Skip to content

Apache canonical host - #678

Merged
jpmckinney merged 5 commits into
mainfrom
apache-canonical-host
Oct 8, 2026
Merged

jpmckinney merged 5 commits into
mainfrom
apache-canonical-host

Conversation

@jpmckinney

@jpmckinney jpmckinney commented Oct 7, 2026 •

Copy link
Copy Markdown
Member

closes #677

jpmckinney and others added 2 commits October 7, 2026 10:07
…only on successful responses

`Header set` applies only to responses Apache doesn't generate itself, so redirects and errors from mod_rewrite
and access control lacked the header at the origin. Cloudflare's HSTS setting currently adds it at the edge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
…DMembers auto to add them

The certificate's names are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
@jpmckinney
jpmckinney requested a review from RobHooper October 7, 2026 14:26
Comment thread salt/apache/files/sites/_common.conf Outdated
Comment thread salt/apache/files/sites/_common.conf Outdated
Comment thread salt/apache/files/sites/_common.conf
jpmckinney and others added 3 commits October 7, 2026 13:19
…wn virtual host, instead of from WordPress

The aliases move from the port 443 virtual host to their own, so requests to the server name don't evaluate the
redirect. Port 80 keeps the aliases for MDRequireHttps and ACME challenges. Like port 80, the redirects are logged to
other_vhosts_access.log, not to the site's logs.

Closes #677

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
…chived repository

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
…e access logs, as from the server-wide log

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
@jpmckinney
jpmckinney force-pushed the apache-canonical-host branch from 2c32e3c to 341eeb5 Compare October 7, 2026 17:20
@jpmckinney

Copy link
Copy Markdown
Member Author

Thank you for the review! The config would now render as:

<MDomain www.open-contracting.org open-contracting.org>
    MDRequireHttps permanent
</MDomain>

<VirtualHost *:80>
    ServerName www.open-contracting.org
    ServerAlias open-contracting.org
</VirtualHost>

<VirtualHost *:443>
    ServerName open-contracting.org
    SSLEngine on
    Protocols h2 http/1.1 acme-tls/1

    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    RewriteEngine on
    RewriteRule ^ https://www.open-contracting.org%{REQUEST_URI} [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName www.open-contracting.org
    SSLEngine on
    Protocols h2 http/1.1 acme-tls/1

    ErrorLog  /var/log/apache2/corporate/error.log
    CustomLog /var/log/apache2/corporate/access.log vhost_combined env=!dontlog

    Include /etc/apache2/sites-available/corporate.conf.include
</VirtualHost>

@jpmckinney

Copy link
Copy Markdown
Member Author

Noting that this extends env=!dontlog into these logs, so I think we have no way to know if AppBeat, Pingdom, or /server-status checks ever start behaving badly/unexpectedly.

@jpmckinney
jpmckinney merged commit 6b9cc7a into main Oct 8, 2026
14 checks passed
@jpmckinney
jpmckinney deleted the apache-canonical-host branch October 8, 2026 13:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Apache canonical redirects

2 participants