Use default sandboxing for the blogs-update service

[chef.git] / cookbooks / matomo / templates / default / apache.erb

diff --git a/cookbooks/matomo/templates/default/apache.erb b/cookbooks/matomo/templates/default/apache.erb
index 45b8bc0f305aecdc07374791eb91e2fcec4c245e..5fd21d6023b375807d8b32cf4f28f82dac6903a8 100644 (file)
--- a/cookbooks/matomo/templates/default/apache.erb
+++ b/cookbooks/matomo/templates/default/apache.erb
@@ -2,9 +2,6 @@
 
 <VirtualHost *:443>
        ServerName matomo.openstreetmap.org
-       ServerAlias matomo.osm.org
-       ServerAlias piwik.openstreetmap.org
-       ServerAlias piwik.osm.org
        ServerAdmin webmaster@openstreetmap.org
 
        SSLEngine on
@@ -24,6 +21,22 @@
        Redirect 403 /tmp/
 </VirtualHost>
 
+<VirtualHost *:443>
+       ServerName matomo.osm.org
+       ServerAlias piwik.openstreetmap.org
+       ServerAlias piwik.osm.org
+       ServerAdmin webmaster@openstreetmap.org
+
+       SSLEngine on
+       SSLCertificateFile /etc/ssl/certs/matomo.openstreetmap.org.pem
+       SSLCertificateKeyFile /etc/ssl/private/matomo.openstreetmap.org.key
+
+       CustomLog /var/log/apache2/matomo.openstreetmap.org-access.log combined
+       ErrorLog /var/log/apache2/matomo.openstreetmap.org-error.log
+
+       RedirectPermanent / https://matomo.openstreetmap.org/
+</VirtualHost>
+
 <VirtualHost *:80>
        ServerName matomo.openstreetmap.org
        ServerAlias matomo.osm.org
@@ -44,23 +57,32 @@
        ExpiresActive On
        RewriteEngine on
 
-       RewriteCond "%{HTTP:Accept-encoding}" "gzip"
+       RewriteCond "%{HTTP:Accept-Encoding}" "br"
+       RewriteCond "%{REQUEST_FILENAME}\.br" -s
+       RewriteRule "^(.*)\.js" "$1\.js\.br" [QSA]
+
+       RewriteCond "%{HTTP:Accept-Encoding}" "gzip"
        RewriteCond "%{REQUEST_FILENAME}\.gz" -s
        RewriteRule "^(.*)\.js" "$1\.js\.gz" [QSA]
 
-       RewriteRule "\.js\.gz$"  "-" [T=text/javascript,E=no-gzip:1]
+       RewriteRule "\.js\.(br|gz)$"  "-" [T=text/javascript,E=no-gzip:1,E=no-brotli:1]
+
+       <FilesMatch "\.js\.br$">
+               Header append Content-Encoding br
+               Header append Vary Accept-Encoding
+       </FilesMatch>
 
        <FilesMatch "\.js\.gz$">
                Header append Content-Encoding gzip
                Header append Vary Accept-Encoding
        </FilesMatch>
 
-       <FilesMatch "(\.js|\.js\.gz)$">
+       <FilesMatch "(\.js|\.js\.gz|\.js\.br)$">
                ExpiresDefault "access plus 1 week"
                Header set Cache-Control "max-age=604800"
        </FilesMatch>
 
         <FilesMatch ".+\.ph(ar|p|tml)$">
-                SetHandler "proxy:unix:/run/php/matomo.openstreetmap.org.sock|fcgi://127.0.0.1"
+                SetHandler "proxy:unix:/run/php/php-matomo.openstreetmap.org-fpm.sock|fcgi://127.0.0.1"
         </FilesMatch>
 </Directory>