113 lines
3.9 KiB
Plaintext
113 lines
3.9 KiB
Plaintext
#====================================================================
|
|
# Apache configuration for LemonLDAP::NG Portal
|
|
#====================================================================
|
|
|
|
# To insert LLNG user id in Apache logs, declare this format and use it in
|
|
# CustomLog directive
|
|
#LogFormat "%v:%p %h %l %{Lm-Remote-User}o %t \"%r\" %>s %O" llng
|
|
|
|
# Portal Virtual Host (auth.__DNSDOMAIN__)
|
|
<VirtualHost *:443>
|
|
ServerName auth.__DNSDOMAIN__
|
|
# See above to set LLNG user id in Apache logs
|
|
#CustomLog $(APACHE_LOG_DIR)/portal.log llng
|
|
|
|
# Uncomment this if you are running behind a reverse proxy and want
|
|
# LemonLDAP::NG to see the real IP address of the end user
|
|
# Adjust the settings to match the IP address of your reverse proxy
|
|
# and the header containing the original IP address
|
|
#
|
|
#RemoteIPHeader X-Forwarded-For
|
|
#RemoteIPInternalProxy 127.0.0.1
|
|
|
|
# DocumentRoot (FCGI scripts)
|
|
DocumentRoot /usr/share/lemonldap-ng/portal/htdocs/
|
|
<Directory /usr/share/lemonldap-ng/portal/htdocs>
|
|
Require all granted
|
|
Options +ExecCGI +FollowSymLinks
|
|
</Directory>
|
|
RewriteEngine On
|
|
# For performances, you can put static html files: simply put the HTML
|
|
# result (example: /oauth2/checksession.html) as static file. Then
|
|
# uncomment the following line.
|
|
# RewriteCond "%{REQUEST_FILENAME}" "!\.html$"
|
|
RewriteCond "%{REQUEST_FILENAME}" "!^/(?:(?:static|javascript|favicon).*|.*\.fcgi)$"
|
|
RewriteRule "^/(.+)$" "/index.fcgi/$1" [PT]
|
|
|
|
# Note that Content-Security-Policy header is generated by portal itself
|
|
<Files *.fcgi>
|
|
SetHandler fcgid-script
|
|
|
|
# Authorization header needs to be passed when using Kerberos or OIDC
|
|
<IfVersion >= 2.4.13>
|
|
CGIPassAuth On
|
|
</IfVersion>
|
|
<IfVersion < 2.4.13>
|
|
RewriteCond %{HTTP:Authorization} ^(.*)
|
|
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
|
|
</IfVersion>
|
|
|
|
Options +ExecCGI
|
|
header unset Lm-Remote-User
|
|
</Files>
|
|
|
|
# Uncomment this if status is enabled
|
|
#FcgidInitialEnv LLNGSTATUSHOST 127.0.0.1:64321
|
|
|
|
# Static files
|
|
Alias /static/ /usr/share/lemonldap-ng/portal/htdocs/static/
|
|
<Directory /usr/share/lemonldap-ng/portal/htdocs/static/>
|
|
Require all granted
|
|
Options +FollowSymLinks
|
|
</Directory>
|
|
<Location /static/>
|
|
<IfModule mod_expires.c>
|
|
ExpiresActive On
|
|
ExpiresDefault "access plus 1 month"
|
|
</IfModule>
|
|
</Location>
|
|
|
|
<IfModule mod_dir.c>
|
|
DirectoryIndex index.fcgi index.html
|
|
</IfModule>
|
|
|
|
# REST/SOAP functions for sessions management (disabled by default)
|
|
<Location /index.fcgi/adminSessions>
|
|
Require all denied
|
|
</Location>
|
|
|
|
# REST/SOAP functions for sessions access (disabled by default)
|
|
<Location /index.fcgi/sessions>
|
|
Require all denied
|
|
</Location>
|
|
|
|
# REST/SOAP functions for configuration access (disabled by default)
|
|
<Location /index.fcgi/config>
|
|
Require all denied
|
|
</Location>
|
|
|
|
# REST/SOAP functions for notification insertion (disabled by default)
|
|
<Location /index.fcgi/notification>
|
|
Require all denied
|
|
</Location>
|
|
|
|
# Enabe compression
|
|
<Location />
|
|
<IfModule mod_deflate.c>
|
|
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css
|
|
SetOutputFilter DEFLATE
|
|
BrowserMatch ^Mozilla/4 gzip-only-text/html
|
|
BrowserMatch ^Mozilla/4\.0[678] no-gzip
|
|
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
|
|
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
|
|
</IfModule>
|
|
<IfModule mod_headers.c>
|
|
Header append Vary User-Agent env=!dont-vary
|
|
</IfModule>
|
|
</Location>
|
|
|
|
# Uncomment this if site if you use SSL only
|
|
#Header set Strict-Transport-Security "max-age=15768000"
|
|
</VirtualHost>
|
|
|