ssl.template.erb

####
##
#
#  This file is automatically generated from the template located at
#  /etc/symbiosis/apache.d/ssl.template.erb.
#
#  Feel free to make changes to this file, and thereafter it will not be
#  automatically updated if the template, or SSL configuration changes.
#
#  For SSL documenation please consult:
#
#  http://symbiosis.bytemark.co.uk/jessie/docs/ch-ssl-hosting.html
#
##
###

<VirtualHost <%= ips.collect{|ip| ip+":443"}.join(" ") %>>

        #
        # Put our server name 
        #
        ServerName  <%= domain %>

        #
        # This is the testing alias.
        #
        ServerAlias <%= domain %>.testing.<%= hostname() %>

        #
        # And server alias in place
        #
        <%= server_aliases %>


        <IfModule ssl_module>
                SSLEngine On

                #
                # The certificate, key, and intermediate bundle (if needed)
                #
                <%= ssl_config %>

                #
                # Intermediate configuration, taken from 
                # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.10&openssl=1.0.1k&hsts=yes&profile=intermediate
                #
                SSLProtocol             all -SSLv3
                SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

                SSLHonorCipherOrder     on
                SSLCompression          off

                #
                # OCSP Stapling -- make sure you remove the reject-www-data
                # rule from the outgoing firewall if you use this.
                #
                SSLUseStapling          off
                SSLStaplingResponderTimeout 5
                SSLStaplingReturnResponderErrors off

% if mandatory_ssl?
                <IfModule headers_module>
                        # HSTS (mod_headers is required) (15768000 seconds = 6 months)
                        Header always set Strict-Transport-Security "max-age=15768000"
                </IfModule>
% end
        </IfModule>

        #
        #  Allow users to override settings via .htaccess
        #
        <Directory <%=domain_directory%> >
                AllowOverride all
                Require all granted
        </Directory>

        #
        #  The document root
        #
        DocumentRoot <%= htdocs_directory %>/

        <IfModule cgi_module>
                #
                # General CGI Handling
                #
                ScriptAlias /cgi-bin/ <%= cgibin_directory %>/

                <Location /cgi-bin>
                        Options +ExecCGI
                </Location>
        </IfModule>

        #
        # Disable indexes by default on the top-level.
        #
        <LocationMatch "^/+$">
                Options -Indexes
        </LocationMatch>

        #
        # We need to log the virtual hostname the incoming request was
        # made against, so that the cron-job in /etc/cron.daily may generate
        # statistics for each domain.
        #
        ErrorLog   "|| /usr/sbin/symbiosis-httpd-logger -s -u <%= domain.uid %> -g <%= domain.gid %> <%= domain.log_dir %>/ssl_error.log"
        CustomLog  "|| /usr/sbin/symbiosis-httpd-logger -s -u <%= domain.uid %> -g <%= domain.gid %> <%= domain.log_dir %>/ssl_access.log" combined
</VirtualHost>

<VirtualHost <%= ips.collect{|ip| ip+":80"}.join(" ") %>>

        #
        # Put our server name 
        #
        ServerName  <%= domain %>

        #
        # This is the testing alias.
        #
        ServerAlias <%= domain %>.testing.<%= hostname() %>

        #
        # And server alias in place
        #
        <%= server_aliases %>

% if mandatory_ssl?
        <IfModule rewrite_module>
                #
                # This redirects all accesses to the HTTPS version of the site.
                #
                RewriteEngine On

                #
                # Use our server nane if HTTP_HOST is empty. 
                #
                RewriteCond "%{HTTP_HOST}" =""
                RewriteRule ^/?(.*) https://<%= domain %>/$1 [R=301,L]
                RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]
        </IfModule>
% else

        #
        #  Allow users to override settings via .htaccess
        #
        <Directory <%=domain_directory%> >
                AllowOverride all
                Require all granted
        </Directory>

        #
        #  The document root
        #
        DocumentRoot     <%= htdocs_directory %>/

        <IfModule cgi_module>
                #
                # General CGI Handling
                #
                ScriptAlias /cgi-bin/ <%= cgibin_directory %>/

                <Location /cgi-bin>
                        Options +ExecCGI
                </Location>
        </IfModule>
        
        #
        # Disable indexes by default 
        #
        <LocationMatch "^/+$">
                Options -Indexes
        </LocationMatch>

        #
        #  We need to log the virtual hostname the incoming request was
        # made against, so that the cron-job in /etc/cron.daily may generate
        # statistics for each domain.
        #
        ErrorLog   "|| /usr/sbin/symbiosis-httpd-logger -s -u <%= domain.uid %> -g <%= domain.gid %> <%= domain.log_dir %>/error.log"
        CustomLog  "|| /usr/sbin/symbiosis-httpd-logger -s -u <%= domain.uid %> -g <%= domain.gid %> <%= domain.log_dir %>/access.log" combined

% end
</VirtualHost>