
|
|
||||||
|
|
||||||
'UseCanonicalName': site.get('UseCanonicalName'),
|
|
||||||
|
|
||||||
'LogLevel': site.get('LogLevel', 'warn'),
|
|
||||||
'ErrorLog': site.get('ErrorLog', '{0}/{1}-error.log'.format(map.logdir, sitename)),
|
|
||||||
'LogFormat': site.get('LogFormat', '"%h %l %u %t \\\"%r\\\" %>s %O"'),
|
|
||||||
'CustomLog': site.get('CustomLog', '{0}/{1}-access.log'.format(map.logdir, sitename)),
|
|
||||||
|
|
||||||
'RedirectSource': site.get('RedirectSource', '/'),
|
|
||||||
'RedirectTarget': site.get('RedirectTarget', 'https://{0}/'.format(sitename)),
|
|
||||||
} %}
|
|
||||||
|
|
||||||
<VirtualHost {%- for intf in vals.interfaces %} {{intf}}:{{ vals.port }}{% endfor -%}>
|
|
||||||
ServerName {{ vals.ServerName }}
|
|
||||||
{% if site.get('ServerAlias') != False %}ServerAlias {{ vals.ServerAlias }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('ServerAdmin') != False %}ServerAdmin {{ vals.ServerAdmin }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('UseCanonicalName') %}UseCanonicalName {{ vals.UseCanonicalName }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('LogLevel') != False %}LogLevel {{ vals.LogLevel }}{% endif %}
|
|
||||||
{% if site.get('ErrorLog') != False %}ErrorLog {{ vals.ErrorLog }}{% endif %}
|
|
||||||
{% if site.get('LogFormat') != False -%}LogFormat {{ vals.LogFormat }}{% endif %}
|
|
||||||
{% if site.get('CustomLog') != False -%}LogFormat {{ vals.LogFormat }} {{ sitename }}
|
|
||||||
CustomLog {{ vals.CustomLog }} {{ sitename }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('RedirectMatch') %}
|
|
||||||
RedirectMatch {{ vals.RedirectSource }} {{ vals.RedirectTarget }}
|
|
||||||
{% else %}
|
|
||||||
Redirect {{ vals.RedirectSource }} {{ vals.RedirectTarget }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('Formula_Append') %}
|
|
||||||
{{ site.Formula_Append|indent(4) }}
|
|
||||||
{% endif %}
|
|
||||||
</VirtualHost>
|
|
||||||
@ -1,65 +0,0 @@
|
|||||||
{% from "apache/map.jinja" import apache with context %}
|
|
||||||
|
|
||||||
include:
|
|
||||||
- apache
|
|
||||||
|
|
||||||
{% for id, site in salt['pillar.get']('apache:sites', {}).items() %}
|
|
||||||
{% set documentroot = site.get('DocumentRoot', '{0}/{1}'.format(apache.wwwdir, site.get('ServerName', id))) %}
|
|
||||||
|
|
||||||
apache_vhosts_{{ id }}:
|
|
||||||
file.managed:
|
|
||||||
- name: {{ apache.vhostdir }}/{{ id }}{{ apache.confext }}
|
|
||||||
- source: {{ site.get('template_file', 'salt://apache/vhosts/standard.tmpl') }}
|
|
||||||
- template: {{ site.get('template_engine', 'jinja') }}
|
|
||||||
- context:
|
|
||||||
id: {{ id|json }}
|
|
||||||
site: {{ site|json }}
|
|
||||||
map: {{ apache|json }}
|
|
||||||
- require:
|
|
||||||
- pkg: apache
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-reload
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
|
|
||||||
{% if site.get('DocumentRoot') != False %}
|
|
||||||
{{ id }}-documentroot:
|
|
||||||
file.directory:
|
|
||||||
- name: {{ documentroot }}
|
|
||||||
- makedirs: True
|
|
||||||
- user: {{ site.get('DocumentRootUser', apache.get('document_root_user'))|json }}
|
|
||||||
- group: {{ site.get('DocumentRootGroup', apache.get('document_root_group'))|json }}
|
|
||||||
- allow_symlink: True
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if grains.os_family == 'Debian' %}
|
|
||||||
{% if site.get('enabled', True) %}
|
|
||||||
a2ensite {{ id }}{{ apache.confext }}:
|
|
||||||
cmd.run:
|
|
||||||
- unless: test -f /etc/apache2/sites-enabled/{{ id }}{{ apache.confext }}
|
|
||||||
- require:
|
|
||||||
- file: /etc/apache2/sites-available/{{ id }}{{ apache.confext }}
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-reload
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
{% else %}
|
|
||||||
a2dissite {{ id }}{{ apache.confext }}:
|
|
||||||
cmd.run:
|
|
||||||
- onlyif: test -f /etc/apache2/sites-enabled/{{ id }}{{ apache.confext }}
|
|
||||||
- require:
|
|
||||||
- file: /etc/apache2/sites-available/{{ id }}{{ apache.confext }}
|
|
||||||
- watch_in:
|
|
||||||
- module: apache-reload
|
|
||||||
- require_in:
|
|
||||||
- module: apache-restart
|
|
||||||
- module: apache-reload
|
|
||||||
- service: apache
|
|
||||||
{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% endfor %}
|
|
||||||
@ -1,136 +0,0 @@
|
|||||||
#
|
|
||||||
# This file is managed by Salt! Do not edit by hand!
|
|
||||||
#
|
|
||||||
{# Define default values here so the template below can just focus on layout #}
|
|
||||||
{%- set sitename = site.get('ServerName', id) -%}
|
|
||||||
|
|
||||||
{%- set vals = {
|
|
||||||
'interfaces': site.get('interface', '*').split(),
|
|
||||||
'port': site.get('port', '80'),
|
|
||||||
|
|
||||||
'ServerName': sitename,
|
|
||||||
'ServerAlias': site.get('ServerAlias', ''),
|
|
||||||
|
|
||||||
'ServerAdmin': site.get('ServerAdmin', 'webmaster@{0}'.format(sitename)),
|
|
||||||
|
|
||||||
'DirectoryIndex': site.get('DirectoryIndex'),
|
|
||||||
'UseCanonicalName': site.get('UseCanonicalName'),
|
|
||||||
'AllowEncodedSlashes': site.get('AllowEncodedSlashes', 'Off'),
|
|
||||||
|
|
||||||
'LogLevel': site.get('LogLevel', 'warn'),
|
|
||||||
'ErrorLog': site.get('ErrorLog', '{0}/{1}-error.log'.format(map.logdir, sitename)),
|
|
||||||
'LogFormat': site.get('LogFormat', '"%h %l %u %t \\\"%r\\\" %>s"'),
|
|
||||||
'CustomLog': site.get('CustomLog', '{0}/{1}-access.log'.format(map.logdir, sitename)),
|
|
||||||
|
|
||||||
'DocumentRoot': site.get('DocumentRoot', '{0}/{1}'.format(map.wwwdir, sitename)),
|
|
||||||
'VirtualDocumentRoot': site.get('VirtualDocumentRoot'),
|
|
||||||
|
|
||||||
'Timeout': site.get('Timeout'),
|
|
||||||
'LimitRequestFields': site.get('LimitRequestFields'),
|
|
||||||
|
|
||||||
'Directory_default': site.get('DocumentRoot', '{0}/{1}'.format(map.wwwdir, sitename)),
|
|
||||||
'Directory': {
|
|
||||||
'Options': '-Indexes +FollowSymLinks',
|
|
||||||
'Order': 'allow,deny',
|
|
||||||
'Allow': 'from all',
|
|
||||||
'Require': 'all granted',
|
|
||||||
'AllowOverride': 'None',
|
|
||||||
},
|
|
||||||
'Location': {
|
|
||||||
'Order': 'allow,deny',
|
|
||||||
'Allow': 'from all',
|
|
||||||
'Require': 'all granted',
|
|
||||||
},
|
|
||||||
} -%}
|
|
||||||
|
|
||||||
<VirtualHost {% for intf in vals.interfaces %} {{intf}}:{{ vals.port }}{% endfor -%}>
|
|
||||||
ServerName {{ vals.ServerName }}
|
|
||||||
{% if site.get('ServerAlias') != False %}ServerAlias {{ vals.ServerAlias }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('ServerAdmin') != False %}ServerAdmin {{ vals.ServerAdmin }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('DirectoryIndex') -%}DirectoryIndex {{ vals.DirectoryIndex }}{% endif %}
|
|
||||||
{% if site.get('UseCanonicalName') -%}UseCanonicalName {{ vals.UseCanonicalName }}{% endif %}
|
|
||||||
{% if site.get('AllowEncodedSlashes') != False -%}AllowEncodedSlashes {{ vals.AllowEncodedSlashes }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('LogLevel') != False -%}LogLevel {{ vals.LogLevel }}{% endif %}
|
|
||||||
{% if site.get('ErrorLog') != False -%}ErrorLog {{ vals.ErrorLog }}{% endif %}
|
|
||||||
{% if site.get('LogFormat') != False -%}LogFormat {{ vals.LogFormat }}{% endif %}
|
|
||||||
{% if site.get('CustomLog') != False -%}CustomLog {{ vals.CustomLog }} {{ vals.LogFormat }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('DocumentRoot') != False -%}DocumentRoot {{ vals.DocumentRoot }}{% endif %}
|
|
||||||
{% if site.get('VirtualDocumentRoot') -%}VirtualDocumentRoot {{ vals.VirtualDocumentRoot }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('Timeout') != False and site.get('Timeout') != None %}Timeout {{ vals.Timeout }}{% endif %}
|
|
||||||
{% if site.get('LimitRequestFields') %}LimitRequestFields {{ vals.LimitRequestFields }}{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('SSLCertificateFile') %}SSLEngine on
|
|
||||||
SSLCertificateFile {{ site.SSLCertificateFile }}
|
|
||||||
{% if site.get('SSLCertificateKeyFile') %}SSLCertificateKeyFile {{ site.SSLCertificateKeyFile }}{% endif %}
|
|
||||||
{% if site.get('SSLCertificateChainFile') %}SSLCertificateChainFile {{ site.SSLCertificateChainFile}}{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if site.get('Rewrite') %}RewriteEngine on
|
|
||||||
{{ site.Rewrite }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{%- for loc, path in site.get('Alias', {}).items() %}
|
|
||||||
Alias {{ loc }} {{ path }}
|
|
||||||
{%- endfor %}
|
|
||||||
|
|
||||||
{%- for path, dir in site.get('Directory', {}).items() -%}
|
|
||||||
{%- set dvals = {
|
|
||||||
'Options': dir.get('Options', vals.Directory.Options),
|
|
||||||
'Order': dir.get('Order', vals.Directory.Order),
|
|
||||||
'Allow': dir.get('Allow', vals.Directory.Allow),
|
|
||||||
'Require': dir.get('Require', vals.Directory.Require),
|
|
||||||
'AllowOverride': dir.get('AllowOverride', vals.Directory.AllowOverride),
|
|
||||||
'Dav': dir.get('Dav', False),
|
|
||||||
} %}
|
|
||||||
|
|
||||||
{%- if path == 'default' %}{% set path = vals.Directory_default %}{% endif %}
|
|
||||||
|
|
||||||
<Directory "{{ path }}">
|
|
||||||
{% if dvals.get('Options') != False %}Options {{ dvals.Options }}{% endif %}
|
|
||||||
{% if map.version == '2.4' %}
|
|
||||||
{% if dvals.get('Require') != False %}Require {{dvals.Require}}{% endif %}
|
|
||||||
{% else %}
|
|
||||||
{% if dvals.get('Order') != False %}Order {{ dvals.Order }}{% endif %}
|
|
||||||
{% if dvals.get('Allow') != False %}Allow {{ dvals.Allow }}{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
{% if dvals.get('AllowOverride') != False %}AllowOverride {{ dvals.AllowOverride }}{% endif %}
|
|
||||||
{% if dvals.get('Dav') != False %}Dav On{% endif %}
|
|
||||||
|
|
||||||
{% if dir.get('Formula_Append') %}
|
|
||||||
{{ dir.Formula_Append|indent(8) }}
|
|
||||||
{% endif %}
|
|
||||||
</Directory>
|
|
||||||
{%- endfor %}
|
|
||||||
|
|
||||||
{%- for path, loc in site.get('Location', {}).items() %}
|
|
||||||
{%- set lvals = {
|
|
||||||
'Order': loc.get('Order', vals.Location.Order),
|
|
||||||
'Allow': loc.get('Allow', vals.Location.Allow),
|
|
||||||
'Require': loc.get('Require', vals.Location.Require),
|
|
||||||
'Dav': loc.get('Dav', False),
|
|
||||||
} %}
|
|
||||||
|
|
||||||
<Location "{{ path }}">
|
|
||||||
{% if map.version == '2.4' %}
|
|
||||||
{%- if lvals.get('Require') != False %}Require {{lvals.Require}}{% endif %}
|
|
||||||
{% else %}
|
|
||||||
{%- if lvals.get('Order') != False %}Order {{ lvals.Order }}{% endif %}
|
|
||||||
{%- if lvals.get('Allow') != False %}Allow {{ lvals.Allow }}{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
{%- if lvals.get('Dav') != False %}Dav On{% endif %}
|
|
||||||
|
|
||||||
{%- if loc.get('Formula_Append') %}
|
|
||||||
{{ loc.Formula_Append|indent(8) }}
|
|
||||||
{% endif %}
|
|
||||||
</Location>
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{%- if site.get('Formula_Append') %}
|
|
||||||
{{ site.Formula_Append|indent(4) }}
|
|
||||||
{% endif %}
|
|
||||||
</VirtualHost>
|
|
||||||
@ -67,7 +67,7 @@ include:
|
|||||||
{% if vhost.get('absent', False) %}
|
{% if vhost.get('absent', False) %}
|
||||||
{{ vhost_server_name }}:
|
{{ vhost_server_name }}:
|
||||||
file.absent:
|
file.absent:
|
||||||
- name: {{ apache.vhostdir_ng }}/{{ vhost_server_name }}{{ apache.confext }}
|
- name: {{ apache.vhostdir }}/{{ vhost_server_name }}{{ apache.confext }}
|
||||||
- require:
|
- require:
|
||||||
- pkg: apache
|
- pkg: apache
|
||||||
- watch_in:
|
- watch_in:
|
||||||
@ -82,8 +82,8 @@ include:
|
|||||||
|
|
||||||
{{ vhost_server_name }}:
|
{{ vhost_server_name }}:
|
||||||
file.managed:
|
file.managed:
|
||||||
- name: {{ apache.vhostdir_ng }}/{{ vhost_server_name }}{{ apache.confext }}
|
- name: {{ apache.vhostdir }}/{{ vhost_server_name }}{{ apache.confext }}
|
||||||
- source: 'salt://apache/vhosts/vhost-ng.conf.jinja'
|
- source: 'salt://apache/vhosts/vhost.conf.jinja'
|
||||||
- template: 'jinja'
|
- template: 'jinja'
|
||||||
- user: root
|
- user: root
|
||||||
- group: root
|
- group: root
|
||||||
372
pillar.example
372
pillar.example
@ -1,372 +0,0 @@
|
|||||||
# see ``pillar-ng.example.yaml`` for new gen pillar
|
|
||||||
|
|
||||||
# ``apache`` formula configuration:
|
|
||||||
apache:
|
|
||||||
|
|
||||||
# By default apache restart/reload states run (false skips)
|
|
||||||
manage_service_states: True
|
|
||||||
|
|
||||||
# lookup section overrides ``map.jinja`` values
|
|
||||||
lookup:
|
|
||||||
server: apache2
|
|
||||||
service: apache2
|
|
||||||
user: some_system_user
|
|
||||||
group: some_system_group
|
|
||||||
|
|
||||||
vhostdir: /etc/apache2/sites-available
|
|
||||||
confdir: /etc/apache2/conf.d
|
|
||||||
confext: .conf
|
|
||||||
logdir: /var/log/apache2
|
|
||||||
wwwdir: /srv/apache2
|
|
||||||
|
|
||||||
# apache version (generally '2.2' or '2.4')
|
|
||||||
version: '2.2'
|
|
||||||
|
|
||||||
# ``apache.mod_wsgi`` formula additional configuration:
|
|
||||||
mod_wsgi: mod_wsgi
|
|
||||||
|
|
||||||
# Default value for AddDefaultCharset in RedHat configuration
|
|
||||||
default_charset: 'UTF-8'
|
|
||||||
|
|
||||||
# Should we enforce DocumentRoot user/group?
|
|
||||||
# Default: do not enforce
|
|
||||||
document_root_user: www-data # Force user if specified, leave it default if not
|
|
||||||
document_root_group: null # Do not enforce group
|
|
||||||
|
|
||||||
global:
|
|
||||||
# global apache directives
|
|
||||||
AllowEncodedSlashes: 'On'
|
|
||||||
|
|
||||||
|
|
||||||
name_virtual_hosts:
|
|
||||||
- interface: '*'
|
|
||||||
port: 80
|
|
||||||
- interface: '*'
|
|
||||||
port: 443
|
|
||||||
|
|
||||||
# ``apache.vhosts`` formula additional configuration:
|
|
||||||
sites:
|
|
||||||
example.net:
|
|
||||||
template_file: salt://apache/vhosts/minimal.tmpl
|
|
||||||
|
|
||||||
example.com: # must be unique; used as an ID declaration in Salt.
|
|
||||||
enabled: True
|
|
||||||
template_file: salt://apache/vhosts/standard.tmpl # or minimal.tmpl or redirect.tmpl or proxy.tmpl
|
|
||||||
|
|
||||||
####################### DEFAULT VALUES BELOW ############################
|
|
||||||
# NOTE: the values below are simply default settings that *can* be
|
|
||||||
# overridden and are not required in order to use this formula to create
|
|
||||||
# vhost entries.
|
|
||||||
#
|
|
||||||
# Do not copy the values below into your Pillar unless you intend to
|
|
||||||
# modify these vaules.
|
|
||||||
####################### DEFAULT VALUES BELOW ############################
|
|
||||||
template_engine: jinja
|
|
||||||
|
|
||||||
interface: '*'
|
|
||||||
port: '80'
|
|
||||||
|
|
||||||
exclude_listen_directive: True # Do not add a Listen directive in httpd.conf
|
|
||||||
|
|
||||||
ServerName: example.com # uses the unique ID above unless specified
|
|
||||||
#ServerAlias: www.example.com # Do not add ServerAlias unless defined
|
|
||||||
|
|
||||||
ServerAdmin: webmaster@example.com
|
|
||||||
|
|
||||||
LogLevel: warn
|
|
||||||
ErrorLog: /path/to/logs/example.com-error.log # E.g.: /var/log/apache2/example.com-error.log
|
|
||||||
CustomLog: /path/to/logs/example.com-access.log # E.g.: /var/log/apache2/example.com-access.log
|
|
||||||
|
|
||||||
DocumentRoot: /path/to/www/dir/example.com # E.g., /var/www/example.com
|
|
||||||
DocumentRootUser: null # do not enforce user, defaults to lookup:document_root_user
|
|
||||||
DocumentRootGroup: www-data # Force group, defaults to lookup:document_root_group
|
|
||||||
|
|
||||||
SSLCertificateFile: /etc/ssl/mycert.pem # if ssl is desired
|
|
||||||
SSLCertificateKeyFile: /etc/ssl/mycert.pem.key # if key for cert is needed or in an extra file
|
|
||||||
SSLCertificateChainFile: /etc/ssl/mycert.chain.pem # if you require a chain of server certificates file
|
|
||||||
|
|
||||||
Directory:
|
|
||||||
# "default" is a special case; uses DocumentRoot value
|
|
||||||
# E.g.: /var/www/example.com
|
|
||||||
default:
|
|
||||||
Options: -Indexes +FollowSymLinks
|
|
||||||
Order: allow,deny # For Apache < 2.4
|
|
||||||
Allow: from all # For apache < 2.4
|
|
||||||
Require: all granted # For apache > 2.4.
|
|
||||||
AllowOverride: None
|
|
||||||
Formula_Append: |
|
|
||||||
Additional config as a
|
|
||||||
multi-line string here
|
|
||||||
|
|
||||||
redirectmatch.com:
|
|
||||||
# Use RedirectMatch Directive https://httpd.apache.org/docs/2.4/fr/mod/mod_alias.html#redirectmatch
|
|
||||||
# Require module mod_alias
|
|
||||||
enabled: True
|
|
||||||
template_file: salt://apache/vhosts/redirect.tmpl
|
|
||||||
ServerName: www.redirectmatch.com
|
|
||||||
ServerAlias: www.redirectmatch.com
|
|
||||||
RedirectMatch: true
|
|
||||||
RedirectSource: '^/$'
|
|
||||||
RedirectTarget: '/subdirectory'
|
|
||||||
DocumentRoot: /var/www/html/
|
|
||||||
ErrorLog: ${APACHE_LOG_DIR}/error.log
|
|
||||||
CustomLog: ${APACHE_LOG_DIR}/access.log
|
|
||||||
|
|
||||||
80-proxyexample.com:
|
|
||||||
template_file: salt://apache/vhosts/redirect.tmpl
|
|
||||||
ServerName: www.proxyexample.com
|
|
||||||
ServerAlias: www.proxyexample.com
|
|
||||||
RedirectSource: '/'
|
|
||||||
RedirectTarget: 'https://www.proxyexample.com/'
|
|
||||||
DocumentRoot: /var/www/proxy
|
|
||||||
|
|
||||||
443-proxyexample.com:
|
|
||||||
template_file: salt://apache/vhosts/proxy.tmpl
|
|
||||||
ServerName: www.proxyexample.com
|
|
||||||
ServerAlias: www.proxyexample.com
|
|
||||||
interface: '*'
|
|
||||||
port: '443'
|
|
||||||
DocumentRoot: /var/www/proxy
|
|
||||||
|
|
||||||
Rewrite: |
|
|
||||||
RewriteRule ^/webmail$ /webmail/ [R]
|
|
||||||
RewriteRule ^/webmail(.*) http://mail.example.com$1 [P,L]
|
|
||||||
RewriteRule ^/vicescws(.*) http://svc.example.com:92$1 [P,L]
|
|
||||||
|
|
||||||
SSLCertificateFile: /etc/httpd/ssl/example.com.crt
|
|
||||||
SSLCertificateKeyFile: /etc/httpd/ssl/example.com.key
|
|
||||||
SSLCertificateChainFile: /etc/httpd/ssl/example.com.cer
|
|
||||||
|
|
||||||
SSLCertificateFile_content: |
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL
|
|
||||||
MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC
|
|
||||||
VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx
|
|
||||||
NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD
|
|
||||||
TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu
|
|
||||||
ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j
|
|
||||||
V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj
|
|
||||||
gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA
|
|
||||||
FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE
|
|
||||||
CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS
|
|
||||||
BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE
|
|
||||||
BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju
|
|
||||||
Wm7DCfrPNGVwFWUQOmsPue9rZBgO
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
|
|
||||||
SSLCertificateKeyFile_content: |
|
|
||||||
-----BEGIN PRIVATE KEY-----
|
|
||||||
MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL
|
|
||||||
MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC
|
|
||||||
VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx
|
|
||||||
NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD
|
|
||||||
TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu
|
|
||||||
ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j
|
|
||||||
V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj
|
|
||||||
gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA
|
|
||||||
FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE
|
|
||||||
CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS
|
|
||||||
BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE
|
|
||||||
BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju
|
|
||||||
Wm7DCfrPNGVwFWUQOmsPue9rZBgO
|
|
||||||
-----END PRIVATE KEY-----
|
|
||||||
|
|
||||||
SSLCertificateChainFile_content: |
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL
|
|
||||||
MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC
|
|
||||||
VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx
|
|
||||||
NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD
|
|
||||||
TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu
|
|
||||||
ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j
|
|
||||||
V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj
|
|
||||||
gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA
|
|
||||||
FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE
|
|
||||||
CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS
|
|
||||||
BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE
|
|
||||||
BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju
|
|
||||||
Wm7DCfrPNGVwFWUQOmsPue9rZBgO
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL
|
|
||||||
MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC
|
|
||||||
VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx
|
|
||||||
NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD
|
|
||||||
TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu
|
|
||||||
ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j
|
|
||||||
V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj
|
|
||||||
gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA
|
|
||||||
FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE
|
|
||||||
CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS
|
|
||||||
BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE
|
|
||||||
BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju
|
|
||||||
Wm7DCfrPNGVwFWUQOmsPue9rZBgO
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
|
|
||||||
ProxyRequests: 'Off'
|
|
||||||
ProxyPreserveHost: 'On'
|
|
||||||
|
|
||||||
ProxyRoute:
|
|
||||||
example prod proxy route:
|
|
||||||
ProxyPassSource: '/'
|
|
||||||
ProxyPassTarget: 'http://prod.example.com:85/'
|
|
||||||
ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'
|
|
||||||
ProxyPassReverseSource: '/'
|
|
||||||
ProxyPassReverseTarget: 'http://prod.example.com:85/'
|
|
||||||
|
|
||||||
example webmail proxy route:
|
|
||||||
ProxyPassSource: '/webmail/'
|
|
||||||
ProxyPassTarget: 'http://mail.example.com/'
|
|
||||||
ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'
|
|
||||||
ProxyPassReverseSource: '/webmail/'
|
|
||||||
ProxyPassReverseTarget: 'http://mail.example.com/'
|
|
||||||
|
|
||||||
example service proxy route:
|
|
||||||
ProxyPassSource: '/svc/'
|
|
||||||
ProxyPassTarget: 'http://svc.example.com:92/'
|
|
||||||
ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'
|
|
||||||
ProxyPassReverseSource: '/svc/'
|
|
||||||
ProxyPassReverseTarget: 'http://svc.example.com:92/'
|
|
||||||
|
|
||||||
Location:
|
|
||||||
/:
|
|
||||||
Require: False
|
|
||||||
Formula_Append: |
|
|
||||||
SecRuleRemoveById 981231
|
|
||||||
SecRuleRemoveById 981173
|
|
||||||
|
|
||||||
/error:
|
|
||||||
Require: 'all granted'
|
|
||||||
|
|
||||||
/docs:
|
|
||||||
Order: allow,deny # For Apache < 2.4
|
|
||||||
Allow: from all # For apache < 2.4
|
|
||||||
Require: all granted # For apache > 2.4.
|
|
||||||
Formula_Append: |
|
|
||||||
Additional config as a
|
|
||||||
multi-line string here
|
|
||||||
|
|
||||||
LocationMatch:
|
|
||||||
'^[.\\/]+([Ww][Ee][Bb][Mm][Aa][Ii][Ll])[.\\/]':
|
|
||||||
Require: False
|
|
||||||
Formula_Append: |
|
|
||||||
RequestHeader set Host mail.example.com
|
|
||||||
|
|
||||||
'^[.\\/]+([Ss][Vv][Cc])[.\\/]':
|
|
||||||
Require: False
|
|
||||||
Formula_Append: |
|
|
||||||
Require ip 123.123.13.6 84.24.25.74
|
|
||||||
|
|
||||||
Proxy_control:
|
|
||||||
'*':
|
|
||||||
AllowAll: False
|
|
||||||
AllowCountry:
|
|
||||||
- DE
|
|
||||||
AllowIP:
|
|
||||||
- 12.5.25.32
|
|
||||||
- 12.5.25.33
|
|
||||||
|
|
||||||
|
|
||||||
Alias:
|
|
||||||
/docs: /usr/share/docs
|
|
||||||
|
|
||||||
Formula_Append: |
|
|
||||||
Additional config as a
|
|
||||||
multi-line string here
|
|
||||||
|
|
||||||
# ``apache.debian_full`` formula additional configuration:
|
|
||||||
register-site:
|
|
||||||
# any name as an array index, and you can duplicate this section
|
|
||||||
UNIQUE_VALUE_HERE:
|
|
||||||
name: 'my name'
|
|
||||||
path: 'salt://path/to/sites-available/conf/file'
|
|
||||||
state: 'enabled'
|
|
||||||
# Optional - use managed file as Jinja Template
|
|
||||||
#template: true
|
|
||||||
#defaults:
|
|
||||||
# custom_var: "default value"
|
|
||||||
|
|
||||||
modules:
|
|
||||||
enabled: # List modules to enable
|
|
||||||
- ldap
|
|
||||||
- ssl
|
|
||||||
disabled: # List modules to disable
|
|
||||||
- rewrite
|
|
||||||
|
|
||||||
flags:
|
|
||||||
enabled: # List server flags to enable
|
|
||||||
- SSL
|
|
||||||
disabled: # List server flags to disable
|
|
||||||
- status
|
|
||||||
|
|
||||||
# KeepAlive: Whether or not to allow persistent connections (more than
|
|
||||||
# one request per connection). Set to "Off" to deactivate.
|
|
||||||
keepalive: 'On'
|
|
||||||
|
|
||||||
security:
|
|
||||||
# can be Full | OS | Minimal | Minor | Major | Prod
|
|
||||||
# where Full conveys the most information, and Prod the least.
|
|
||||||
ServerTokens: Prod
|
|
||||||
|
|
||||||
# [debian only] configure mod_ssl
|
|
||||||
ssl:
|
|
||||||
SSLCipherSuite: 'HIGH:!aNULL'
|
|
||||||
SSLHonorCipherOrder: 'Off'
|
|
||||||
SSLProtocol: 'all -SSLv3'
|
|
||||||
SSLUseStapling: 'Off'
|
|
||||||
SSLStaplingResponderTimeout: '5'
|
|
||||||
SSLStaplingReturnResponderErrors: 'Off'
|
|
||||||
SSLStaplingCache: 'shmcb:/var/run/ocsp(128000)'
|
|
||||||
|
|
||||||
# ``apache.mod_remoteip`` formula additional configuration:
|
|
||||||
mod_remoteip:
|
|
||||||
RemoteIPHeader: X-Forwarded-For
|
|
||||||
RemoteIPTrustedProxy:
|
|
||||||
- 10.0.8.0/24
|
|
||||||
- 127.0.0.1
|
|
||||||
|
|
||||||
# ``apache.mod_security`` formula additional configuration:
|
|
||||||
mod_security:
|
|
||||||
crs_install: True
|
|
||||||
# If not set, default distro's configuration is installed as is
|
|
||||||
manage_config: True
|
|
||||||
sec_rule_engine: 'On'
|
|
||||||
sec_request_body_access: 'On'
|
|
||||||
sec_request_body_limit: '14000000'
|
|
||||||
sec_request_body_no_files_limit: '114002'
|
|
||||||
sec_request_body_in_memory_limit: '114002'
|
|
||||||
sec_request_body_limit_action: 'Reject'
|
|
||||||
sec_pcre_match_limit: '15000'
|
|
||||||
sec_pcre_match_limit_recursion: '15000'
|
|
||||||
sec_debug_log_level: '3'
|
|
||||||
|
|
||||||
rules:
|
|
||||||
enabled:
|
|
||||||
modsecurity_crs_10_setup.conf:
|
|
||||||
rule_set: ''
|
|
||||||
enabled: True
|
|
||||||
modsecurity_crs_20_protocol_violations.conf:
|
|
||||||
rule_set: 'base_rules'
|
|
||||||
enabled: False
|
|
||||||
|
|
||||||
custom_rule_files:
|
|
||||||
# any name as an array index, and you can duplicate this section
|
|
||||||
UNIQUE_VALUE_HERE:
|
|
||||||
file: 'my name'
|
|
||||||
path: 'salt://path/to/modsecurity/custom/file'
|
|
||||||
enabled: True
|
|
||||||
|
|
||||||
mod_ssl:
|
|
||||||
# set this to True if you want to override your distributions default TLS configuration
|
|
||||||
manage_tls_defaults: False
|
|
||||||
# This stuff is deliberately not configured via map.jinja resp. apache:lookup.
|
|
||||||
# We're unable to know sane defaults for each release of every distribution.
|
|
||||||
# See https://github.com/saltstack-formulas/openssh-formula/issues/102 for a related discussion
|
|
||||||
# Have a look at bettercrypto.org for up-to-date settings.
|
|
||||||
# These are default values:
|
|
||||||
SSLCipherSuite: EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
|
|
||||||
# Mitigate the CRIME attack
|
|
||||||
SSLCompression: Off
|
|
||||||
SSLProtocol: all -SSLv2 -SSLv3 -TLSv1
|
|
||||||
SSLHonorCipherOrder: On
|
|
||||||
SSLOptions: "+StrictRequire"
|
|
||||||
Loading…
Reference in New Issue
Block a user