factorisation macros
This commit is contained in:
Olivier Navas
parent
c70da9ad8f
commit
a2bdf91dce
3 changed files with 58 additions and 100 deletions
|
|
@ -1,7 +1,7 @@
|
|||
# RETIRER TOUS LES COMMENTAIRES, CONSERVER LA LIGNE UTILE PARMI CELLES CI-DESSOUS ET REMPLACER LES CHAMPS EN S'AIDANT DE LA DOCUMENTATION CI-DESSOUS
|
||||
#
|
||||
# Use vhost_HTTP_Generic $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf $modsecurityStatus
|
||||
# Use vhost_HTTPS_Generic $vhostFQDN $cert $protoDest $urlDest $logPolicy $accessPolicy $indexingConf $modsecurityStatus
|
||||
# Use vhost_HTTP_Generic $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf $modsecurityStatus
|
||||
# Use vhost_HTTPS_Generic $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf $modsecurityStatus
|
||||
#
|
||||
|
||||
|
||||
|
|
@ -10,7 +10,7 @@
|
|||
# L'activation de le fonction reverse proxy pour un virtualhost se fait par l'utilisation d'une des macros disponibles
|
||||
#
|
||||
# vhost_HTTP_Generic : mandataire HTTP vers un serveur mandate interne
|
||||
# vhost_HTTPS_Generic : mandataire HTTPS avec support des certificats région et redirection automatique HTTP -> HTTPS
|
||||
# vhost_HTTPS_Generic : mandataire HTTPS avec support d'un certificat letsencrypt et redirection automatique HTTP -> HTTPS
|
||||
#
|
||||
#
|
||||
## PARAMETRES
|
||||
|
|
@ -23,7 +23,12 @@
|
|||
# $urlDest : En mode http et https, indiquer l'url du serveur mandaté, sans le protocole
|
||||
# En mode balancer, répéter le FQDN pour utiliser comme nom de balancer. Il doit aussi figurer dans la configuration supplémentaire
|
||||
# $logPolicy : Niveau de log souhaité : debug | info | notice | warn | error | crit | alert | emerg ou combinaison, avec guillemets "debug ssl:warn authz_core:crit dumpio:trace7 rewrite:trace6"
|
||||
# $accessPolicy : Accessibilite du virtualhost : OpenAccessPolicy | InternalAccessPolicy | ManagementAccessPolicy | LDAPAccessPolicy
|
||||
# $accessPolicy : Accessibilite du virtualhost :
|
||||
# - OpenAccessPolicy : accessible publiquement
|
||||
# - InternalAccessPolicy : accessible depuis le réseau interne uniquement
|
||||
# - InternalAdminAccessPolicy : accessible depuis les ip internes des administrateurs uniquement
|
||||
# - LDAPUserAccessPolicy : accessible à tout utilisateur disposant d'un compte ldap ; peut être suivi de "Require ldap-user"
|
||||
# - LDAPAdminAccessPolicy : accessible à tout administrateur authentifié par son compte ldap
|
||||
# $indexingConf : Stratégie vis a vis des moteurs de recherche : AllowCrawlerIndexing | BlockCrawlerIndexing
|
||||
# $modsecurityStatus : Activation ou pas du module mod_security pour le virtualhost : On | Off | DetectionOnly
|
||||
# La valeur "On" est preferable en production mais peut amener à gerer une liste d'exclusions
|
||||
|
|
|
|||
|
|
@ -76,17 +76,15 @@
|
|||
|
||||
### Pour donner accès à des utilisateurs en plus de ceux acceptés par la policy
|
||||
#<Location />
|
||||
# Use InternalAccessPolicy
|
||||
#
|
||||
# Authname "Acces restreint"
|
||||
# Authtype Basic
|
||||
# AuthBasicProvider ldap-interne
|
||||
# Use ConnexionLdapInterne
|
||||
# Use LDAPUserAccessPolicy
|
||||
# Require ldap-user login1
|
||||
# Require ldap-user login2
|
||||
# Require ldap-attribute "memberof=cn=xxxxx"
|
||||
#</Location>
|
||||
|
||||
### Pour ne pas propager l'authentification vers le serveur mandaté
|
||||
# RequestHeader unset Authorization
|
||||
|
||||
|
||||
### Si une API du site mandaté utilise des codes d'erreur HTTP pour communiquer une information fonctionnelle à son client (beurk)
|
||||
#<Location "/api/">
|
||||
|
|
|
|||
|
|
@ -101,12 +101,6 @@ SecCookieFormat 0
|
|||
|
||||
|
||||
# Macros
|
||||
<Macro ProxyCommon>
|
||||
ProxyRequests Off
|
||||
ProxyVia Off
|
||||
ProxyPreserveHost On
|
||||
</Macro>
|
||||
|
||||
<Macro OpenAccessPolicy>
|
||||
Require all granted
|
||||
</Macro>
|
||||
|
|
@ -189,6 +183,49 @@ SecCookieFormat 0
|
|||
</Macro>
|
||||
|
||||
|
||||
# Configuration de la fonction reverse proxy
|
||||
<Macro ProxyCommon $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf>
|
||||
# Definition du virtualhost
|
||||
ServerName $vhostFQDN
|
||||
DocumentRoot "/var/www/html"
|
||||
|
||||
# Niveau de log souhaite
|
||||
LogLevel $logPolicy
|
||||
ErrorLog ${APACHE_LOG_DIR}/$vhostFQDN-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/$vhostFQDN-access.log combined
|
||||
|
||||
# Politique vis a vis des moteurs de recherche
|
||||
Use $indexingConf
|
||||
|
||||
# Configuration de l'accessibilite du virtualhost (public, interne, restreint)
|
||||
<Location />
|
||||
Use $accessPolicy
|
||||
</Location>
|
||||
ProxyRequests Off
|
||||
ProxyVia Off
|
||||
ProxyPreserveHost On
|
||||
ProxyPass /rp_ressources !
|
||||
ProxyPass /rp_maintenance !
|
||||
ProxyPass /balancer-manager !
|
||||
ProxyPass / $protoDest://$urlDest/
|
||||
ProxyPassReverse / $protoDest://$vhostFQDN/
|
||||
# Configuration du chemin vers la page de status du load balancer
|
||||
<Location "/balancer-manager">
|
||||
SecRuleEngine off
|
||||
SetHandler balancer-manager
|
||||
Use InternalAdminAccessPolicy
|
||||
</Location>
|
||||
# Configuration du chemin vers les ressources reverse proxy
|
||||
<Location "/rp_ressources">
|
||||
SecRuleEngine off
|
||||
Use OpenAccessPolicy
|
||||
</Location>
|
||||
# Definition des pages d'erreur
|
||||
Use ErrorDocumentPages
|
||||
# Gestion de la page de maintenance
|
||||
Use CheckMaintenancePage $vhostFQDN
|
||||
</Macro>
|
||||
|
||||
|
||||
# Redirige un domaine http vers https
|
||||
<Macro vhost_redirect_http-https $domain>
|
||||
|
|
@ -236,27 +273,10 @@ Use vhost_redirect_http-https $vhostFQDN
|
|||
$ENV{'PERL_CONF_DEBUG'} and print "------- Generation du vhosts $vhostFQDN -------\n";
|
||||
</Perl>
|
||||
|
||||
# Definition du virtualhost
|
||||
ServerName $vhostFQDN
|
||||
DocumentRoot "/var/www/html"
|
||||
Use ProxyCommon $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf
|
||||
|
||||
# Configuration SSL avec le bon certificat
|
||||
# Include conf.patterns.d/01_ssl_$cert.conf
|
||||
SSLEngine on
|
||||
|
||||
# Niveau de log souhaite
|
||||
LogLevel $logPolicy
|
||||
ErrorLog ${APACHE_LOG_DIR}/$vhostFQDN-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/$vhostFQDN-access.log combined
|
||||
|
||||
# Politique vis a vis des moteurs de recherche
|
||||
Use $indexingConf
|
||||
|
||||
# Configuration de l'accessibilite du virtualhost (public, interne, restreint)
|
||||
<Location />
|
||||
Use $accessPolicy
|
||||
</Location>
|
||||
|
||||
# Inclusion de la configuration additionnelle
|
||||
<Perl>
|
||||
my $dir=$ENV{"$vhostFQDN"};
|
||||
|
|
@ -268,35 +288,10 @@ Use vhost_redirect_http-https $vhostFQDN
|
|||
}
|
||||
</Perl>
|
||||
|
||||
# Configuration du chemin vers la page de status du load balancer
|
||||
<Location "/balancer-manager">
|
||||
SecRuleEngine off
|
||||
SetHandler balancer-manager
|
||||
Use InternalAdminAccessPolicy
|
||||
</Location>
|
||||
# Configuration du chemin vers les ressources reverse proxy
|
||||
<Location "/rp_ressources">
|
||||
SecRuleEngine off
|
||||
Use OpenAccessPolicy
|
||||
</Location>
|
||||
# Configuration de la fonction reverse proxy
|
||||
Use ProxyCommon
|
||||
ProxyPass /rp_ressources !
|
||||
ProxyPass /rp_maintenance !
|
||||
ProxyPass /balancer-manager !
|
||||
ProxyPass / $protoDest://$urlDest/
|
||||
ProxyPassReverse / $protoDest://$vhostFQDN/
|
||||
|
||||
<If "'$protoDest' == 'http'">
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
</If>
|
||||
|
||||
# Definition des pages d'erreur
|
||||
Use ErrorDocumentPages
|
||||
|
||||
# Gestion de la page de maintenance
|
||||
Use CheckMaintenancePage $vhostFQDN
|
||||
|
||||
# Gestion mod_security et inclusion des exceptions
|
||||
<IfModule mod_security2.c>
|
||||
SecRuleEngine $modsecurityStatus
|
||||
|
|
@ -328,22 +323,7 @@ Use vhost_redirect_http-https $vhostFQDN
|
|||
$ENV{'PERL_CONF_DEBUG'} and print "------- Generation du vhosts $vhostFQDN -------\n";
|
||||
</Perl>
|
||||
|
||||
# Definition du virtualhost
|
||||
ServerName $vhostFQDN
|
||||
DocumentRoot "/var/www/html"
|
||||
|
||||
# Niveau de log souhaite
|
||||
LogLevel $logPolicy
|
||||
ErrorLog ${APACHE_LOG_DIR}/$vhostFQDN-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/$vhostFQDN-access.log combined
|
||||
|
||||
# Politique vis a vis des moteurs de recherche
|
||||
Use $indexingConf
|
||||
|
||||
# Configuration de l'accessibilite du virtualhost (public, interne, restreint)
|
||||
<Location />
|
||||
Use $accessPolicy
|
||||
</Location>
|
||||
Use ProxyCommon $vhostFQDN $protoDest $urlDest $logPolicy $accessPolicy $indexingConf
|
||||
|
||||
# Inclusion de la configuration additionnelle
|
||||
<Perl>
|
||||
|
|
@ -356,35 +336,10 @@ Use vhost_redirect_http-https $vhostFQDN
|
|||
}
|
||||
</Perl>
|
||||
|
||||
# Configuration du chemin vers la page de status du load balancer
|
||||
<Location "/balancer-manager">
|
||||
SecRuleEngine off
|
||||
SetHandler balancer-manager
|
||||
Use InternalAdminAccessPolicy
|
||||
</Location>
|
||||
# Configuration du chemin vers les ressources reverse proxy
|
||||
<Location "/rp_ressources">
|
||||
SecRuleEngine off
|
||||
Use OpenAccessPolicy
|
||||
</Location>
|
||||
# Configuration de la fonction reverse proxy
|
||||
Use ProxyCommon
|
||||
ProxyPass /rp_ressources !
|
||||
ProxyPass /rp_maintenance !
|
||||
ProxyPass /balancer-manager !
|
||||
ProxyPass / $protoDest://$urlDest/
|
||||
ProxyPassReverse / $protoDest://$vhostFQDN/
|
||||
|
||||
<If "'$protoDest' == 'https'">
|
||||
RequestHeader set X-Forwarded-Proto "http"
|
||||
</If>
|
||||
|
||||
# Definition des pages d'erreur
|
||||
Use ErrorDocumentPages
|
||||
|
||||
# Gestion de la page de maintenance
|
||||
Use CheckMaintenancePage $vhostFQDN
|
||||
|
||||
# Gestion mod_security et inclusion des exceptions
|
||||
<IfModule mod_security2.c>
|
||||
SecRuleEngine $modsecurityStatus
|
||||
|
|
|
|||
Loading…
Reference in a new issue