Editing Archive:Https3 (section)

== Secure Apache Configuration ==

Next, we want to configure Apache to serve the secure pages. However, generate_apacheconf hasn't created a secure.conf file in /opt/eprints3/cfg/ so this needs to be done manually. Some configuration has been generated for us in /opt/eprints3/archives/repos1/var/auto-secure.conf and /opt/eprints3/archives/repos2/var/auto-secure.conf, but there are some problems with this:

* Some sections of the configuration overlap;
* The EPrints_ArchiveID and PerlSetVar EPrints_Secure variables have not been set.

 We'll therefore create our own configuration. Create a new file called cfg/secure.conf:

  #cfg/secure.conf:
  NameVirtualHost *:443
  <VirtualHost *:443>
    ServerAdmin itsupport@FQDN
    ServerName  eprints.FQDN
    
    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl/apache.pem
    
    ErrorLog /var/log/apache2/error.log
    
    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn
    
    CustomLog /var/log/apache2/access.log combined
    ServerSignature On
    
   DocumentRoot "/var/www/eprints"
    
    <Directory "/opt/eprints3/cgi/users">
      AuthName "User Area"
      AuthType "Basic"
      PerlAuthenHandler EPrints::Apache::Auth::authen
      PerlAuthzHandler EPrints::Apache::Auth::authz
      require valid-user
     
      SetHandler perl-script
      PerlHandler ModPerl::Registry
      PerlSendHeader Off
      Options ExecCGI FollowSymLinks
    </Directory>
    <Directory "/opt/eprints3/cgi/users/awstats">
      PerlSendHeader On
    </Directory>
    
    <Directory "/opt/eprints3/cgi">
      SetHandler perl-script
      PerlHandler ModPerl::Registry
      PerlSendHeader Off
      Options ExecCGI FollowSymLinks
    </Directory>
    
    PerlTransHandler EPrints::Apache::Rewrite
    
    Include /opt/eprints3/archives/repos1/var/manual-secure.conf 
    Include /opt/eprints3/archives/repos2/var/manual-secure.conf
  </VirtualHost>

Not the line 'DocumentRoot "/var/www/eprints"'. Create an index.html file in /var/www/eprints/ with a welcome message and links to the home pages of the repositories. Also note that we need to create a manual-secure.conf file for each repository. The contents of this file are as follows:

  #/opt/eprints3/archives/repos1s/var/manual-secure.conf
  
  <Location "/repos1">
    PerlSetVar EPrints_ArchiveID repos1
    PerlSetVar EPrints_Secure yes
    PerlSetVar EPrints_Dir_SecuredCGI /opt/eprints3/cgi/users
    PerlSetVar EPrints_Dir_Documents /opt/eprints3/archives/repos1/documents
    PerlLogHandler EPrints::Apache::LogHandler
  </Location>
  
  Alias /repos1/cgi/accounts/confirm /opt/eprints3/cgi/confirm
  Alias /repos1/cgi/accounts/register /opt/eprints3/cgi/register
  Alias /repos1/cgi/accounts/reset_password /opt/eprints3/cgi/reset_password
  Alias /repos1/cgi/accounts/set_password /opt/eprints3/cgi/set_password
  Alias /repos1/cgi/users/ /opt/eprints3/cgi/users/
  Alias /repos1/ /opt/eprints3/archives/publications/html/

For completeness, we'll also want to add the welcome page to http: Add the following lines to /opt/eprints3/cfg/apache.conf

  <VirtualHost *:80>
    ServerName eprints.FQDN
    ServerAdmin itsupport@FQDN
    DocumentRoot "/var/www/eprints"
  </VirtualHost>

Add 'Include /opt/eprints3/cfg/secure.conf' to the Apache configuration.

One thing remains. In /opt/eprints3/archives/repos1/cfg/cfg.d/misc.pl and /opt/eprints3/archives/repos2/cfg/cfg.d/misc.pl change the line

  $c->{cookie_domain} = $c->{host}; 

to read

  $c->{cookie_domain} = $c->{securehost}; 

Restart Apache. At this point it should be possible to access the repositories at http://publications.modhist.ox.ac.uk and http://oxhistonline.modhist.ox.ac.uk and log in to the secure area. 

=== Debian / Ubuntu specific SSL instructions ===

Create a file called ssl in /etc/apache2/sites-available/ssl and add the line 'Include /opt/eprints3/cfg/secure.conf'. Run the commands:

  a2ensite ssl
  a2enmod ssl
  apache2-ssl-certificate
  echo "Listen 443" >> /etc/apache2/ports.conf