Skip to content
Snippets Groups Projects
Select Git revision
  • main default
1 result
Blame Permalink
vhost.conf 5.79 KiB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156 






<VirtualHost *:80>
  Include /etc/apache2/{{ apache_conf_dir }}/global-redirect.conf

{% if nextcloud.protocol|default("https") == "https" and groups.proxyserver is not defined %}
  ServerAdmin {{ apache_server_admin }}
  ServerName  {{ nextcloud.domain }}
  ServerAlias {{ nextcloud.domain }}{% for alias in nextcloud.aliases|default([]) %} {{ alias }}{% endfor %}

  Include /etc/apache2/{{ apache_conf_dir }}/redirect-ssl.conf
  Include /etc/apache2/{{ apache_conf_dir }}/letsencrypt-redirect.conf

  SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
  LogLevel warn
{% if apache_version|default('2.4') == '2.4' %}
  ErrorLogFormat "[%{u}t] [%l] [pid %P] [client\ %{X-Forwarded-For}i] %M% ,\ referer:\ %{Referer}i"
{% endif %}
  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
  ErrorLog {{ apacheLogDir }}/{{ nextcloud.domain }}-error.log
  CustomLog {{ apacheLogDir }}/{{ nextcloud.domain }}-access.log combined env=!forwarded
  CustomLog {{ apacheLogDir }}/{{ nextcloud.domain }}-access.log proxy env=forwarded
</VirtualHost>

<VirtualHost *:443>
  Include /etc/apache2/{{ apache_conf_dir }}/global-redirect.conf

{% endif %}
  ServerAdmin {{ apache_server_admin }}
  ServerName  {{ nextcloud.domain }}
  ServerAlias {{ nextcloud.domain }}{% for alias in nextcloud.aliases|default([]) %} {{ alias }}{% endfor %}

  Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
  Header set Referrer-Policy "no-referrer"
{% for header in nextcloud.headers|default([]) %}
  Header set {{ header }}
{% endfor %}

{% if nextcloud.protocol|default("https") == "https" and groups.proxyserver is defined %}
  SetEnv HTTP_X_FORWARDED_HOST {{ nextcloud.domain }}
  SetEnv HTTPS on
  SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0
{% endif %}

{% if nextcloud.jail is defined and not php_fpm_socket|default(false) %}
  <LocationMatch "/fpm-status">
    Include /etc/apache2/{{ apache_conf_dir }}/global-deny.conf
    ProxyPass fcgi://127.0.0.1:{{ nextcloud.jail.port }}
  </LocationMatch>
  <FilesMatch \.php$>
    SetHandler "proxy:fcgi://127.0.0.1:{{ nextcloud.jail.port }}"
  </FilesMatch>
{% endif %}

  DocumentRoot {{ webRoot }}
  <Directory {{ webRoot }}/>
    Options +ExecCGI +Indexes +FollowSymLinks +MultiViews
    AllowOverride All
{% if nextcloud.apache_auth is defined and nextcloud.apache_auth.active|default(true) %}
    AuthType {{ nextcloud.apache_auth.type }}
    AuthName "{{ nextcloud.apache_auth.name }}"
    AuthUserFile {{ dataRoot }}/passwords/{{ nextcloud.apache_auth.user }}
    Require user {{ nextcloud.apache_auth.user }}
{% else %}
{% if apache_version|default('2.4') == '2.2' %}
    Order allow,deny
    allow from all
{% else %}
    Include /etc/apache2/{{ apache_conf_dir }}/global-deny.conf
{% endif %}
{% endif %}
  </Directory>
  <Directory {{ webRoot }}/.git/>
    Require all denied
  </Directory>

{% if nextcloud.spreed is defined %}
  <Location /webrtc>
    ProxyPass http://127.0.0.1:8080/webrtc
    ProxyPassReverse /webrtc
  </Location>
  <Location /webrtc/ws>
    ProxyPass ws://127.0.0.1:8080/webrtc/ws
  </Location>
  ProxyVia On
  ProxyPreserveHost On
  RequestHeader set X-Forwarded-Proto 'https' env=HTTPS
{% endif %}

  SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
  LogLevel warn
{% if apache_version|default('2.4') == '2.4' %}
  ErrorLogFormat "[%{u}t] [%l] [pid %P] [client\ %{X-Forwarded-For}i] %M% ,\ referer:\ %{Referer}i"
{% endif %}
  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
  ErrorLog {{ apacheLogDir }}/{{ nextcloud.domain }}-error.log
  CustomLog {{ apacheLogDir }}/{{ nextcloud.domain }}-access.log combined env=!forwarded
  CustomLog {{ apacheLogDir }}/{{ nextcloud.domain }}-access.log proxy env=forwarded

  <IfModule mod_expires.c>
    ExpiresActive {% if apache_cache.active %}On{% else %}Off{% endif %}

    ExpiresDefault {{ apache_cache.default }}
{% for type in apache_cache.bytype %}
    ExpiresByType {{ type.type }} {{ type.default }}
{% endfor %}
  </IfModule>

  SetEnvIf X-Forwarded-Proto https HTTPS=on

  BrowserMatch "MSIE [2-6]" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
  # MSIE 7 and newer should be able to use keepalive
  BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

{% if nextcloud.protocol|default("https") == "https" and groups.proxyserver is not defined %}
  Include /etc/apache2/{{ apache_conf_dir }}/options-ssl-apache.conf
{% if nextcloud.letsencrypt|default(true) %}
  SSLCertificateFile /etc/letsencrypt/live/{{ nextcloud.domain }}/cert.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/{{ nextcloud.domain }}/privkey.pem
  SSLCertificateChainFile /etc/letsencrypt/live/{{ nextcloud.domain }}/chain.pem
{% else %}
{% for certs in apache_certificates|default([]) %}
{% if certs.domain == nextcloud.domain %}
{% for cert in certs.certs %}
  {{cert.type}} /etc/ssl/private/{{cert.file}}
{% endfor %}
{% for alias in certs.aliases|default([]) %}
</VirtualHost>

<VirtualHost *:443>
  Include /etc/apache2/{{ apache_conf_dir }}/global-redirect.conf

  ServerName {{ alias }}
  Redirect 301 / https://{{ certs.domain }}/

  SSLEngine on
{% for cert in certs.certs %}
  {{cert.type}} /etc/ssl/private/{{cert.file}}
{% endfor %}

  SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
  LogLevel warn
{% if apache_version|default('2.4') == '2.4' %}
  ErrorLogFormat "[%{u}t] [%l] [pid %P] [client\ %{X-Forwarded-For}i] %M% ,\ referer:\ %{Referer}i"
{% endif %}
  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
  ErrorLog {{ apacheLogDir }}/{{ certs.domain }}-error.log
  CustomLog {{ apacheLogDir }}/{{ certs.domain }}-access.log combined env=!forwarded
  CustomLog {{ apacheLogDir }}/{{ certs.domain }}-access.log proxy env=forwarded
{% endfor %}
{% endif %}
{% endfor %}
{% endif %}
{% endif %}
</VirtualHost>