Permalink
Name already in use
A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
comanage-registry-docker/comanage-registry-mailman/apache-shib/httpd.conf
Go to fileThis commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update the Mailman 3 images and service deployment scripts so that Apache HTTP Server with the Shibboleth SP serves as the web proxy so that the Mailman 3 UI interfaces (Postorius and Hyperkitty) are protected with SAML.
184 lines (137 sloc)
4.98 KB
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ServerRoot "/usr/local/apache2" | |
Listen 80 | |
LoadModule mpm_event_module modules/mod_mpm_event.so | |
LoadModule authn_file_module modules/mod_authn_file.so | |
LoadModule authn_core_module modules/mod_authn_core.so | |
LoadModule authz_host_module modules/mod_authz_host.so | |
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so | |
LoadModule authz_user_module modules/mod_authz_user.so | |
LoadModule authz_core_module modules/mod_authz_core.so | |
LoadModule access_compat_module modules/mod_access_compat.so | |
LoadModule auth_basic_module modules/mod_auth_basic.so | |
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so | |
LoadModule reqtimeout_module modules/mod_reqtimeout.so | |
LoadModule filter_module modules/mod_filter.so | |
LoadModule substitute_module modules/mod_substitute.so | |
LoadModule mime_module modules/mod_mime.so | |
LoadModule log_config_module modules/mod_log_config.so | |
LoadModule env_module modules/mod_env.so | |
LoadModule headers_module modules/mod_headers.so | |
LoadModule setenvif_module modules/mod_setenvif.so | |
LoadModule version_module modules/mod_version.so | |
LoadModule proxy_module modules/mod_proxy.so | |
LoadModule proxy_http_module modules/mod_proxy_http.so | |
LoadModule ssl_module modules/mod_ssl.so | |
LoadModule unixd_module modules/mod_unixd.so | |
LoadModule status_module modules/mod_status.so | |
LoadModule autoindex_module modules/mod_autoindex.so | |
LoadModule dir_module modules/mod_dir.so | |
LoadModule alias_module modules/mod_alias.so | |
LoadModule rewrite_module modules/mod_rewrite.so | |
LoadModule mod_shib /opt/shibboleth-sp/lib/shibboleth/mod_shib_24.so | |
<IfModule unixd_module> | |
User daemon | |
Group daemon | |
</IfModule> | |
ServerAdmin you@example.com | |
ServerName http://${VIRTUAL_HOST_FQDN}:80 | |
<Directory /> | |
AllowOverride none | |
Require all denied | |
</Directory> | |
DocumentRoot "/usr/local/apache2/htdocs" | |
<Directory "/usr/local/apache2/htdocs"> | |
Options Indexes FollowSymLinks | |
AllowOverride None | |
Require all granted | |
</Directory> | |
<IfModule dir_module> | |
DirectoryIndex index.html | |
</IfModule> | |
<Files ".ht*"> | |
Require all denied | |
</Files> | |
ErrorLog /proc/self/fd/2 | |
LogLevel warn | |
<IfModule log_config_module> | |
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined | |
LogFormat "%h %l %u %t \"%r\" %>s %b" common | |
<IfModule logio_module> | |
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio | |
</IfModule> | |
CustomLog /proc/self/fd/1 common | |
</IfModule> | |
<IfModule mime_module> | |
TypesConfig conf/mime.types | |
AddType application/x-compress .Z | |
AddType application/x-gzip .gz .tgz | |
</IfModule> | |
<VirtualHost _default_:80> | |
ServerName http://${VIRTUAL_HOST_FQDN}:80 | |
UseCanonicalName On | |
RewriteEngine On | |
RewriteCond %{HTTPS} off | |
RewriteRule ^ https://%{HTTP_HOST}:443%{REQUEST_URI} [R=302,L,QSA] | |
</VirtualHost> | |
Listen 443 | |
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH | |
SSLHonorCipherOrder on | |
SSLProtocol all -SSLv3 | |
SSLPassPhraseDialog builtin | |
SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)" | |
SSLSessionCacheTimeout 300 | |
<VirtualHost _default_:443> | |
DocumentRoot "/usr/local/apache2/htdocs" | |
ServerName https://${VIRTUAL_HOST_FQDN}:443 | |
ServerAdmin you@example.com | |
ErrorLog /proc/self/fd/2 | |
TransferLog /proc/self/fd/1 | |
SSLEngine on | |
SSLCertificateFile "/usr/local/apache2/conf/server.crt" | |
SSLCertificateKeyFile "/usr/local/apache2/conf/server.key" | |
BrowserMatch "MSIE [2-5]" \ | |
nokeepalive ssl-unclean-shutdown \ | |
downgrade-1.0 force-response-1.0 | |
CustomLog /proc/self/fd/1 \ | |
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" | |
RedirectMatch "^/$" "https://${VIRTUAL_HOST_FQDN}/postorius/lists/" | |
Alias "/static/" "/opt/mailman-web-data/static/" | |
<Directory "/opt/mailman-web-data/static"> | |
Require all granted | |
</Directory> | |
<Location "/Shibboleth.sso"> | |
SetHandler shib | |
</Location> | |
<Location "/api/"> | |
ProxyPass http://mailman-core:8001/ | |
ProxyPassReverse http://mailman-core:8001/ | |
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME} | |
RequestHeader set "Host" expr=%{HTTP_HOST} | |
AddOutputFilterByType SUBSTITUTE application/json | |
Substitute "s|\"self_link\": \"http://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:8001|\"self_link\": \"https://${VIRTUAL_HOST_FQDN}/api|" | |
</Location> | |
<Location "/postorius/"> | |
AuthType Shibboleth | |
ShibRequestSetting requireSession 1 | |
ShibUseHeaders On | |
Require shib-attr mail ${MAILMAN_ADMIN_EMAIL} | |
ProxyPass http://mailman-web:8000/postorius/ | |
ProxyPassReverse http://mailman-web:8000/postorius/ | |
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME} | |
RequestHeader set "Host" expr=%{HTTP_HOST} | |
</Location> | |
<Location "/hyperkitty/"> | |
AuthType Shibboleth | |
ShibRequestSetting requireSession 1 | |
ShibUseHeaders On | |
Require shib-session | |
ProxyPass http://mailman-web:8000/hyperkitty/ | |
ProxyPassReverse http://mailman-web:8000/hyperkitty/ | |
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME} | |
RequestHeader set "Host" expr=%{HTTP_HOST} | |
</Location> | |
</VirtualHost> | |
<IfModule ssl_module> | |
SSLRandomSeed startup builtin | |
SSLRandomSeed connect builtin | |
</IfModule> | |