portal-apache2.4.conf 3.76 KB
Newer Older
1 2 3 4
#====================================================================
# Apache configuration for LemonLDAP::NG Portal
#====================================================================

5 6 7 8
# To insert LLNG user id in Apache logs, declare this format and use it in
# CustomLog directive
#LogFormat "%v:%p %h %l %{Lm-Remote-User}o %t \"%r\" %>s %O" llng

9 10 11
# Portal Virtual Host (auth.__DNSDOMAIN__)
<VirtualHost __VHOSTLISTEN__>
    ServerName auth.__DNSDOMAIN__
12
    # See above to set LLNG user id in Apache logs
13
    #CustomLog __APACHELOGDIR__/portal.log llng
14

15 16 17 18 19 20 21 22
    # Uncomment this if you are running behind a reverse proxy and want
    # LemonLDAP::NG to see the real IP address of the end user
    # Adjust the settings to match the IP address of your reverse proxy
    # and the header containing the original IP address
    #
    #RemoteIPHeader X-Forwarded-For
    #RemoteIPInternalProxy 127.0.0.1

23
    # DocumentRoot (FCGI scripts)
24 25
    DocumentRoot __PORTALSITEDIR__
    <Directory __PORTALSITEDIR__>
Xavier Guimard's avatar
Xavier Guimard committed
26 27
        Require all granted
        Options +ExecCGI +FollowSymLinks
28
    </Directory>
29
    RewriteEngine On
30 31 32 33
    # For performances, you can put static html files: simply put the HTML
    # result (example: /oauth2/checksession.html) as static file. Then
    # uncomment the following line.
    # RewriteCond "%{REQUEST_FILENAME}" "!\.html$"
34 35
    RewriteCond "%{REQUEST_FILENAME}" "!^/(?:(?:static|javascript|favicon).*|.*\.fcgi)$"
    RewriteRule "^/(.+)$" "/index.fcgi/$1" [PT]
36

Xavier Guimard's avatar
Xavier Guimard committed
37
    # Note that Content-Security-Policy header is generated by portal itself
38
    <Files *.fcgi>
Xavier Guimard's avatar
Xavier Guimard committed
39
        SetHandler fcgid-script
Xavier Guimard's avatar
Xavier Guimard committed
40 41 42 43 44 45
        # For Authorization header to be passed, please uncomment one of the following:
        # for Apache >= 2.4.13
        #CGIPassAuth On
        # for Apache < 2.4.13
        #RewriteCond %{HTTP:Authorization} ^(.*)
        #RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
46
        Options +ExecCGI
47
        header unset Lm-Remote-User
Xavier Guimard's avatar
Xavier Guimard committed
48 49
    </Files>

50 51 52
    # Uncomment this if status is enabled
    #FcgidInitialEnv LLNGSTATUSHOST 127.0.0.1:64321

53
    # Static files
54
    Alias /static/ __PORTALSTATICDIR__
55 56 57 58 59 60 61 62 63 64 65
    <Directory __PORTALSTATICDIR__>
        Require all granted
        Options +FollowSymLinks
    </Directory>
    <Location /static/>
        <IfModule mod_expires.c>
            ExpiresActive On
            ExpiresDefault "access plus 1 month"
        </IfModule>
    </Location>

66
    <IfModule mod_dir.c>
67
        DirectoryIndex index.fcgi index.html
68 69
    </IfModule>

70
    # REST/SOAP functions for sessions management (disabled by default)
71
    <Location /index.fcgi/adminSessions>
Xavier Guimard's avatar
Xavier Guimard committed
72
        Require all denied
73 74
    </Location>

75
    # REST/SOAP functions for sessions access (disabled by default)
76
    <Location /index.fcgi/sessions>
Xavier Guimard's avatar
Xavier Guimard committed
77
        Require all denied
78 79
    </Location>

80
    # REST/SOAP functions for configuration access (disabled by default)
81
    <Location /index.fcgi/config>
Xavier Guimard's avatar
Xavier Guimard committed
82
        Require all denied
83 84
    </Location>

85
    # REST/SOAP functions for notification insertion (disabled by default)
86
    <Location /index.fcgi/notification>
Xavier Guimard's avatar
Xavier Guimard committed
87
        Require all denied
88 89
    </Location>

90
    # Enabe compression
91 92
    <Location />
        <IfModule mod_deflate.c>
Xavier Guimard's avatar
Xavier Guimard committed
93 94 95 96 97 98
                AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css
                SetOutputFilter DEFLATE
                BrowserMatch ^Mozilla/4 gzip-only-text/html
                BrowserMatch ^Mozilla/4\.0[678] no-gzip
                BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
                SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
99 100
        </IfModule>
        <IfModule mod_headers.c>
Xavier Guimard's avatar
Xavier Guimard committed
101
                Header append Vary User-Agent env=!dont-vary
102 103
        </IfModule>
    </Location>
104 105 106

    # Uncomment this if site if you use SSL only
    #Header set Strict-Transport-Security 15768000
107 108
</VirtualHost>