ExternalMirrors
/
apache-formula
Mirror von https://github.com/saltstack-formulas/apache-formula.git
Beobachten 1
Favorisieren 0
Fork 1
Code Issues 0 Releases 31 Wiki Aktivität
Saltstack Official Apache Formula
Du kannst nicht mehr als 25 Themen auswählen Themen müssen entweder mit einem Buchstaben oder einer Ziffer beginnen. Sie können Bindestriche („-“) enthalten und bis zu 35 Zeichen lang sein.
388 Commits
5 Branches
Struktur: 55c6010bde
Branches Tags
${ item.name }
Erstelle Branch ${ searchTerm }
von „55c6010bde“
${ noResults }
apache-formula/pillar.example

346 Zeilen
13KB
Originalformat Blame Verlauf 

  1. # ``apache`` formula configuration:

  2. apache:

  3. 

  4.   # lookup section overrides ``map.jinja`` values

  5.   lookup:

  6.     server: apache2

  7.     service: apache2

  8.     user: some_system_user

  9.     group: some_system_group

  10. 

  11.     vhostdir: /etc/apache2/sites-available

  12.     confdir: /etc/apache2/conf.d

  13.     confext: .conf

  14.     logdir: /var/log/apache2

  15.     wwwdir: /srv/apache2

  16. 

  17.     # apache version (generally '2.2' or '2.4')

  18.     version: '2.2'

  19. 

  20.     # ``apache.mod_wsgi`` formula additional configuration:

  21.     mod_wsgi: mod_wsgi

  22. 

  23.     # Default value for AddDefaultCharset in RedHat configuration

  24.     default_charset: 'UTF-8'

  25. 

  26.   global:

  27.     # global apache directives

  28.     AllowEncodedSlashes: 'On'

  29. 

  30. 

  31.   name_virtual_hosts:

  32.     - interface: '*'

  33.       port: 80

  34.     - interface: '*'

  35.       port: 443

  36. 

  37.   # ``apache.vhosts`` formula additional configuration:

  38.   sites:

  39.     example.net:

  40.       template_file: salt://apache/vhosts/minimal.tmpl

  41. 

  42.     example.com: # must be unique; used as an ID declaration in Salt.

  43.       enabled: True

  44.       template_file: salt://apache/vhosts/standard.tmpl # or minimal.tmpl or redirect.tmpl or proxy.tmpl

  45. 

  46.       ####################### DEFAULT VALUES BELOW ############################

  47.       # NOTE: the values below are simply default settings that *can* be

  48.       # overridden and are not required in order to use this formula to create

  49.       # vhost entries.

  50.       #

  51.       # Do not copy the values below into your Pillar unless you intend to

  52.       # modify these vaules.

  53.       ####################### DEFAULT VALUES BELOW ############################

  54.       template_engine: jinja

  55. 

  56.       interface: '*'

  57.       port: '80'

  58. 

  59.       exclude_listen_directive: True # Do not add a Listen directive in httpd.conf

  60. 

  61.       ServerName: example.com # uses the unique ID above unless specified

  62.       ServerAlias: www.example.com

  63. 

  64.       ServerAdmin: webmaster@example.com

  65. 

  66.       LogLevel: warn

  67.       ErrorLog: /path/to/logs/example.com-error.log # E.g.: /var/log/apache2/example.com-error.log

  68.       CustomLog: /path/to/logs/example.com-access.log # E.g.: /var/log/apache2/example.com-access.log

  69. 

  70.       DocumentRoot: /path/to/www/dir/example.com # E.g., /var/www/example.com

  71. 

  72.       SSLCertificateFile: /etc/ssl/mycert.pem # if ssl is desired

  73.       SSLCertificateKeyFile: /etc/ssl/mycert.pem.key # if key for cert is needed or in an extra file

  74.       SSLCertificateChainFile: /etc/ssl/mycert.chain.pem # if you require a chain of server certificates file

  75. 

  76.       Directory:

  77.         # "default" is a special case; Adds ``/path/to/www/dir/example.com``

  78.         # E.g.: /var/www/example.com

  79.         default:

  80.           Options: -Indexes +FollowSymLinks

  81.           Order: allow,deny    # For Apache < 2.4

  82.           Allow: from all      # For apache < 2.4

  83.           Require: all granted # For apache > 2.4.

  84.           AllowOverride: None

  85.           Formula_Append: |

  86.             Additional config as a

  87.             multi-line string here

  88. 

  89.     redirectmatch.com:

  90.       # Use RedirectMatch Directive https://httpd.apache.org/docs/2.4/fr/mod/mod_alias.html#redirectmatch

  91.       # Require module mod_alias 

  92.       enabled: True

  93.       template_file: salt://apache/vhosts/redirect.tmpl

  94.       ServerName: www.redirectmatch.com

  95.       ServerAlias: www.redirectmatch.com

  96.       RedirectMatch: true

  97.       RedirectSource: '^/$'

  98.       RedirectTarget: '/subdirectory'

  99.       DocumentRoot: /var/www/html/

  100.       ErrorLog: ${APACHE_LOG_DIR}/error.log

  101.       CustomLog: ${APACHE_LOG_DIR}/access.log

  102. 

  103.     80-proxyexample.com:

  104.       template_file: salt://apache/vhosts/redirect.tmpl

  105.       ServerName: www.proxyexample.com

  106.       ServerAlias: www.proxyexample.com

  107.       RedirectSource: '/'

  108.       RedirectTarget: 'https://www.proxyexample.com/'

  109.       DocumentRoot: /var/www/proxy

  110. 

  111.     443-proxyexample.com:

  112.       template_file: salt://apache/vhosts/proxy.tmpl

  113.       ServerName: www.proxyexample.com

  114.       ServerAlias: www.proxyexample.com

  115.       interface: '*'

  116.       port: '443'

  117.       DocumentRoot: /var/www/proxy

  118. 

  119.       Rewrite: |

  120.         RewriteRule ^/webmail$ /webmail/ [R]

  121.         RewriteRule ^/webmail(.*) http://mail.example.com$1 [P,L]

  122.         RewriteRule ^/vicescws(.*) http://svc.example.com:92$1 [P,L]

  123. 

  124.       SSLCertificateFile: /etc/httpd/ssl/example.com.crt

  125.       SSLCertificateKeyFile: /etc/httpd/ssl/example.com.key

  126.       SSLCertificateChainFile: /etc/httpd/ssl/example.com.cer

  127. 

  128.       SSLCertificateFile_content: |

  129.         -----BEGIN CERTIFICATE-----

  130.         MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  131.         MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  132.         VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  133.         NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  134.         TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  135.         ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  136.         V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  137.         gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  138.         FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  139.         CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  140.         BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  141.         BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  142.         Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  143.         -----END CERTIFICATE-----

  144. 

  145.       SSLCertificateKeyFile_content: |

  146.         -----BEGIN PRIVATE KEY-----

  147.         MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  148.         MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  149.         VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  150.         NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  151.         TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  152.         ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  153.         V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  154.         gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  155.         FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  156.         CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  157.         BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  158.         BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  159.         Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  160.         -----END PRIVATE KEY-----

  161. 

  162.       SSLCertificateChainFile_content: |

  163.         -----BEGIN CERTIFICATE-----

  164.         MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  165.         MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  166.         VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  167.         NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  168.         TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  169.         ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  170.         V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  171.         gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  172.         FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  173.         CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  174.         BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  175.         BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  176.         Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  177.         -----END CERTIFICATE-----

  178.         -----BEGIN CERTIFICATE-----

  179.         MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  180.         MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  181.         VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  182.         NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  183.         TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  184.         ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  185.         V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  186.         gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  187.         FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  188.         CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  189.         BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  190.         BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  191.         Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  192.         -----END CERTIFICATE-----

  193. 

  194.       ProxyRequests: 'Off'

  195.       ProxyPreserveHost: 'On'

  196. 

  197.       ProxyRoute:

  198.         example prod proxy route:

  199.           ProxyPassSource: '/'

  200.           ProxyPassTarget: 'http://prod.example.com:85/'

  201.           ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  202.           ProxyPassReverseSource: '/'

  203.           ProxyPassReverseTarget: 'http://prod.example.com:85/'

  204. 

  205.         example webmail proxy route:

  206.           ProxyPassSource: '/webmail/'

  207.           ProxyPassTarget: 'http://mail.example.com/'

  208.           ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  209.           ProxyPassReverseSource: '/webmail/'

  210.           ProxyPassReverseTarget: 'http://mail.example.com/'

  211. 

  212.         example service proxy route:

  213.           ProxyPassSource: '/svc/'

  214.           ProxyPassTarget: 'http://svc.example.com:92/'

  215.           ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  216.           ProxyPassReverseSource: '/svc/'

  217.           ProxyPassReverseTarget: 'http://svc.example.com:92/'

  218. 

  219.       Location:

  220.         /:

  221.           Require: False

  222.           Formula_Append: |

  223.             SecRuleRemoveById 981231

  224.             SecRuleRemoveById 981173

  225. 

  226.         /error:

  227.           Require: 'all granted'

  228. 

  229.         /docs:

  230.           Order: allow,deny    # For Apache < 2.4

  231.           Allow: from all      # For apache < 2.4

  232.           Require: all granted # For apache > 2.4.

  233.           Formula_Append: |

  234.             Additional config as a

  235.             multi-line string here

  236. 

  237.       LocationMatch:

  238.         '^[.\\/]+([Ww][Ee][Bb][Mm][Aa][Ii][Ll])[.\\/]':

  239.           Require: False

  240.           Formula_Append: |

  241.             RequestHeader  set  Host  mail.example.com

  242. 

  243.         '^[.\\/]+([Ss][Vv][Cc])[.\\/]':

  244.           Require: False

  245.           Formula_Append: |

  246.             Require ip 123.123.13.6 84.24.25.74

  247. 

  248.       Proxy_control:

  249.         '*':

  250.           AllowAll: False

  251.           AllowCountry:

  252.             - DE

  253.           AllowIP:

  254.             - 12.5.25.32

  255.             - 12.5.25.33

  256. 

  257. 

  258.       Alias:

  259.         /docs: /usr/share/docs

  260. 

  261.       Formula_Append: |

  262.         Additional config as a

  263.         multi-line string here

  264. 

  265.   # ``apache.debian_full`` formula additional configuration:

  266.   register-site:

  267.     # any name as an array index, and you can duplicate this section

  268.     UNIQUE_VALUE_HERE:

  269.       name: 'my name'

  270.       path: 'salt://path/to/sites-available/conf/file'

  271.       state: 'enabled'

  272.       # Optional - use managed file as Jinja Template

  273.       #template: true

  274.       #defaults:

  275.       #  custom_var: "default value"

  276. 

  277.   modules:

  278.     enabled:  # List modules to enable

  279.       - ldap

  280.       - ssl

  281.     disabled:  # List modules to disable

  282.       - rewrite

  283. 

  284.   # KeepAlive: Whether or not to allow persistent connections (more than

  285.   # one request per connection). Set to "Off" to deactivate.

  286.   keepalive: 'On'

  287. 

  288.   security:

  289.     # can be Full | OS | Minimal | Minor | Major | Prod

  290.     # where Full conveys the most information, and Prod the least.

  291.     ServerTokens: Prod

  292. 

  293.   # ``apache.mod_remoteip`` formula additional configuration:

  294.   mod_remoteip:

  295.     RemoteIPHeader: X-Forwarded-For

  296.     RemoteIPTrustedProxy:

  297.       - 10.0.8.0/24

  298.       - 127.0.0.1

  299. 

  300.   # ``apache.mod_security`` formula additional configuration:

  301.   mod_security:

  302.     crs_install: True

  303.     # If not set, default distro's configuration is installed as is

  304.     manage_config: True

  305.     sec_rule_engine: 'On'

  306.     sec_request_body_access: 'On'

  307.     sec_request_body_limit: '14000000'

  308.     sec_request_body_no_files_limit: '114002'

  309.     sec_request_body_in_memory_limit: '114002'

  310.     sec_request_body_limit_action: 'Reject'

  311.     sec_pcre_match_limit: '15000'

  312.     sec_pcre_match_limit_recursion: '15000'

  313.     sec_debug_log_level: '3'

  314. 

  315.     rules:

  316.       enabled:

  317.       modsecurity_crs_10_setup.conf:

  318.         rule_set: ''

  319.         enabled: True

  320.       modsecurity_crs_20_protocol_violations.conf:

  321.         rule_set: 'base_rules'

  322.         enabled: False

  323. 

  324.     custom_rule_files:

  325.       # any name as an array index, and you can duplicate this section

  326.       UNIQUE_VALUE_HERE:

  327.         file: 'my name'

  328.         path: 'salt://path/to/modsecurity/custom/file'

  329.         enabled: True

  330. 

  331.   mod_ssl:

  332.     # set this to True if you want to override your distributions default TLS configuration

  333.     manage_tls_defaults: False

  334.     # This stuff is deliberately not configured via map.jinja resp. apache:lookup.

  335.     # We're unable to know sane defaults for each release of every distribution.

  336.     # See https://github.com/saltstack-formulas/openssh-formula/issues/102 for a related discussion

  337.     # Have a look at bettercrypto.org for up-to-date settings.

  338.     # These are default values:

  339.     SSLCipherSuite: EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

  340.     # Mitigate the CRIME attack

  341.     SSLCompression: Off

  342.     SSLProtocol: all -SSLv2 -SSLv3 -TLSv1

  343.     SSLHonorCipherOrder: On

  344.     SSLOptions: "+StrictRequire"