libretic/ansible-role-reverse_proxy
7
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
ansible-role-reverse_proxy/templates/custom_reverse_proxy.conf

394 lines
11 KiB
Text
Raw Normal View History

commit initial
2022-03-02 00:41:53 +01:00
# {{ ansible_managed }}
BufferedLogs Off
TraceEnable Off
Timeout 300
KeepAlive On
MaxKeepAliveRequests 512
KeepAliveTimeout 15
# Configuration MPM Event
ServerLimit 64
ThreadsPerChild 32
AsyncRequestWorkerFactor 2
MaxRequestWorkers 2048
MaxRequestsPerChild 16384
GracefulShutdownTimeout 2
# Supprime les informations version
ServerTokens ProductOnly
ServerSignature Off
SecServerSignature ";-)"
# Configuration headers
Header unset X-Powered-By
Header unset X-AspNet-Version
Header unset Server
Header set X-Frame-Options SAMEORIGIN
Header set X-XSS-Protection 1;mode=block
Header set X-Content-Type-Options nosniff
Header set Strict-Transport-Security "max-age=16070400"
Corrections sur configuration par défaut du traitement des requêtes par modsecurity
2022-06-10 10:11:22 +02:00
# Configuration Modsecurity par défaut pour l'analyse des requêtes
SecResponseBodyAccess Off
Alignement des valeurs SecRequestBodyLimit
2024-07-02 10:17:54 +02:00
SecRequestBodyLimit 104857600
Corrections sur configuration par défaut du traitement des requêtes par modsecurity
2022-06-10 10:11:22 +02:00
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction ProcessPartial
commit initial
2022-03-02 00:41:53 +01:00
# Macros
Ajout d'une macro empty permettant de désactiver certaines configurations automatiques
2022-05-19 11:24:24 +02:00
<Macro Empty>
</Macro>
commit initial
2022-03-02 00:41:53 +01:00
<Macro OpenAccessPolicy>
Require all granted
</Macro>
<Macro InternalAccessPolicy>
Require ip 10.0.0.0/8
Require ip 172.16.0.0/12
Require ip 192.168.0.0/16
</Macro>
<Macro LDAPUserAccessPolicy>
ldap admins
2022-03-13 00:07:26 +01:00
Authname "Acces reserve aux utilisateurs disposant d'un compte valide (annuaire)"
commit initial
2022-03-02 00:41:53 +01:00
Authtype Basic
AuthBasicProvider ldap
AuthLDAPBindAuthoritative on
ldap admins
2022-03-13 00:07:26 +01:00
AuthLDAPBindDN {{ reverse_proxy_ldap_bind_dn }}
AuthLDAPBindPassword {{ reverse_proxy_ldap_bind_password }}
commit initial
2022-03-02 00:41:53 +01:00
AuthLDAPUrl ldap://{{ reverse_proxy_ldap_srv }}/{{ reverse_proxy_ldap_basedn }}?{{ reverse_proxy_ldap_userdn }}
Require valid-user
</Macro>
<Macro LDAPAdminAccessPolicy>
ldap admins
2022-03-13 00:07:26 +01:00
Authname "Acces reserve aux administrateurs (annuaire)"
commit initial
2022-03-02 00:41:53 +01:00
Authtype Basic
AuthBasicProvider ldap
AuthLDAPBindAuthoritative on
ldap admins
2022-03-13 00:07:26 +01:00
AuthLDAPBindDN {{ reverse_proxy_ldap_bind_dn }}
AuthLDAPBindPassword {{ reverse_proxy_ldap_bind_password }}
commit initial
2022-03-02 00:41:53 +01:00
AuthLDAPUrl ldap://{{ reverse_proxy_ldap_srv }}/{{ reverse_proxy_ldap_basedn }}?{{ reverse_proxy_ldap_userdn }}
Require valid-user
Require ldap-user {{ reverse_proxy_ldap_admins }}
</Macro>
<Macro BlockCrawlerIndexing>
Header set X-Robots-Tag "noindex, nofollow"
ProxyPass /robots.txt !
RewriteEngine On
RewriteRule ^/robots\.txt$ /rp_ressources/robots_disabled.txt [L]
</Macro>
<Macro AllowCrawlerIndexing>
Header set X-Robots-Tag "all"
ProxyPass /robots.txt !
RewriteEngine On
RewriteRule ^/robots\.txt$ /rp_ressources/robots_enabled.txt [L]
</Macro>
<Macro ErrorDocumentPages>
ProxyErrorOverride On
ErrorDocument 400 /rp_ressources/400.html
ErrorDocument 401 /rp_ressources/401.html
ErrorDocument 403 /rp_ressources/403.html
ErrorDocument 404 /rp_ressources/404.html
ErrorDocument 500 /rp_ressources/500.html
ErrorDocument 502 /rp_ressources/502.html
ErrorDocument 503 /rp_ressources/503.html
ErrorDocument 504 /rp_ressources/504.html
ErrorDocument {{ reverse_proxy_http_modsecurity_error_code }} /rp_ressources/{{ reverse_proxy_http_modsecurity_error_code }}.html
</Macro>
changement macro checkmaintenance
2022-03-02 14:08:21 +01:00
<Macro CheckMaintenancePage $vhostFQDN>
commit initial
2022-03-02 00:41:53 +01:00
RewriteEngine On
<Location "/rp_maintenance/auth/">
Use LDAPAdminAccessPolicy
</Location>
# Si on est en maintenance
corrections pages maintenance
2022-03-13 13:56:03 +01:00
<If "-f %{DOCUMENT_ROOT} . '/rp_maintenance/$vhostFQDN.html'">
commit initial
2022-03-02 00:41:53 +01:00
RewriteCond %{REMOTE_ADDR} !127.0.0.1
RewriteCond %{REQUEST_URI} !^/rp_ressources/*
RewriteCond %{REQUEST_URI} !^/rp_maintenance/*
RewriteCond %{HTTP_COOKIE} !rp_acces_maintenance=([^;]+)
corrections pages maintenance
2022-03-13 13:56:03 +01:00
RewriteRule ^.*$ %{DOCUMENT_ROOT}/rp_maintenance/$vhostFQDN.html
commit initial
2022-03-02 00:41:53 +01:00
Header Set Cache-Control "no-store"
</If>
</Macro>
factorisation macros
2022-03-03 22:03:13 +01:00
# Configuration de la fonction reverse proxy
<Macro ProxyCommon $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf>
# Definition du virtualhost
ServerName $vhostFQDN
DocumentRoot "/var/www/html"
# Niveau de log souhaite
LogLevel $logPolicy
ErrorLog ${APACHE_LOG_DIR}/$vhostFQDN-error.log
CustomLog ${APACHE_LOG_DIR}/$vhostFQDN-access.log combined
# Politique vis a vis des moteurs de recherche
Use $indexingConf
# Configuration de l'accessibilite du virtualhost (public, interne, restreint)
<Location />
Use $accessPolicy
</Location>
Corrections adresses mail
2022-03-21 14:29:38 +01:00
# On autorise quand même l'accès a .well-known pour letsencrypt
<Location /.well-known>
Use OpenAccessPolicy
</Location>
factorisation macros
2022-03-03 22:03:13 +01:00
ProxyRequests Off
ProxyVia Off
ProxyPreserveHost On
ProxyPass /rp_ressources !
ProxyPass /rp_maintenance !
ProxyPass /balancer-manager !
ProxyPass / $protoDest://$urlDest/
ProxyPassReverse / $protoDest://$vhostFQDN/
# Configuration du chemin vers la page de status du load balancer
<Location "/balancer-manager">
SecRuleEngine off
SetHandler balancer-manager
ldap admins
2022-03-13 00:07:26 +01:00
Use InternalAccessPolicy
factorisation macros
2022-03-03 22:03:13 +01:00
</Location>
# Configuration du chemin vers les ressources reverse proxy
<Location "/rp_ressources">
SecRuleEngine off
Use OpenAccessPolicy
</Location>
# Definition des pages d'erreur
Use ErrorDocumentPages
# Gestion de la page de maintenance
Use CheckMaintenancePage $vhostFQDN
</Macro>
commit initial
2022-03-02 00:41:53 +01:00
# Redirige un domaine http vers https
<Macro vhost_redirect_http-https $domain>
<VirtualHost *:80>
ServerName $domain
Redirect permanent / https://$domain/
</VirtualHost>
</Macro>
# Redirige un domaine http vers n'importe qu'elle autre adresse http où https
<Macro vhost_redirect_http_generic $domainSource $domainDest $accessPolicy>
<VirtualHost *:80>
ServerName $domainSource
Redirect permanent / $domainDest/
#Restriction configuration
<Location />
Use $accessPolicy
Use ErrorDocumentPages
</Location>
</VirtualHost>
</Macro>
<Macro vhost_HTTPS_Generic $vhostFQDN $cert $protoDest $urlDest $logPolicy $accessPolicy $indexingConf $modsecurityStatus>
Use vhost_redirect_http-https $vhostFQDN
<Perl>
if ( $cert eq "LE" )
{
print "------- Utilisation d'un certificat LetsEncrypt pour $vhostFQDN -------\n";
$MDomain{"$vhostFQDN"} = {
MDCertificateAgreement => 'accepted',
MDContactEmail => '{{ reverse_proxy_default_serveradmin_email }}',
MDStapling => 'on',
};
}
</Perl>
<VirtualHost *:443>
<Perl>
$ENV{'PERL_CONF_DEBUG'} and print "------- Generation du vhosts $vhostFQDN -------\n";
</Perl>
factorisation macros
2022-03-03 22:03:13 +01:00
Use ProxyCommon $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf
commit initial
2022-03-02 00:41:53 +01:00
SSLEngine on
# Inclusion de la configuration additionnelle
<Perl>
my $dir=$ENV{"$vhostFQDN"};
my $config_file="$dir/1_vhost_additional.conf";
if( -f $config_file)
{
$ENV{'PERL_CONF_DEBUG'} and print "Inclusion du fichier '$config_file'\n";
push @Include, "$config_file";
}
</Perl>
<If "'$protoDest' == 'http'">
RequestHeader set X-Forwarded-Proto "https"
</If>
# Gestion mod_security et inclusion des exceptions
<IfModule mod_security2.c>
SecRuleEngine $modsecurityStatus
<Perl>
my $dir=$ENV{"$vhostFQDN"};
my $config_file="$dir/2_mds_exclusion.conf";
if( -f $config_file)
{
$ENV{'PERL_CONF_DEBUG'} and print "Inclusion du fichier '$config_file'\n";
push @Include, "$config_file";
}
</Perl>
</IfModule>
<Perl>
$ENV{'PERL_CONF_DEBUG'} and print "----------------------------------------------\n";
</Perl>
</VirtualHost>
</Macro>
<Macro vhost_HTTP_Generic $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf $modsecurityStatus>
<VirtualHost *:80>
<Perl>
$ENV{'PERL_CONF_DEBUG'} and print "------- Generation du vhosts $vhostFQDN -------\n";
</Perl>
factorisation macros
2022-03-03 22:03:13 +01:00
Use ProxyCommon $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf
commit initial
2022-03-02 00:41:53 +01:00
# Inclusion de la configuration additionnelle
<Perl>
my $dir=$ENV{"$vhostFQDN"};
my $config_file="$dir/1_vhost_additional.conf";
if( -f $config_file)
{
$ENV{'PERL_CONF_DEBUG'} and print "Inclusion du fichier '$config_file'\n";
push @Include, "$config_file";
}
</Perl>
<If "'$protoDest' == 'https'">
RequestHeader set X-Forwarded-Proto "http"
</If>
# Gestion mod_security et inclusion des exceptions
<IfModule mod_security2.c>
SecRuleEngine $modsecurityStatus
<Perl>
my $dir=$ENV{"$vhostFQDN"};
my $config_file="$dir/2_mds_exclusion.conf";
if( -f $config_file)
{
$ENV{'PERL_CONF_DEBUG'} and print "Inclusion du fichier '$config_file'\n";
push @Include, "$config_file";
}
</Perl>
</IfModule>
<Perl>
$ENV{'PERL_CONF_DEBUG'} and print "----------------------------------------------\n";
</Perl>
</VirtualHost>
</Macro>
# Virtualhosts techniques
# Fait en sorte que si fqdn demandé ne correspond a aucun connu apache ne serve pas le 1er
<VirtualHost *:80>
Personnalisation
2022-04-21 20:56:52 +02:00
Redirect / https://www.libretic.fr/error
commit initial
2022-03-02 00:41:53 +01:00
</VirtualHost>
# Permet l'acces a des pages d'info apache
ExtendedStatus on
Listen 9090 http
<VirtualHost *:9090>
ServerName localhost
DocumentRoot /var/www/html/
<Location /server-info>
SetHandler server-info
ldap admins
2022-03-13 00:07:26 +01:00
Use InternalAccessPolicy
commit initial
2022-03-02 00:41:53 +01:00
Require host localhost
</Location>
<Location /status>
SetHandler server-status
ldap admins
2022-03-13 00:07:26 +01:00
Use InternalAccessPolicy
commit initial
2022-03-02 00:41:53 +01:00
Require host localhost
</Location>
LogLevel info
ErrorLog ${APACHE_LOG_DIR}/monitoring-page-error.log
CustomLog ${APACHE_LOG_DIR}/monitoring-page-access.log combined
</VirtualHost>
# Perl scan vhosts.d
PerlSetEnv VHOSTS_DIR /etc/apache2/vhosts.d
PerlSetEnv VHOST_DEFAULT_FILE 0_vhost.conf
PerlSetEnv PERL_CONF_DEBUG 1
PerlSetVar StatusOptionsAll On
PerlSetVar StatusDeparseOptions "-p -sC"
<Perl>
$Apache2::Server::SaveConfig = 1
</Perl>
<Perl>
my $VHOSTS_REGEX='^\s*Use\s+vhost.+?\s+(.+?)\s+?';
my @vhosts_sub_dirs=`find $ENV{'VHOSTS_DIR'} -mindepth 1 -maxdepth 1 -type d`;
$ENV{'PERL_CONF_DEBUG'} and print "------ Pre-Traitement ------\n";
for my $subdir (@vhosts_sub_dirs)
{
chomp $subdir;
my $config_file="${subdir}/$ENV{'VHOST_DEFAULT_FILE'}";
open my $vhost_file, "<", $config_file or die;
while(my $line = <$vhost_file>)
{
if(my @matches = $line =~ /$VHOSTS_REGEX/)
{
my $vhost_name=${matches[0]};
$ENV{'PERL_CONF_DEBUG'} and print "Identification du vhost: $vhost_name\n";
push @PerlSetEnv, ["$vhost_name" => "$subdir"];
}
}
close $config_file;
}
$ENV{'PERL_CONF_DEBUG'} and print "----------------------------\n";
</Perl>
<Perl>
use Apache2::PerlSections ( );
$ENV{'PERL_CONF_DEBUG'} and print "------ Chargement des vhosts ------\n";
foreach my $key (keys %ENV) {
my $subdir=$ENV{$key};
my $config_file="${subdir}/$ENV{'VHOST_DEFAULT_FILE'}";
if( -f $config_file )
{
$ENV{'PERL_CONF_DEBUG'} and print "Ajout du vhost: $key\n";
push @Include, "$config_file";
}
}
$ENV{'PERL_CONF_DEBUG'} and print "-----------------------------------\n";
print STDERR Apache::PerlSections->dump( );
</Perl>
Reference in a new issue Copy permalink