45feb7621d
Because the bulk of this traffic originates with our load balancer we need to use port info to differentiate between actual source clients in the load balancer logs. That info is currently missing so add it in. Change-Id: I737e6373c09669f0321b656ecd4b137b94be38a4
34 lines
1.1 KiB
Django/Jinja
34 lines
1.1 KiB
Django/Jinja
Listen 3081
|
|
|
|
<VirtualHost *:3081>
|
|
ServerName {{ inventory_hostname }}
|
|
ServerAdmin infra-root@opendev.org
|
|
|
|
AllowEncodedSlashes On
|
|
|
|
ErrorLog ${APACHE_LOG_DIR}/gitea-ssl-error.log
|
|
|
|
LogLevel warn
|
|
|
|
LogFormat "%h:%{remote}p %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combinedport
|
|
CustomLog ${APACHE_LOG_DIR}/gitea-ssl-access.log combinedport
|
|
|
|
SSLEngine on
|
|
SSLProtocol All -SSLv2 -SSLv3
|
|
# Note: this list should ensure ciphers that provide forward secrecy
|
|
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
|
|
SSLHonorCipherOrder on
|
|
|
|
SSLCertificateFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.cer
|
|
SSLCertificateKeyFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
|
|
SSLCertificateChainFile /etc/letsencrypt-certs/{{ inventory_hostname }}/ca.cer
|
|
|
|
SSLProxyEngine on
|
|
|
|
Use UserAgentFilter
|
|
|
|
ProxyPass / https://{{ gitea_reverse_proxy_hostname }}:3000/ retry=0
|
|
ProxyPassReverse / https://{{ gitea_reverse_proxy_hostname }}:3000/
|
|
|
|
</VirtualHost>
|