ExternalMirrors
/
apache-formula
miroir de https://github.com/saltstack-formulas/apache-formula.git
Suivre 1
Ajouter aux favoris 0
Bifurcation 1
Code Tickets 0 Versions 31 Wiki Activité
Saltstack Official Apache Formula
Vous ne pouvez pas sélectionner plus de 25 sujets Les noms de sujets doivent commencer par une lettre ou un nombre, peuvent contenir des tirets ('-') et peuvent comporter jusqu'à 35 caractères.
458 Révisions
5 Branches
Aborescence: 34d1f7cf15
Branches Tags
${ item.name }
Créer la branche ${ searchTerm }
de '34d1f7cf15'
${ noResults }
apache-formula/pillar.example

372 lines
14KB
Brut Annotations Historique 

  1. # ``apache`` formula configuration:

  2. apache:

  3. 

  4.   # By default apache restart/reload states run (false skips)

  5.   manage_service_states: True

  6. 

  7.   # lookup section overrides ``map.jinja`` values

  8.   lookup:

  9.     server: apache2

  10.     service: apache2

  11.     user: some_system_user

  12.     group: some_system_group

  13. 

  14.     vhostdir: /etc/apache2/sites-available

  15.     confdir: /etc/apache2/conf.d

  16.     confext: .conf

  17.     logdir: /var/log/apache2

  18.     wwwdir: /srv/apache2

  19. 

  20.     # apache version (generally '2.2' or '2.4')

  21.     version: '2.2'

  22. 

  23.     # ``apache.mod_wsgi`` formula additional configuration:

  24.     mod_wsgi: mod_wsgi

  25. 

  26.     # Default value for AddDefaultCharset in RedHat configuration

  27.     default_charset: 'UTF-8'

  28. 

  29.     # Should we enforce DocumentRoot user/group?

  30.     # Default: do not enforce

  31.     document_root_user: www-data   # Force user if specified, leave it default if not

  32.     document_root_group: null      # Do not enforce group

  33. 

  34.   global:

  35.     # global apache directives

  36.     AllowEncodedSlashes: 'On'

  37. 

  38. 

  39.   name_virtual_hosts:

  40.     - interface: '*'

  41.       port: 80

  42.     - interface: '*'

  43.       port: 443

  44. 

  45.   # ``apache.vhosts`` formula additional configuration:

  46.   sites:

  47.     example.net:

  48.       template_file: salt://apache/vhosts/minimal.tmpl

  49. 

  50.     example.com: # must be unique; used as an ID declaration in Salt.

  51.       enabled: True

  52.       template_file: salt://apache/vhosts/standard.tmpl # or minimal.tmpl or redirect.tmpl or proxy.tmpl

  53. 

  54.       ####################### DEFAULT VALUES BELOW ############################

  55.       # NOTE: the values below are simply default settings that *can* be

  56.       # overridden and are not required in order to use this formula to create

  57.       # vhost entries.

  58.       #

  59.       # Do not copy the values below into your Pillar unless you intend to

  60.       # modify these vaules.

  61.       ####################### DEFAULT VALUES BELOW ############################

  62.       template_engine: jinja

  63. 

  64.       interface: '*'

  65.       port: '80'

  66. 

  67.       exclude_listen_directive: True # Do not add a Listen directive in httpd.conf

  68. 

  69.       ServerName: example.com # uses the unique ID above unless specified

  70.       #ServerAlias: www.example.com # Do not add ServerAlias unless defined

  71. 

  72.       ServerAdmin: webmaster@example.com

  73. 

  74.       LogLevel: warn

  75.       ErrorLog: /path/to/logs/example.com-error.log # E.g.: /var/log/apache2/example.com-error.log

  76.       CustomLog: /path/to/logs/example.com-access.log # E.g.: /var/log/apache2/example.com-access.log

  77. 

  78.       DocumentRoot: /path/to/www/dir/example.com # E.g., /var/www/example.com

  79.       DocumentRootUser: null       # do not enforce user, defaults to lookup:document_root_user

  80.       DocumentRootGroup: www-data  # Force group, defaults to lookup:document_root_group

  81. 

  82.       SSLCertificateFile: /etc/ssl/mycert.pem # if ssl is desired

  83.       SSLCertificateKeyFile: /etc/ssl/mycert.pem.key # if key for cert is needed or in an extra file

  84.       SSLCertificateChainFile: /etc/ssl/mycert.chain.pem # if you require a chain of server certificates file

  85. 

  86.       Directory:

  87.         # "default" is a special case; uses DocumentRoot value

  88.         # E.g.: /var/www/example.com

  89.         default:

  90.           Options: -Indexes +FollowSymLinks

  91.           Order: allow,deny    # For Apache < 2.4

  92.           Allow: from all      # For apache < 2.4

  93.           Require: all granted # For apache > 2.4.

  94.           AllowOverride: None

  95.           Formula_Append: |

  96.             Additional config as a

  97.             multi-line string here

  98. 

  99.     redirectmatch.com:

  100.       # Use RedirectMatch Directive https://httpd.apache.org/docs/2.4/fr/mod/mod_alias.html#redirectmatch

  101.       # Require module mod_alias 

  102.       enabled: True

  103.       template_file: salt://apache/vhosts/redirect.tmpl

  104.       ServerName: www.redirectmatch.com

  105.       ServerAlias: www.redirectmatch.com

  106.       RedirectMatch: true

  107.       RedirectSource: '^/$'

  108.       RedirectTarget: '/subdirectory'

  109.       DocumentRoot: /var/www/html/

  110.       ErrorLog: ${APACHE_LOG_DIR}/error.log

  111.       CustomLog: ${APACHE_LOG_DIR}/access.log

  112. 

  113.     80-proxyexample.com:

  114.       template_file: salt://apache/vhosts/redirect.tmpl

  115.       ServerName: www.proxyexample.com

  116.       ServerAlias: www.proxyexample.com

  117.       RedirectSource: '/'

  118.       RedirectTarget: 'https://www.proxyexample.com/'

  119.       DocumentRoot: /var/www/proxy

  120. 

  121.     443-proxyexample.com:

  122.       template_file: salt://apache/vhosts/proxy.tmpl

  123.       ServerName: www.proxyexample.com

  124.       ServerAlias: www.proxyexample.com

  125.       interface: '*'

  126.       port: '443'

  127.       DocumentRoot: /var/www/proxy

  128. 

  129.       Rewrite: |

  130.         RewriteRule ^/webmail$ /webmail/ [R]

  131.         RewriteRule ^/webmail(.*) http://mail.example.com$1 [P,L]

  132.         RewriteRule ^/vicescws(.*) http://svc.example.com:92$1 [P,L]

  133. 

  134.       SSLCertificateFile: /etc/httpd/ssl/example.com.crt

  135.       SSLCertificateKeyFile: /etc/httpd/ssl/example.com.key

  136.       SSLCertificateChainFile: /etc/httpd/ssl/example.com.cer

  137. 

  138.       SSLCertificateFile_content: |

  139.         -----BEGIN CERTIFICATE-----

  140.         MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  141.         MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  142.         VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  143.         NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  144.         TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  145.         ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  146.         V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  147.         gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  148.         FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  149.         CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  150.         BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  151.         BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  152.         Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  153.         -----END CERTIFICATE-----

  154. 

  155.       SSLCertificateKeyFile_content: |

  156.         -----BEGIN PRIVATE KEY-----

  157.         MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  158.         MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  159.         VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  160.         NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  161.         TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  162.         ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  163.         V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  164.         gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  165.         FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  166.         CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  167.         BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  168.         BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  169.         Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  170.         -----END PRIVATE KEY-----

  171. 

  172.       SSLCertificateChainFile_content: |

  173.         -----BEGIN CERTIFICATE-----

  174.         MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  175.         MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  176.         VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  177.         NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  178.         TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  179.         ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  180.         V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  181.         gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  182.         FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  183.         CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  184.         BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  185.         BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  186.         Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  187.         -----END CERTIFICATE-----

  188.         -----BEGIN CERTIFICATE-----

  189.         MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  190.         MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  191.         VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  192.         NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  193.         TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  194.         ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  195.         V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  196.         gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  197.         FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  198.         CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  199.         BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  200.         BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  201.         Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  202.         -----END CERTIFICATE-----

  203. 

  204.       ProxyRequests: 'Off'

  205.       ProxyPreserveHost: 'On'

  206. 

  207.       ProxyRoute:

  208.         example prod proxy route:

  209.           ProxyPassSource: '/'

  210.           ProxyPassTarget: 'http://prod.example.com:85/'

  211.           ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  212.           ProxyPassReverseSource: '/'

  213.           ProxyPassReverseTarget: 'http://prod.example.com:85/'

  214. 

  215.         example webmail proxy route:

  216.           ProxyPassSource: '/webmail/'

  217.           ProxyPassTarget: 'http://mail.example.com/'

  218.           ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  219.           ProxyPassReverseSource: '/webmail/'

  220.           ProxyPassReverseTarget: 'http://mail.example.com/'

  221. 

  222.         example service proxy route:

  223.           ProxyPassSource: '/svc/'

  224.           ProxyPassTarget: 'http://svc.example.com:92/'

  225.           ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  226.           ProxyPassReverseSource: '/svc/'

  227.           ProxyPassReverseTarget: 'http://svc.example.com:92/'

  228. 

  229.       Location:

  230.         /:

  231.           Require: False

  232.           Formula_Append: |

  233.             SecRuleRemoveById 981231

  234.             SecRuleRemoveById 981173

  235. 

  236.         /error:

  237.           Require: 'all granted'

  238. 

  239.         /docs:

  240.           Order: allow,deny    # For Apache < 2.4

  241.           Allow: from all      # For apache < 2.4

  242.           Require: all granted # For apache > 2.4.

  243.           Formula_Append: |

  244.             Additional config as a

  245.             multi-line string here

  246. 

  247.       LocationMatch:

  248.         '^[.\\/]+([Ww][Ee][Bb][Mm][Aa][Ii][Ll])[.\\/]':

  249.           Require: False

  250.           Formula_Append: |

  251.             RequestHeader  set  Host  mail.example.com

  252. 

  253.         '^[.\\/]+([Ss][Vv][Cc])[.\\/]':

  254.           Require: False

  255.           Formula_Append: |

  256.             Require ip 123.123.13.6 84.24.25.74

  257. 

  258.       Proxy_control:

  259.         '*':

  260.           AllowAll: False

  261.           AllowCountry:

  262.             - DE

  263.           AllowIP:

  264.             - 12.5.25.32

  265.             - 12.5.25.33

  266. 

  267. 

  268.       Alias:

  269.         /docs: /usr/share/docs

  270. 

  271.       Formula_Append: |

  272.         Additional config as a

  273.         multi-line string here

  274. 

  275.   # ``apache.debian_full`` formula additional configuration:

  276.   register-site:

  277.     # any name as an array index, and you can duplicate this section

  278.     UNIQUE_VALUE_HERE:

  279.       name: 'my name'

  280.       path: 'salt://path/to/sites-available/conf/file'

  281.       state: 'enabled'

  282.       # Optional - use managed file as Jinja Template

  283.       #template: true

  284.       #defaults:

  285.       #  custom_var: "default value"

  286. 

  287.   modules:

  288.     enabled:  # List modules to enable

  289.       - ldap

  290.       - ssl

  291.     disabled:  # List modules to disable

  292.       - rewrite

  293. 

  294.   flags:

  295.     enabled:  # List server flags to enable

  296.       - SSL

  297.     disabled: # List server flags to disable

  298.       - status

  299. 

  300.   # KeepAlive: Whether or not to allow persistent connections (more than

  301.   # one request per connection). Set to "Off" to deactivate.

  302.   keepalive: 'On'

  303. 

  304.   security:

  305.     # can be Full | OS | Minimal | Minor | Major | Prod

  306.     # where Full conveys the most information, and Prod the least.

  307.     ServerTokens: Prod

  308. 

  309.   # [debian only] configure mod_ssl

  310.   ssl:

  311.     SSLCipherSuite: 'HIGH:!aNULL'

  312.     SSLHonorCipherOrder: 'Off'

  313.     SSLProtocol: 'all -SSLv3'

  314.     SSLUseStapling: 'Off'

  315.     SSLStaplingResponderTimeout: '5'

  316.     SSLStaplingReturnResponderErrors: 'Off'

  317.     SSLStaplingCache: 'shmcb:/var/run/ocsp(128000)'

  318. 

  319.   # ``apache.mod_remoteip`` formula additional configuration:

  320.   mod_remoteip:

  321.     RemoteIPHeader: X-Forwarded-For

  322.     RemoteIPTrustedProxy:

  323.       - 10.0.8.0/24

  324.       - 127.0.0.1

  325. 

  326.   # ``apache.mod_security`` formula additional configuration:

  327.   mod_security:

  328.     crs_install: True

  329.     # If not set, default distro's configuration is installed as is

  330.     manage_config: True

  331.     sec_rule_engine: 'On'

  332.     sec_request_body_access: 'On'

  333.     sec_request_body_limit: '14000000'

  334.     sec_request_body_no_files_limit: '114002'

  335.     sec_request_body_in_memory_limit: '114002'

  336.     sec_request_body_limit_action: 'Reject'

  337.     sec_pcre_match_limit: '15000'

  338.     sec_pcre_match_limit_recursion: '15000'

  339.     sec_debug_log_level: '3'

  340. 

  341.     rules:

  342.       enabled:

  343.       modsecurity_crs_10_setup.conf:

  344.         rule_set: ''

  345.         enabled: True

  346.       modsecurity_crs_20_protocol_violations.conf:

  347.         rule_set: 'base_rules'

  348.         enabled: False

  349. 

  350.     custom_rule_files:

  351.       # any name as an array index, and you can duplicate this section

  352.       UNIQUE_VALUE_HERE:

  353.         file: 'my name'

  354.         path: 'salt://path/to/modsecurity/custom/file'

  355.         enabled: True

  356. 

  357.   mod_ssl:

  358.     # set this to True if you want to override your distributions default TLS configuration

  359.     manage_tls_defaults: False

  360.     # This stuff is deliberately not configured via map.jinja resp. apache:lookup.

  361.     # We're unable to know sane defaults for each release of every distribution.

  362.     # See https://github.com/saltstack-formulas/openssh-formula/issues/102 for a related discussion

  363.     # Have a look at bettercrypto.org for up-to-date settings.

  364.     # These are default values:

  365.     SSLCipherSuite: EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

  366.     # Mitigate the CRIME attack

  367.     SSLCompression: Off

  368.     SSLProtocol: all -SSLv2 -SSLv3 -TLSv1

  369.     SSLHonorCipherOrder: On

  370.     SSLOptions: "+StrictRequire"