Difference between revisions of "Apache Configuration for EPrints with Anubis"
(Added initial Apache config) |
m |
||
| Line 6: | Line 6: | ||
<VirtualHost *:443> | <VirtualHost *:443> | ||
| + | |||
| + | Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" | ||
| − | |||
| − | |||
LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Accept-Language}i\" \"%{Referer}i\" \"%{User-agent}i\" \"%{techaro.lol-anubis-cookie-verification}C\"" | LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Accept-Language}i\" \"%{Referer}i\" \"%{User-agent}i\" \"%{techaro.lol-anubis-cookie-verification}C\"" | ||
ErrorLog /var/log/httpd/ssl_error_log | ErrorLog /var/log/httpd/ssl_error_log | ||
| Line 24: | Line 24: | ||
SSLCertificateKeyFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.key | SSLCertificateKeyFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.key | ||
SSLCertificateChainFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.ca-bundle | SSLCertificateChainFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.ca-bundle | ||
| − | + | ||
Include EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf | Include EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf | ||
| − | + | ||
Alias /shibboleth EPRINTS_PATH/archives/ARCHIVE_ID/shibboleth | Alias /shibboleth EPRINTS_PATH/archives/ARCHIVE_ID/shibboleth | ||
<Location "/shibboleth"> | <Location "/shibboleth"> | ||
Revision as of 09:24, 24 August 2026
HTTPS Virtualhost (EPRINTS_PATH/archives/ARCHIVE_ID/ssl/securevhost.conf)
- Assumes inclusion of all archives' ssl/securevhost.conf's from /etc/httpd/conf.d/eprints.conf or /etc/apache2/sites-enabled/eprints.conf.
- Replaces path of EPrints, ID of the archive and hostname of repository archive with EPRINTS_PATH, ARCHIVE_ID and HOSTNAME respectively.
- Includes Shibboleth configuration that is ultimately exempted from being proxied via Anubis
- Logs names based on those used for RHEL-based Linux, changes may be required for Debian-based Linux (e.g Ubuntu).
<VirtualHost *:443>
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Accept-Language}i\" \"%{Referer}i\" \"%{User-agent}i\" \"%{techaro.lol-anubis-cookie-verification}C\""
ErrorLog /var/log/httpd/ssl_error_log
TransferLog /var/log/httpd/ssl_access_log
LogLevel warn
SSLEngine on SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLHonorCipherOrder on SSLCompression off SSLSessionTickets off SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE- RSA-AES128-GCM-SHA256 SSLCertificateFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.crt SSLCertificateKeyFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.key SSLCertificateChainFile EPRINTS_PATH/archives/ARCHIVE_ID/ssl/HOSTNAME.ca-bundle Include EPRINTS_PATH/cfg/apache_ssl/ARCHIVE_ID.conf Alias /shibboleth EPRINTS_PATH/archives/ARCHIVE_ID/shibboleth <Location "/shibboleth"> SetHandler perl-script PerlHandler ModPerl::Registry PerlSendHeader Off Options ExecCGI FollowSymLinks AuthType shibboleth ShibRequestSetting requireSession 1 require shib-session PerlSetVar EPrints_ArchiveID reading </Location> <Location /cgi/shibboleth> AuthType shibboleth ShibRequestSetting requireSession 1 require shib-session </Location> PerlTransHandler +EPrints::Apache::Rewrite
</VirtualHost>
