Merge branch 'develop'

5 files changed, 52 insertions, 15 deletions

diff --git a/puppet/modules/site_apache/files/conf.d/acme.conf b/puppet/modules/site_apache/files/conf.d/acme.conf
new file mode 100644
index 00000000..cdddf53e
--- /dev/null
+++ b/puppet/modules/site_apache/files/conf.d/acme.conf
@@ -0,0 +1,10 @@
+#
+# Allow ACME certificate verification if /srv/acme exists.
+#
+<IfModule mod_headers.c>
+  Alias "/.well-known/acme-challenge/" "/srv/acme/"
+  <Directory "/srv/acme/*">
+    Require all granted
+    Header set Content-Type "application/jose+json"
+  </Directory>
+</IfModule>
diff --git a/puppet/modules/site_apache/manifests/common.pp b/puppet/modules/site_apache/manifests/common.pp
index 8a11759a..208c15d5 100644
--- a/puppet/modules/site_apache/manifests/common.pp
+++ b/puppet/modules/site_apache/manifests/common.pp
@@ -27,4 +27,6 @@ class site_apache::common {
   }
 
   include site_apache::common::tls
+  include site_apache::common::acme
+
 }
diff --git a/puppet/modules/site_apache/manifests/common/acme.pp b/puppet/modules/site_apache/manifests/common/acme.pp
new file mode 100644
index 00000000..eda4148b
--- /dev/null
+++ b/puppet/modules/site_apache/manifests/common/acme.pp
@@ -0,0 +1,38 @@
+#
+# Allows for potential ACME validations (aka Let's Encrypt)
+#
+class site_apache::common::acme {
+  #
+  # well, this doesn't work:
+  #
+  # apache::config::global {'acme.conf':}
+  #
+  # since /etc/apache2/conf.d is NEVER LOADED BY APACHE
+  # https://gitlab.com/shared-puppet-modules-group/apache/issues/11
+  #
+
+  file {
+    '/etc/apache2/conf-available/acme.conf':
+      ensure  => present,
+      source  => 'puppet:///modules/site_apache/conf.d/acme.conf',
+      require => Package[apache],
+      notify  => Service[apache];
+    '/etc/apache2/conf-enabled/acme.conf':
+      ensure  => link,
+      target  => '/etc/apache2/conf-available/acme.conf',
+      require => Package[apache],
+      notify  => Service[apache];
+  }
+
+  file {
+    '/srv/acme':
+      ensure => 'directory',
+      owner => 'www-data',
+      group => 'www-data',
+      mode => '0755';
+    '/srv/acme/ok':
+      owner => 'www-data',
+      group => 'www-data',
+      content => 'ok';
+  }
+}
diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index bfa5d04d..e68b9ebe 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -23,6 +23,8 @@ Listen 0.0.0.0:<%= @api_port %>
 <% end -%>
     Header always unset X-Powered-By
     Header always unset X-Runtime
+    Header always set X-XSS-Protection "1; mode=block"
+    Header always set X-Content-Type-Options: nosniff
   </IfModule>
 
   DocumentRoot /srv/leap/webapp/public
diff --git a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
index 232b1577..1d19094e 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
@@ -37,19 +37,4 @@
   </Location>
 <% end -%>
 
-<% if (defined? @services) and (@services.include? 'static') -%>
-  DocumentRoot "/srv/static/root/public"
-  <% if scope.function_guess_apache_version([]) == '2.4' %>
-  <Directory /srv/static/root/public>
-    AllowOverride None
-    Require all granted
-  </Directory>
-  <% end %>
-  AccessFileName .htaccess
-
-  Alias /provider.json /srv/leap/provider.json
-  <Location /provider.json>
-    Header set X-Minimum-Client-Version 0.5
-  </Location>
-<% end -%>
 </VirtualHost>