Commit 7c994774 authored by Stefano Alberto Russo's avatar Stefano Alberto Russo
Browse files

Forces SSL everytwhere except than on localhost. Used rosetta certs for default Apache SSL conf.

parent c4a41a23

services/proxy/000-default.conf

+4 −4
Original line number Diff line number Diff line
@@ -36,10 +36,10 @@ 
    #  1) dev env is different than staging/production, and

    #  2) other roules in 001-proxy.conf are never reached



    #RewriteEngine On

    #RewriteCond %{HTTPS} off

    #RewriteCond %{HTTP_HOST} !=localhost

    #RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

    RewriteEngine On

    RewriteCond %{HTTPS} off

    RewriteCond %{HTTP_HOST} !=localhost

    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

    

    ProxyPass / http://webapp:8080/

    ProxyPassReverse / http://webapp:8080/

services/proxy/001-proxy.conf

+18 −16
Original line number Diff line number Diff line
@@ -3,26 +3,28 @@ 
#  Rosetta platform 

#---------------------------



# WARNING: not relevant anymore, see 000-default.conf



# Non-SSL

<VirtualHost *:80>

    ServerName rosetta.platform

    Redirect 301 / https://rosetta.platform/

</VirtualHost>

#<VirtualHost *:80>

#    ServerName rosetta.platform

#    Redirect 301 / https://rosetta.platform/

#</VirtualHost>



# SSL

<VirtualHost *:443>

    

    ServerName rosetta.platform



    SSLEngine on

    SSLCertificateFile /root/certificates/rosetta_platform/rosetta_platform.crt

    SSLCertificateKeyFile /root/certificates/rosetta_platform/rosetta_platform.key

    SSLCACertificateFile /root/certificates/rosetta_platform/rosetta_platform.ca-bundle



    ProxyPass / http://webapp:8080/

    ProxyPassReverse / http://webapp:8080/

    

</VirtualHost>

#<VirtualHost *:443>

#    

#    ServerName rosetta.platform

#

#    SSLEngine on

#    SSLCertificateFile /root/certificates/rosetta_platform/rosetta_platform.crt

#    SSLCertificateKeyFile /root/certificates/rosetta_platform/rosetta_platform.key

#    SSLCACertificateFile /root/certificates/rosetta_platform/rosetta_platform.ca-bundle

#

#    ProxyPass / http://webapp:8080/

#    ProxyPassReverse / http://webapp:8080/

    

#</VirtualHost>



# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

services/proxy/default-ssl.conf

+5 −2
Original line number Diff line number Diff line
@@ -30,8 +30,11 @@ 
        #   /usr/share/doc/apache2/README.Debian.gz for more info.

        #   If both key and certificate are stored in the same file, only the

        #   SSLCertificateFile directive is needed.

        SSLCertificateFile  /etc/ssl/certs/ssl-cert-snakeoil.pem

        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

        #SSLCertificateFile  /etc/ssl/certs/ssl-cert-snakeoil.pem

        #SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

        SSLCertificateFile /root/certificates/rosetta_platform/rosetta_platform.crt

        SSLCertificateKeyFile /root/certificates/rosetta_platform/rosetta_platform.key

        SSLCACertificateFile /root/certificates/rosetta_platform/rosetta_platform.ca-bundle



        #   Server Certificate Chain:

        #   Point SSLCertificateChainFile at a file containing the