Difference between revisions of "Apache Configuration for EPrints with Anubis"

From EPrints Documentation
Jump to: navigation, search
(Added initial Apache config)
 
m (→‎EPrints Level Perl Module Isolation (EPRINTS_PATH/cfg/perl_module_isolation.conf))
 
(24 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
=== HTTPS Virtualhost (EPRINTS_PATH/archives/ARCHIVE_ID/ssl/securevhost.conf) ===
+
__NOTOC__
−
* Assumes inclusion of all archives' ssl/securevhost.conf's from /etc/httpd/conf.d/eprints.conf or /etc/apache2/sites-enabled/eprints.conf.   
+
This page details the Apache configuration required to deploy [https://github.com/techaroHQ/anubis Anubis] proxy within EPrints using [https://github.com/techaroHQ/anubis this ingredient] and running its bin/generate_apacheconf_for_anubis, as of 24th August 2026.
−
* Replaces path of EPrints, ID of the archive and hostname of repository archive with EPRINTS_PATH, ARCHIVE_ID and HOSTNAME respectively.
+
 
−
* Includes Shibboleth configuration that is ultimately exempted from being proxied via Anubis
+
The following placeholders are used within these configuration files:
−
* Logs names based on those used for RHEL-based Linux, changes may be required for Debian-based Linux (e.g Ubuntu).
+
{| class="wikitable"
 +
! Placeholder !! Description !! Example
 +
|-
 +
| '''ADMIN_EMAIL''' || The email address for the EPrints repository archive's administrator. || <code>eprints@example.org</code>
 +
|-
 +
| '''ARCHIVE_ID''' || ID of the specific EPrints repository archive. || <code>example_org</code>
 +
|-
 +
| '''EPRINTS_PATH''' || Path to EPrints installation. || <code>/opt/eprints3</code>
 +
|-
 +
| '''HOSTNAME''' || The hostname of the EPrints repository archive. || <code>eprints.example.org</code>
 +
|}
 +
 
 +
== Organisation of Configuration ==
 +
There are is a simplification in this set of configuration with the substituting the include of ARCHIVE_ID.logging.conf in the archive level internal (port 3000) HTTP VirtualHost (EPRINTS_PATH/cfg/apache/ARCHIVE_ID.conf) for the actual configuration in that file.
 +
* [[#Apache Level Configuration (/etc/httpd/conf.d/eprints.conf or /etc/apache2/sites-enabled/eprints.conf)|Apache Level Configuration (/etc/httpd/conf.d/eprints.conf or /etc/apache2/sites-enabled/eprints.conf)]]
 +
** [[#EPrints Level HTTP VirtualHosts (EPRINTS_PATH/cfg/apache.conf)|EPrints Level HTTP VirtualHosts (EPRINTS_PATH/cfg/apache.conf)]]
 +
*** [[#EPrints Level Perl Module Isolation (EPRINTS_PATH/cfg/perl_module_isolation.conf)|EPrints Level Perl Module Isolation (EPRINTS_PATH/cfg/perl_module_isolation.conf)]]
 +
*** [[#Archive Level HTTP VirtualHost HTTP-to-HTTPS Redirect (ARCHIVE_ID_http_to_https_redirect.conf)|Archive Level HTTP VirtualHost HTTP-to-HTTPS Redirect (ARCHIVE_ID_http_to_https_redirect.conf)]]
 +
*** [[#Archive Level Internal (port 3000) HTTP VirtualHost (EPRINTS_PATH/cfg/apache/ARCHIVE_ID.conf)|Archive Level Internal (port 3000) HTTP VirtualHost (EPRINTS_PATH/cfg/apache/ARCHIVE_ID.conf)]]
 +
** [[#Archive Level HTTPS Virtualhost (EPRINTS_PATH/archives/ARCHIVE_ID/ssl/securevhost.conf)|Archive Level HTTPS Virtualhost (EPRINTS_PATH/archives/ARCHIVE_ID/ssl/securevhost.conf)]]
 +
*** [[#Archive Level Anubis Proxy for HTTPS VirtualHost (EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf)|Archive Level Anubis Proxy for HTTPS VirtualHost (EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf)]]
 +
 
 +
=== Apache Level Configuration (/etc/httpd/conf.d/eprints.conf or /etc/apache2/sites-enabled/eprints.conf) ===
 +
Include EPRINTS_PATH/cfg/apache.conf
 +
Include EPRINTS_PATH/archives/*/securevhost.conf
 +
 
 +
=== EPrints Level HTTP VirtualHosts (EPRINTS_PATH/cfg/apache.conf) ===
 +
#
 +
# apache.conf include file for EPrints
 +
#
 +
# Any changes made here will be lost if you run generate_apacheconf_for_anubis
 +
  #
 +
 +
# EPrints moved to be internal-only, with Anubis facing the outside world.
 +
Listen [::1]:3000
 +
 +
# Load the perl modules & repository configurations
 +
PerlSwitches -IEPRINTS_PATH/perl_lib
 +
Include EPRINTS_PATH/cfg/perl_module_isolation.conf
 +
 +
# Load the per-repository apache configuration
 +
Include EPRINTS_PATH/cfg/apache/*.conf
  
−
  <VirtualHost *:443>
+
=== EPrints Level Perl Module Isolation (EPRINTS_PATH/cfg/perl_module_isolation.conf) ===
 +
  ##This file is included by apache.conf -- Do not edit this file directly.
 +
##You should edit the perl_module_isolation flag in EPRINTS_PATH/perl_lib/EPrints/SystemSettings.pm, then run EPRINTS_PATH/bin/generate_apacheconf --system --replace to regenerate this file.
 
   
 
   
−
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+
  ##The following two lines turn the perl_module_isolation OFF (All repositories now sharing a single perl interpreter and have access to all perl modules.)
 +
PerlModule EPrints
 +
PerlPostConfigHandler +EPrints::post_config_handler
  
−
LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Accept-Language}i\" \"%{Referer}i\" \"%{User-agent}i\" \"%{techaro.lol-anubis-cookie-verification}C\""
+
=== Archive Level HTTP VirtualHost HTTP-to-HTTPS Redirect (ARCHIVE_ID_http_to_https_redirect.conf) ===
−
  ErrorLog   /var/log/httpd/ssl_error_log
+
#
−
  TransferLog /var/log/httpd/ssl_access_log
+
# apache.conf include file for ARCHIVE_ID
−
  LogLevel warn
+
#
 +
# Any changes made here will be lost if you run generate_apacheconf
 +
# or generate_apacheconf for anubis with the --replace option
 +
#
 +
 +
  # The main virtual host for this repository
 +
<VirtualHost *:80>
 +
   ServerName HOSTNAME
 +
 +
  ServerAdmin ADMIN_EMAIL
 +
   
 +
  RedirectPermanent / https://HOSTNAME/
 +
  </VirtualHost>
  
−
  SSLEngine on
+
=== Archive Level Internal (port 3000) HTTP VirtualHost (EPRINTS_PATH/cfg/apache/ARCHIVE_ID.conf) ===
−
  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
+
#
−
  SSLHonorCipherOrder on
+
# apache.conf include file for ARCHIVE_ID
−
  SSLCompression off
+
  #
−
  SSLSessionTickets off
+
  # Any changes made here will be lost if you run generate_apacheconf
−
  SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE- RSA-AES128-GCM-SHA256
+
# or generate_apacheconf_for_anubis with the --replace option
 +
  #
 +
   
 +
  # The main virtual host for this repository
 +
  <VirtualHost *:3000>
 +
  ServerName HOSTNAME
 +
 +
  # This file configures the apache logs of EPrints itself. Only requests passed through anubis to EPrints can make it this far.
 +
  # This file will not be overwritten by generate_apacheconf_for_anubis, so you can modify it.
 +
  LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Accept-Language}i\" \"%{Referer}i\" \"%{User-agent}i\" \"%{techaro.lol-anubis-cookie-verification}C\""
 +
  ErrorLog    /var/log/httpd/eprints_internal_error_log
 +
  TransferLog /var/log/httpd/eprints_internal_access_log
 +
 +
  ServerAdmin ADMIN_EMAIL
 +
 +
  Include EPRINTS_PATH/cfg/perl_module_isolation_vhost.conf
 +
 +
  <Location "">
 +
    PerlSetVar EPrints_ArchiveID ARCHIVE_ID
 +
    PerlSetVar EPrints_Secure yes
 
   
 
   
−
SSLCertificateFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.crt
+
    Options +ExecCGI
−
  SSLCertificateKeyFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.key
+
    <IfModule mod_authz_core.c>
−
  SSLCertificateChainFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.ca-bundle
+
        Require all granted
 +
    </IfModule>
 +
    <IfModule !mod_authz_core.c>
 +
        Order allow,deny
 +
        Allow from all
 +
    </IfModule>
 +
  </Location>
 +
 
 +
  # Set by $c->{max_upload_filesize}
 +
  LimitRequestBody 1073741824
 +
 +
  # Note that PerlTransHandler can't go inside
 +
  # a "Location" block as it occurs before the
 +
  # Location is known.
 +
  PerlTransHandler +EPrints::Apache::Rewrite
 +
   
 +
  # Get the real remote IP back, otherwise all accesses appear to come from ::1
 +
  <IfModule remoteip_module>
 +
    RemoteIPHeader X-Real-Ip
 +
    RemoteIPTrustedProxy ::1
 +
  </IfModule>
 +
  </VirtualHost>
  
−
Include EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf
+
=== Archive Level HTTPS Virtualhost (EPRINTS_PATH/archives/ARCHIVE_ID/ssl/securevhost.conf) ===
 +
* Includes Shibboleth configuration that is ultimately exempted from being proxied via Anubis
 +
* Logs names based on those used for RHEL-based Linux, changes may be required for Debian-based Linux (e.g Ubuntu).
  
−
  Alias /shibboleth EPRINTS_PATH/archives/ARCHIVE_ID/shibboleth
+
  <VirtualHost *:443>
−
<Location "/shibboleth">
+
 
−
  SetHandler perl-script
+
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
−
  PerlHandler ModPerl::Registry
+
−
  PerlSendHeader Off
+
  LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Accept-Language}i\" \"%{Referer}i\" \"%{User-agent}i\" \"%{techaro.lol-anubis-cookie-verification}C\""
−
  Options ExecCGI FollowSymLinks
+
  ErrorLog /var/log/httpd/ssl_error_log
 +
  TransferLog /var/log/httpd/ssl_access_log
 +
  LogLevel warn
 +
 +
  SSLEngine on
 +
  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
 +
  SSLHonorCipherOrder on
 +
  SSLCompression off
 +
  SSLSessionTickets off
 +
  SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE- RSA-AES128-GCM-SHA256
 +
 +
  SSLCertificateFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.crt
 +
  SSLCertificateKeyFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.key
 +
  SSLCertificateChainFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.ca-bundle
 +
 +
  Include EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf
 +
 +
  Alias /shibboleth EPRINTS_PATH/archives/ARCHIVE_ID/shibboleth
 +
  <Location "/shibboleth">
 +
    SetHandler perl-script
 +
    PerlHandler ModPerl::Registry
 +
    PerlSendHeader Off
 +
    Options ExecCGI FollowSymLinks
 
    
 
    
−
  AuthType shibboleth
+
    AuthType shibboleth
−
  ShibRequestSetting requireSession 1
+
    ShibRequestSetting requireSession 1
−
  require shib-session
+
    require shib-session
−
  PerlSetVar EPrints_ArchiveID reading
+
    PerlSetVar EPrints_ArchiveID reading
−
  </Location>
+
  </Location>
 +
   
 +
  <Location /cgi/shibboleth>
 +
    AuthType shibboleth
 +
    ShibRequestSetting requireSession 1
 +
    require shib-session
 +
  </Location>
 +
 +
  PerlTransHandler +EPrints::Apache::Rewrite
 +
 +
</VirtualHost>
 +
 
 +
=== Archive Level Anubis Proxy for HTTPS VirtualHost (EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf) ===
 +
# HTTPS listener that forwards to Anubis
 +
 +
# These headers need to be set or else Anubis will
 +
# throw an "admin misconfiguration" error.
 +
RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR}
 +
RequestHeader set X-Forwarded-Proto "https"
 +
RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s"
 +
 +
ProxyPreserveHost On
 
   
 
   
−
  <Location /cgi/shibboleth>
+
  ProxyRequests Off
−
  AuthType shibboleth
+
ProxyVia Off
−
  ShibRequestSetting requireSession 1
+
  ProxyTimeout 300
−
  require shib-session
 
−
  </Location>
 
 
   
 
   
−
  PerlTransHandler +EPrints::Apache::Rewrite
+
  # don't try and proxy shibboleth.
 +
ProxyPass /Shibboleth.sso !
 +
ProxyPass /shibboleth !
 +
ProxyPass /cgi/shibboleth !
 
   
 
   
−
</VirtualHost>
+
# Replace 8923 with the port Anubis listens on
 +
ProxyPass / http://[::1]:8923/
 +
ProxyPassReverse / http://[::1]:8923/

Latest revision as of 13:29, 24 August 2026

This page details the Apache configuration required to deploy Anubis proxy within EPrints using this ingredient and running its bin/generate_apacheconf_for_anubis, as of 24th August 2026.

The following placeholders are used within these configuration files:

Placeholder Description Example
ADMIN_EMAIL The email address for the EPrints repository archive's administrator. eprints@example.org
ARCHIVE_ID ID of the specific EPrints repository archive. example_org
EPRINTS_PATH Path to EPrints installation. /opt/eprints3
HOSTNAME The hostname of the EPrints repository archive. eprints.example.org

Organisation of Configuration

There are is a simplification in this set of configuration with the substituting the include of ARCHIVE_ID.logging.conf in the archive level internal (port 3000) HTTP VirtualHost (EPRINTS_PATH/cfg/apache/ARCHIVE_ID.conf) for the actual configuration in that file.

Apache Level Configuration (/etc/httpd/conf.d/eprints.conf or /etc/apache2/sites-enabled/eprints.conf)

Include EPRINTS_PATH/cfg/apache.conf
Include EPRINTS_PATH/archives/*/securevhost.conf

EPrints Level HTTP VirtualHosts (EPRINTS_PATH/cfg/apache.conf)

#
# apache.conf include file for EPrints
#
# Any changes made here will be lost if you run generate_apacheconf_for_anubis
#

# EPrints moved to be internal-only, with Anubis facing the outside world.
Listen [::1]:3000

# Load the perl modules & repository configurations
PerlSwitches -IEPRINTS_PATH/perl_lib
Include EPRINTS_PATH/cfg/perl_module_isolation.conf

# Load the per-repository apache configuration
Include EPRINTS_PATH/cfg/apache/*.conf

EPrints Level Perl Module Isolation (EPRINTS_PATH/cfg/perl_module_isolation.conf)

##This file is included by apache.conf -- Do not edit this file directly.
##You should edit the perl_module_isolation flag in EPRINTS_PATH/perl_lib/EPrints/SystemSettings.pm, then run EPRINTS_PATH/bin/generate_apacheconf --system --replace to regenerate this file.

##The following two lines turn the perl_module_isolation OFF (All repositories now sharing a single perl interpreter and have access to all perl modules.)
PerlModule EPrints
PerlPostConfigHandler +EPrints::post_config_handler

Archive Level HTTP VirtualHost HTTP-to-HTTPS Redirect (ARCHIVE_ID_http_to_https_redirect.conf)

#
# apache.conf include file for ARCHIVE_ID
#
# Any changes made here will be lost if you run generate_apacheconf
# or generate_apacheconf for anubis with the --replace option
#

# The main virtual host for this repository
<VirtualHost *:80>
  ServerName HOSTNAME

  ServerAdmin ADMIN_EMAIL

  RedirectPermanent / https://HOSTNAME/
</VirtualHost>

Archive Level Internal (port 3000) HTTP VirtualHost (EPRINTS_PATH/cfg/apache/ARCHIVE_ID.conf)

#
# apache.conf include file for ARCHIVE_ID
#
# Any changes made here will be lost if you run generate_apacheconf 
# or generate_apacheconf_for_anubis with the --replace option
#

# The main virtual host for this repository
<VirtualHost *:3000>
  ServerName HOSTNAME

  # This file configures the apache logs of EPrints itself. Only requests passed through anubis to EPrints can make it this far.
  # This file will not be overwritten by generate_apacheconf_for_anubis, so you can modify it.
  LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Accept-Language}i\" \"%{Referer}i\" \"%{User-agent}i\" \"%{techaro.lol-anubis-cookie-verification}C\""
  ErrorLog    /var/log/httpd/eprints_internal_error_log
  TransferLog /var/log/httpd/eprints_internal_access_log

  ServerAdmin ADMIN_EMAIL

  Include EPRINTS_PATH/cfg/perl_module_isolation_vhost.conf

  <Location "">
    PerlSetVar EPrints_ArchiveID ARCHIVE_ID
    PerlSetVar EPrints_Secure yes

    Options +ExecCGI
    <IfModule mod_authz_core.c>
       Require all granted
    </IfModule>
    <IfModule !mod_authz_core.c>
       Order allow,deny
       Allow from all
    </IfModule>
  </Location>
 
  # Set by $c->{max_upload_filesize}
  LimitRequestBody 1073741824

  # Note that PerlTransHandler can't go inside
  # a "Location" block as it occurs before the
  # Location is known.
  PerlTransHandler +EPrints::Apache::Rewrite

  # Get the real remote IP back, otherwise all accesses appear to come from ::1
  <IfModule remoteip_module>
    RemoteIPHeader X-Real-Ip
    RemoteIPTrustedProxy ::1
  </IfModule>
</VirtualHost>

Archive Level HTTPS Virtualhost (EPRINTS_PATH/archives/ARCHIVE_ID/ssl/securevhost.conf)

  • Includes Shibboleth configuration that is ultimately exempted from being proxied via Anubis
  • Logs names based on those used for RHEL-based Linux, changes may be required for Debian-based Linux (e.g Ubuntu).
<VirtualHost *:443>
 
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

  LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Accept-Language}i\" \"%{Referer}i\" \"%{User-agent}i\" \"%{techaro.lol-anubis-cookie-verification}C\""
  ErrorLog /var/log/httpd/ssl_error_log
  TransferLog /var/log/httpd/ssl_access_log
  LogLevel warn

  SSLEngine on
  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
  SSLHonorCipherOrder on
  SSLCompression off
  SSLSessionTickets off
  SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE- RSA-AES128-GCM-SHA256

  SSLCertificateFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.crt
  SSLCertificateKeyFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.key
  SSLCertificateChainFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.ca-bundle

  Include EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf

  Alias /shibboleth EPRINTS_PATH/archives/ARCHIVE_ID/shibboleth
  <Location "/shibboleth">
    SetHandler perl-script
    PerlHandler ModPerl::Registry
    PerlSendHeader Off
    Options ExecCGI FollowSymLinks
  
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    require shib-session
    PerlSetVar EPrints_ArchiveID reading
  </Location>

  <Location /cgi/shibboleth>
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    require shib-session
  </Location>

  PerlTransHandler +EPrints::Apache::Rewrite

</VirtualHost>

Archive Level Anubis Proxy for HTTPS VirtualHost (EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf)

# HTTPS listener that forwards to Anubis

# These headers need to be set or else Anubis will
# throw an "admin misconfiguration" error.
RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR}
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s"

ProxyPreserveHost On

ProxyRequests Off
ProxyVia Off
ProxyTimeout 300

# don't try and proxy shibboleth.
ProxyPass /Shibboleth.sso !
ProxyPass /shibboleth !
ProxyPass /cgi/shibboleth !

# Replace 8923 with the port Anubis listens on
ProxyPass / http://[::1]:8923/
ProxyPassReverse / http://[::1]:8923/
Retrieved from ‘https://wiki.eprints.org/w/index.php?title=Apache_Configuration_for_EPrints_with_Anubis&oldid=17165’