Fix logging of basic authentication use

[chef.git] / cookbooks / mailman / templates / default / apache.erb

diff --git a/cookbooks/mailman/templates/default/apache.erb b/cookbooks/mailman/templates/default/apache.erb
index 2262c3fa280b4f19d68c921dcafebca51536c47b..1e4917d637c71f8b7957f64733ed67079b5399ec 100644 (file)
--- a/cookbooks/mailman/templates/default/apache.erb
+++ b/cookbooks/mailman/templates/default/apache.erb
@@ -1,62 +1,91 @@
 # DO NOT EDIT - This file is being maintained by Chef
 
 <VirtualHost *:80>
-        ServerName <%= @name %>
-        ServerAdmin postmaster@openstreetmap.org
+  ServerName <%= @name %>
+<% @aliases.each do |alias_name| -%>
+  ServerAlias <%= alias_name %>
+<% end -%>
+  ServerAdmin postmaster@openstreetmap.org
 
-        CustomLog /var/log/apache2/<%= @name %>-access.log combined
-        ErrorLog /var/log/apache2/<%= @name %>-error.log
+  CustomLog /var/log/apache2/<%= @name %>-access.log combined
+  ErrorLog /var/log/apache2/<%= @name %>-error.log
 
-        RedirectPermanent / https://<%= @name %>/
+  RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
+  RedirectPermanent / https://<%= @name %>/
 </VirtualHost>
+<% unless @aliases.empty? -%>
 
 <VirtualHost *:443>
-       ServerName <%= @name %>
-       ServerAdmin postmaster@openstreetmap.org
-       ServerSignature On
-
-        SSLEngine on
-
-       CustomLog /var/log/apache2/<%= @name %>-access.log combined
-       ErrorLog /var/log/apache2/<%= @name %>-error.log
-       LogLevel warn
-
-        AddDefaultCharset off
-
-       DocumentRoot <%= @directory %>
-
-       RewriteEngine on
-
-       RewriteCond %{HTTP_REFERER} www\.mailbait\.info
-       RewriteRule . - [F,L]
-
-       RedirectMatch ^/$ /listinfo
-       RedirectMatch ^/cgi-bin/mailman/(.*)$ /$1
-
-       <Directory /var/lib/mailman/archives/>
-               Options Indexes FollowSymLinks
-               AllowOverride None
-               Require all granted
-       </Directory>
-
-       Alias /pipermail/ /var/lib/mailman/archives/public/
-       Alias /images/ /usr/share/images/mailman/
-
-       ScriptAlias /admin /usr/lib/cgi-bin/mailman/admin
-       ScriptAlias /admindb /usr/lib/cgi-bin/mailman/admindb
-       ScriptAlias /confirm /usr/lib/cgi-bin/mailman/confirm
-       ScriptAlias /create /usr/lib/cgi-bin/mailman/create
-       ScriptAlias /edithtml /usr/lib/cgi-bin/mailman/edithtml
-       ScriptAlias /listinfo /usr/lib/cgi-bin/mailman/listinfo
-       ScriptAlias /options /usr/lib/cgi-bin/mailman/options
-       ScriptAlias /private /usr/lib/cgi-bin/mailman/private
-       ScriptAlias /rmlist /usr/lib/cgi-bin/mailman/rmlist
-       ScriptAlias /roster /usr/lib/cgi-bin/mailman/roster
-       ScriptAlias /subscribe /usr/lib/cgi-bin/mailman/subscribe
-       ScriptAlias /mailman/ /usr/lib/cgi-bin/mailman/
-
-       <Location ~ "/pipermail/([^/]+)/(2004|2005|2006|2007|2008|2009|2010|2011|2012|2013|2014)">
-               ExpiresActive On
-               ExpiresDefault "access plus 180 days"
-       </Location>
+  ServerName <%= @aliases.first %>
+<% @aliases.drop(1).each do |alias_name| -%>
+  ServerAlias <%= alias_name %>
+<% end -%>
+  ServerAdmin webmaster@openstreetmap.org
+
+  SSLEngine on
+  SSLCertificateFile /etc/ssl/certs/<%= @name %>.pem
+  SSLCertificateKeyFile /etc/ssl/private/<%= @name %>.key
+
+  CustomLog /var/log/apache2/<%= @name %>-access.log combined
+  ErrorLog /var/log/apache2/<%= @name %>-error.log
+
+  RedirectPermanent / https://<%= @name %>/
+</VirtualHost>
+<% end -%>
+
+<VirtualHost *:443>
+  ServerName <%= @name %>
+  ServerAdmin postmaster@openstreetmap.org
+  ServerSignature On
+
+  SSLEngine on
+  SSLCertificateFile /etc/ssl/certs/<%= @name %>.pem
+  SSLCertificateKeyFile /etc/ssl/private/<%= @name %>.key
+
+  CustomLog /var/log/apache2/<%= @name %>-access.log combined
+  ErrorLog /var/log/apache2/<%= @name %>-error.log
+  LogLevel warn
+
+  AddDefaultCharset off
+
+  DocumentRoot <%= @directory %>
+
+  RewriteEngine on
+
+  RewriteCond %{HTTP_REFERER} www\.mailbait\.info
+  RewriteRule . - [F,L]
+
+  RedirectMatch ^/$ /listinfo
+  RedirectMatch ^/cgi-bin/mailman/(.*)$ /$1
+
+  # Redact list archive entries per request of talk moderators
+  RedirectMatch 451 ^/pipermail/talk/2022-July/(087645|087647)\.html$
+
+  <Directory /var/lib/mailman/archives/>
+         Options Indexes FollowSymLinks
+    AllowOverride None
+    Require all granted
+  </Directory>
+
+  Alias /pipermail/ /var/lib/mailman/archives/public/
+  Alias /images/mailman/ /usr/share/images/mailman/
+  Alias /images/ /usr/share/images/mailman/
+
+  ScriptAlias /admin /usr/lib/cgi-bin/mailman/admin
+  ScriptAlias /admindb /usr/lib/cgi-bin/mailman/admindb
+  ScriptAlias /confirm /usr/lib/cgi-bin/mailman/confirm
+  ScriptAlias /create /usr/lib/cgi-bin/mailman/create
+  ScriptAlias /edithtml /usr/lib/cgi-bin/mailman/edithtml
+  ScriptAlias /listinfo /usr/lib/cgi-bin/mailman/listinfo
+  ScriptAlias /options /usr/lib/cgi-bin/mailman/options
+  ScriptAlias /private /usr/lib/cgi-bin/mailman/private
+  ScriptAlias /rmlist /usr/lib/cgi-bin/mailman/rmlist
+  ScriptAlias /roster /usr/lib/cgi-bin/mailman/roster
+  ScriptAlias /subscribe /usr/lib/cgi-bin/mailman/subscribe
+  ScriptAlias /mailman/ /usr/lib/cgi-bin/mailman/
+
+  <Location ~ "/pipermail/([^/]+)/(2004|2005|2006|2007|2008|2009|2010|2011|2012|2013|2014|2015|2016|2017|2018|2019|2020|2021)">
+    ExpiresActive On
+    ExpiresDefault "access plus 180 days"
+  </Location>
 </VirtualHost>