mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-06-27 23:57:02 +08:00
79 lines
2.4 KiB
Plaintext
79 lines
2.4 KiB
Plaintext
<VirtualHost *:80>
|
|
ServerName {{ site_name }}
|
|
{% if server_aliases %}
|
|
ServerAlias {{ server_aliases | join(" ") }}
|
|
{% endif %}
|
|
ServerAdmin {{ server_admin }}
|
|
TraceEnable Off
|
|
|
|
{% if gzip %}
|
|
SetOutputFilter DEFLATE
|
|
{% endif %}
|
|
|
|
{% if certbot %}
|
|
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
|
|
{% endif %}
|
|
|
|
{% if site_name == "fedoraproject.org" %}
|
|
Alias /static/hotspot.txt /srv/web/fedoraproject.org/static/hotspot.txt
|
|
{% endif %}
|
|
|
|
{% if sslonly %}
|
|
RewriteEngine On
|
|
RewriteCond %{REQUEST_URI} !/.well-known/acme-challenge/.*
|
|
RewriteCond %{REQUEST_URI} !/static/hotspot.txt
|
|
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [NE]
|
|
{% else %}
|
|
Include "conf.d/{{ site_name }}/*.conf"
|
|
{% endif %}
|
|
</VirtualHost>
|
|
|
|
{% if ssl %}
|
|
<VirtualHost *:443>
|
|
ServerName {{ site_name }}
|
|
{% if server_aliases %}
|
|
ServerAlias {{ server_aliases | join(" ") }}
|
|
{% endif %}
|
|
ServerAdmin {{ server_admin }}
|
|
|
|
{% if ansible_distribution == 'Fedora' and not inventory_hostname.startswith(('proxy01.phx2','proxy10.phx2')) and site_name != 'src.fedoraproject.org' %}
|
|
Protocols h2 http/1.1
|
|
{% else %}
|
|
# For proxy01/10 and src.fedoraproject.org we only do http/1.1 because h2 hits a curl bug downloading sources
|
|
# For builds with tons of source files like texlive.
|
|
Protocols http/1.1
|
|
{% endif %}
|
|
|
|
{% if gzip %}
|
|
SetOutputFilter DEFLATE
|
|
{% endif %}
|
|
|
|
SSLEngine on
|
|
{% if certbot %}
|
|
SSLCertificateFile /etc/pki/tls/certs/{{ site_name }}.cert
|
|
SSLCertificateKeyFile /etc/pki/tls/private/{{ site_name }}.key
|
|
SSLCertificateChainFile /etc/pki/tls/certs/{{ site_name }}.intermediate.cert
|
|
{% else %}
|
|
SSLCertificateFile /etc/pki/tls/certs/{{ cert_name }}.cert
|
|
SSLCertificateKeyFile /etc/pki/tls/private/{{ cert_name }}.key
|
|
{% if SSLCertificateChainFile %}
|
|
SSLCertificateChainFile /etc/pki/tls/certs/{{ SSLCertificateChainFile }}
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
SSLHonorCipherOrder On
|
|
|
|
# https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
|
|
# If you change the protocols or cipher suites, you should probably update
|
|
# modules/squid/files/squid.conf-el6 too, to keep it in sync.
|
|
SSLProtocol {{ ssl_protocols }}
|
|
SSLCipherSuite {{ ssl_ciphers }}
|
|
|
|
{% if sslonly %}
|
|
Header always add Strict-Transport-Security "max-age=31536000; {% if stssubdomains %}includeSubDomains; {% endif %}preload"
|
|
{% endif %}
|
|
Include "conf.d/{{ site_name }}/*.conf"
|
|
</VirtualHost>
|
|
{% endif %}
|
|
|