diff --git a/docker-compose.yaml b/docker-compose.yaml new file mode 100755 index 0000000..bbea0c8 --- /dev/null +++ b/docker-compose.yaml @@ -0,0 +1,40 @@ + proxy: + image: lzrbear/docker-apache2-ubuntu:16.04 + restart: always + container_name: proxy + ports: + - 5080:8080 + - 5043:443 + links: + - registry:registry + volumes: + - "/var/lab/registry/etc/apache2/domain.crt:/usr/local/apache2/conf/domain.crt" + - "/var/lab/registry/etc/apache2/domain.key:/usr/local/apache2/conf/domain.key" + - "/var/lab/registry/etc/apache2/httpd.groups:/usr/local/apache2/conf/httpd.groups" + - "/var/lab/registry/etc/apache2/httpd.htpasswd:/usr/local/apache2/conf/httpd.htpasswd" + - "/var/lab/registry/modules/apache2.conf:/etc/apache2/apache2.conf" + - "/var/lab/registry/modules/000-default.conf:/etc/apache2/sites-enabled/000-default.conf" + - "/var/lab/registry/modules/ports.conf:/etc/apache2/ports.conf" + - "/var/lab/registry/modules/headers.load:/etc/apache2/mods-enabled/headers.load" + - "/var/lab/registry/modules/mod_ssl.load:/etc/apache2/mods-enabled/mod_ssl.load" + - "/var/lab/registry/modules/mod_ssl.conf:/etc/apache2/mods-enabled/mod_ssl.conf" + - "/var/lab/registry/modules/authz_groupfile.load:/etc/apache2/mods-enabled/authz_groupfile.load" + - "/var/lab/registry/modules/proxy.load:/etc/apache2/mods-enabled/proxy.load" + - "/var/lab/registry/modules/proxy_http.load:/etc/apache2/mods-enabled/proxy_http.load" + - "/var/lab/registry/modules/authn_file.load:/etc/apache2/mods-enabled/authn_file.load" + - "/var/lab/registry/modules/authn_core.load:/etc/apache2/mods-enabled/authn_core.load" + - "/var/lab/registry/modules/authz_user.load:/etc/apache2/mods-enabled/authz_user.load" + - "/var/lab/registry/modules/authz_core.load:/etc/apache2/mods-enabled/authz_core.load" + - "/var/lab/registry/modules/auth_basic.load:/etc/apache2/mods-enabled/auth_basic.load" + - "/var/lab/registry/modules/access_compat.load:/etc/apache2/mods-enabled/access_compat.load" + + + registry: + image: registry:2 + restart: always + container_name: registry + ports: + - 5000:5000 + volumes: + - "/var/lab/registry-data:/var/lib/registry" + diff --git a/files/create.auth-files.sh b/files/create.auth-files.sh new file mode 100644 index 0000000..6652967 --- /dev/null +++ b/files/create.auth-files.sh @@ -0,0 +1,8 @@ +# create a password file for "testuser" and "testpassword" +docker run --entrypoint htpasswd httpd:2.4 -Bbn testuser testpassword > httpd.htpasswd +# Create another one for "testuserpush" and "testpasswordpush" +docker run --entrypoint htpasswd httpd:2.4 -Bbn testuserpush testpasswordpush >> httpd.htpasswd + +# Create your group file +echo "pusher: testuserpush" > httpd.groups + diff --git a/files/create.ertificate-files.sh b/files/create.ertificate-files.sh new file mode 100644 index 0000000..74334de --- /dev/null +++ b/files/create.ertificate-files.sh @@ -0,0 +1,9 @@ +# Important +# Add your IP in subjectAltName in the openssl.cnf before generating i +# certssudo vi /etc/ssl/openssl.cnf +# Add this line +#subjectAltName=IP:192.168.0.2 +mkdir -p ./certs +openssl req \ + -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \ + -x509 -days 365 -out certs/domain.crt diff --git a/files/etc/apache2/domain.crt b/files/etc/apache2/domain.crt new file mode 100755 index 0000000..6df7c6f --- /dev/null +++ b/files/etc/apache2/domain.crt @@ -0,0 +1,3 @@ +-----BEGIN CERTIFICATE----- +paste here crt +-----END CERTIFICATE----- diff --git a/files/etc/apache2/domain.key b/files/etc/apache2/domain.key new file mode 100755 index 0000000..864b63f --- /dev/null +++ b/files/etc/apache2/domain.key @@ -0,0 +1,3 @@ +-----BEGIN PRIVATE KEY----- +paste here you key +-----END PRIVATE KEY----- diff --git a/files/etc/apache2/httpd.conf b/files/etc/apache2/httpd.conf new file mode 100755 index 0000000..ca03548 --- /dev/null +++ b/files/etc/apache2/httpd.conf @@ -0,0 +1,188 @@ +LoadModule headers_module modules/mod_headers.so + +LoadModule authn_file_module modules/mod_authn_file.so +LoadModule authn_core_module modules/mod_authn_core.so +LoadModule authz_groupfile_module modules/mod_authz_groupfile.so +LoadModule authz_user_module modules/mod_authz_user.so +LoadModule authz_core_module modules/mod_authz_core.so +LoadModule auth_basic_module modules/mod_auth_basic.so +LoadModule access_compat_module modules/mod_access_compat.so + +LoadModule log_config_module modules/mod_log_config.so + +LoadModule ssl_module modules/mod_ssl.so + +LoadModule proxy_module modules/mod_proxy.so +LoadModule proxy_http_module modules/mod_proxy_http.so + +LoadModule unixd_module modules/mod_unixd.so + +LoadModule mpm_event_module modules/mod_mpm_event.so +LoadModule authz_host_module modules/mod_authz_host.so +LoadModule reqtimeout_module modules/mod_reqtimeout.so +LoadModule filter_module modules/mod_filter.so +LoadModule mime_module modules/mod_mime.so +LoadModule env_module modules/mod_env.so +LoadModule setenvif_module modules/mod_setenvif.so +LoadModule version_module modules/mod_version.so +LoadModule status_module modules/mod_status.so +LoadModule autoindex_module modules/mod_autoindex.so + + SSLRandomSeed startup builtin + SSLRandomSeed connect builtin + + + + User daemon + Group daemon + + +ServerAdmin you@example.com + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %b" common + + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio + + + CustomLog /proc/self/fd/1 common + + +ServerRoot "/usr/local/apache2" + +Listen 443 + + + AllowOverride none + Require all denied + + + + #LoadModule cgid_module modules/mod_cgid.so + + + #LoadModule cgi_module modules/mod_cgi.so + +LoadModule dir_module modules/mod_dir.so +LoadModule alias_module modules/mod_alias.so + + + AllowOverride none + Require all denied + + +DocumentRoot "/usr/local/apache2/htdocs" + + Options Indexes FollowSymLinks + + AllowOverride None + + Require all granted + + + + DirectoryIndex index.html + + + + Require all denied + + + + + ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/" + + + + + #Scriptsock cgisock + + +# + + AllowOverride None + Options None + Require all granted + + + + RequestHeader unset Proxy early + + + + TypesConfig conf/mime.types + + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + + + + + +#Include conf/extra/proxy-html.conf + + + + + ServerName localhost + + SSLEngine on + SSLCertificateFile /usr/local/apache2/conf/domain.crt + SSLCertificateKeyFile /usr/local/apache2/conf/domain.key + + ## SSL settings recommendation from: https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html + # Anti CRIME + SSLCompression off + + # POODLE and other stuff + SSLProtocol all -SSLv2 -SSLv3 -TLSv1 + + # Secure cypher suites + SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH + SSLHonorCipherOrder on + + Header always set "Docker-Distribution-Api-Version" "registry/2.0" + Header onsuccess set "Docker-Distribution-Api-Version" "registry/2.0" +Header always set Strict-Transport-Security "max-age=max-age=15552000; includeSubdomains; preload" +Header set Public-Key-Pins "pin-sha256=\"redacted=\"; max-age=15552000; includeSubdomains;" + # add for uknow blob + Header add X-Forwarded-Proto "https" + RequestHeader add X-Forwarded-Proto "https" + RequestHeader set X-Forwarded-Proto "https" + + ProxyRequests off + ProxyPreserveHost on + + # no proxy for /error/ (Apache HTTPd errors messages) + ProxyPass /error/ ! + + ProxyPass /v2 http://registry:5000/v2 + ProxyPassReverse /v2 http://registry:5000/v2 + + + Order deny,allow + Allow from all + AuthName "Registry Authentication" + AuthType basic + AuthUserFile "/usr/local/apache2/conf/httpd.htpasswd" + AuthGroupFile "/usr/local/apache2/conf/httpd.groups" + + # Read access to authentified users + + Require valid-user + + + # Write access to docker-deployer only + + Require group pusher + + + + + diff --git a/files/etc/apache2/httpd.groups b/files/etc/apache2/httpd.groups new file mode 100755 index 0000000..464fa6e --- /dev/null +++ b/files/etc/apache2/httpd.groups @@ -0,0 +1 @@ +pusher: username diff --git a/files/etc/apache2/httpd.htpasswd b/files/etc/apache2/httpd.htpasswd new file mode 100755 index 0000000..7ab57be --- /dev/null +++ b/files/etc/apache2/httpd.htpasswd @@ -0,0 +1,3 @@ +user1:password +... +usern:password diff --git a/files/modules/000-default.conf b/files/modules/000-default.conf new file mode 100644 index 0000000..14e3e3d --- /dev/null +++ b/files/modules/000-default.conf @@ -0,0 +1,106 @@ +ServerName localhost + + SSLRandomSeed startup builtin + SSLRandomSeed connect builtin + + + ServerName registry.vlabs.uniwa.gr + + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined + SSLEngine On + SSLCertificateFile /usr/local/apache2/conf/domain.crt + SSLCertificateKeyFile /usr/local/apache2/conf/domain.key + + SSLCompression off + SSLProtocol all -SSLv2 -SSLv3 -TLSv1 + SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH + SSLHonorCipherOrder on + + Header always set "Docker-Distribution-Api-Version" "registry/2.0" + Header onsuccess set "Docker-Distribution-Api-Version" "registry/2.0" + RequestHeader set X-Forwarded-Proto "https" + + ProxyRequests Off + ProxyPreserveHost On + ProxyPass /error/ ! + ProxyPass /v2 http://registry.vlabs.uniwa.gr:5000/v2 + ProxyPassReverse /v2 http://registry.vlabs.uniwa.gr:5000/v2 + + + #SSLRequireSSL + + # Order allow,deny + # Allow from all + # Read access to authentified users + + Order allow,deny + Allow from all + #Require valid-user + + + # Write access to docker-deployer only + + Order deny,allow + Deny from all + #Require group pusher + + + + + + + + + + + + + + ServerName registry.vlabs.uniwa.gr + + ErrorLog ${APACHE_LOG_DIR}/error5043.log + CustomLog ${APACHE_LOG_DIR}/access5043.log combined + SSLEngine On + SSLCertificateFile /usr/local/apache2/conf/domain.crt + SSLCertificateKeyFile /usr/local/apache2/conf/domain.key + + SSLCompression off + SSLProtocol all -SSLv2 -SSLv3 -TLSv1 + SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH + SSLHonorCipherOrder on + + Header always set "Docker-Distribution-Api-Version" "registry/2.0" + Header onsuccess set "Docker-Distribution-Api-Version" "registry/2.0" + RequestHeader set X-Forwarded-Proto "https" + + ProxyRequests Off + ProxyPreserveHost On + ProxyPass /error/ ! + ProxyPass /v2 http://registry.vlabs.uniwa.gr:5000/v2 + ProxyPassReverse /v2 http://registry.vlabs.uniwa.gr:5000/v2 + + + #SSLRequireSSL + + Order deny,allow + Allow from all + AuthName "Registry Authentication" + AuthType basic + AuthUserFile "/usr/local/apache2/conf/httpd.htpasswd" + AuthGroupFile "/usr/local/apache2/conf/httpd.groups" + + # Read access to authentified users + + Require valid-user + + + # Write access to docker-deployer only + + Require group pusher + + + + + + diff --git a/files/modules/access_compat.load b/files/modules/access_compat.load new file mode 100644 index 0000000..83273df --- /dev/null +++ b/files/modules/access_compat.load @@ -0,0 +1,2 @@ +# Depends: authn_core +LoadModule access_compat_module /usr/lib/apache2/modules/mod_access_compat.so diff --git a/files/modules/actions.conf b/files/modules/actions.conf new file mode 100644 index 0000000..c3f5d29 --- /dev/null +++ b/files/modules/actions.conf @@ -0,0 +1,11 @@ +# a2enmod-note: needs-configuration + +# +# Action lets you define media types that will execute a script whenever +# a matching file is called. This eliminates the need for repeated URL +# pathnames for oft-used CGI file processors. +# Format: Action media/type /cgi-script/location +# Format: Action handler-name /cgi-script/location +# + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/actions.load b/files/modules/actions.load new file mode 100644 index 0000000..4207df3 --- /dev/null +++ b/files/modules/actions.load @@ -0,0 +1 @@ +LoadModule actions_module /usr/lib/apache2/modules/mod_actions.so diff --git a/files/modules/alias.conf b/files/modules/alias.conf new file mode 100644 index 0000000..3583d3b --- /dev/null +++ b/files/modules/alias.conf @@ -0,0 +1,24 @@ + + # Aliases: Add here as many aliases as you need (with no limit). The format is + # Alias fakename realname + # + # Note that if you include a trailing / on fakename then the server will + # require it to be present in the URL. So "/icons" isn't aliased in this + # example, only "/icons/". If the fakename is slash-terminated, then the + # realname must also be slash terminated, and if the fakename omits the + # trailing slash, the realname must also omit it. + # + # We include the /icons/ alias for FancyIndexed directory listings. If + # you do not use FancyIndexing, you may comment this out. + + Alias /icons/ "/usr/share/apache2/icons/" + + + Options FollowSymlinks + AllowOverride None + Require all granted + + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/alias.load b/files/modules/alias.load new file mode 100644 index 0000000..4cb7385 --- /dev/null +++ b/files/modules/alias.load @@ -0,0 +1 @@ +LoadModule alias_module /usr/lib/apache2/modules/mod_alias.so diff --git a/files/modules/allowmethods.load b/files/modules/allowmethods.load new file mode 100644 index 0000000..e5bbe59 --- /dev/null +++ b/files/modules/allowmethods.load @@ -0,0 +1 @@ +LoadModule allowmethods_module /usr/lib/apache2/modules/mod_allowmethods.so diff --git a/files/modules/apache2.conf b/files/modules/apache2.conf new file mode 100644 index 0000000..41697f2 --- /dev/null +++ b/files/modules/apache2.conf @@ -0,0 +1,227 @@ +# This is the main Apache server configuration file. It contains the +# configuration directives that give the server its instructions. +# See http://httpd.apache.org/docs/2.4/ for detailed information about +# the directives and /usr/share/doc/apache2/README.Debian about Debian specific +# hints. +# +# +# Summary of how the Apache 2 configuration works in Debian: +# The Apache 2 web server configuration in Debian is quite different to +# upstream's suggested way to configure the web server. This is because Debian's +# default Apache2 installation attempts to make adding and removing modules, +# virtual hosts, and extra configuration directives as flexible as possible, in +# order to make automating the changes and administering the server as easy as +# possible. + +# It is split into several files forming the configuration hierarchy outlined +# below, all located in the /etc/apache2/ directory: +# +# /etc/apache2/ +# |-- apache2.conf +# | `-- ports.conf +# |-- mods-enabled +# | |-- *.load +# | `-- *.conf +# |-- conf-enabled +# | `-- *.conf +# `-- sites-enabled +# `-- *.conf +# +# +# * apache2.conf is the main configuration file (this file). It puts the pieces +# together by including all remaining configuration files when starting up the +# web server. +# +# * ports.conf is always included from the main configuration file. It is +# supposed to determine listening ports for incoming connections which can be +# customized anytime. +# +# * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/ +# directories contain particular configuration snippets which manage modules, +# global configuration fragments, or virtual host configurations, +# respectively. +# +# They are activated by symlinking available configuration files from their +# respective *-available/ counterparts. These should be managed by using our +# helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See +# their respective man pages for detailed information. +# +# * The binary is called apache2. Due to the use of environment variables, in +# the default configuration, apache2 needs to be started/stopped with +# /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not +# work with the default configuration. + + +# Global configuration +# + +# +# ServerRoot: The top of the directory tree under which the server's +# configuration, error, and log files are kept. +# +# NOTE! If you intend to place this on an NFS (or otherwise network) +# mounted filesystem then please read the Mutex documentation (available +# at ); +# you will save yourself a lot of trouble. +# +# Do NOT add a slash at the end of the directory path. +# +#ServerRoot "/etc/apache2" + +# +# The accept serialization lock file MUST BE STORED ON A LOCAL DISK. +# +#Mutex file:${APACHE_LOCK_DIR} default + +# +# The directory where shm and other runtime files will be stored. +# + +DefaultRuntimeDir ${APACHE_RUN_DIR} + +# +# PidFile: The file in which the server should record its process +# identification number when it starts. +# This needs to be set in /etc/apache2/envvars +# +PidFile ${APACHE_PID_FILE} + +# +# Timeout: The number of seconds before receives and sends time out. +# +Timeout 300 + +# +# KeepAlive: Whether or not to allow persistent connections (more than +# one request per connection). Set to "Off" to deactivate. +# +KeepAlive On + +# +# MaxKeepAliveRequests: The maximum number of requests to allow +# during a persistent connection. Set to 0 to allow an unlimited amount. +# We recommend you leave this number high, for maximum performance. +# +MaxKeepAliveRequests 100 + +# +# KeepAliveTimeout: Number of seconds to wait for the next request from the +# same client on the same connection. +# +KeepAliveTimeout 5 + + +# These need to be set in /etc/apache2/envvars +User ${APACHE_RUN_USER} +Group ${APACHE_RUN_GROUP} + +# +# HostnameLookups: Log the names of clients or just their IP addresses +# e.g., www.apache.org (on) or 204.62.129.132 (off). +# The default is off because it'd be overall better for the net if people +# had to knowingly turn this feature on, since enabling it means that +# each client request will result in AT LEAST one lookup request to the +# nameserver. +# +HostnameLookups Off + +# ErrorLog: The location of the error log file. +# If you do not specify an ErrorLog directive within a +# container, error messages relating to that virtual host will be +# logged here. If you *do* define an error logfile for a +# container, that host's errors will be logged there and not here. +# +ErrorLog ${APACHE_LOG_DIR}/error.log + +# +# LogLevel: Control the severity of messages logged to the error_log. +# Available values: trace8, ..., trace1, debug, info, notice, warn, +# error, crit, alert, emerg. +# It is also possible to configure the log level for particular modules, e.g. +# "LogLevel info ssl:warn" +# +LogLevel warn + +# Include module configuration: +IncludeOptional mods-enabled/*.load +IncludeOptional mods-enabled/*.conf + +# Include list of ports to listen on +Include ports.conf + + +# Sets the default security model of the Apache2 HTTPD server. It does +# not allow access to the root filesystem outside of /usr/share and /var/www. +# The former is used by web applications packaged in Debian, +# the latter may be used for local directories served by the web server. If +# your system is serving content from a sub-directory in /srv you must allow +# access here, or in any related virtual host. + + Options FollowSymLinks + AllowOverride None + Require all denied + + + + AllowOverride None + Require all granted + + + + Options Indexes FollowSymLinks + AllowOverride None + Require all granted + + +# +# Options Indexes FollowSymLinks +# AllowOverride None +# Require all granted +# + + + + +# AccessFileName: The name of the file to look for in each directory +# for additional configuration directives. See also the AllowOverride +# directive. +# +AccessFileName .htaccess + +# +# The following lines prevent .htaccess and .htpasswd files from being +# viewed by Web clients. +# + + Require all denied + + + +# +# The following directives define some format nicknames for use with +# a CustomLog directive. +# +# These deviate from the Common Log Format definitions in that they use %O +# (the actual bytes sent including headers) instead of %b (the size of the +# requested file), because the latter makes it impossible to detect partial +# requests. +# +# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended. +# Use mod_remoteip instead. +# +LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined +LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined +LogFormat "%h %l %u %t \"%r\" %>s %O" common +LogFormat "%{Referer}i -> %U" referer +LogFormat "%{User-agent}i" agent + +# Include of directories ignores editors' and dpkg's backup files, +# see README.Debian for details. + +# Include generic snippets of statements +IncludeOptional conf-enabled/*.conf + +# Include the virtual host configurations: +IncludeOptional sites-enabled/*.conf + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/asis.load b/files/modules/asis.load new file mode 100644 index 0000000..6b73c45 --- /dev/null +++ b/files/modules/asis.load @@ -0,0 +1,2 @@ +# Depends: mime +LoadModule asis_module /usr/lib/apache2/modules/mod_asis.so diff --git a/files/modules/auth_basic.load b/files/modules/auth_basic.load new file mode 100644 index 0000000..5f3cd1c --- /dev/null +++ b/files/modules/auth_basic.load @@ -0,0 +1,2 @@ +# Depends: authn_core +LoadModule auth_basic_module /usr/lib/apache2/modules/mod_auth_basic.so diff --git a/files/modules/auth_digest.load b/files/modules/auth_digest.load new file mode 100644 index 0000000..4fa7a3e --- /dev/null +++ b/files/modules/auth_digest.load @@ -0,0 +1,2 @@ +# Depends: authn_core +LoadModule auth_digest_module /usr/lib/apache2/modules/mod_auth_digest.so diff --git a/files/modules/auth_form.load b/files/modules/auth_form.load new file mode 100644 index 0000000..91e9507 --- /dev/null +++ b/files/modules/auth_form.load @@ -0,0 +1,2 @@ +# Depends: session authn_core +LoadModule auth_form_module /usr/lib/apache2/modules/mod_auth_form.so diff --git a/files/modules/authn_anon.load b/files/modules/authn_anon.load new file mode 100644 index 0000000..331922a --- /dev/null +++ b/files/modules/authn_anon.load @@ -0,0 +1 @@ +LoadModule authn_anon_module /usr/lib/apache2/modules/mod_authn_anon.so diff --git a/files/modules/authn_core.load b/files/modules/authn_core.load new file mode 100644 index 0000000..446074f --- /dev/null +++ b/files/modules/authn_core.load @@ -0,0 +1 @@ +LoadModule authn_core_module /usr/lib/apache2/modules/mod_authn_core.so diff --git a/files/modules/authn_dbd.load b/files/modules/authn_dbd.load new file mode 100644 index 0000000..d517af3 --- /dev/null +++ b/files/modules/authn_dbd.load @@ -0,0 +1,2 @@ +# Depends: dbd +LoadModule authn_dbd_module /usr/lib/apache2/modules/mod_authn_dbd.so diff --git a/files/modules/authn_dbm.load b/files/modules/authn_dbm.load new file mode 100644 index 0000000..c39d41b --- /dev/null +++ b/files/modules/authn_dbm.load @@ -0,0 +1 @@ +LoadModule authn_dbm_module /usr/lib/apache2/modules/mod_authn_dbm.so diff --git a/files/modules/authn_file.load b/files/modules/authn_file.load new file mode 100644 index 0000000..9f13b35 --- /dev/null +++ b/files/modules/authn_file.load @@ -0,0 +1 @@ +LoadModule authn_file_module /usr/lib/apache2/modules/mod_authn_file.so diff --git a/files/modules/authn_socache.load b/files/modules/authn_socache.load new file mode 100644 index 0000000..786232d --- /dev/null +++ b/files/modules/authn_socache.load @@ -0,0 +1 @@ +LoadModule authn_socache_module /usr/lib/apache2/modules/mod_authn_socache.so diff --git a/files/modules/authnz_fcgi.load b/files/modules/authnz_fcgi.load new file mode 100644 index 0000000..69d757c --- /dev/null +++ b/files/modules/authnz_fcgi.load @@ -0,0 +1 @@ +LoadModule authnz_fcgi_module /usr/lib/apache2/modules/mod_authnz_fcgi.so diff --git a/files/modules/authnz_ldap.load b/files/modules/authnz_ldap.load new file mode 100644 index 0000000..c56d4dc --- /dev/null +++ b/files/modules/authnz_ldap.load @@ -0,0 +1,2 @@ +# Depends: ldap +LoadModule authnz_ldap_module /usr/lib/apache2/modules/mod_authnz_ldap.so diff --git a/files/modules/authz_core.load b/files/modules/authz_core.load new file mode 100644 index 0000000..5499bf3 --- /dev/null +++ b/files/modules/authz_core.load @@ -0,0 +1 @@ +LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so diff --git a/files/modules/authz_dbd.load b/files/modules/authz_dbd.load new file mode 100644 index 0000000..cf82cae --- /dev/null +++ b/files/modules/authz_dbd.load @@ -0,0 +1,2 @@ +# Depends: dbd authz_core +LoadModule authz_dbd_module /usr/lib/apache2/modules/mod_authz_dbd.so diff --git a/files/modules/authz_dbm.load b/files/modules/authz_dbm.load new file mode 100644 index 0000000..6db4831 --- /dev/null +++ b/files/modules/authz_dbm.load @@ -0,0 +1,2 @@ +# Depends: authz_core +LoadModule authz_dbm_module /usr/lib/apache2/modules/mod_authz_dbm.so diff --git a/files/modules/authz_groupfile.load b/files/modules/authz_groupfile.load new file mode 100644 index 0000000..eda3d21 --- /dev/null +++ b/files/modules/authz_groupfile.load @@ -0,0 +1,2 @@ +# Depends: authz_core +LoadModule authz_groupfile_module /usr/lib/apache2/modules/mod_authz_groupfile.so diff --git a/files/modules/authz_host.load b/files/modules/authz_host.load new file mode 100644 index 0000000..f8cf87a --- /dev/null +++ b/files/modules/authz_host.load @@ -0,0 +1,2 @@ +# Depends: authz_core +LoadModule authz_host_module /usr/lib/apache2/modules/mod_authz_host.so diff --git a/files/modules/authz_owner.load b/files/modules/authz_owner.load new file mode 100644 index 0000000..cbad3b5 --- /dev/null +++ b/files/modules/authz_owner.load @@ -0,0 +1 @@ +LoadModule authz_owner_module /usr/lib/apache2/modules/mod_authz_owner.so diff --git a/files/modules/authz_user.load b/files/modules/authz_user.load new file mode 100644 index 0000000..e47c40c --- /dev/null +++ b/files/modules/authz_user.load @@ -0,0 +1,2 @@ +# Depends: authz_core +LoadModule authz_user_module /usr/lib/apache2/modules/mod_authz_user.so diff --git a/files/modules/autoindex.conf b/files/modules/autoindex.conf new file mode 100644 index 0000000..f6cf45f --- /dev/null +++ b/files/modules/autoindex.conf @@ -0,0 +1,96 @@ + + # Directives controlling the display of server-generated directory listings. + + # + # IndexOptions: Controls the appearance of server-generated directory + # listings. + # Remove/replace the "Charset=UTF-8" if you don't use UTF-8 for your filenames. + IndexOptions FancyIndexing VersionSort HTMLTable NameWidth=* DescriptionWidth=* Charset=UTF-8 + + # + # AddIcon* directives tell the server which icon to show for different + # files or filename extensions. These are only displayed for + # FancyIndexed directories. + AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip x-bzip2 + + AddIconByType (TXT,/icons/text.gif) text/* + AddIconByType (IMG,/icons/image2.gif) image/* + AddIconByType (SND,/icons/sound2.gif) audio/* + AddIconByType (VID,/icons/movie.gif) video/* + + AddIcon /icons/binary.gif .bin .exe + AddIcon /icons/binhex.gif .hqx + AddIcon /icons/tar.gif .tar + AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv + AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip + AddIcon /icons/a.gif .ps .ai .eps + AddIcon /icons/layout.gif .html .shtml .htm .pdf + AddIcon /icons/text.gif .txt + AddIcon /icons/c.gif .c + AddIcon /icons/p.gif .pl .py + AddIcon /icons/f.gif .for + AddIcon /icons/dvi.gif .dvi + AddIcon /icons/uuencoded.gif .uu + AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl + AddIcon /icons/tex.gif .tex + # It's a suffix rule, so simply matching "core" matches "score" as well ! + AddIcon /icons/bomb.gif /core + AddIcon (SND,/icons/sound2.gif) .ogg + AddIcon (VID,/icons/movie.gif) .ogm + + AddIcon /icons/back.gif .. + AddIcon /icons/hand.right.gif README + AddIcon /icons/folder.gif ^^DIRECTORY^^ + AddIcon /icons/blank.gif ^^BLANKICON^^ + + # Default icons for OpenDocument format + AddIcon /icons/odf6odt-20x22.png .odt + AddIcon /icons/odf6ods-20x22.png .ods + AddIcon /icons/odf6odp-20x22.png .odp + AddIcon /icons/odf6odg-20x22.png .odg + AddIcon /icons/odf6odc-20x22.png .odc + AddIcon /icons/odf6odf-20x22.png .odf + AddIcon /icons/odf6odb-20x22.png .odb + AddIcon /icons/odf6odi-20x22.png .odi + AddIcon /icons/odf6odm-20x22.png .odm + + AddIcon /icons/odf6ott-20x22.png .ott + AddIcon /icons/odf6ots-20x22.png .ots + AddIcon /icons/odf6otp-20x22.png .otp + AddIcon /icons/odf6otg-20x22.png .otg + AddIcon /icons/odf6otc-20x22.png .otc + AddIcon /icons/odf6otf-20x22.png .otf + AddIcon /icons/odf6oti-20x22.png .oti + AddIcon /icons/odf6oth-20x22.png .oth + + # + # DefaultIcon is which icon to show for files which do not have an icon + # explicitly set. + DefaultIcon /icons/unknown.gif + + # + # AddDescription allows you to place a short description after a file in + # server-generated indexes. These are only displayed for FancyIndexed + # directories. + # Format: AddDescription "description" filename + #AddDescription "GZIP compressed document" .gz + #AddDescription "tar archive" .tar + #AddDescription "GZIP compressed tar archive" .tgz + + # + # ReadmeName is the name of the README file the server will look for by + # default, and append to directory listings. + # + # HeaderName is the name of a file which should be prepended to + # directory indexes + ReadmeName README.html + HeaderName HEADER.html + + # + # IndexIgnore is a set of filenames which directory indexing should ignore + # and not include in the listing. Shell-style wildcarding is permitted. + IndexIgnore .??* *~ *# RCS CVS *,v *,t + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/autoindex.load b/files/modules/autoindex.load new file mode 100644 index 0000000..82328b9 --- /dev/null +++ b/files/modules/autoindex.load @@ -0,0 +1 @@ +LoadModule autoindex_module /usr/lib/apache2/modules/mod_autoindex.so diff --git a/files/modules/buffer.load b/files/modules/buffer.load new file mode 100644 index 0000000..f5e7423 --- /dev/null +++ b/files/modules/buffer.load @@ -0,0 +1 @@ +LoadModule buffer_module /usr/lib/apache2/modules/mod_buffer.so diff --git a/files/modules/cache.load b/files/modules/cache.load new file mode 100644 index 0000000..e3189a0 --- /dev/null +++ b/files/modules/cache.load @@ -0,0 +1 @@ +LoadModule cache_module /usr/lib/apache2/modules/mod_cache.so diff --git a/files/modules/cache_disk.conf b/files/modules/cache_disk.conf new file mode 100644 index 0000000..a69beae --- /dev/null +++ b/files/modules/cache_disk.conf @@ -0,0 +1,27 @@ + + + # cache cleaning is done by htcacheclean, which can be configured in + # /etc/default/apache2 + # + # For further information, see the comments in that file, + # /usr/share/doc/apache2/README.Debian, and the htcacheclean(8) + # man page. + + # This path must be the same as the one in /etc/default/apache2 + CacheRoot /var/cache/apache2/mod_cache_disk + + # This will also cache local documents. It usually makes more sense to + # put this into the configuration for just one virtual host. + #CacheEnable disk / + + + # The result of CacheDirLevels * CacheDirLength must not be higher than + # 20. Moreover, pay attention on file system limits. Some file systems + # do not support more than a certain number of inodes and + # subdirectories (e.g. 32000 for ext3) + CacheDirLevels 2 + CacheDirLength 1 + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/cache_disk.load b/files/modules/cache_disk.load new file mode 100644 index 0000000..3b641a1 --- /dev/null +++ b/files/modules/cache_disk.load @@ -0,0 +1,2 @@ +# Depends: cache +LoadModule cache_disk_module /usr/lib/apache2/modules/mod_cache_disk.so diff --git a/files/modules/cache_socache.load b/files/modules/cache_socache.load new file mode 100644 index 0000000..47a3dcb --- /dev/null +++ b/files/modules/cache_socache.load @@ -0,0 +1,2 @@ +# Depends: cache +LoadModule cache_socache_module /usr/lib/apache2/modules/mod_cache_socache.so diff --git a/files/modules/cgi.load b/files/modules/cgi.load new file mode 100644 index 0000000..1be9048 --- /dev/null +++ b/files/modules/cgi.load @@ -0,0 +1 @@ +LoadModule cgi_module /usr/lib/apache2/modules/mod_cgi.so diff --git a/files/modules/cgid.conf b/files/modules/cgid.conf new file mode 100644 index 0000000..762f00b --- /dev/null +++ b/files/modules/cgid.conf @@ -0,0 +1,4 @@ +# Socket for cgid communication +ScriptSock ${APACHE_RUN_DIR}/cgisock + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/cgid.load b/files/modules/cgid.load new file mode 100644 index 0000000..e036f7d --- /dev/null +++ b/files/modules/cgid.load @@ -0,0 +1 @@ +LoadModule cgid_module /usr/lib/apache2/modules/mod_cgid.so diff --git a/files/modules/charset_lite.load b/files/modules/charset_lite.load new file mode 100644 index 0000000..f137a57 --- /dev/null +++ b/files/modules/charset_lite.load @@ -0,0 +1 @@ +LoadModule charset_lite_module /usr/lib/apache2/modules/mod_charset_lite.so diff --git a/files/modules/data.load b/files/modules/data.load new file mode 100644 index 0000000..ef488a4 --- /dev/null +++ b/files/modules/data.load @@ -0,0 +1 @@ +LoadModule data_module /usr/lib/apache2/modules/mod_data.so diff --git a/files/modules/dav.load b/files/modules/dav.load new file mode 100644 index 0000000..6f6d1bb --- /dev/null +++ b/files/modules/dav.load @@ -0,0 +1 @@ +LoadModule dav_module /usr/lib/apache2/modules/mod_dav.so diff --git a/files/modules/dav_fs.conf b/files/modules/dav_fs.conf new file mode 100644 index 0000000..8499551 --- /dev/null +++ b/files/modules/dav_fs.conf @@ -0,0 +1,3 @@ +DAVLockDB ${APACHE_LOCK_DIR}/DAVLock + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/dav_fs.load b/files/modules/dav_fs.load new file mode 100644 index 0000000..ba2a3f8 --- /dev/null +++ b/files/modules/dav_fs.load @@ -0,0 +1,2 @@ +# Depends: dav +LoadModule dav_fs_module /usr/lib/apache2/modules/mod_dav_fs.so diff --git a/files/modules/dav_lock.load b/files/modules/dav_lock.load new file mode 100644 index 0000000..ba0703e --- /dev/null +++ b/files/modules/dav_lock.load @@ -0,0 +1 @@ +LoadModule dav_lock_module /usr/lib/apache2/modules/mod_dav_lock.so diff --git a/files/modules/dbd.load b/files/modules/dbd.load new file mode 100644 index 0000000..5495f2a --- /dev/null +++ b/files/modules/dbd.load @@ -0,0 +1 @@ +LoadModule dbd_module /usr/lib/apache2/modules/mod_dbd.so diff --git a/files/modules/deflate.conf b/files/modules/deflate.conf new file mode 100644 index 0000000..91d7f33 --- /dev/null +++ b/files/modules/deflate.conf @@ -0,0 +1,14 @@ + + + # these are known to be safe with MSIE 6 + AddOutputFilterByType DEFLATE text/html text/plain text/xml + + # everything else may cause problems with MSIE 6 + AddOutputFilterByType DEFLATE text/css + AddOutputFilterByType DEFLATE application/x-javascript application/javascript application/ecmascript + AddOutputFilterByType DEFLATE application/rss+xml + AddOutputFilterByType DEFLATE application/xml + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/deflate.load b/files/modules/deflate.load new file mode 100644 index 0000000..3873ffc --- /dev/null +++ b/files/modules/deflate.load @@ -0,0 +1,2 @@ +# Depends: filter +LoadModule deflate_module /usr/lib/apache2/modules/mod_deflate.so diff --git a/files/modules/dialup.load b/files/modules/dialup.load new file mode 100644 index 0000000..3c4a636 --- /dev/null +++ b/files/modules/dialup.load @@ -0,0 +1 @@ +LoadModule dialup_module /usr/lib/apache2/modules/mod_dialup.so diff --git a/files/modules/dir.conf b/files/modules/dir.conf new file mode 100644 index 0000000..21a0e8b --- /dev/null +++ b/files/modules/dir.conf @@ -0,0 +1,5 @@ + + DirectoryIndex index.html index.cgi index.pl index.php index.xhtml index.htm + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/dir.load b/files/modules/dir.load new file mode 100644 index 0000000..e5b5d92 --- /dev/null +++ b/files/modules/dir.load @@ -0,0 +1 @@ +LoadModule dir_module /usr/lib/apache2/modules/mod_dir.so diff --git a/files/modules/dump_io.load b/files/modules/dump_io.load new file mode 100644 index 0000000..561c24b --- /dev/null +++ b/files/modules/dump_io.load @@ -0,0 +1 @@ +LoadModule dumpio_module /usr/lib/apache2/modules/mod_dumpio.so diff --git a/files/modules/echo.load b/files/modules/echo.load new file mode 100644 index 0000000..42cae85 --- /dev/null +++ b/files/modules/echo.load @@ -0,0 +1 @@ +LoadModule echo_module /usr/lib/apache2/modules/mod_echo.so diff --git a/files/modules/env.load b/files/modules/env.load new file mode 100644 index 0000000..8bf608d --- /dev/null +++ b/files/modules/env.load @@ -0,0 +1 @@ +LoadModule env_module /usr/lib/apache2/modules/mod_env.so diff --git a/files/modules/expires.load b/files/modules/expires.load new file mode 100644 index 0000000..092acab --- /dev/null +++ b/files/modules/expires.load @@ -0,0 +1 @@ +LoadModule expires_module /usr/lib/apache2/modules/mod_expires.so diff --git a/files/modules/ext_filter.load b/files/modules/ext_filter.load new file mode 100644 index 0000000..b3a1596 --- /dev/null +++ b/files/modules/ext_filter.load @@ -0,0 +1 @@ +LoadModule ext_filter_module /usr/lib/apache2/modules/mod_ext_filter.so diff --git a/files/modules/file_cache.load b/files/modules/file_cache.load new file mode 100644 index 0000000..32c0a56 --- /dev/null +++ b/files/modules/file_cache.load @@ -0,0 +1,2 @@ +# Depends: cache +LoadModule file_cache_module /usr/lib/apache2/modules/mod_file_cache.so diff --git a/files/modules/filter.load b/files/modules/filter.load new file mode 100644 index 0000000..94c4270 --- /dev/null +++ b/files/modules/filter.load @@ -0,0 +1 @@ +LoadModule filter_module /usr/lib/apache2/modules/mod_filter.so diff --git a/files/modules/headers.load b/files/modules/headers.load new file mode 100644 index 0000000..e4497e5 --- /dev/null +++ b/files/modules/headers.load @@ -0,0 +1 @@ +LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so diff --git a/files/modules/heartbeat.load b/files/modules/heartbeat.load new file mode 100644 index 0000000..208686c --- /dev/null +++ b/files/modules/heartbeat.load @@ -0,0 +1,3 @@ +# This module depends on mod_watchdog to be loaded before. In Debian, this +# module is statically linked. +LoadModule heartbeat_module /usr/lib/apache2/modules/mod_heartbeat.so diff --git a/files/modules/heartmonitor.load b/files/modules/heartmonitor.load new file mode 100644 index 0000000..e5deba7 --- /dev/null +++ b/files/modules/heartmonitor.load @@ -0,0 +1,3 @@ +# This module depends on mod_watchdog to be loaded before. In Debian, this +# module is statically linked. +LoadModule heartmonitor_module /usr/lib/apache2/modules/mod_heartmonitor.so diff --git a/files/modules/ident.load b/files/modules/ident.load new file mode 100644 index 0000000..f7c4c3c --- /dev/null +++ b/files/modules/ident.load @@ -0,0 +1 @@ +LoadModule ident_module /usr/lib/apache2/modules/mod_ident.so diff --git a/files/modules/include.load b/files/modules/include.load new file mode 100644 index 0000000..dc4359a --- /dev/null +++ b/files/modules/include.load @@ -0,0 +1,2 @@ +# Depends: mime +LoadModule include_module /usr/lib/apache2/modules/mod_include.so diff --git a/files/modules/info.conf b/files/modules/info.conf new file mode 100644 index 0000000..78a0649 --- /dev/null +++ b/files/modules/info.conf @@ -0,0 +1,15 @@ + + + # Allow remote server configuration reports, with the URL of + # http://servername/server-info (requires that mod_info.c be loaded). + # Uncomment and change the "192.0.2.0/24" to allow access from other hosts. + # + + SetHandler server-info + Require local + #Require ip 192.0.2.0/24 + + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/info.load b/files/modules/info.load new file mode 100644 index 0000000..c71efcc --- /dev/null +++ b/files/modules/info.load @@ -0,0 +1 @@ +LoadModule info_module /usr/lib/apache2/modules/mod_info.so diff --git a/files/modules/lbmethod_bybusyness.load b/files/modules/lbmethod_bybusyness.load new file mode 100644 index 0000000..cf894a3 --- /dev/null +++ b/files/modules/lbmethod_bybusyness.load @@ -0,0 +1,2 @@ +# Depends: proxy_balancer +LoadModule lbmethod_bybusyness_module /usr/lib/apache2/modules/mod_lbmethod_bybusyness.so diff --git a/files/modules/lbmethod_byrequests.load b/files/modules/lbmethod_byrequests.load new file mode 100644 index 0000000..cdd8fc5 --- /dev/null +++ b/files/modules/lbmethod_byrequests.load @@ -0,0 +1,2 @@ +# Depends: proxy_balancer +LoadModule lbmethod_byrequests_module /usr/lib/apache2/modules/mod_lbmethod_byrequests.so diff --git a/files/modules/lbmethod_bytraffic.load b/files/modules/lbmethod_bytraffic.load new file mode 100644 index 0000000..dabbe72 --- /dev/null +++ b/files/modules/lbmethod_bytraffic.load @@ -0,0 +1,2 @@ +# Depends: proxy_balancer +LoadModule lbmethod_bytraffic_module /usr/lib/apache2/modules/mod_lbmethod_bytraffic.so diff --git a/files/modules/lbmethod_heartbeat.load b/files/modules/lbmethod_heartbeat.load new file mode 100644 index 0000000..2200f3a --- /dev/null +++ b/files/modules/lbmethod_heartbeat.load @@ -0,0 +1,2 @@ +# Depends: proxy_balancer +LoadModule lbmethod_heartbeat_module /usr/lib/apache2/modules/mod_lbmethod_heartbeat.so diff --git a/files/modules/ldap.conf b/files/modules/ldap.conf new file mode 100644 index 0000000..697b70b --- /dev/null +++ b/files/modules/ldap.conf @@ -0,0 +1,6 @@ + + SetHandler ldap-status + Require local + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/ldap.load b/files/modules/ldap.load new file mode 100644 index 0000000..f9d38a3 --- /dev/null +++ b/files/modules/ldap.load @@ -0,0 +1 @@ +LoadModule ldap_module /usr/lib/apache2/modules/mod_ldap.so diff --git a/files/modules/log_debug.load b/files/modules/log_debug.load new file mode 100644 index 0000000..1a27fa8 --- /dev/null +++ b/files/modules/log_debug.load @@ -0,0 +1 @@ +LoadModule log_debug_module /usr/lib/apache2/modules/mod_log_debug.so diff --git a/files/modules/log_forensic.load b/files/modules/log_forensic.load new file mode 100644 index 0000000..9116a3d --- /dev/null +++ b/files/modules/log_forensic.load @@ -0,0 +1 @@ +LoadModule log_forensic_module /usr/lib/apache2/modules/mod_log_forensic.so diff --git a/files/modules/lua.load b/files/modules/lua.load new file mode 100644 index 0000000..0b639f5 --- /dev/null +++ b/files/modules/lua.load @@ -0,0 +1 @@ +LoadModule lua_module /usr/lib/apache2/modules/mod_lua.so diff --git a/files/modules/macro.load b/files/modules/macro.load new file mode 100644 index 0000000..3a72864 --- /dev/null +++ b/files/modules/macro.load @@ -0,0 +1 @@ +LoadModule macro_module /usr/lib/apache2/modules/mod_macro.so diff --git a/files/modules/mime.conf b/files/modules/mime.conf new file mode 100644 index 0000000..d1b1d89 --- /dev/null +++ b/files/modules/mime.conf @@ -0,0 +1,249 @@ + + + # + # TypesConfig points to the file containing the list of mappings from + # filename extension to MIME-type. + # + TypesConfig /etc/mime.types + + # + # AddType allows you to add to or override the MIME configuration + # file mime.types for specific file types. + # + #AddType application/x-gzip .tgz + # + # AddEncoding allows you to have certain browsers uncompress + # information on the fly. Note: Not all browsers support this. + # Despite the name similarity, the following Add* directives have + # nothing to do with the FancyIndexing customization directives above. + # + #AddEncoding x-compress .Z + #AddEncoding x-gzip .gz .tgz + #AddEncoding x-bzip2 .bz2 + # + # If the AddEncoding directives above are commented-out, then you + # probably should define those extensions to indicate media types: + # + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + AddType application/x-bzip2 .bz2 + + # + # DefaultLanguage and AddLanguage allows you to specify the language of + # a document. You can then use content negotiation to give a browser a + # file in a language the user can understand. + # + # Specify a default language. This means that all data + # going out without a specific language tag (see below) will + # be marked with this one. You probably do NOT want to set + # this unless you are sure it is correct for all cases. + # + # * It is generally better to not mark a page as + # * being a certain language than marking it with the wrong + # * language! + # + # DefaultLanguage nl + # + # Note 1: The suffix does not have to be the same as the language + # keyword --- those with documents in Polish (whose net-standard + # language code is pl) may wish to use "AddLanguage pl .po" to + # avoid the ambiguity with the common suffix for perl scripts. + # + # Note 2: The example entries below illustrate that in some cases + # the two character 'Language' abbreviation is not identical to + # the two character 'Country' code for its country, + # E.g. 'Danmark/dk' versus 'Danish/da'. + # + # Note 3: In the case of 'ltz' we violate the RFC by using a three char + # specifier. There is 'work in progress' to fix this and get + # the reference data for rfc1766 cleaned up. + # + # Catalan (ca) - Croatian (hr) - Czech (cs) - Danish (da) - Dutch (nl) + # English (en) - Esperanto (eo) - Estonian (et) - French (fr) - German (de) + # Greek-Modern (el) - Hebrew (he) - Italian (it) - Japanese (ja) + # Korean (ko) - Luxembourgeois* (ltz) - Norwegian Nynorsk (nn) + # Norwegian (no) - Polish (pl) - Portugese (pt) + # Brazilian Portuguese (pt-BR) - Russian (ru) - Swedish (sv) + # Simplified Chinese (zh-CN) - Spanish (es) - Traditional Chinese (zh-TW) + # + AddLanguage am .amh + AddLanguage ar .ara + AddLanguage be .be + AddLanguage bg .bg + AddLanguage bn .bn + AddLanguage br .br + AddLanguage bs .bs + AddLanguage ca .ca + AddLanguage cs .cz .cs + AddLanguage cy .cy + AddLanguage da .dk + AddLanguage de .de + AddLanguage dz .dz + AddLanguage el .el + AddLanguage en .en + AddLanguage eo .eo + # es is ecmascript in /etc/mime.types + RemoveType es + AddLanguage es .es + AddLanguage et .et + AddLanguage eu .eu + AddLanguage fa .fa + AddLanguage fi .fi + AddLanguage fr .fr + AddLanguage ga .ga + AddLanguage gl .glg + AddLanguage gu .gu + AddLanguage he .he + AddLanguage hi .hi + AddLanguage hr .hr + AddLanguage hu .hu + AddLanguage hy .hy + AddLanguage id .id + AddLanguage is .is + AddLanguage it .it + AddLanguage ja .ja + AddLanguage ka .ka + AddLanguage kk .kk + AddLanguage km .km + AddLanguage kn .kn + AddLanguage ko .ko + AddLanguage ku .ku + AddLanguage lo .lo + AddLanguage lt .lt + AddLanguage ltz .ltz + AddLanguage lv .lv + AddLanguage mg .mg + AddLanguage mk .mk + AddLanguage ml .ml + AddLanguage mr .mr + AddLanguage ms .msa + AddLanguage nb .nob + AddLanguage ne .ne + AddLanguage nl .nl + AddLanguage nn .nn + AddLanguage no .no + AddLanguage pa .pa + AddLanguage pl .po + AddLanguage pt-BR .pt-br + AddLanguage pt .pt + AddLanguage ro .ro + AddLanguage ru .ru + AddLanguage sa .sa + AddLanguage se .se + AddLanguage si .si + AddLanguage sk .sk + AddLanguage sl .sl + AddLanguage sq .sq + AddLanguage sr .sr + AddLanguage sv .sv + AddLanguage ta .ta + AddLanguage te .te + AddLanguage th .th + AddLanguage tl .tl + RemoveType tr + # tr is troff in /etc/mime.types + AddLanguage tr .tr + AddLanguage uk .uk + AddLanguage ur .ur + AddLanguage vi .vi + AddLanguage wo .wo + AddLanguage xh .xh + AddLanguage zh-CN .zh-cn + AddLanguage zh-TW .zh-tw + + # + # Commonly used filename extensions to character sets. You probably + # want to avoid clashes with the language extensions, unless you + # are good at carefully testing your setup after each change. + # See http://www.iana.org/assignments/character-sets for the + # official list of charset names and their respective RFCs. + # + AddCharset us-ascii .ascii .us-ascii + AddCharset ISO-8859-1 .iso8859-1 .latin1 + AddCharset ISO-8859-2 .iso8859-2 .latin2 .cen + AddCharset ISO-8859-3 .iso8859-3 .latin3 + AddCharset ISO-8859-4 .iso8859-4 .latin4 + AddCharset ISO-8859-5 .iso8859-5 .cyr .iso-ru + AddCharset ISO-8859-6 .iso8859-6 .arb .arabic + AddCharset ISO-8859-7 .iso8859-7 .grk .greek + AddCharset ISO-8859-8 .iso8859-8 .heb .hebrew + AddCharset ISO-8859-9 .iso8859-9 .latin5 .trk + AddCharset ISO-8859-10 .iso8859-10 .latin6 + AddCharset ISO-8859-13 .iso8859-13 + AddCharset ISO-8859-14 .iso8859-14 .latin8 + AddCharset ISO-8859-15 .iso8859-15 .latin9 + AddCharset ISO-8859-16 .iso8859-16 .latin10 + AddCharset ISO-2022-JP .iso2022-jp .jis + AddCharset ISO-2022-KR .iso2022-kr .kis + AddCharset ISO-2022-CN .iso2022-cn .cis + AddCharset Big5 .Big5 .big5 .b5 + AddCharset cn-Big5 .cn-big5 + # For russian, more than one charset is used (depends on client, mostly): + AddCharset WINDOWS-1251 .cp-1251 .win-1251 + AddCharset CP866 .cp866 + AddCharset KOI8 .koi8 + AddCharset KOI8-E .koi8-e + AddCharset KOI8-r .koi8-r .koi8-ru + AddCharset KOI8-U .koi8-u + AddCharset KOI8-ru .koi8-uk .ua + AddCharset ISO-10646-UCS-2 .ucs2 + AddCharset ISO-10646-UCS-4 .ucs4 + AddCharset UTF-7 .utf7 + AddCharset UTF-8 .utf8 + AddCharset UTF-16 .utf16 + AddCharset UTF-16BE .utf16be + AddCharset UTF-16LE .utf16le + AddCharset UTF-32 .utf32 + AddCharset UTF-32BE .utf32be + AddCharset UTF-32LE .utf32le + AddCharset euc-cn .euc-cn + AddCharset euc-gb .euc-gb + AddCharset euc-jp .euc-jp + AddCharset euc-kr .euc-kr + #Not sure how euc-tw got in - IANA doesn't list it??? + AddCharset EUC-TW .euc-tw + AddCharset gb2312 .gb2312 .gb + AddCharset iso-10646-ucs-2 .ucs-2 .iso-10646-ucs-2 + AddCharset iso-10646-ucs-4 .ucs-4 .iso-10646-ucs-4 + AddCharset shift_jis .shift_jis .sjis + AddCharset BRF .brf + + # + # AddHandler allows you to map certain file extensions to "handlers": + # actions unrelated to filetype. These can be either built into the server + # or added with the Action directive (see below) + # + # To use CGI scripts outside of ScriptAliased directories: + # (You will also need to add "ExecCGI" to the "Options" directive.) + # + #AddHandler cgi-script .cgi + + # + # For files that include their own HTTP headers: + # + #AddHandler send-as-is asis + + # + # For server-parsed imagemap files: + # + #AddHandler imap-file map + + # + # For type maps (negotiated resources): + # (This is enabled by default to allow the Apache "It Worked" page + # to be distributed in multiple languages.) + # + AddHandler type-map var + + # + # Filters allow you to process content before it is sent to the client. + # + # To parse .shtml files for server-side includes (SSI): + # (You will also need to add "Includes" to the "Options" directive.) + # + AddType text/html .shtml + AddOutputFilter INCLUDES .shtml + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/mime.load b/files/modules/mime.load new file mode 100644 index 0000000..d908fd6 --- /dev/null +++ b/files/modules/mime.load @@ -0,0 +1 @@ +LoadModule mime_module /usr/lib/apache2/modules/mod_mime.so diff --git a/files/modules/mime_magic.conf b/files/modules/mime_magic.conf new file mode 100644 index 0000000..12ed930 --- /dev/null +++ b/files/modules/mime_magic.conf @@ -0,0 +1,5 @@ + + MIMEMagicFile /etc/apache2/magic + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/mime_magic.load b/files/modules/mime_magic.load new file mode 100644 index 0000000..42357db --- /dev/null +++ b/files/modules/mime_magic.load @@ -0,0 +1 @@ +LoadModule mime_magic_module /usr/lib/apache2/modules/mod_mime_magic.so diff --git a/files/modules/mod_ssl.conf b/files/modules/mod_ssl.conf new file mode 100755 index 0000000..e69de29 diff --git a/files/modules/mod_ssl.load b/files/modules/mod_ssl.load new file mode 100755 index 0000000..ff861da --- /dev/null +++ b/files/modules/mod_ssl.load @@ -0,0 +1 @@ +LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so diff --git a/files/modules/mpm_event.conf b/files/modules/mpm_event.conf new file mode 100644 index 0000000..2003d07 --- /dev/null +++ b/files/modules/mpm_event.conf @@ -0,0 +1,18 @@ +# event MPM +# StartServers: initial number of server processes to start +# MinSpareThreads: minimum number of worker threads which are kept spare +# MaxSpareThreads: maximum number of worker threads which are kept spare +# ThreadsPerChild: constant number of worker threads in each server process +# MaxRequestWorkers: maximum number of worker threads +# MaxConnectionsPerChild: maximum number of requests a server process serves + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/mpm_event.load b/files/modules/mpm_event.load new file mode 100644 index 0000000..00d970b --- /dev/null +++ b/files/modules/mpm_event.load @@ -0,0 +1,2 @@ +# Conflicts: mpm_worker mpm_prefork +LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so diff --git a/files/modules/mpm_prefork.conf b/files/modules/mpm_prefork.conf new file mode 100644 index 0000000..2642e3b --- /dev/null +++ b/files/modules/mpm_prefork.conf @@ -0,0 +1,16 @@ +# prefork MPM +# StartServers: number of server processes to start +# MinSpareServers: minimum number of server processes which are kept spare +# MaxSpareServers: maximum number of server processes which are kept spare +# MaxRequestWorkers: maximum number of server processes allowed to start +# MaxConnectionsPerChild: maximum number of requests a server process serves + + + StartServers 5 + MinSpareServers 5 + MaxSpareServers 10 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/mpm_prefork.load b/files/modules/mpm_prefork.load new file mode 100644 index 0000000..05da7a3 --- /dev/null +++ b/files/modules/mpm_prefork.load @@ -0,0 +1,2 @@ +# Conflicts: mpm_event mpm_worker +LoadModule mpm_prefork_module /usr/lib/apache2/modules/mod_mpm_prefork.so diff --git a/files/modules/mpm_worker.conf b/files/modules/mpm_worker.conf new file mode 100644 index 0000000..de5831e --- /dev/null +++ b/files/modules/mpm_worker.conf @@ -0,0 +1,22 @@ +# worker MPM +# StartServers: initial number of server processes to start +# MinSpareThreads: minimum number of worker threads which are kept spare +# MaxSpareThreads: maximum number of worker threads which are kept spare +# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a +# graceful restart. ThreadLimit can only be changed by stopping +# and starting Apache. +# ThreadsPerChild: constant number of worker threads in each server process +# MaxRequestWorkers: maximum number of threads +# MaxConnectionsPerChild: maximum number of requests a server process serves + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/mpm_worker.load b/files/modules/mpm_worker.load new file mode 100644 index 0000000..f9d0c4d --- /dev/null +++ b/files/modules/mpm_worker.load @@ -0,0 +1,2 @@ +# Conflicts: mpm_event mpm_prefork +LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so diff --git a/files/modules/negotiation.conf b/files/modules/negotiation.conf new file mode 100644 index 0000000..409b3bf --- /dev/null +++ b/files/modules/negotiation.conf @@ -0,0 +1,20 @@ + + + # LanguagePriority allows you to give precedence to some languages + # in case of a tie during content negotiation. + # + # Just list the languages in decreasing order of preference. We have + # more or less alphabetized them here. You probably want to change this. + # + LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv tr zh-CN zh-TW + + # + # ForceLanguagePriority allows you to serve a result page rather than + # MULTIPLE CHOICES (Prefer) [in case of a tie] or NOT ACCEPTABLE (Fallback) + # [in case no accepted languages matched the available variants] + # + ForceLanguagePriority Prefer Fallback + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/negotiation.load b/files/modules/negotiation.load new file mode 100644 index 0000000..8df5711 --- /dev/null +++ b/files/modules/negotiation.load @@ -0,0 +1 @@ +LoadModule negotiation_module /usr/lib/apache2/modules/mod_negotiation.so diff --git a/files/modules/ports.conf b/files/modules/ports.conf new file mode 100755 index 0000000..504eb16 --- /dev/null +++ b/files/modules/ports.conf @@ -0,0 +1,15 @@ +# have to change the VirtualHost statement in +# /etc/apache2/sites-enabled/000-default.conf + +Listen 8080 + + + Listen 443 + + + + Listen 443 + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet + diff --git a/files/modules/proxy.conf b/files/modules/proxy.conf new file mode 100644 index 0000000..cf4a9fb --- /dev/null +++ b/files/modules/proxy.conf @@ -0,0 +1,27 @@ + + + # If you want to use apache2 as a forward proxy, uncomment the + # 'ProxyRequests On' line and the block below. + # WARNING: Be careful to restrict access inside the block. + # Open proxy servers are dangerous both to your network and to the + # Internet at large. + # + # If you only want to use apache2 as a reverse proxy/gateway in + # front of some web application server, you DON'T need + # 'ProxyRequests On'. + + #ProxyRequests On + # + # AddDefaultCharset off + # Require all denied + # #Require local + # + + # Enable/disable the handling of HTTP/1.1 "Via:" headers. + # ("Full" adds the server version; "Block" removes all outgoing Via: headers) + # Set to one of: Off | On | Full | Block + #ProxyVia Off + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/proxy.load b/files/modules/proxy.load new file mode 100644 index 0000000..8828205 --- /dev/null +++ b/files/modules/proxy.load @@ -0,0 +1 @@ +LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so diff --git a/files/modules/proxy_ajp.load b/files/modules/proxy_ajp.load new file mode 100644 index 0000000..adc0c86 --- /dev/null +++ b/files/modules/proxy_ajp.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_ajp_module /usr/lib/apache2/modules/mod_proxy_ajp.so diff --git a/files/modules/proxy_balancer.conf b/files/modules/proxy_balancer.conf new file mode 100644 index 0000000..16199f6 --- /dev/null +++ b/files/modules/proxy_balancer.conf @@ -0,0 +1,15 @@ + + + # Balancer manager enables dynamic update of balancer members + # (needs mod_status). Uncomment to enable. + # + # + # + # SetHandler balancer-manager + # Require local + # + # + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/proxy_balancer.load b/files/modules/proxy_balancer.load new file mode 100644 index 0000000..2baa546 --- /dev/null +++ b/files/modules/proxy_balancer.load @@ -0,0 +1,2 @@ +# Depends: proxy alias slotmem_shm +LoadModule proxy_balancer_module /usr/lib/apache2/modules/mod_proxy_balancer.so diff --git a/files/modules/proxy_connect.load b/files/modules/proxy_connect.load new file mode 100644 index 0000000..df81372 --- /dev/null +++ b/files/modules/proxy_connect.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_connect_module /usr/lib/apache2/modules/mod_proxy_connect.so diff --git a/files/modules/proxy_express.load b/files/modules/proxy_express.load new file mode 100644 index 0000000..81d3a2f --- /dev/null +++ b/files/modules/proxy_express.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_express_module /usr/lib/apache2/modules/mod_proxy_express.so diff --git a/files/modules/proxy_fcgi.load b/files/modules/proxy_fcgi.load new file mode 100644 index 0000000..067c87e --- /dev/null +++ b/files/modules/proxy_fcgi.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_fcgi_module /usr/lib/apache2/modules/mod_proxy_fcgi.so diff --git a/files/modules/proxy_fdpass.load b/files/modules/proxy_fdpass.load new file mode 100644 index 0000000..b27bcdb --- /dev/null +++ b/files/modules/proxy_fdpass.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_fdpass_module /usr/lib/apache2/modules/mod_proxy_fdpass.so diff --git a/files/modules/proxy_ftp.conf b/files/modules/proxy_ftp.conf new file mode 100644 index 0000000..29fec56 --- /dev/null +++ b/files/modules/proxy_ftp.conf @@ -0,0 +1,8 @@ + + + # Define the character set for proxied FTP listings. Default is ISO-8859-1 + ProxyFtpDirCharset UTF-8 + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/proxy_ftp.load b/files/modules/proxy_ftp.load new file mode 100644 index 0000000..8f2a197 --- /dev/null +++ b/files/modules/proxy_ftp.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_ftp_module /usr/lib/apache2/modules/mod_proxy_ftp.so diff --git a/files/modules/proxy_html.conf b/files/modules/proxy_html.conf new file mode 100644 index 0000000..14692ad --- /dev/null +++ b/files/modules/proxy_html.conf @@ -0,0 +1,75 @@ +# Configuration example. +# +# For detailed information about these directives see +# +# and for mod_xml2enc see +# +# + +# All knowledge of HTML links has been removed from the mod_proxy_html +# code itself, and is instead read from httpd.conf (or included file) +# at server startup. So you MUST declare it. This will normally be +# at top level, but can also be used in a . +# +# Here's the declaration for W3C HTML 4.01 and XHTML 1.0 + +ProxyHTMLLinks a href +ProxyHTMLLinks area href +ProxyHTMLLinks link href +ProxyHTMLLinks img src longdesc usemap +ProxyHTMLLinks object classid codebase data usemap +ProxyHTMLLinks q cite +ProxyHTMLLinks blockquote cite +ProxyHTMLLinks ins cite +ProxyHTMLLinks del cite +ProxyHTMLLinks form action +ProxyHTMLLinks input src usemap +ProxyHTMLLinks head profile +ProxyHTMLLinks base href +ProxyHTMLLinks script src for + +# To support scripting events (with ProxyHTMLExtended On), +# you'll need to declare them too. + +ProxyHTMLEvents onclick ondblclick onmousedown onmouseup \ + onmouseover onmousemove onmouseout onkeypress \ + onkeydown onkeyup onfocus onblur onload \ + onunload onsubmit onreset onselect onchange + +# If you need to support legacy (pre-1998, aka "transitional") HTML or XHTML, +# you'll need to uncomment the following deprecated link attributes. +# Note that these are enabled in earlier mod_proxy_html versions +# +# ProxyHTMLLinks frame src longdesc +# ProxyHTMLLinks iframe src longdesc +# ProxyHTMLLinks body background +# ProxyHTMLLinks applet codebase +# +# If you're dealing with proprietary HTML variants, +# declare your own URL attributes here as required. +# +# ProxyHTMLLinks myelement myattr otherattr +# +########### +# EXAMPLE # +########### +# +# To define the URL /my-gateway/ as a gateway to an appserver with address +# http://some.app.intranet/ on a private network, after loading the +# modules and including this configuration file: +# +# ProxyRequests Off <-- this is an important security setting +# ProxyPass /my-gateway/ http://some.app.intranet/ +# +# ProxyPassReverse / +# ProxyHTMLEnable On +# ProxyHTMLURLMap http://some.app.intranet/ /my-gateway/ +# ProxyHTMLURLMap / /my-gateway/ +# +# +# Many (though not all) real-life setups are more complex. +# +# See the documentation at +# http://apache.webthing.com/mod_proxy_html/ +# and the tutorial at +# http://www.apachetutor.org/admin/reverseproxies diff --git a/files/modules/proxy_html.load b/files/modules/proxy_html.load new file mode 100644 index 0000000..d8b248e --- /dev/null +++ b/files/modules/proxy_html.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_html_module /usr/lib/apache2/modules/mod_proxy_html.so diff --git a/files/modules/proxy_http.load b/files/modules/proxy_http.load new file mode 100644 index 0000000..a3ffe02 --- /dev/null +++ b/files/modules/proxy_http.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.so diff --git a/files/modules/proxy_scgi.load b/files/modules/proxy_scgi.load new file mode 100644 index 0000000..fb6b0d7 --- /dev/null +++ b/files/modules/proxy_scgi.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_scgi_module /usr/lib/apache2/modules/mod_proxy_scgi.so diff --git a/files/modules/proxy_wstunnel.load b/files/modules/proxy_wstunnel.load new file mode 100644 index 0000000..fe6589d --- /dev/null +++ b/files/modules/proxy_wstunnel.load @@ -0,0 +1,2 @@ +# Depends: proxy +LoadModule proxy_wstunnel_module /usr/lib/apache2/modules/mod_proxy_wstunnel.so diff --git a/files/modules/ratelimit.load b/files/modules/ratelimit.load new file mode 100644 index 0000000..fc933d7 --- /dev/null +++ b/files/modules/ratelimit.load @@ -0,0 +1,2 @@ +# Depends: env +LoadModule ratelimit_module /usr/lib/apache2/modules/mod_ratelimit.so diff --git a/files/modules/reflector.load b/files/modules/reflector.load new file mode 100644 index 0000000..91701d8 --- /dev/null +++ b/files/modules/reflector.load @@ -0,0 +1 @@ +LoadModule reflector_module /usr/lib/apache2/modules/mod_reflector.so diff --git a/files/modules/remoteip.load b/files/modules/remoteip.load new file mode 100644 index 0000000..a771554 --- /dev/null +++ b/files/modules/remoteip.load @@ -0,0 +1 @@ +LoadModule remoteip_module /usr/lib/apache2/modules/mod_remoteip.so diff --git a/files/modules/reqtimeout.conf b/files/modules/reqtimeout.conf new file mode 100644 index 0000000..534cd88 --- /dev/null +++ b/files/modules/reqtimeout.conf @@ -0,0 +1,27 @@ + + + # mod_reqtimeout limits the time waiting on the client to prevent an + # attacker from causing a denial of service by opening many connections + # but not sending requests. This file tries to give a sensible default + # configuration, but it may be necessary to tune the timeout values to + # the actual situation. Note that it is also possible to configure + # mod_reqtimeout per virtual host. + + + # Wait max 20 seconds for the first byte of the request line+headers + # From then, require a minimum data rate of 500 bytes/s, but don't + # wait longer than 40 seconds in total. + # Note: Lower timeouts may make sense on non-ssl virtual hosts but can + # cause problem with ssl enabled virtual hosts: This timeout includes + # the time a browser may need to fetch the CRL for the certificate. If + # the CRL server is not reachable, it may take more than 10 seconds + # until the browser gives up. + RequestReadTimeout header=20-40,minrate=500 + + # Wait max 10 seconds for the first byte of the request body (if any) + # From then, require a minimum data rate of 500 bytes/s + RequestReadTimeout body=10,minrate=500 + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/reqtimeout.load b/files/modules/reqtimeout.load new file mode 100644 index 0000000..8b2c5e6 --- /dev/null +++ b/files/modules/reqtimeout.load @@ -0,0 +1 @@ +LoadModule reqtimeout_module /usr/lib/apache2/modules/mod_reqtimeout.so diff --git a/files/modules/request.load b/files/modules/request.load new file mode 100644 index 0000000..6727f5a --- /dev/null +++ b/files/modules/request.load @@ -0,0 +1 @@ +LoadModule request_module /usr/lib/apache2/modules/mod_request.so diff --git a/files/modules/rewrite.load b/files/modules/rewrite.load new file mode 100644 index 0000000..b32f162 --- /dev/null +++ b/files/modules/rewrite.load @@ -0,0 +1 @@ +LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so diff --git a/files/modules/sed.load b/files/modules/sed.load new file mode 100644 index 0000000..cf5d9af --- /dev/null +++ b/files/modules/sed.load @@ -0,0 +1 @@ +LoadModule sed_module /usr/lib/apache2/modules/mod_sed.so diff --git a/files/modules/session.load b/files/modules/session.load new file mode 100644 index 0000000..f518c96 --- /dev/null +++ b/files/modules/session.load @@ -0,0 +1 @@ +LoadModule session_module /usr/lib/apache2/modules/mod_session.so diff --git a/files/modules/session_cookie.load b/files/modules/session_cookie.load new file mode 100644 index 0000000..8cffd89 --- /dev/null +++ b/files/modules/session_cookie.load @@ -0,0 +1,2 @@ +# Depends: session +LoadModule session_cookie_module /usr/lib/apache2/modules/mod_session_cookie.so diff --git a/files/modules/session_crypto.load b/files/modules/session_crypto.load new file mode 100644 index 0000000..b3f7a95 --- /dev/null +++ b/files/modules/session_crypto.load @@ -0,0 +1,2 @@ +# Depends: session +LoadModule session_crypto_module /usr/lib/apache2/modules/mod_session_crypto.so diff --git a/files/modules/session_dbd.load b/files/modules/session_dbd.load new file mode 100644 index 0000000..18fa4a4 --- /dev/null +++ b/files/modules/session_dbd.load @@ -0,0 +1,2 @@ +# Depends: session +LoadModule session_dbd_module /usr/lib/apache2/modules/mod_session_dbd.so diff --git a/files/modules/setenvif.conf b/files/modules/setenvif.conf new file mode 100644 index 0000000..b6c4cc4 --- /dev/null +++ b/files/modules/setenvif.conf @@ -0,0 +1,32 @@ + + + # + # The following directives modify normal HTTP response behavior to + # handle known problems with browser implementations. + # + BrowserMatch "Mozilla/2" nokeepalive + BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0 + BrowserMatch "RealPlayer 4\.0" force-response-1.0 + BrowserMatch "Java/1\.0" force-response-1.0 + BrowserMatch "JDK/1\.0" force-response-1.0 + + # + # The following directive disables redirects on non-GET requests for + # a directory that does not include the trailing slash. This fixes a + # problem with Microsoft WebFolders which does not appropriately handle + # redirects for folders with DAV methods. + # Same deal with Apple's DAV filesystem and Gnome VFS support for DAV. + # + BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully + BrowserMatch "MS FrontPage" redirect-carefully + BrowserMatch "^WebDrive" redirect-carefully + BrowserMatch "^WebDAVFS/1.[012]" redirect-carefully + BrowserMatch "^gnome-vfs/1.0" redirect-carefully + BrowserMatch "^gvfs/1" redirect-carefully + BrowserMatch "^XML Spy" redirect-carefully + BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully + BrowserMatch " Konqueror/4" redirect-carefully + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/setenvif.load b/files/modules/setenvif.load new file mode 100644 index 0000000..bcb5c52 --- /dev/null +++ b/files/modules/setenvif.load @@ -0,0 +1 @@ +LoadModule setenvif_module /usr/lib/apache2/modules/mod_setenvif.so diff --git a/files/modules/slotmem_plain.load b/files/modules/slotmem_plain.load new file mode 100644 index 0000000..0a68121 --- /dev/null +++ b/files/modules/slotmem_plain.load @@ -0,0 +1 @@ +LoadModule slotmem_plain_module /usr/lib/apache2/modules/mod_slotmem_plain.so diff --git a/files/modules/slotmem_shm.load b/files/modules/slotmem_shm.load new file mode 100644 index 0000000..48ba402 --- /dev/null +++ b/files/modules/slotmem_shm.load @@ -0,0 +1 @@ +LoadModule slotmem_shm_module /usr/lib/apache2/modules/mod_slotmem_shm.so diff --git a/files/modules/socache_dbm.load b/files/modules/socache_dbm.load new file mode 100644 index 0000000..c759d35 --- /dev/null +++ b/files/modules/socache_dbm.load @@ -0,0 +1 @@ +LoadModule socache_dbm_module /usr/lib/apache2/modules/mod_socache_dbm.so diff --git a/files/modules/socache_memcache.load b/files/modules/socache_memcache.load new file mode 100644 index 0000000..15d1ad0 --- /dev/null +++ b/files/modules/socache_memcache.load @@ -0,0 +1 @@ +LoadModule socache_memcache_module /usr/lib/apache2/modules/mod_socache_memcache.so diff --git a/files/modules/socache_shmcb.load b/files/modules/socache_shmcb.load new file mode 100644 index 0000000..542a2b2 --- /dev/null +++ b/files/modules/socache_shmcb.load @@ -0,0 +1 @@ +LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so diff --git a/files/modules/speling.load b/files/modules/speling.load new file mode 100644 index 0000000..423e401 --- /dev/null +++ b/files/modules/speling.load @@ -0,0 +1 @@ +LoadModule speling_module /usr/lib/apache2/modules/mod_speling.so diff --git a/files/modules/ssl.conf b/files/modules/ssl.conf new file mode 100644 index 0000000..1dc4eea --- /dev/null +++ b/files/modules/ssl.conf @@ -0,0 +1,85 @@ + + + # Pseudo Random Number Generator (PRNG): + # Configure one or more sources to seed the PRNG of the SSL library. + # The seed data should be of good random quality. + # WARNING! On some platforms /dev/random blocks if not enough entropy + # is available. This means you then cannot use the /dev/random device + # because it would lead to very long connection times (as long as + # it requires to make more entropy available). But usually those + # platforms additionally provide a /dev/urandom device which doesn't + # block. So, if available, use this one instead. Read the mod_ssl User + # Manual for more details. + # + SSLRandomSeed startup builtin + SSLRandomSeed startup file:/dev/urandom 512 + SSLRandomSeed connect builtin + SSLRandomSeed connect file:/dev/urandom 512 + + ## + ## SSL Global Context + ## + ## All SSL configuration in this context applies both to + ## the main server and all SSL-enabled virtual hosts. + ## + + # + # Some MIME-types for downloading Certificates and CRLs + # + AddType application/x-x509-ca-cert .crt + AddType application/x-pkcs7-crl .crl + + # Pass Phrase Dialog: + # Configure the pass phrase gathering process. + # The filtering dialog program (`builtin' is a internal + # terminal dialog) has to provide the pass phrase on stdout. + SSLPassPhraseDialog exec:/usr/share/apache2/ask-for-passphrase + + # Inter-Process Session Cache: + # Configure the SSL Session Cache: First the mechanism + # to use and second the expiring timeout (in seconds). + # (The mechanism dbm has known memory leaks and should not be used). + #SSLSessionCache dbm:${APACHE_RUN_DIR}/ssl_scache + SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000) + SSLSessionCacheTimeout 300 + + # Semaphore: + # Configure the path to the mutual exclusion semaphore the + # SSL engine uses internally for inter-process synchronization. + # (Disabled by default, the global Mutex directive consolidates by default + # this) + #Mutex file:${APACHE_LOCK_DIR}/ssl_mutex ssl-cache + + + # SSL Cipher Suite: + # List the ciphers that the client is permitted to negotiate. See the + # ciphers(1) man page from the openssl package for list of all available + # options. + # Enable only secure ciphers: + SSLCipherSuite HIGH:!aNULL + + # SSL server cipher order preference: + # Use server priorities for cipher algorithm choice. + # Clients may prefer lower grade encryption. You should enable this + # option if you want to enforce stronger encryption, and can afford + # the CPU cost, and did not override SSLCipherSuite in a way that puts + # insecure ciphers first. + # Default: Off + #SSLHonorCipherOrder on + + # The protocols to enable. + # Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2 + # SSL v2 is no longer supported + SSLProtocol all -SSLv3 + + # Allow insecure renegotiation with clients which do not yet support the + # secure renegotiation protocol. Default: Off + #SSLInsecureRenegotiation on + + # Whether to forbid non-SNI clients to access name based virtual hosts. + # Default: Off + #SSLStrictSNIVHostCheck On + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/ssl.load b/files/modules/ssl.load new file mode 100644 index 0000000..3d2336a --- /dev/null +++ b/files/modules/ssl.load @@ -0,0 +1,2 @@ +# Depends: setenvif mime socache_shmcb +LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so diff --git a/files/modules/status.conf b/files/modules/status.conf new file mode 100644 index 0000000..5f53ba7 --- /dev/null +++ b/files/modules/status.conf @@ -0,0 +1,29 @@ + + # Allow server status reports generated by mod_status, + # with the URL of http://servername/server-status + # Uncomment and change the "192.0.2.0/24" to allow access from other hosts. + + + SetHandler server-status + Require local + #Require ip 192.0.2.0/24 + + + # Keep track of extended status information for each request + ExtendedStatus On + + # Determine if mod_status displays the first 63 characters of a request or + # the last 63, assuming the request itself is greater than 63 chars. + # Default: Off + #SeeRequestTail On + + + + # Show Proxy LoadBalancer status in mod_status + ProxyStatus On + + + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/status.load b/files/modules/status.load new file mode 100644 index 0000000..9efd636 --- /dev/null +++ b/files/modules/status.load @@ -0,0 +1 @@ +LoadModule status_module /usr/lib/apache2/modules/mod_status.so diff --git a/files/modules/substitute.load b/files/modules/substitute.load new file mode 100644 index 0000000..df361cd --- /dev/null +++ b/files/modules/substitute.load @@ -0,0 +1 @@ +LoadModule substitute_module /usr/lib/apache2/modules/mod_substitute.so diff --git a/files/modules/suexec.load b/files/modules/suexec.load new file mode 100644 index 0000000..116858b --- /dev/null +++ b/files/modules/suexec.load @@ -0,0 +1 @@ +LoadModule suexec_module /usr/lib/apache2/modules/mod_suexec.so diff --git a/files/modules/unique_id.load b/files/modules/unique_id.load new file mode 100644 index 0000000..2d0c9eb --- /dev/null +++ b/files/modules/unique_id.load @@ -0,0 +1 @@ +LoadModule unique_id_module /usr/lib/apache2/modules/mod_unique_id.so diff --git a/files/modules/userdir.conf b/files/modules/userdir.conf new file mode 100644 index 0000000..a6c0da6 --- /dev/null +++ b/files/modules/userdir.conf @@ -0,0 +1,17 @@ + + UserDir public_html + UserDir disabled root + + + AllowOverride FileInfo AuthConfig Limit Indexes + Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec + + Require all granted + + + Require all denied + + + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/files/modules/userdir.load b/files/modules/userdir.load new file mode 100644 index 0000000..0cfc621 --- /dev/null +++ b/files/modules/userdir.load @@ -0,0 +1 @@ +LoadModule userdir_module /usr/lib/apache2/modules/mod_userdir.so diff --git a/files/modules/usertrack.load b/files/modules/usertrack.load new file mode 100644 index 0000000..25918b5 --- /dev/null +++ b/files/modules/usertrack.load @@ -0,0 +1 @@ +LoadModule usertrack_module /usr/lib/apache2/modules/mod_usertrack.so diff --git a/files/modules/vhost_alias.load b/files/modules/vhost_alias.load new file mode 100644 index 0000000..4fe4cb6 --- /dev/null +++ b/files/modules/vhost_alias.load @@ -0,0 +1 @@ +LoadModule vhost_alias_module /usr/lib/apache2/modules/mod_vhost_alias.so diff --git a/files/modules/xml2enc.load b/files/modules/xml2enc.load new file mode 100644 index 0000000..98cfa18 --- /dev/null +++ b/files/modules/xml2enc.load @@ -0,0 +1 @@ +LoadModule xml2enc_module /usr/lib/apache2/modules/mod_xml2enc.so diff --git a/run.docker-compose.sh b/run.docker-compose.sh new file mode 100755 index 0000000..00f4025 --- /dev/null +++ b/run.docker-compose.sh @@ -0,0 +1,15 @@ + +sudo mkdir -p /var/lab/registry/modules +sudo mkdir -p /var/lab/registry/etc/apache2 +sudo mkdir -p /var/lab/registry-data + +sudo chown zeus.zeus -R /var/lab/registry/modules + +sudo chown www-data.www-data -R /var/lab/registry/modules +sudo chown www-data.www-data -R /var/lab/registry/etc/apache2 + +sudo cp -rf files/modules/* /var/lab/registry/modules +sudo cp -rf files/etc/apache2/* /var/lab/registry/etc/apache2 + +docker-compose up -d +