Skip to content

Commit f58ff87

Browse files
dachris1dachris1
committed
new config based on debian config
added <IfModule mod_version.c> because gentoo has no mod version installed by default added <IfModule mod_proxy_fcgi.c>
1 parent 98f84fe commit f58ff87

File tree

1 file changed

+98
-23
lines changed

1 file changed

+98
-23
lines changed

‎install/dist/tpl/gentoo/apache_ispconfig.vhost.master‎

Lines changed: 98 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,83 @@
44
# for the ISPConfig controlpanel
55
######################################################
66

7-
{vhost_port_listen} Listen {vhost_port}
8-
<tmpl_if name='apache_version' op='<' value='2.4' format='version'>
9-
NameVirtualHost *:{vhost_port}
10-
</tmpl_if>
7+
<tmpl_var name="vhost_port_listen"> Listen <tmpl_var name="vhost_port">
8+
NameVirtualHost *:<tmpl_var name="vhost_port">
119

12-
<VirtualHost _default_:{vhost_port}>
10+
<VirtualHost _default_:<tmpl_var name="vhost_port">>
1311
ServerAdmin webmaster@localhost
1412

1513
Alias /mail /var/www/ispconfig/mail
1614

15+
<Directory /var/www/ispconfig/>
16+
<FilesMatch "\.ph(p3?|tml)$">
17+
SetHandler None
18+
</FilesMatch>
19+
</Directory>
20+
<Directory /usr/local/ispconfig/interface/web/>
21+
<FilesMatch "\.ph(p3?|tml)$">
22+
SetHandler None
23+
</FilesMatch>
24+
</Directory>
25+
1726
<IfModule mod_fcgid.c>
1827
DocumentRoot /var/www/ispconfig/
1928
SuexecUserGroup ispconfig ispconfig
2029
<Directory /var/www/ispconfig/>
21-
Options +Indexes +FollowSymLinks +MultiViews +ExecCGI
30+
Options -Indexes +FollowSymLinks +MultiViews +ExecCGI
2231
AllowOverride AuthConfig Indexes Limit Options FileInfo
23-
<FilesMatch "\.ph(p[3-5]?|tml)$">
32+
<FilesMatch "\.php$">
2433
SetHandler fcgid-script
2534
</FilesMatch>
2635
FCGIWrapper /var/www/php-fcgi-scripts/ispconfig/.php-fcgi-starter .php
36+
<tmpl_if name='apache_version' op='>' value='2.2' format='version'>
37+
Require all granted
38+
<tmpl_else>
2739
Order allow,deny
2840
Allow from all
41+
</tmpl_if>
2942
</Directory>
3043
DirectoryIndex index.php
44+
IPCCommTimeout 7200
45+
MaxRequestLen 15728640
46+
</IfModule>
47+
48+
<IfModule mod_proxy_fcgi.c>
49+
DocumentRoot /usr/local/ispconfig/interface/web
50+
SuexecUserGroup ispconfig ispconfig
51+
DirectoryIndex index.php
52+
53+
<Directory /usr/local/ispconfig/interface/web>
54+
Options -Indexes +FollowSymLinks +MultiViews +ExecCGI
55+
AllowOverride AuthConfig Indexes Limit Options FileInfo
56+
<tmpl_if name='apache_version' op='>' value='2.2' format='version'>
57+
Require all granted
58+
<tmpl_else>
59+
Order allow,deny
60+
Allow from all
61+
</tmpl_if>
62+
<FilesMatch \.php$>
63+
#SetHandler "proxy:unix:/var/lib/php5-fpm/ispconfig.sock|fcgi://localhost"
64+
SetHandler "proxy:fcgi://127.0.0.1:9000"
65+
</FilesMatch>
66+
</Directory>
3167
</IfModule>
3268

33-
<IfModule mod_php5.c>
69+
<IfModule mpm_itk_module>
3470
DocumentRoot /usr/local/ispconfig/interface/web/
71+
AssignUserId ispconfig ispconfig
3572
AddType application/x-httpd-php .php
3673
<Directory /usr/local/ispconfig/interface/web>
74+
# php_admin_value open_basedir "/usr/local/ispconfig/interface:/usr/share:/tmp"
3775
Options +FollowSymLinks
3876
AllowOverride None
77+
<tmpl_if name='apache_version' op='>' value='2.2' format='version'>
78+
Require all granted
79+
<tmpl_else>
3980
Order allow,deny
4081
Allow from all
41-
php_value magic_quotes_gpc 0
82+
</tmpl_if>
83+
php_value magic_quotes_gpc 0
4284
</Directory>
4385
</IfModule>
4486

@@ -51,20 +93,53 @@
5193
</IfModule>
5294

5395
# SSL Configuration
54-
{ssl_comment}SSLEngine On
55-
{ssl_comment}SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
56-
{ssl_comment}SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
96+
<tmpl_var name="ssl_comment">SSLEngine On
97+
<tmpl_if name='apache_version' op='>=' value='2.3.16' format='version'>
98+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
99+
<tmpl_else>
100+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv2 -SSLv3
101+
</tmpl_if>
102+
<tmpl_var name="ssl_comment">SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
103+
<tmpl_var name="ssl_comment">SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
104+
<tmpl_var name="ssl_bundle_comment">SSLCACertificateFile /usr/local/ispconfig/interface/ssl/ispserver.bundle
57105

58-
</VirtualHost>
106+
<tmpl_var name="ssl_comment">SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
107+
<tmpl_var name="ssl_comment">SSLHonorCipherOrder On
108+
<tmpl_if name='apache_version' op='>=' value='2.4.3' format='version'>
109+
<tmpl_var name="ssl_comment">SSLCompression Off
110+
</tmpl_if>
111+
<tmpl_if name='apache_version' op='>=' value='2.4.11' format='version'>
112+
<tmpl_var name="ssl_comment">SSLSessionTickets Off
113+
</tmpl_if>
59114

60-
<Directory /var/www/php-cgi-scripts>
61-
AllowOverride None
62-
Order Deny,Allow
63-
Deny from all
64-
</Directory>
115+
<IfModule mod_headers.c>
116+
# ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval
117+
Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'"
118+
<tmpl_var name="ssl_comment">Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests"
119+
Header set X-Content-Type-Options: nosniff
120+
Header set X-Frame-Options: SAMEORIGIN
121+
Header set X-XSS-Protection: "1; mode=block"
122+
Header always edit Set-Cookie (.*) "$1; HTTPOnly"
123+
<tmpl_var name="ssl_comment">Header always edit Set-Cookie (.*) "$1; Secure"
124+
<IfModule mod_version.c>
125+
<IfVersion >= 2.4.7>
126+
Header setifempty Strict-Transport-Security "max-age=15768000"
127+
</IfVersion>
128+
<IfVersion < 2.4.7>
129+
Header set Strict-Transport-Security "max-age=15768000"
130+
</IfVersion>
131+
</IfModule>
132+
RequestHeader unset Proxy early
133+
</IfModule>
134+
135+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
136+
<tmpl_var name="ssl_comment">SSLUseStapling On
137+
<tmpl_var name="ssl_comment">SSLStaplingResponderTimeout 5
138+
<tmpl_var name="ssl_comment">SSLStaplingReturnResponderErrors Off
139+
</tmpl_if>
140+
141+
# Redirect http to https
142+
ErrorDocument 400 "<script>document.location.href='https://'+location.hostname+':'+location.port';</script><h1>Error 400 - trying to redirect</h1>"
143+
144+
</VirtualHost>
65145

66-
<Directory /var/www/php-fcgi-scripts>
67-
AllowOverride None
68-
Order Deny,Allow
69-
Deny from all
70-
</Directory>

0 commit comments

Comments
 (0)