From 9fec0ce26bce4c4f4298a214cc44c362e75a44e1 Mon Sep 17 00:00:00 2001 From: Thom Date: Tue, 29 Mar 2022 14:58:01 +0000 Subject: [PATCH 1/2] Port apps vhost from install/ to server/ (#6321) --- server/conf/apache_apps.vhost.master | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/server/conf/apache_apps.vhost.master b/server/conf/apache_apps.vhost.master index 8d6df71b7d..6957ed5eb8 100644 --- a/server/conf/apache_apps.vhost.master +++ b/server/conf/apache_apps.vhost.master @@ -9,10 +9,12 @@ ServerAdmin webmaster@localhost {tmpl_var name='apps_vhost_servername'} - - - SetHandler None - + + + + SetHandler None + + # SSL Configuration SSLEngine On @@ -96,7 +98,7 @@ DocumentRoot {tmpl_var name='apps_vhost_dir'} SuexecUserGroup ispapps ispapps - Options +Indexes +FollowSymLinks +MultiViews +ExecCGI + Options -Indexes +FollowSymLinks +MultiViews +ExecCGI AllowOverride AuthConfig Indexes Limit Options FileInfo SetHandler fcgid-script @@ -109,6 +111,8 @@ Allow from all + IPCCommTimeout 7200 + MaxRequestLen 15728640 {tmpl_if name="use_rspamd"} -- GitLab From d76a5f15e848dacc4e4baff84ab01fa333bcdfe8 Mon Sep 17 00:00:00 2001 From: Thom Pol Date: Sun, 25 Sep 2022 21:25:36 +0200 Subject: [PATCH 2/2] Symlink apps vhost from install/ to file in server/ --- install/tpl/apache_apps.vhost.master | 135 +-------------------------- 1 file changed, 1 insertion(+), 134 deletions(-) mode change 100644 => 120000 install/tpl/apache_apps.vhost.master diff --git a/install/tpl/apache_apps.vhost.master b/install/tpl/apache_apps.vhost.master deleted file mode 100644 index 6957ed5eb8..0000000000 --- a/install/tpl/apache_apps.vhost.master +++ /dev/null @@ -1,134 +0,0 @@ -###################################################### -# This virtual host contains the configuration -# for the ISPConfig apps vhost -###################################################### - -{tmpl_var name='vhost_port_listen'} Listen {tmpl_var name='apps_vhost_port'} -# NameVirtualHost *:{tmpl_var name='apps_vhost_port'} - - - ServerAdmin webmaster@localhost - {tmpl_var name='apps_vhost_servername'} - - - - SetHandler None - - - - # SSL Configuration - SSLEngine On - - SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1 - - SSLProtocol All -SSLv2 -SSLv3 - - SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt - SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key - SSLCACertificateFile /usr/local/ispconfig/interface/ssl/ispserver.bundle - - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 - SSLHonorCipherOrder On - - SSLCompression Off - - - SSLSessionTickets Off - - - - # ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval - Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'" - Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests" - Header set X-Content-Type-Options: nosniff - Header set X-Frame-Options: SAMEORIGIN - Header set X-XSS-Protection: "1; mode=block" - Header always edit Set-Cookie (.*) "$1; HTTPOnly" - Header always edit Set-Cookie (.*) "$1; Secure" - = 2.4.7> - Header setifempty Strict-Transport-Security "max-age=15768000" - - - Header set Strict-Transport-Security "max-age=15768000" - - RequestHeader unset Proxy early - - - - SSLUseStapling On - SSLStaplingResponderTimeout 5 - SSLStaplingReturnResponderErrors Off - - - - RequestHeader unset Proxy early - - - - DocumentRoot {tmpl_var name='apps_vhost_dir'} - AddType application/x-httpd-php .php - - Options FollowSymLinks - AllowOverride None - - Require all granted - - Order allow,deny - Allow from all - - - - - - DocumentRoot {tmpl_var name='apps_vhost_dir'} - AddType application/x-httpd-php .php - - Options FollowSymLinks - AllowOverride None - - Require all granted - - Order allow,deny - Allow from all - - - - - - DocumentRoot {tmpl_var name='apps_vhost_dir'} - SuexecUserGroup ispapps ispapps - - Options -Indexes +FollowSymLinks +MultiViews +ExecCGI - AllowOverride AuthConfig Indexes Limit Options FileInfo - - SetHandler fcgid-script - - FCGIWrapper {tmpl_var name='apps_vhost_basedir'}/php-fcgi-scripts/apps/.php-fcgi-starter .php - - Require all granted - - Order allow,deny - Allow from all - - - IPCCommTimeout 7200 - MaxRequestLen 15728640 - - -{tmpl_if name="use_rspamd"} - - Order allow,deny - Allow from all - - RewriteEngine On - RewriteRule ^/rspamd$ /rspamd/ [R,L] - RewriteRule ^/rspamd/(.*) http://127.0.0.1:11334/$1 [P] -{/tmpl_if} - - - - - - SSLStaplingCache shmcb:/var/run/ocsp(128000) - - diff --git a/install/tpl/apache_apps.vhost.master b/install/tpl/apache_apps.vhost.master new file mode 120000 index 0000000000..a2fefe5c92 --- /dev/null +++ b/install/tpl/apache_apps.vhost.master @@ -0,0 +1 @@ +server/conf/apache_apps.vhost.master \ No newline at end of file -- GitLab