ServerName {{ gerrit_vhost_name }} ServerAdmin webmaster@openstack.org ErrorLog ${APACHE_LOG_DIR}/gerrit-error.log LogLevel warn CustomLog ${APACHE_LOG_DIR}/gerrit-access.log combined Redirect / https://{{ gerrit_vhost_name }}/ ServerName {{ gerrit_vhost_name }} ServerAdmin webmaster@openstack.org AllowEncodedSlashes On ErrorLog ${APACHE_LOG_DIR}/gerrit-ssl-error.log LogLevel warn CustomLog ${APACHE_LOG_DIR}/gerrit-ssl-access.log combined SSLEngine on SSLProtocol All -SSLv2 -SSLv3 # Note: this list should ensure ciphers that provide forward secrecy SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP SSLHonorCipherOrder on SSLCertificateFile /etc/letsencrypt-certs/{{ gerrit_vhost_name }}/{{ gerrit_vhost_name }}.cer SSLCertificateKeyFile /etc/letsencrypt-certs/{{ gerrit_vhost_name }}/{{ gerrit_vhost_name }}.key SSLCertificateChainFile /etc/letsencrypt-certs/{{ gerrit_vhost_name }}/ca.cer SSLOptions +StdEnvVars SSLOptions +StdEnvVars BrowserMatch "MSIE [2-6]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 # MSIE 7 and newer should be able to use keepalive BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown RewriteEngine on ProxyRequests off ProxyVia off ProxyPreserveHost on ProxyStatus On ProxyPassMatch ^/p/ ! ProxyPassMatch ^/robots.txt$ ! ProxyPassMatch ^/server-status ! ProxyPass / http://localhost:8081/ nocanon ProxyPassReverse / http://localhost:8081/ Alias /robots.txt /home/gerrit2/review_site/static/robots.txt SetEnv GIT_PROJECT_ROOT /opt/lib/git SetEnv GIT_HTTP_EXPORT_ALL AliasMatch ^/p/(.*/objects/[0-9a-f]{2}/[0-9a-f]{38})$ /opt/lib/git/$1 AliasMatch ^/p/(.*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$ /opt/lib/git/$1 ScriptAlias /p/ /usr/lib/git-core/git-http-backend/ Require all granted Order allow,deny Allow from all Require all granted Allow from all Satisfy Any Require all granted Allow from all Satisfy Any