ood-portal.conf.erb

#
# Open OnDemand Portal
#
# Generated using ood-portal-generator version <%= OodPortalGenerator::VERSION %>
#
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# !!                                    !!
# !!     DO NOT EDIT THIS FILE          !!
# !!                                    !!
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#
# This file is auto-generated by ood-portal-generator and will be over-written
# in future updates.
#
# 1. To modify this file, first update the global configuration file:
#
#      /etc/ood/config/ood-portal.yml
#
#    You can find more information about the ood-portal-generator configuration
#    at:
#
#      https://osc.github.io/ood-documentation/master/infrastructure/ood-portal-generator.html
#
# 2. Then build/install the updated Apache config with:
#
#      sudo /opt/ood/ood-portal-generator/sbin/update_ood_portal
#
# 3. Finally, restart Apache to have the changes take effect:
#
#      # For CentOS 6
#      sudo service httpd24-httpd condrestart
#      sudo service httpd24-htcacheclean condrestart
#
#      # For CentOS 7
#      sudo systemctl try-restart httpd24-httpd.service httpd24-htcacheclean.service
#

<% if @listen_addr_port -%>
# Listen should always be one of:
#     - <port>
#     - <ipv4>:<port>
#     - <ipv6>:<port>
#
<% Array(@listen_addr_port).each do |addr_port| -%>
Listen <%= addr_port %>
<% end -%>
<% end -%>

<% if @ssl -%>
# Redirect all http traffic to the https Open OnDemand portal URI
#     http://*:<%= @port %>
#     #=> <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %>
#
<VirtualHost *:80>
  RewriteEngine On
  RewriteRule ^(.*) <%= @ssl ? "https" : "http" %>://<%= @servername || "%{SERVER_NAME}" %>:<%= @port %>$1 [R=301,NE,L]
</VirtualHost>
<% end -%>

# The Open OnDemand portal VirtualHost
#
<VirtualHost *:<%= @port %>>
  <%- if @servername -%>
  ServerName <%= @servername %>

  ErrorLog  "<%= @logroot %>/<%= @servername %>_error<%= "_ssl" if @ssl %>.log"
  CustomLog "<%= @logroot %>/<%= @servername %>_access<%= "_ssl" if @ssl %>.log" combined

  RewriteEngine On
  RewriteCond %{HTTP_HOST} !^(<%= @servername %>(:<%= @port %>)?)?$ [NC]
  RewriteRule ^(.*) <%= @ssl ? "https" : "http" %>://<%= @servername %>:<%= @port %>$1 [R=301,NE,L]
  <%- end -%>

  <%- if @ssl -%>
  SSLEngine On
  <%- @ssl.each do |line| -%>
  <%= line %>
  <%- end -%>
  <%- end -%>

  # Lua configuration
  #
  <%- if @lua_root -%>
  LuaRoot "<%= @lua_root %>"
  <%- end -%>
  LogLevel lua_module:<%= @lua_log_level %>

  # Log authenticated user requests (requires min log level: info)
  LuaHookLog logger.lua logger

  # Authenticated-user to system-user mapping configuration
  #
  SetEnv OOD_USER_MAP_CMD "<%= @user_map_cmd %>"
  <%- if @user_env -%>
  SetEnv OOD_USER_ENV "<%= @user_env %>"
  <%- end -%>
  <%- if @map_fail_uri -%>
  SetEnv OOD_MAP_FAIL_URI "<%= @map_fail_uri %>"
  <%- end -%>

  # Per-user Nginx (PUN) configuration
  # NB: Apache will need sudo privs to control the PUNs
  #
  SetEnv OOD_PUN_STAGE_CMD "<%= @pun_stage_cmd %>"

  #
  # Below is used for sub-uri's this Open OnDemand portal supports
  #

  <%- if @public_uri && @public_root -%>
  # Serve up publicly available assets from local file system:
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @public_uri %>/favicon.ico
  #     #=> <%= @public_root %>/favicon.ico
  #
  Alias "<%= @public_uri %>" "<%= @public_root %>"
  <Directory "<%= @public_root %>">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
  </Directory>
  <%- end -%>

  <%- if @node_uri -%>
  # Reverse proxy traffic to backend webserver through IP sockets:
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @node_uri %>/HOST/PORT/index.html
  #     #=> http://HOST:PORT<%= @node_uri %>/HOST/PORT/index.html
  #
  <LocationMatch "^<%= @node_uri %>/(?<host><%= @host_regex %>)/(?<port>\d+)">
    <%- @auth.each do |line| -%>
    <%= line %>
    <%- end -%>

    # ProxyPassReverse implementation
    Header edit Location "^[^/]+//[^/]+" ""

    # ProxyPassReverseCookieDomain implemenation
    Header edit* Set-Cookie ";\s*(?i)Domain[^;]*" ""

    # ProxyPassReverseCookiePath implementation
    Header edit* Set-Cookie ";\s*(?i)Path[^;]*" ""
    Header edit  Set-Cookie "^([^;]+)" "$1; Path=<%= @node_uri %>/%{MATCH_HOST}e/%{MATCH_PORT}e"

    LuaHookFixups node_proxy.lua node_proxy_handler
  </LocationMatch>
  <%- end -%>

  <%- if @rnode_uri -%>
  # Reverse "relative" proxy traffic to backend webserver through IP sockets:
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @rnode_uri %>/HOST/PORT/index.html
  #     #=> http://HOST:PORT/index.html
  #
  <LocationMatch "^<%= @rnode_uri %>/(?<host><%= @host_regex || "[^/]+" %>)/(?<port>\d+)(?<uri>/.*|)">
    <%- @auth.each do |line| -%>
    <%= line %>
    <%- end -%>

    # ProxyPassReverse implementation
    Header edit Location "^([^/]+//[^/]+)|(?=/)" "<%= @rnode_uri %>/%{MATCH_HOST}e/%{MATCH_PORT}e"

    # ProxyPassReverseCookieDomain implemenation
    Header edit* Set-Cookie ";\s*(?i)Domain[^;]*" ""

    # ProxyPassReverseCookiePath implementation
    Header edit* Set-Cookie ";\s*(?i)Path[^;]*" ""
    Header edit  Set-Cookie "^([^;]+)" "$1; Path=<%= @rnode_uri %>/%{MATCH_HOST}e/%{MATCH_PORT}e"

    LuaHookFixups node_proxy.lua node_proxy_handler
  </LocationMatch>
  <%- end -%>

  <%- if @pun_uri && @nginx_uri -%>
  # Reverse proxy traffic to backend PUNs through Unix domain sockets:
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @pun_uri %>/dev/app/simulations/1
  #     #=> unix:/path/to/socket|http://localhost<%= @pun_uri %>/dev/app/simulations/1
  #
  SetEnv OOD_PUN_URI "<%= @pun_uri %>"
  <Location "<%= @pun_uri %>">
    <%- @auth.each do |line| -%>
    <%= line %>
    <%- end -%>

    ProxyPassReverse "http://localhost<%= @pun_uri %>"

    # ProxyPassReverseCookieDomain implementation (strip domain)
    Header edit* Set-Cookie ";\s*(?i)Domain[^;]*" ""

    # ProxyPassReverseCookiePath implementation (less restrictive)
    Header edit* Set-Cookie ";\s*(?i)Path\s*=(?-i)(?!\s*<%= @pun_uri %>)[^;]*" "; Path=<%= @pun_uri %>"

    SetEnv OOD_PUN_SOCKET_ROOT "<%= @pun_socket_root %>"
    SetEnv OOD_PUN_MAX_RETRIES "<%= @pun_max_retries %>"
    LuaHookFixups pun_proxy.lua pun_proxy_handler

    <%- if @analytics -%>
    SetEnv OOD_ANALYTICS_TRACKING_URL "<%= @analytics['url'] %>"
    SetEnv OOD_ANALYTICS_TRACKING_ID  "<%= @analytics['id']  %>"
    LuaHookLog analytics.lua analytics_handler
    <%- end -%>
  </Location>

  # Control backend PUN for authenticated user:
  # NB: See mod_ood_proxy for more details.
  #
  #    <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @nginx_uri %>/stop
  #    #=> stops the authenticated user's PUN
  #
  SetEnv OOD_NGINX_URI "<%= @nginx_uri %>"
  <Location "<%= @nginx_uri %>">
    <%- @auth.each do |line| -%>
    <%= line %>
    <%- end -%>

    LuaHookFixups nginx.lua nginx_handler
  </Location>
  <%- end -%>

  <%- if @root_uri -%>
  # Redirect root URI to specified URI
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %>/
  #     #=> <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @root_uri %>
  #
  RedirectMatch ^/$ "<%= @root_uri %>"
  <%- end -%>

  <%- if @logout_uri && @logout_redirect -%>
  # Redirect logout URI to specified redirect URI
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @logout_uri %>
  #     #=> <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @logout_redirect %>
  #
  Redirect "<%= @logout_uri %>" "<%= @logout_redirect %>"
  <%- end -%>

  <%- if @oidc_uri -%>
  # OpenID Connect redirect URI:
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @oidc_uri %>
  #     #=> handled by mod_auth_openidc
  #
  <Location "<%= @oidc_uri %>">
    <%- @auth.each do |line| -%>
    <%= line %>
    <%- end -%>
  </Location>
  <%- end -%>

  <%- if @oidc_discover_uri && @oidc_discover_root -%>
  # Discover URI for OpenID Connect (used for multiple Id Providers):
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @oidc_discover_uri %>
  #     #=> <%= @oidc_discover_root %>/
  #
  Alias "<%= @oidc_discover_uri %>" "<%= @oidc_discover_root %>"
  <Directory "<%= @oidc_discover_root %>">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
  </Directory>
  <%- end -%>

  <%- if @register_uri && @register_root %>
  # Register and/or unregister the mapping of an authenticated-user to a system-user
  # NB: This is not needed for regular expression mapping
  #
  #     <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %><%= @register_uri %>
  #     #=> <%= @register_root %>/
  #
  Alias "<%= @register_uri %>" "<%= @register_root %>"
  <Directory "<%= @register_root %>">
    Options Indexes FollowSymLinks
    AllowOverride None

    <%- @auth.each do |line| -%>
    <%= line %>
    <%- end -%>
  </Directory>
  <%- end -%>
</VirtualHost>