ExternalMirrors
/
apache-formula
mirror of https://github.com/saltstack-formulas/apache-formula.git
Watch 1
Star 0
Fork 1
Code Issues 0 Releases 31 Wiki Activity
Saltstack Official Apache Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
672 Commits
5 Branches
Tree: c4dce07476
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'c4dce07476'
${ noResults }
apache-formula/pillar.example

552 lines
22KB
Raw Blame History 

  1. # -*- coding: utf-8 -*-

  2. # vim: ft=yaml

  3. ---

  4. apache:

  5.   lookup:

  6.     master: template-master

  7. 

  8.     # apache version (generally '2.2' or '2.4')

  9.     # version: '2.2'

  10. 

  11.     # Default value for AddDefaultCharset in RedHat configuration

  12.     default_charset: 'UTF-8'

  13. 

  14.     # Should we enforce DocumentRoot user/group?

  15.     document_root_user: null   # Defaults to: apache.user

  16.     document_root_group: null  # Defaults to: apache.group

  17. 

  18.     # Just for testing purposes

  19.     winner: lookup

  20.     added_in_lookup: lookup_value

  21. 

  22.   # Using bash package and udev service as an example. This allows us to

  23.   # test the template formula itself. You should set these parameters to

  24.   # examples that make sense in the contexto of the formula you're writing.

  25.   # pkg:

  26.   #   deps:

  27.   #     mod_ssl   # redhat

  28.   #     mod_security  # redhat

  29.   #     mod_geoip     # redhat

  30.   #     GeoIP  # redhat

  31.   #     libapache2-mod-security2  # Debian

  32. 

  33.   global:

  34.     # global apache directives

  35.     AllowEncodedSlashes: 'On'

  36. 

  37.   name_virtual_hosts:

  38.     - interface: '*'

  39.       port: 80

  40.     - interface: '*'

  41.       port: 443

  42. 

  43.   # ``apache.vhosts`` formula additional configuration:

  44.   # fqdn should be added to /etc/hosts i.e. ##

  45.   # $ tail -3 /etc/hosts

  46.   # 127.0.0.1   example.com

  47.   # 127.0.0.1   www.redirectmatch.com

  48.   # 127.0.0.1   www.proxyexample.com

  49. 

  50.   sites:

  51.     example.net:

  52.       template_file: salt://apache/config/vhosts/minimal.tmpl

  53.       port: '8081'

  54. 

  55.     example.com:  # must be unique; used as an ID declaration in Salt.

  56.       enabled: true

  57.       # or minimal.tmpl or redirect.tmpl or proxy.tmpl

  58.       template_file: salt://apache/config/vhosts/standard.tmpl

  59. 

  60.       ####################### DEFAULT VALUES BELOW ############################

  61.       # NOTE: the values below are simply default settings that *can* be

  62.       # overridden and are not required in order to use this formula to create

  63.       # vhost entries.

  64.       #

  65.       # Do not copy the values below into your Pillar unless you intend to

  66.       # modify these vaules.

  67.       ####################### DEFAULT VALUES BELOW ############################

  68.       template_engine: jinja

  69. 

  70.       interface: '*'

  71.       port: '443'

  72. 

  73.       exclude_listen_directive: true  # Do not add a Listen directive in httpd.conf

  74. 

  75.       ServerName: example.com  # uses the unique ID above unless specified

  76.       # ServerAlias: www.example.com  # Do not add ServerAlias unless defined

  77. 

  78.       ServerAdmin: webmaster@example.com

  79. 

  80.       LogLevel: warn

  81.       # E.g.: /var/log/apache2/example.com-error.log

  82.       # ErrorLog: /path/to/logs/example.com-error.log

  83.       # E.g.: /var/log/apache2/example.com-access.log

  84.       # CustomLog: /path/to/logs/example.com-access.log

  85. 

  86.       # E.g., /var/www/example.com

  87.       DocumentRoot: /path/to/www/dir/example.com

  88.       # do not enforce user, defaults to lookup:document_root_user or apache.user

  89.       DocumentRootUser: null

  90.       # Force group, defaults to lookup:document_root_group or apache.user

  91.       DocumentRootGroup: null

  92. 

  93.       {# {%- if grains.os_family in ('Debian', 'Suse', 'Gentoo') %} #}

  94.       {# SSLCertificateFile: /etc/apache2/conf/server.crt #}

  95.       {# SSLCertificateKeyFile: /etc/apache2/conf/server.key #}

  96.       {# {%- else %} #}

  97.       {# SSLCertificateFile: /etc/httpd/conf/server.crt #}

  98.       {# SSLCertificateKeyFile: /etc/httpd/conf/server.key #}

  99.       {# {%- endif %} #}

  100.       {# # SSLCertificateChainFile: /etc/httpd/ssl/example.com.cer #}

  101.       {#  #}

  102.       {# SSLCertificateFile_content: | #}

  103.       {#   -----BEGIN CERTIFICATE----- #}

  104.       {#   MIIDYTCCAkkCFCKCcuwB/Ze9bI5/75oRChNH8RzHMA0GCSqGSIb3DQEBCwUAMG0x #}

  105.       {#   CzAJBgNVBAYTAklFMREwDwYDVQQIDAhDb25uYWNodDESMBAGA1UEBwwJQ29ubWFp #}

  106.       {#   Y25lMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxFDASBgNVBAMM #}

  107.       {#   C2V4YW1wbGUuY29tMB4XDTIwMTAwMzEzMzI1N1oXDTIxMTAwMzEzMzI1N1owbTEL #}

  108.       {#   MAkGA1UEBhMCSUUxETAPBgNVBAgMCENvbm5hY2h0MRIwEAYDVQQHDAlDb25tYWlj #}

  109.       {#   bmUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEUMBIGA1UEAwwL #}

  110.       {#   ZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDSl0qL #}

  111.       {#   ol+/b3R9VccpOLe5Cg1Tf1zstAzV5TvjcjSdytdwMDGy9J8Yi2EcMZ1wNdMkvf4D #}

  112.       {#   mr+72Za+qeHHc0ZA+fIJoV+tTcbLbV/mhv0i0i7Zldi3QuvIVBpLR2Z5s5mXZ7C8 #}

  113.       {#   yz8VpF9enQkS3uNnbNuZNT3ElGHmlAj1yHsh0K+TbvZrygFkG0wvYwivhlt1Zcbo #}

  114.       {#   th4LJ+gBwNIdSJUiAa58VO5ZNeenM9DquJfZVcFc1bDFqzU0T9KY4PsxmzO1A2+m #}

  115.       {#   TDHoGR4nCz7B+5Ec4USyBUuKo2FhALBEtYz2hlwaf9XasSSvmzO5hhPCQ3nJ4qeY #}

  116.       {#   i+BLCSpiq2lApPVZAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAD9/78A4ygQWbO27 #}

  117.       {#   jQPm+2Zg0f9Sn1tcD4tOVao0MlAfWrALjbmj82hg+givEQKAuN7ptthYoaJcOxHl #}

  118.       {#   aUe++y3bQiCznN73yKSJZFgG5fYR8tyMslsYRBcKSay0nvPhN/3Jry0nNehDREQ+ #}

  119.       {#   2H0vB595bymGNTmux13sNwOZH1i8KEgxdLcFbje87+CbhCGbFhS3lHPY2FeXnHpO #}

  120.       {#   W60Zchwsy06xMjo4rzbQatdJj/HAh6lIx0YmNDX/d3dCLpZlkvUBT6ENVhipi5bb #}

  121.       {#   2pF/Awob8AYWbIn4N7gmIP5Sb0tugpEgrSgSyDdZNWoFDChvfHXcNUP8lblIftAl #}

  122.       {#   ylssbnQ= #}

  123.       {#   -----END CERTIFICATE----- #}

  124.       {#  #}

  125.       {# SSLCertificateKeyFile_content: | #}

  126.       {#   -----BEGIN RSA PRIVATE KEY----- #}

  127.       {#   MIIEowIBAAKCAQEA0pdKi6Jfv290fVXHKTi3uQoNU39c7LQM1eU743I0ncrXcDAx #}

  128.       {#   svSfGIthHDGdcDXTJL3+A5q/u9mWvqnhx3NGQPnyCaFfrU3Gy21f5ob9ItIu2ZXY #}

  129.       {#   t0LryFQaS0dmebOZl2ewvMs/FaRfXp0JEt7jZ2zbmTU9xJRh5pQI9ch7IdCvk272 #}

  130.       {#   a8oBZBtML2MIr4ZbdWXG6LYeCyfoAcDSHUiVIgGufFTuWTXnpzPQ6riX2VXBXNWw #}

  131.       {#   xas1NE/SmOD7MZsztQNvpkwx6BkeJws+wfuRHOFEsgVLiqNhYQCwRLWM9oZcGn/V #}

  132.       {#   2rEkr5szuYYTwkN5yeKnmIvgSwkqYqtpQKT1WQIDAQABAoIBAQCI39SP1UWuQ17P #}

  133.       {#   Z8U+waKIHkRzFMDtCEmfbJL0TfJs7L4CKRDkY6JUbaL8lDLkD9fgdax340jja5VS #}

  134.       {#   70/UNtRevxXVtJFfLsIazkgaqXo1+65/talZ06E0X5WHgCzWxSj7A2YYD3I9OszR #}

  135.       {#   zfdr0Hq1akeA2N4AuwC2wVjhhyCg5Lg4xY0l+kRFLrPU4RctsjCAaveVIm3wmJVd #}

  136.       {#   vmHO9hKcR3nxuIx0/cPYe20WgGSqbYJQburE1uXp26uz/Jek/u8FNFIEjWCWB+vj #}

  137.       {#   eRQOcxngebyWCh0dyoxb3nL28Yty9O1MlLP2b0YMmep1ZfEFtwn4M2d8FdW1WCmJ #}

  138.       {#   viOGFx4BAoGBAPTYSIpyxea1qaeNmT97e4YgPwV3rajhdPRYSQKyCsjKHk7Q/uxk #}

  139.       {#   Phddo0ymiGKLCRAUwg9py900slY8mZKbdrVxXV4EEhngrWrr2gpfzxkEF1i0d4bS #}

  140.       {#   2OuRCbkfE23glxqtVjvnTlrRANaXgk5mUQCL1YDUf+hrpEvF0pTbDRYpAoGBANwv #}

  141.       {#   ffy+Sk+e0v+NlthhNHUDcXisIoW7b/DoT0H8DtbJV/QVexaGln7Ts6EgaH2NdpC+ #}

  142.       {#   dyLKa+l7oIeKgXeHm2Tgm879di/ChQCkoAHIUu5Nm0c5D2Vst26JrfCA7vZb9ddI #}

  143.       {#   FMFt5bsDgRqFzTXFe0k9TEIBiF0Pp5xfHVwNWeuxAoGAGNY3xZOO77BN3WlHumDU #}

  144.       {#   Tu7Gdc+GFjOIoaCzB0r4PRYDrQsWUPR6N/SPtB7Qhu6DpNX2OYoJ3A6UaJsNGQoc #}

  145.       {#   KJuvVPIkw+s+rDHwlEzTvT3lAGKOHWcWCg9UZSr51ZOKwHIE5V65XA0HgL0twrYu #}

  146.       {#   UVfd+IuVzgXdTLJsgh0WXsECgYApcgcU+/yg4BR3Zf9u2100aWGChWQ6J/36KsBA #}

  147.       {#   e2GPrHaRyzlQFCVf2hmFysPgXjBjLnbeZZvKZyrgWIHmLfBiHKU3YR5N/x9p75Lu #}

  148.       {#   wvZZROJllagAP2aHuAK1so9IcCbmTvsZLcaAXTh/9Y+a/4ElWBRymDdCzR+Pn5e3 #}

  149.       {#   LAwxAQKBgBHH42ri6pHbRptINzJ9sw3PhwewQZtGu3sfvrOknBs3togptCrjBWDF #}

  150.       {#   eOGuFmjHO9vnhWs2yWQYETL1jt+CWgzRc4o4akB3qH5sXar5F7h06y16RFV9u6UJ #}

  151.       {#   qaGqPFcy/l/5H6uNPLZt4Ufg3T0Mz0Az+Dti99KqVLKeqWQvXVc4 #}

  152.       {#   -----END RSA PRIVATE KEY----- #}

  153. 

  154. 

  155.       Directory:

  156.         # "default" is a special case; uses DocumentRoot value

  157.         # E.g.: /var/www/example.com

  158.         default:

  159.           Options: -Indexes +FollowSymLinks

  160.           Order: allow,deny     # For Apache < 2.4

  161.           Allow: from all       # For apache < 2.4

  162.           Require: all granted  # For apache > 2.4.

  163.           AllowOverride: None

  164.           # Formula_Append: |

  165.           #   Additional config as a

  166.           #   multi-line string here

  167. 

  168.     # Force SSL: Redirect from 80 to 443

  169.     example2.com:

  170.       port: 80

  171.       template_file: salt://apache/vhosts/redirect.tmpl

  172.       RedirectSource: 'permanent /'

  173.       # Trailing slash is important

  174.       RedirectTarget: 'https://example.com/'

  175.     example2.com_ssl:

  176.       port: 443

  177.       ServerName: example.com

  178.       # SSLCertificateFile: /path/to/ssl.crt

  179.       # SSLCertificateKeyFile: /path/to/ssl.key

  180.       # SSLCertificateChainFile: /path/to/ssl.ca.crt

  181. 

  182.     # Use RedirectMatch Directive

  183.     redirectmatch.com:

  184.       # - https://httpd.apache.org/docs/2.4/fr/mod/mod_alias.html#redirectmatch

  185.       # Require module mod_alias

  186.       enabled: true

  187.       template_file: salt://apache/config/vhosts/redirect.tmpl

  188.       ServerName: www.redirectmatch.com

  189.       ServerAlias: www.redirectmatch.com

  190.       RedirectMatch: true

  191.       RedirectSource: '^/$'

  192.       RedirectTarget: '/subdirectory'

  193.       DocumentRoot: /var/www/html/

  194.       port: '8083'

  195. 

  196.     8084-proxyexample.com:

  197.       template_file: salt://apache/config/vhosts/redirect.tmpl

  198.       ServerName: www.proxyexample.com

  199.       ServerAlias: www.proxyexample.com

  200.       RedirectSource: '/'

  201.       RedirectTarget: 'https://www.proxyexample.com/'

  202.       DocumentRoot: /var/www/proxy

  203.       port: '8084'

  204. 

  205.     # 8443-proxyexample.com:

  206.     #   template_file: salt://apache/config/vhosts/proxy.tmpl

  207.     #   ServerName: www.proxyexample.com

  208.     #   ServerAlias: www.proxyexample.com

  209.     #   interface: '*'

  210.     #   port: '8443'

  211.     #   DocumentRoot: /var/www/proxy

  212.     #

  213.     #   Rewrite: |

  214.     #     RewriteRule ^/webmail$ /webmail/ [R]

  215.     #     RewriteRule ^/webmail(.*) http://mail.example.com$1 [P,L]

  216.     #     RewriteRule ^/vicescws(.*) http://svc.example.com:92$1 [P,L]

  217.     #

  218.     #   SSLCertificateFile: /etc/httpd/conf/server.crt

  219.     #   SSLCertificateKeyFile: /etc/httpd/conf/server.key

  220.     #   # SSLCertificateChainFile: /etc/httpd/ssl/example.com.cer

  221.     #

  222.     #   SSLCertificateFile_content: |

  223.     #     -----BEGIN CERTIFICATE-----

  224.     #     MIIDYTCCAkkCFCKCcuwB/Ze9bI5/75oRChNH8RzHMA0GCSqGSIb3DQEBCwUAMG0x

  225.     #     CzAJBgNVBAYTAklFMREwDwYDVQQIDAhDb25uYWNodDESMBAGA1UEBwwJQ29ubWFp

  226.     #     Y25lMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxFDASBgNVBAMM

  227.     #     C2V4YW1wbGUuY29tMB4XDTIwMTAwMzEzMzI1N1oXDTIxMTAwMzEzMzI1N1owbTEL

  228.     #     MAkGA1UEBhMCSUUxETAPBgNVBAgMCENvbm5hY2h0MRIwEAYDVQQHDAlDb25tYWlj

  229.     #     bmUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEUMBIGA1UEAwwL

  230.     #     ZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDSl0qL

  231.     #     ol+/b3R9VccpOLe5Cg1Tf1zstAzV5TvjcjSdytdwMDGy9J8Yi2EcMZ1wNdMkvf4D

  232.     #     mr+72Za+qeHHc0ZA+fIJoV+tTcbLbV/mhv0i0i7Zldi3QuvIVBpLR2Z5s5mXZ7C8

  233.     #     yz8VpF9enQkS3uNnbNuZNT3ElGHmlAj1yHsh0K+TbvZrygFkG0wvYwivhlt1Zcbo

  234.     #     th4LJ+gBwNIdSJUiAa58VO5ZNeenM9DquJfZVcFc1bDFqzU0T9KY4PsxmzO1A2+m

  235.     #     TDHoGR4nCz7B+5Ec4USyBUuKo2FhALBEtYz2hlwaf9XasSSvmzO5hhPCQ3nJ4qeY

  236.     #     i+BLCSpiq2lApPVZAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAD9/78A4ygQWbO27

  237.     #     jQPm+2Zg0f9Sn1tcD4tOVao0MlAfWrALjbmj82hg+givEQKAuN7ptthYoaJcOxHl

  238.     #     aUe++y3bQiCznN73yKSJZFgG5fYR8tyMslsYRBcKSay0nvPhN/3Jry0nNehDREQ+

  239.     #     2H0vB595bymGNTmux13sNwOZH1i8KEgxdLcFbje87+CbhCGbFhS3lHPY2FeXnHpO

  240.     #     W60Zchwsy06xMjo4rzbQatdJj/HAh6lIx0YmNDX/d3dCLpZlkvUBT6ENVhipi5bb

  241.     #     2pF/Awob8AYWbIn4N7gmIP5Sb0tugpEgrSgSyDdZNWoFDChvfHXcNUP8lblIftAl

  242.     #     ylssbnQ=

  243.     #     -----END CERTIFICATE-----

  244.     #

  245.     #   SSLCertificateKeyFile_content: |

  246.     #     -----BEGIN RSA PRIVATE KEY-----

  247.     #     MIIEowIBAAKCAQEA0pdKi6Jfv290fVXHKTi3uQoNU39c7LQM1eU743I0ncrXcDAx

  248.     #     svSfGIthHDGdcDXTJL3+A5q/u9mWvqnhx3NGQPnyCaFfrU3Gy21f5ob9ItIu2ZXY

  249.     #     t0LryFQaS0dmebOZl2ewvMs/FaRfXp0JEt7jZ2zbmTU9xJRh5pQI9ch7IdCvk272

  250.     #     a8oBZBtML2MIr4ZbdWXG6LYeCyfoAcDSHUiVIgGufFTuWTXnpzPQ6riX2VXBXNWw

  251.     #     xas1NE/SmOD7MZsztQNvpkwx6BkeJws+wfuRHOFEsgVLiqNhYQCwRLWM9oZcGn/V

  252.     #     2rEkr5szuYYTwkN5yeKnmIvgSwkqYqtpQKT1WQIDAQABAoIBAQCI39SP1UWuQ17P

  253.     #     Z8U+waKIHkRzFMDtCEmfbJL0TfJs7L4CKRDkY6JUbaL8lDLkD9fgdax340jja5VS

  254.     #     70/UNtRevxXVtJFfLsIazkgaqXo1+65/talZ06E0X5WHgCzWxSj7A2YYD3I9OszR

  255.     #     zfdr0Hq1akeA2N4AuwC2wVjhhyCg5Lg4xY0l+kRFLrPU4RctsjCAaveVIm3wmJVd

  256.     #     vmHO9hKcR3nxuIx0/cPYe20WgGSqbYJQburE1uXp26uz/Jek/u8FNFIEjWCWB+vj

  257.     #     eRQOcxngebyWCh0dyoxb3nL28Yty9O1MlLP2b0YMmep1ZfEFtwn4M2d8FdW1WCmJ

  258.     #     viOGFx4BAoGBAPTYSIpyxea1qaeNmT97e4YgPwV3rajhdPRYSQKyCsjKHk7Q/uxk

  259.     #     Phddo0ymiGKLCRAUwg9py900slY8mZKbdrVxXV4EEhngrWrr2gpfzxkEF1i0d4bS

  260.     #     2OuRCbkfE23glxqtVjvnTlrRANaXgk5mUQCL1YDUf+hrpEvF0pTbDRYpAoGBANwv

  261.     #     ffy+Sk+e0v+NlthhNHUDcXisIoW7b/DoT0H8DtbJV/QVexaGln7Ts6EgaH2NdpC+

  262.     #     dyLKa+l7oIeKgXeHm2Tgm879di/ChQCkoAHIUu5Nm0c5D2Vst26JrfCA7vZb9ddI

  263.     #     FMFt5bsDgRqFzTXFe0k9TEIBiF0Pp5xfHVwNWeuxAoGAGNY3xZOO77BN3WlHumDU

  264.     #     Tu7Gdc+GFjOIoaCzB0r4PRYDrQsWUPR6N/SPtB7Qhu6DpNX2OYoJ3A6UaJsNGQoc

  265.     #     KJuvVPIkw+s+rDHwlEzTvT3lAGKOHWcWCg9UZSr51ZOKwHIE5V65XA0HgL0twrYu

  266.     #     UVfd+IuVzgXdTLJsgh0WXsECgYApcgcU+/yg4BR3Zf9u2100aWGChWQ6J/36KsBA

  267.     #     e2GPrHaRyzlQFCVf2hmFysPgXjBjLnbeZZvKZyrgWIHmLfBiHKU3YR5N/x9p75Lu

  268.     #     wvZZROJllagAP2aHuAK1so9IcCbmTvsZLcaAXTh/9Y+a/4ElWBRymDdCzR+Pn5e3

  269.     #     LAwxAQKBgBHH42ri6pHbRptINzJ9sw3PhwewQZtGu3sfvrOknBs3togptCrjBWDF

  270.     #     eOGuFmjHO9vnhWs2yWQYETL1jt+CWgzRc4o4akB3qH5sXar5F7h06y16RFV9u6UJ

  271.     #     qaGqPFcy/l/5H6uNPLZt4Ufg3T0Mz0Az+Dti99KqVLKeqWQvXVc4

  272.     #     -----END RSA PRIVATE KEY-----

  273.     #

  274.     #   SSLCertificateChainFile_content: |

  275.     #     -----BEGIN CERTIFICATE-----

  276.     #     MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  277.     #     MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  278.     #     VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  279.     #     NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  280.     #     TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  281.     #     ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  282.     #     V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  283.     #     gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  284.     #     FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  285.     #     CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  286.     #     BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  287.     #     BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  288.     #     Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  289.     #     -----END CERTIFICATE-----

  290.     #     -----BEGIN CERTIFICATE-----

  291.     #     MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEwJDTjEL

  292.     #     MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMC

  293.     #     VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDTA1MDgx

  294.     #     NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQQHEwJD

  295.     #     TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbmcgWWFu

  296.     #     ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBewKE/B7j

  297.     #     V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAgMBAAGj

  298.     #     gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIwR4MHaA

  299.     #     FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMAkGA1UE

  300.     #     CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU4xFDAS

  301.     #     BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEE

  302.     #     BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/+HQX67aRfgZu7KWdI+Ju

  303.     #     Wm7DCfrPNGVwFWUQOmsPue9rZBgO

  304.     #     -----END CERTIFICATE-----

  305.     #

  306.     #   ProxyRequests: 'Off'

  307.     #   ProxyPreserveHost: 'On'

  308.     #

  309.     #   ProxyRoute:

  310.     #     example prod proxy route:

  311.     #       ProxyPassSource: '/'

  312.     #       ProxyPassTarget: 'http://prod.example.com:85/'

  313.     #       ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  314.     #       ProxyPassReverseSource: '/'

  315.     #       ProxyPassReverseTarget: 'http://prod.example.com:85/'

  316.     #

  317.     #     example webmail proxy route:

  318.     #       ProxyPassSource: '/webmail/'

  319.     #       ProxyPassTarget: 'http://mail.example.com/'

  320.     #       ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  321.     #       ProxyPassReverseSource: '/webmail/'

  322.     #       ProxyPassReverseTarget: 'http://mail.example.com/'

  323.     #

  324.     #     example service proxy route:

  325.     #       ProxyPassSource: '/svc/'

  326.     #       ProxyPassTarget: 'http://svc.example.com:92/'

  327.     #       ProxyPassTargetOptions: 'connectiontimeout=10 timeout=90'

  328.     #       ProxyPassReverseSource: '/svc/'

  329.     #       ProxyPassReverseTarget: 'http://svc.example.com:92/'

  330.     #

  331.     #   Location:

  332.     #     /:

  333.     #       Require: false

  334.     #       # Formula_Append: |

  335.     #       #   SecRuleRemoveById 981231

  336.     #       #   SecRuleRemoveById 981173

  337.     #

  338.     #     /error:

  339.     #       Require: 'all granted'

  340.     #

  341.     #     /docs:

  342.     #       Order: allow,deny     # For Apache < 2.4

  343.     #       Allow: from all       # For apache < 2.4

  344.     #       Require: all granted  # For apache > 2.4.

  345.     #       # Formula_Append: |

  346.     #       #   Additional config as a

  347.     #       #   multi-line string here

  348.     #

  349.     #   LocationMatch:

  350.     #     '^[.\\/]+([Ww][Ee][Bb][Mm][Aa][Ii][Ll])[.\\/]':

  351.     #       Require: false

  352.     #       Formula_Append: |

  353.     #         RequestHeader  set  Host  mail.example.com

  354.     #

  355.     #     '^[.\\/]+([Ss][Vv][Cc])[.\\/]':

  356.     #       Require: false

  357.     #       Formula_Append: |

  358.     #         Require ip 123.123.13.6 84.24.25.74

  359.     #

  360.     #   Proxy_control:

  361.     #     '*':

  362.     #       AllowAll: false

  363.     #       AllowCountry: false

  364.     #       #   - DE

  365.     #       AllowIP:

  366.     #         - 12.5.25.32

  367.     #         - 12.5.25.33

  368.     #

  369.     #   Alias:

  370.     #     /docs: /usr/share/docs

  371.     #

  372.     #   ScriptAlias:

  373.     #     /cgi-bin/: /var/www/cgi-bin/

  374. 

  375.         # Formula_Append: |

  376.         #   \#Additional config as a

  377.         #   \#multi-line string here

  378. 

  379.   # ``apache.debian_full`` formula additional configuration:

  380.   register-site:

  381.     # any name as an array index, and you can duplicate this section

  382.     unique_value_here:

  383.       name: 'myname'

  384.       path: 'salt://apache/files/myname.conf'

  385.       state: 'enabled'

  386.       # Optional - use managed file as Jinja Template

  387.       # template: true

  388.       # defaults:

  389.       #   custom_var: "default value"

  390. 

  391.   modules:

  392.     enabled:   # List modules to enable

  393.       - ssl

  394.       # - prefork

  395.       - rewrite

  396.       - proxy

  397.       - proxy_ajp

  398.       - proxy_html

  399.       - headers

  400.       # geoip

  401.       - status

  402.       # - logio

  403.       - dav

  404.       - dav_fs

  405.       - dav_lock

  406.       - auth_digest

  407.       - socache_shmcb

  408.       # - watchdog

  409.       - xml2enc

  410.       - ldap

  411.     disabled:  # List modules to disable

  412.       - geoip

  413. 

  414.   flags:

  415.     enabled:   # List server flags to enable

  416.       - SSL

  417.     disabled:  # List server flags to disable

  418.       - status

  419. 

  420.   # KeepAlive: Whether or not to allow persistent connections (more than

  421.   # one request per connection). Set to "Off" to deactivate.

  422.   keepalive: 'On'

  423. 

  424.   TimeOut: 60  # software default is 60 seconds

  425. 

  426.   security:

  427.     # can be Full | OS | Minimal | Minor | Major | Prod

  428.     # where Full conveys the most information, and Prod the least.

  429.     ServerTokens: Prod

  430. 

  431.   # [debian only] configure mod_ssl

  432.   ssl:

  433.     SSLCipherSuite: 'HIGH:!aNULL'

  434.     SSLHonorCipherOrder: 'Off'

  435.     SSLProtocol: 'all -SSLv3'

  436.     SSLUseStapling: 'Off'

  437.     SSLStaplingResponderTimeout: '5'

  438.     SSLStaplingReturnResponderErrors: 'Off'

  439.     SSLStaplingCache: 'shmcb:/var/run/ocsp(128000)'

  440. 

  441.   # ``apache.mod_remoteip`` formula additional configuration:

  442.   mod_remoteip:

  443.     RemoteIPHeader: X-Forwarded-For

  444.     RemoteIPTrustedProxy:

  445.       - 10.0.8.0/24

  446.       - 127.0.0.1

  447.     RemoteIPInternalProxy:

  448.       - 10.10.8.0/24

  449.       - 127.0.0.1

  450. 

  451.   # ``apache.mod_security`` formula additional configuration:

  452.   mod_security:

  453.     crs_install: false

  454.     # If not set, default distro's configuration is installed as is

  455.     manage_config: true

  456.     sec_rule_engine: 'On'

  457.     sec_request_body_access: 'On'

  458.     sec_request_body_limit: '14000000'

  459.     sec_request_body_no_files_limit: '114002'

  460.     sec_request_body_in_memory_limit: '114002'

  461.     sec_request_body_limit_action: 'Reject'

  462.     sec_pcre_match_limit: '15000'

  463.     sec_pcre_match_limit_recursion: '15000'

  464.     sec_debug_log_level: '3'

  465. 

  466.     rules:

  467.       # enabled: ~

  468.       modsecurity_crs_10_setup.conf:

  469.         rule_set: ''

  470.         enabled: true

  471.       modsecurity_crs_20_protocol_violations.conf:

  472.         rule_set: 'base_rules'

  473.         enabled: false

  474. 

  475.     custom_rule_files:

  476.       # any name as an array index, and you can duplicate this section

  477.       UNIQUE_VALUE_HERE:

  478.         file: 'myname'

  479.         # path/to/modsecurity/custom/file

  480.         path: 'salt://apache/files/dummy.conf'

  481.         enabled: false

  482. 

  483.   mod_ssl:

  484.     # set this to true if you want to override your distributions default TLS

  485.     # configuration

  486.     manage_tls_defaults: false

  487.     # This stuff is deliberately not configured via map.jinja resp.

  488.     # apache:lookup.  We're unable to know sane defaults for each release of

  489.     # every distribution.

  490.     # See https://github.com/saltstack-formulas/openssh-formula/issues/102 for

  491.     # a related discussion Have a look at bettercrypto.org for up-to-date

  492.     # settings.

  493.     # These are default values:

  494.     # yamllint disable-line rule:line-length

  495.     SSLCipherSuite: EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

  496.     # Mitigate the CRIME attack

  497.     SSLCompression: 'Off'

  498.     SSLProtocol: all -SSLv2 -SSLv3 -TLSv1

  499.     SSLHonorCipherOrder: 'On'

  500.     SSLOptions: "+StrictRequire"

  501.   server_status_require:

  502.     ip:

  503.       - 10.8.8.0/24

  504.     host:

  505.       - foo.example.com

  506. 

  507.   tofs:

  508.     # The files_switch key serves as a selector for alternative

  509.     # directories under the formula files directory. See TOFS pattern

  510.     # doc for more info.

  511.     # Note: Any value not evaluated by `config.get` will be used literally.

  512.     # This can be used to set custom paths, as many levels deep as required.

  513.     files_switch:

  514.       - any/path/can/be/used/here

  515.       - id

  516.       - roles

  517.       - osfinger

  518.       - os

  519.       - os_family

  520.     # All aspects of path/file resolution are customisable using the options below.

  521.     # This is unnecessary in most cases; there are sensible defaults.

  522.     # Default path: salt://< path_prefix >/< dirs.files >/< dirs.default >

  523.     #         I.e.: salt://apache/files/default

  524.     # path_prefix: template_alt

  525.     # dirs:

  526.     #   files: files_alt

  527.     #   default: default_alt

  528.     # The entries under `source_files` are prepended to the default source files

  529.     # given for the state

  530.     # source_files:

  531.     #   apache-config-file-file-managed:

  532.     #     - 'example_alt.tmpl'

  533.     #     - 'example_alt.tmpl.jinja'

  534. 

  535.     # For testing purposes

  536.     source_files:

  537.       apache-config-file-file-managed:

  538.         - 'example.tmpl.jinja'

  539.       apache-subcomponent-config-file-file-managed:

  540.         - 'subcomponent-example.tmpl.jinja'

  541. 

  542.   # Just for testing purposes

  543.   winner: pillar

  544.   added_in_pillar: pillar_value

  545. 

  546.   retry_option:

  547.     # https://docs.saltstack.com/en/latest/ref/states/requisites.html#retrying-states

  548.     attempts: 1

  549.     until: true

  550.     interval: 1

  551.     splay: 1