puppet-mediawiki/templates/apache/mediawiki.erb
Timothy Chavez 2a68660f4b Use the SSLProtocol blacklist approach
It turns out that specifying the ciphers we want to use leads to
breakage.  So instead we'll explicitly tell Apache which ciphers
we don't want to use.

Change-Id: I0f8211533495a6a4340c01dadb8069ccf9be429c
2014-10-16 11:41:04 -05:00

118 lines
4.3 KiB
Plaintext

#####################################################################
### THIS FILE IS MANAGED BY PUPPET
### puppet:///files/apache/sites/labconsole.wikimedia.org
#####################################################################
# vim: filetype=apache
<VirtualHost *:80>
ServerAdmin noc@openstack.org
ServerName <%= scope.lookupvar("mediawiki::site_hostname") %>
DocumentRoot /var/www
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(.*)$ https://<%= scope.lookupvar("mediawiki::site_hostname") %>/$1 [L,R]
ErrorLog /var/log/apache2/mediawiki-error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog /var/log/apache2/mediawiki-access.log combined
ServerSignature Off
</VirtualHost>
<VirtualHost *:443>
ServerAdmin noc@openstack.org
ServerName <%= scope.lookupvar("mediawiki::site_hostname") %>
SSLEngine on
SSLProtocol All -SSLv2 -SSLv3
SSLCertificateFile <%= scope.lookupvar("mediawiki::ssl_cert_file") %>
SSLCertificateKeyFile <%= scope.lookupvar("mediawiki::ssl_key_file") %>
<% if scope.lookupvar("mediawiki::ssl_chain_file") != "" %>
SSLCertificateChainFile <%= scope.lookupvar("mediawiki::ssl_chain_file") %>
<% end %>
RedirectMatch ^/$ http://<%= scope.lookupvar("mediawiki::site_hostname") %>/wiki/
DocumentRoot /var/www
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
<Directory "<%= scope.lookupvar('mediawiki::mediawiki_images_location') %>">
# Ignore .htaccess files
AllowOverride None
# Serve HTML as plaintext, don't execute SHTML
AddType text/plain .html .htm .shtml .php
# Don't run arbitrary PHP code.
php_admin_flag engine off
</Directory>
<IfModule mod_expires.c>
ExpiresActive On
<Directory "<%= scope.lookupvar('mediawiki::mediawiki_location') %>">
<FilesMatch "\.(gif|jpe?g|png|css|js|woff|svg|eot|ttf)$">
ExpiresByType image/gif A2592000
ExpiresByType image/png A2592000
ExpiresByType image/jpeg A2592000
ExpiresByType text/css A2592000
ExpiresByType text/javascript A2592000
ExpiresByType application/x-javascript A2592000
ExpiresByType application/x-font-woff A2592000
ExpiresByType image/svg+xml A2592000
ExpiresByType application/vnd.ms-fontobject A2592000
ExpiresByType application/x-font-ttf A2592000
## I think it's likely dangerous to enable this for the entire domain.
## I'm nearly positive we only need to do so for the WebFonts.
## For now I'm going to keep this disabled.
#Header add Access-Control-Allow-Origin "*"
</FilesMatch>
</Directory>
</IfModule>
AddType application/x-font-woff .woff
AddType application/vnd.ms-fontobject .eot
# TTF doesn't have an official MIME type, but I really don't want to use application/octet-stream for it
AddType application/x-font-ttf .ttf
Alias /w/images <%= scope.lookupvar('mediawiki::mediawiki_images_location') %>
Alias /w <%= scope.lookupvar('mediawiki::mediawiki_location') %>
Alias /wiki <%= scope.lookupvar('mediawiki::mediawiki_location') %>/index.php
# Redirect old /Article_Name urls
RewriteEngine on
RewriteCond %{REQUEST_URI} !^/w/
RewriteCond %{REQUEST_URI} !^/wiki/
RewriteRule ^/(.*)$ https://<%= scope.lookupvar("mediawiki::site_hostname") %>/wiki/$1 [L,R]
ErrorLog /var/log/apache2/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog /var/log/apache2/access.log combined
ServerSignature Off
</VirtualHost>