From 91e35ea42b3b1d366f08f8d0c16c6c379d732ae2 Mon Sep 17 00:00:00 2001
From: James McKinney <26463+jpmckinney@users.noreply.github.com>
Date: Wed, 7 Oct 2026 10:02:42 -0400
Subject: [PATCH 1/5] fix(apache): Send HSTS on Apache-generated redirects and
 errors, not only on successful responses

`Header set` applies only to responses Apache doesn't generate itself, so redirects and errors from mod_rewrite
and access control lacked the header at the origin. Cloudflare's HSTS setting currently adds it at the edge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
---
 salt/apache/files/sites/docs.conf.include      | 2 +-
 salt/apache/files/sites/wordpress.conf.include | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/apache/files/sites/docs.conf.include b/salt/apache/files/sites/docs.conf.include
index 8016d1d5..27a44589 100644
--- a/salt/apache/files/sites/docs.conf.include
+++ b/salt/apache/files/sites/docs.conf.include
@@ -89,7 +89,7 @@ SetEnv BANNER /includes/banner_live.html
     # https://httpd.apache.org/docs/current/howto/ssi.html#configuring
     AddOutputFilter INCLUDES .html
 
-    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 
     # docson needs unsafe-eval and frame-ancestors. infrastructure uses Google Fonts. standard, infrastructure, and public-private-partnerships use <iframe>.
     Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com https://use.typekit.net; frame-src 'self' https://www.youtube-nocookie.com https://docs.google.com https://open-contracting.github.io; connect-src 'self' https://raw.githubusercontent.com/open-contracting/extension_registry/main/build/extensions.json; object-src 'none'; worker-src 'none'; frame-ancestors 'self'"
diff --git a/salt/apache/files/sites/wordpress.conf.include b/salt/apache/files/sites/wordpress.conf.include
index f19ddb89..0cf5f6bf 100644
--- a/salt/apache/files/sites/wordpress.conf.include
+++ b/salt/apache/files/sites/wordpress.conf.include
@@ -1,5 +1,5 @@
 DocumentRoot /home/{{ user }}/public_html
-Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 Header set X-Content-Type-Options nosniff
 
 <Directory /home/{{ user }}/public_html>

From 902d74eb02b6af6049458ed15ff69a97c3f12eef Mon Sep 17 00:00:00 2001
From: James McKinney <26463+jpmckinney@users.noreply.github.com>
Date: Wed, 7 Oct 2026 10:18:16 -0400
Subject: [PATCH 2/5] feat(apache): List server aliases in MDomain, instead of
 relying on MDMembers auto to add them

The certificate's names are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
---
 salt/apache/files/sites/_common.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/apache/files/sites/_common.conf b/salt/apache/files/sites/_common.conf
index f08517d1..f158c0fe 100644
--- a/salt/apache/files/sites/_common.conf
+++ b/salt/apache/files/sites/_common.conf
@@ -5,7 +5,7 @@
 {%- set ports = [80, 443] if ssl else [80] -%}
 {#- `servername` is not set for the default site. -#}
 {%- if ssl and servername -%}
-<MDomain {{ servername }}>
+<MDomain {{ ([servername] + serveraliases)|join(' ') }}>
     MDRequireHttps permanent
 </MDomain>
 {%- endif %}

From 1f58fd77a35f31fe61fcc1403d335778540ba5d7 Mon Sep 17 00:00:00 2001
From: James McKinney <26463+jpmckinney@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:03:03 -0400
Subject: [PATCH 3/5] feat(apache): Redirect server aliases to the server name
 from their own virtual host, instead of from WordPress

The aliases move from the port 443 virtual host to their own, so requests to the server name don't evaluate the
redirect. Port 80 keeps the aliases for MDRequireHttps and ACME challenges. Like port 80, the redirects are logged to
other_vhosts_access.log, not to the site's logs.

Closes #677

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
---
 docs/develop/update/apache.rst       |  3 ++-
 salt/apache/files/sites/_common.conf | 37 +++++++++++++++++++++++++---
 2 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/docs/develop/update/apache.rst b/docs/develop/update/apache.rst
index 24dd9bff..18dbd257 100644
--- a/docs/develop/update/apache.rst
+++ b/docs/develop/update/apache.rst
@@ -70,7 +70,8 @@ This will:
    -  If ``apache.public_access`` is ``True`` and ``https`` isn't ``False``:
 
       -  :ref:`ssl-certificates`
-      -  Create a virtual host serving port 443
+      -  Create a virtual host serving port 443 for the ``servername``
+      -  Create a virtual host serving port 443 for any ``serveraliases``, to redirect to the ``servername``
       -  Configure a HTTP to HTTPS permanent redirect
       -  Add a ``Strict-Transport-Security`` header
 
diff --git a/salt/apache/files/sites/_common.conf b/salt/apache/files/sites/_common.conf
index f158c0fe..c1807563 100644
--- a/salt/apache/files/sites/_common.conf
+++ b/salt/apache/files/sites/_common.conf
@@ -3,29 +3,43 @@
 {%- set ssl = pillar.apache.get('public_access') and https -%}
 {#- MDRequireHttps requires a virtual host on port 80. -#}
 {%- set ports = [80, 443] if ssl else [80] -%}
+
+{%- macro address(port) -%}
+{{ pillar.apache.ipv4 if 'ipv4' in pillar.apache else '*' }}:{{ port }}{% if 'ipv6' in pillar.apache %} [{{ pillar.apache.ipv6 }}]:{{ port }}{% endif %}
+{%- endmacro -%}
+
+{%- macro tls() %}
+    SSLEngine on
+    {#- https://github.com/icing/mod_md#tls-alpn-challenges #}
+    Protocols h2 http/1.1 acme-tls/1
+{%- endmacro -%}
+
 {#- `servername` is not set for the default site. -#}
 {%- if ssl and servername -%}
 <MDomain {{ ([servername] + serveraliases)|join(' ') }}>
     MDRequireHttps permanent
 </MDomain>
 {%- endif %}
+
 {%- for port in ports %}
 
-<VirtualHost {{ pillar.apache.ipv4 if 'ipv4' in pillar.apache else '*' }}:{{ port }}{% if 'ipv6' in pillar.apache %} [{{ pillar.apache.ipv6 }}]:{{ port }}{% endif %}>
+<VirtualHost {{ address(port) }}>
     {%- if servername %}
     ServerName {{ servername }}
     {%- endif %}
+    {#- On port 443, the aliases have their own virtual host. #}
+    {%- if port == 80 %}
     {%- for serveralias in serveraliases %}
     ServerAlias {{ serveralias }}
     {%- endfor %}
+    {%- endif %}
 
     {%- if port == 443 %}
-    SSLEngine on
-    {#- https://github.com/icing/mod_md#tls-alpn-challenges #}
-    Protocols h2 http/1.1 acme-tls/1
+    {{- tls() }}
 
     {#- System-wide configuration files should be prefixed with numbers #}
     {%- if pillar.apache.get('site_logs') and not filename[:1].isdigit() %}
+
     ErrorLog  /var/log/apache2/{{ filename }}/error.log
     CustomLog /var/log/apache2/{{ filename }}/access.log vhost_combined
     {%- endif %}
@@ -40,4 +54,19 @@
     Include {{ includefile }}
     {%- endif %}
 </VirtualHost>
+{%- if port == 80 and ssl and serveraliases %}
+
+<VirtualHost {{ address(443) }}>
+    ServerName {{ serveraliases[0] }}
+    {%- for serveralias in serveraliases[1:] %}
+    ServerAlias {{ serveralias }}
+    {%- endfor %}
+    {{- tls() }}
+
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+
+    RewriteEngine on
+    RewriteRule ^ https://{{ servername }}%{REQUEST_URI} [R=301,L]
+</VirtualHost>
+{%- endif %}
 {%- endfor %}

From 85df93039219c61bfc1d6195872923adce9382ff Mon Sep 17 00:00:00 2001
From: James McKinney <26463+jpmckinney@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:03:04 -0400
Subject: [PATCH 4/5] docs(apache): Link to mod_md's httpd documentation,
 instead of its archived repository

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
---
 docs/conf.py                         | 1 -
 docs/develop/commit.rst              | 2 +-
 docs/develop/update/apache.rst       | 2 +-
 docs/develop/update/nginx.rst        | 2 +-
 salt/apache/files/sites/_common.conf | 4 ++--
 salt/apache/modules/md.sls           | 1 -
 6 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index 682b9da6..00f9d932 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -52,6 +52,5 @@
 linkcheck_anchors_ignore_for_url = (
     r"^https://github\.com/[^/]+/[^/]+/blob/",
     r"^https://github\.com/[^/]+/[^/]+/tree/",
-    r"^https://github\.com/icing/mod_md",
     r"^https://rabbitmq\.kingfisher\.open-contracting\.org",
 )
diff --git a/docs/develop/commit.rst b/docs/develop/commit.rst
index 2287801d..64a070fb 100644
--- a/docs/develop/commit.rst
+++ b/docs/develop/commit.rst
@@ -51,7 +51,7 @@ Review code
 
 For context, for other repositories, work is done on a branch and tested on a local machine before a pull request is made, which is then tested on continuous integration, reviewed and approved before merging.
 
-However, for this repository, in some cases, it's impossible to test changes to server configurations, for example: if SSL certificates are involved (without `additional configuration <https://github.com/icing/mod_md#ports-ports-ports>`__), or if external services are involved. In other cases, it's too much effort to setup a test environment in which to test changes.
+However, for this repository, in some cases, it's impossible to test changes to server configurations, for example: if SSL certificates are involved (without `additional configuration <https://httpd.apache.org/docs/2.4/mod/mod_md.html#mdcachallenges>`__), or if external services are involved. In other cases, it's too much effort to setup a test environment in which to test changes.
 
 In such cases, the same process is followed as in other repositories, but without the benefit of tests.
 
diff --git a/docs/develop/update/apache.rst b/docs/develop/update/apache.rst
index 18dbd257..331eaee1 100644
--- a/docs/develop/update/apache.rst
+++ b/docs/develop/update/apache.rst
@@ -173,7 +173,7 @@ The service should now be available at its ``https://`` web address.
 
 .. tip::
 
-   In case of error, see `mod_md's troubleshooting guide <https://github.com/icing/mod_md#how-to-fix-problems>`__.
+   In case of error, see `mod_md's documentation <https://httpd.apache.org/docs/2.4/mod/mod_md.html>`__ and the `Let's Encrypt community <https://community.letsencrypt.org>`__.
 
    If you need to test the acquisition of certificates, :ref:`use Let's Encrypt's staging environment<mod_md-test>`.
 
diff --git a/docs/develop/update/nginx.rst b/docs/develop/update/nginx.rst
index a779e006..1ef683ed 100644
--- a/docs/develop/update/nginx.rst
+++ b/docs/develop/update/nginx.rst
@@ -110,4 +110,4 @@ The service should now be available at its ``https://`` web address. Certbot wil
 
 .. tip::
 
-   If you need to test the acquisition of certificates, `use Let's Encrypt's staging environment <https://github.com/icing/mod_md#dipping-the-toe>`__.
+   If you need to test the acquisition of certificates, `use Let's Encrypt's staging environment <https://letsencrypt.org/docs/staging-environment/>`__.
diff --git a/salt/apache/files/sites/_common.conf b/salt/apache/files/sites/_common.conf
index c1807563..5780c571 100644
--- a/salt/apache/files/sites/_common.conf
+++ b/salt/apache/files/sites/_common.conf
@@ -1,4 +1,4 @@
-{#- https://github.com/icing/mod_md#readme -#}
+{#- https://httpd.apache.org/docs/2.4/mod/mod_md.html -#}
 {#- Without additional configuration, mod_md can only acquire certificates if port 80 is open. -#}
 {%- set ssl = pillar.apache.get('public_access') and https -%}
 {#- MDRequireHttps requires a virtual host on port 80. -#}
@@ -10,7 +10,7 @@
 
 {%- macro tls() %}
     SSLEngine on
-    {#- https://github.com/icing/mod_md#tls-alpn-challenges #}
+    {#- https://httpd.apache.org/docs/2.4/mod/mod_md.html#preamble ("https: Challenges") #}
     Protocols h2 http/1.1 acme-tls/1
 {%- endmacro -%}
 
diff --git a/salt/apache/modules/md.sls b/salt/apache/modules/md.sls
index f33f5ff1..52caf0d8 100644
--- a/salt/apache/modules/md.sls
+++ b/salt/apache/modules/md.sls
@@ -4,7 +4,6 @@ include:
 # mod_md 2.2 is in at least Apache 2.4.42.
 # mod_watchdog is part of the server and not a module.
 # https://downloads.apache.org/httpd/CHANGES_2.4
-# https://github.com/icing/mod_md#versions-and-releases
 md:
   apache_module.enabled:
     - watch_in:

From 341eeb5923314748db03f1722a317b7e59d8b5b5 Mon Sep 17 00:00:00 2001
From: James McKinney <26463+jpmckinney@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:03:05 -0400
Subject: [PATCH 5/5] fix(apache): Omit uptime monitors and server-status
 requests from site access logs, as from the server-wide log

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XB7xnMp5MnC8no9eDkui8n
---
 salt/apache/files/sites/_common.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/apache/files/sites/_common.conf b/salt/apache/files/sites/_common.conf
index 5780c571..ee87d06f 100644
--- a/salt/apache/files/sites/_common.conf
+++ b/salt/apache/files/sites/_common.conf
@@ -41,7 +41,7 @@
     {%- if pillar.apache.get('site_logs') and not filename[:1].isdigit() %}
 
     ErrorLog  /var/log/apache2/{{ filename }}/error.log
-    CustomLog /var/log/apache2/{{ filename }}/access.log vhost_combined
+    CustomLog /var/log/apache2/{{ filename }}/access.log vhost_combined env=!dontlog
     {%- endif %}
 
     Include {{ includefile }}