diff --git a/docs/conf.py b/docs/conf.py index 682b9da64..00f9d9327 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -52,6 +52,5 @@ linkcheck_anchors_ignore_for_url = ( r"^https://github\.com/[^/]+/[^/]+/blob/", r"^https://github\.com/[^/]+/[^/]+/tree/", - r"^https://github\.com/icing/mod_md", r"^https://rabbitmq\.kingfisher\.open-contracting\.org", ) diff --git a/docs/develop/commit.rst b/docs/develop/commit.rst index 2287801de..64a070fb7 100644 --- a/docs/develop/commit.rst +++ b/docs/develop/commit.rst @@ -51,7 +51,7 @@ Review code For context, for other repositories, work is done on a branch and tested on a local machine before a pull request is made, which is then tested on continuous integration, reviewed and approved before merging. -However, for this repository, in some cases, it's impossible to test changes to server configurations, for example: if SSL certificates are involved (without `additional configuration `__), or if external services are involved. In other cases, it's too much effort to setup a test environment in which to test changes. +However, for this repository, in some cases, it's impossible to test changes to server configurations, for example: if SSL certificates are involved (without `additional configuration `__), or if external services are involved. In other cases, it's too much effort to setup a test environment in which to test changes. In such cases, the same process is followed as in other repositories, but without the benefit of tests. diff --git a/docs/develop/update/apache.rst b/docs/develop/update/apache.rst index 24dd9bffb..331eaee1a 100644 --- a/docs/develop/update/apache.rst +++ b/docs/develop/update/apache.rst @@ -70,7 +70,8 @@ This will: - If ``apache.public_access`` is ``True`` and ``https`` isn't ``False``: - :ref:`ssl-certificates` - - Create a virtual host serving port 443 + - Create a virtual host serving port 443 for the ``servername`` + - Create a virtual host serving port 443 for any ``serveraliases``, to redirect to the ``servername`` - Configure a HTTP to HTTPS permanent redirect - Add a ``Strict-Transport-Security`` header @@ -172,7 +173,7 @@ The service should now be available at its ``https://`` web address. .. tip:: - In case of error, see `mod_md's troubleshooting guide `__. + In case of error, see `mod_md's documentation `__ and the `Let's Encrypt community `__. If you need to test the acquisition of certificates, :ref:`use Let's Encrypt's staging environment`. diff --git a/docs/develop/update/nginx.rst b/docs/develop/update/nginx.rst index a779e0062..1ef683ed7 100644 --- a/docs/develop/update/nginx.rst +++ b/docs/develop/update/nginx.rst @@ -110,4 +110,4 @@ The service should now be available at its ``https://`` web address. Certbot wil .. tip:: - If you need to test the acquisition of certificates, `use Let's Encrypt's staging environment `__. + If you need to test the acquisition of certificates, `use Let's Encrypt's staging environment `__. diff --git a/salt/apache/files/sites/_common.conf b/salt/apache/files/sites/_common.conf index f08517d1a..ee87d06f1 100644 --- a/salt/apache/files/sites/_common.conf +++ b/salt/apache/files/sites/_common.conf @@ -1,33 +1,47 @@ -{#- https://github.com/icing/mod_md#readme -#} +{#- https://httpd.apache.org/docs/2.4/mod/mod_md.html -#} {#- Without additional configuration, mod_md can only acquire certificates if port 80 is open. -#} {%- set ssl = pillar.apache.get('public_access') and https -%} {#- MDRequireHttps requires a virtual host on port 80. -#} {%- set ports = [80, 443] if ssl else [80] -%} + +{%- macro address(port) -%} +{{ pillar.apache.ipv4 if 'ipv4' in pillar.apache else '*' }}:{{ port }}{% if 'ipv6' in pillar.apache %} [{{ pillar.apache.ipv6 }}]:{{ port }}{% endif %} +{%- endmacro -%} + +{%- macro tls() %} + SSLEngine on + {#- https://httpd.apache.org/docs/2.4/mod/mod_md.html#preamble ("https: Challenges") #} + Protocols h2 http/1.1 acme-tls/1 +{%- endmacro -%} + {#- `servername` is not set for the default site. -#} {%- if ssl and servername -%} - + MDRequireHttps permanent {%- endif %} + {%- for port in ports %} - + {%- if servername %} ServerName {{ servername }} {%- endif %} + {#- On port 443, the aliases have their own virtual host. #} + {%- if port == 80 %} {%- for serveralias in serveraliases %} ServerAlias {{ serveralias }} {%- endfor %} + {%- endif %} {%- if port == 443 %} - SSLEngine on - {#- https://github.com/icing/mod_md#tls-alpn-challenges #} - Protocols h2 http/1.1 acme-tls/1 + {{- tls() }} {#- System-wide configuration files should be prefixed with numbers #} {%- if pillar.apache.get('site_logs') and not filename[:1].isdigit() %} + ErrorLog /var/log/apache2/{{ filename }}/error.log - CustomLog /var/log/apache2/{{ filename }}/access.log vhost_combined + CustomLog /var/log/apache2/{{ filename }}/access.log vhost_combined env=!dontlog {%- endif %} Include {{ includefile }} @@ -40,4 +54,19 @@ Include {{ includefile }} {%- endif %} +{%- if port == 80 and ssl and serveraliases %} + + + ServerName {{ serveraliases[0] }} + {%- for serveralias in serveraliases[1:] %} + ServerAlias {{ serveralias }} + {%- endfor %} + {{- tls() }} + + Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + + RewriteEngine on + RewriteRule ^ https://{{ servername }}%{REQUEST_URI} [R=301,L] + +{%- endif %} {%- endfor %} diff --git a/salt/apache/files/sites/docs.conf.include b/salt/apache/files/sites/docs.conf.include index 8016d1d58..27a445891 100644 --- a/salt/apache/files/sites/docs.conf.include +++ b/salt/apache/files/sites/docs.conf.include @@ -89,7 +89,7 @@ SetEnv BANNER /includes/banner_live.html # https://httpd.apache.org/docs/current/howto/ssi.html#configuring AddOutputFilter INCLUDES .html - Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" # docson needs unsafe-eval and frame-ancestors. infrastructure uses Google Fonts. standard, infrastructure, and public-private-partnerships use