You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
72 lines
2.5 KiB
72 lines
2.5 KiB
# generated 2023-08-21, Mozilla Guideline v5.7, Apache 2.4.41, OpenSSL 1.1.1k, intermediate configuration |
|
# https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1k&guideline=5.7 |
|
|
|
# this configuration requires mod_ssl, mod_socache_shmcb, mod_rewrite, and mod_headers |
|
<VirtualHost *:80> |
|
RewriteEngine On |
|
RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/ |
|
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L] |
|
</VirtualHost> |
|
|
|
<VirtualHost *:443> |
|
SSLEngine on |
|
|
|
# enable HTTP/2, if available |
|
Protocols h2 http/1.1 |
|
|
|
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) |
|
Header always set Strict-Transport-Security "max-age=63072000" |
|
|
|
ServerAdmin webmaster@localhost |
|
DocumentRoot /var/www/kivitendo-erp |
|
|
|
AddHandler fcgid-script .fpl |
|
FcgidMaxRequestLen 10485760 |
|
FcgidIOTimeout 32000 |
|
AliasMatch ^/[^/]+\.pl /var/www/kivitendo-erp/dispatcher.fpl |
|
Alias [^/] /var/www/kivitendo-erp/ |
|
|
|
|
|
# disallow access to .git or config for all cases |
|
<DirectoryMatch "(\.git|config)/"> |
|
Require all denied |
|
</DirectoryMatch> |
|
|
|
<Directory /var/www/kivitendo-erp> |
|
SSLRequireSSL |
|
Options ExecCGI Includes FollowSymlinks |
|
AllowOverride All |
|
Require all granted |
|
</Directory> |
|
|
|
{% if use_basic_auth == true %} |
|
<Location "/*"> |
|
AuthUserFile /etc/apache2/.htpasswd |
|
AuthName "Please authenticate" |
|
AuthType Basic |
|
Require valid-user |
|
</Location> |
|
|
|
{% endif %} |
|
<DirectoryMatch /var/www/kivitendo-erp/users> |
|
Order Deny,Allow |
|
Deny from All |
|
</DirectoryMatch> |
|
|
|
SSLCertificateFile {{ ssl.CertFile }} |
|
SSLCertificateKeyFile {{ ssl.CertKey }} |
|
SSLCertificateChainFile {{ ssl.ChainFile }} |
|
ErrorLog ${APACHE_LOG_DIR}/error.log |
|
CustomLog ${APACHE_LOG_DIR}/access.log combined |
|
</VirtualHost> |
|
|
|
# intermediate configuration |
|
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 |
|
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 |
|
SSLHonorCipherOrder off |
|
SSLSessionTickets off |
|
|
|
SSLUseStapling On |
|
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)" |
|
|
|
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
|
|
|