087fbd7dd7
In switching to all-HTTPS for Mailman sites, it was missed that only the plain HTTP vhosts set a DocumentRoot of /var/www. This was only used for publishing metadata so went unnoticed until now. Rather than add a DocumentRoot to the new HTTPS vhosts, simply use Aliases to map the specific files we want to expose, for improved clarity and to make it less likely they'll be overlooked in configuration in the future. In order to make sure the archives.yaml file exists at server creation, before its cronjob fires for the first time, add a direct invocation of the script which builds it. Move all tasks related to this after the tasks which create the mailing lists, so that the generated file will include them. This also simplifies testing. For the non-multihost configuration, only robots.txt is expected to be present, so don't add an alias for archives.yaml there. Also add regression tests to ensure we keep these working. Change-Id: I6b54b0386f0ea9f888c1f23580ad8698314474b9
68 lines
2.6 KiB
Django/Jinja
68 lines
2.6 KiB
Django/Jinja
<VirtualHost *:80>
|
|
ServerName {{ mailman_site.listdomain }}
|
|
|
|
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_site.listdomain }}-error.log
|
|
|
|
# Possible values include: debug, info, notice, warn, error, crit,
|
|
# alert, emerg.
|
|
LogLevel warn
|
|
|
|
CustomLog ${APACHE_LOG_DIR}/{{ mailman_site.listdomain }}-access.log combined
|
|
|
|
RedirectPermanent / https://{{ mailman_site.listdomain }}/
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:443>
|
|
ServerName {{ mailman_site.listdomain }}
|
|
ServerAdmin webmaster@openstack.org
|
|
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_site.listdomain }}-ssl-error.log
|
|
LogLevel warn
|
|
CustomLog ${APACHE_LOG_DIR}/{{ mailman_site.listdomain }}-ssl-access.log combined
|
|
|
|
SSLEngine on
|
|
SSLProtocol All -SSLv2 -SSLv3
|
|
# Note: this list should ensure ciphers that provide forward secrecy
|
|
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
|
|
SSLHonorCipherOrder on
|
|
|
|
SSLCertificateFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.cer
|
|
SSLCertificateKeyFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
|
|
SSLCertificateChainFile /etc/letsencrypt-certs/{{ inventory_hostname }}/ca.cer
|
|
|
|
RewriteEngine on
|
|
RewriteRule ^/$ /cgi-bin/mailman/listinfo [R]
|
|
RewriteCond %{HTTP_HOST} ^lists\.openstack\.org$ [nocase]
|
|
RewriteRule /(cgi-bin/mailman/listinfo|pipermail)/(community|foundation|foundation-board|foundation-board-confidential|goldmembers|marketing|staff|summitsponsors)(/.*|$) %{REQUEST_SCHEME}://lists.openinfra.dev/$1/$2$3 [last,redirect=permanent]
|
|
RewriteCond %{HTTP_HOST} ^lists\.openstack\.org$ [nocase]
|
|
RewriteRule /(cgi-bin/mailman/listinfo|pipermail)/(edge-computing)(/.*|$) %{REQUEST_SCHEME}://lists.opendev.org/$1/$2$3 [last,redirect=permanent]
|
|
|
|
ScriptAlias /cgi-bin/mailman/ /usr/lib/cgi-bin/mailman/
|
|
Alias /pipermail/ /srv/mailman/{{ mailman_site.name }}/archives/public/
|
|
Alias /images/mailman/ /usr/share/images/mailman/
|
|
Alias /archives.yaml /var/www/archives.yaml
|
|
Alias /robots.txt /var/www/robots.txt
|
|
|
|
<Directory /usr/lib/cgi-bin/mailman/>
|
|
AllowOverride None
|
|
Options ExecCGI
|
|
AddHandler cgi-script .cgi
|
|
SetEnv HOST {{ mailman_site.listdomain }}
|
|
Order allow,deny
|
|
Allow from all
|
|
Require all granted
|
|
</Directory>
|
|
<Directory /srv/mailman/{{ mailman_site.name }}/archives/public/>
|
|
Options FollowSymlinks
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
Require all granted
|
|
</Directory>
|
|
<Directory /usr/share/images/mailman/>
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
Require all granted
|
|
</Directory>
|
|
</VirtualHost>
|