Apache canonical host

docs/conf.py

@@ -52,6 +52,5 @@
 linkcheck_anchors_ignore_for_url = (
     r"^https://github\.com/[^/]+/[^/]+/blob/",
     r"^https://github\.com/[^/]+/[^/]+/tree/",
-    r"^https://github\.com/icing/mod_md",
     r"^https://rabbitmq\.kingfisher\.open-contracting\.org",
 )

docs/develop/commit.rst

@@ -51,7 +51,7 @@ Review code
 
 For context, for other repositories, work is done on a branch and tested on a local machine before a pull request is made, which is then tested on continuous integration, reviewed and approved before merging.
 
-However, for this repository, in some cases, it's impossible to test changes to server configurations, for example: if SSL certificates are involved (without `additional configuration <https://github.com/icing/mod_md#ports-ports-ports>`__), or if external services are involved. In other cases, it's too much effort to setup a test environment in which to test changes.
+However, for this repository, in some cases, it's impossible to test changes to server configurations, for example: if SSL certificates are involved (without `additional configuration <https://httpd.apache.org/docs/2.4/mod/mod_md.html#mdcachallenges>`__), or if external services are involved. In other cases, it's too much effort to setup a test environment in which to test changes.
 
 In such cases, the same process is followed as in other repositories, but without the benefit of tests.
 

docs/develop/update/apache.rst

@@ -70,7 +70,8 @@ This will:
    -  If ``apache.public_access`` is ``True`` and ``https`` isn't ``False``:
 
       -  :ref:`ssl-certificates`
-      -  Create a virtual host serving port 443
+      -  Create a virtual host serving port 443 for the ``servername``
+      -  Create a virtual host serving port 443 for any ``serveraliases``, to redirect to the ``servername``
       -  Configure a HTTP to HTTPS permanent redirect
       -  Add a ``Strict-Transport-Security`` header
 
@@ -172,7 +173,7 @@ The service should now be available at its ``https://`` web address.
 
 .. tip::
 
-   In case of error, see `mod_md's troubleshooting guide <https://github.com/icing/mod_md#how-to-fix-problems>`__.
+   In case of error, see `mod_md's documentation <https://httpd.apache.org/docs/2.4/mod/mod_md.html>`__ and the `Let's Encrypt community <https://community.letsencrypt.org>`__.
 
    If you need to test the acquisition of certificates, :ref:`use Let's Encrypt's staging environment<mod_md-test>`.
 

docs/develop/update/nginx.rst

@@ -110,4 +110,4 @@ The service should now be available at its ``https://`` web address. Certbot wil
 
 .. tip::
 
-   If you need to test the acquisition of certificates, `use Let's Encrypt's staging environment <https://github.com/icing/mod_md#dipping-the-toe>`__.
+   If you need to test the acquisition of certificates, `use Let's Encrypt's staging environment <https://letsencrypt.org/docs/staging-environment/>`__.

salt/apache/files/sites/_common.conf

@@ -1,33 +1,47 @@
-{#- https://github.com/icing/mod_md#readme -#}
+{#- https://httpd.apache.org/docs/2.4/mod/mod_md.html -#}
 {#- Without additional configuration, mod_md can only acquire certificates if port 80 is open. -#}
 {%- set ssl = pillar.apache.get('public_access') and https -%}
 {#- MDRequireHttps requires a virtual host on port 80. -#}
 {%- set ports = [80, 443] if ssl else [80] -%}
+
+{%- macro address(port) -%}
+{{ pillar.apache.ipv4 if 'ipv4' in pillar.apache else '*' }}:{{ port }}{% if 'ipv6' in pillar.apache %} [{{ pillar.apache.ipv6 }}]:{{ port }}{% endif %}
+{%- endmacro -%}
+
+{%- macro tls() %}
+    SSLEngine on
+    {#- https://httpd.apache.org/docs/2.4/mod/mod_md.html#preamble ("https: Challenges") #}
+    Protocols h2 http/1.1 acme-tls/1
+{%- endmacro -%}
+
 {#- `servername` is not set for the default site. -#}
 {%- if ssl and servername -%}
-<MDomain {{ servername }}>
+<MDomain {{ ([servername] + serveraliases)|join(' ') }}>
     MDRequireHttps permanent
 </MDomain>
 {%- endif %}
+
 {%- for port in ports %}
 
-<VirtualHost {{ pillar.apache.ipv4 if 'ipv4' in pillar.apache else '*' }}:{{ port }}{% if 'ipv6' in pillar.apache %} [{{ pillar.apache.ipv6 }}]:{{ port }}{% endif %}>
+<VirtualHost {{ address(port) }}>
     {%- if servername %}
     ServerName {{ servername }}
     {%- endif %}
+    {#- On port 443, the aliases have their own virtual host. #}
+    {%- if port == 80 %}
     {%- for serveralias in serveraliases %}
     ServerAlias {{ serveralias }}
     {%- endfor %}
+    {%- endif %}
 
     {%- if port == 443 %}
-    SSLEngine on
-    {#- https://github.com/icing/mod_md#tls-alpn-challenges #}
-    Protocols h2 http/1.1 acme-tls/1
+    {{- tls() }}
 
     {#- System-wide configuration files should be prefixed with numbers #}
     {%- if pillar.apache.get('site_logs') and not filename[:1].isdigit() %}
+
     ErrorLog  /var/log/apache2/{{ filename }}/error.log
-    CustomLog /var/log/apache2/{{ filename }}/access.log vhost_combined
+    CustomLog /var/log/apache2/{{ filename }}/access.log vhost_combined env=!dontlog
     {%- endif %}
 
     Include {{ includefile }}
@@ -40,4 +54,19 @@
     Include {{ includefile }}
     {%- endif %}
 </VirtualHost>
+{%- if port == 80 and ssl and serveraliases %}
+
+<VirtualHost {{ address(443) }}>
+    ServerName {{ serveraliases[0] }}
+    {%- for serveralias in serveraliases[1:] %}
+    ServerAlias {{ serveralias }}
+    {%- endfor %}
+    {{- tls() }}
+
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+
+    RewriteEngine on
+    RewriteRule ^ https://{{ servername }}%{REQUEST_URI} [R=301,L]
+</VirtualHost>
+{%- endif %}
 {%- endfor %}

salt/apache/files/sites/docs.conf.include

@@ -89,7 +89,7 @@ SetEnv BANNER /includes/banner_live.html
     # https://httpd.apache.org/docs/current/howto/ssi.html#configuring
     AddOutputFilter INCLUDES .html
 
-    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 
     # docson needs unsafe-eval and frame-ancestors. infrastructure uses Google Fonts. standard, infrastructure, and public-private-partnerships use <iframe>.
     Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com https://use.typekit.net; frame-src 'self' https://www.youtube-nocookie.com https://docs.google.com https://open-contracting.github.io; connect-src 'self' https://raw.githubusercontent.com/open-contracting/extension_registry/main/build/extensions.json; object-src 'none'; worker-src 'none'; frame-ancestors 'self'"

salt/apache/files/sites/wordpress.conf.include

@@ -1,5 +1,5 @@
 DocumentRoot /home/{{ user }}/public_html
-Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 Header set X-Content-Type-Options nosniff
 
 <Directory /home/{{ user }}/public_html>

salt/apache/modules/md.sls

@@ -4,7 +4,6 @@ include:
 # mod_md 2.2 is in at least Apache 2.4.42.
 # mod_watchdog is part of the server and not a module.
 # https://downloads.apache.org/httpd/CHANGES_2.4
-# https://github.com/icing/mod_md#versions-and-releases
 md:
   apache_module.enabled:
     - watch_in: