puppet_apache.git - [puppet

Age	Commit message (Collapse)	Author
2014-04-19	remove unnecessary new lines	mh

2014-04-18	address puppet 3.x deprecation warnings	mh

2014-04-14	more identation fixing	mh

2012-06-08	fix dynamic scope variables, function access	mh

2011-10-08	introduce a new template style, less duplicated things, more handy options	mh

2011-05-18	we need to set the var also vor http parts	mh

2011-05-18	move header to partials	mh

2011-05-17	this is now in the include file	mh

2011-05-17	migrate authentication to partials	mh

2011-05-17	switching logs over to partials	mh

2011-05-17	improve mod_security rules	mh
	* handled now by a partial * possibility to add rules that should be removed * possibility to add custom mod_sec options" * use new infrastructure for existing mod_sec tweaks
2010-12-12	enable HTS everywhere	mh

2010-12-06	add STS header for enforced SSL sites	mh
	* http://en.wikipedia.org/wiki/Strict_Transport_Security This will tell browsers to interact with that site only per HTTPS.
2010-10-25	improve redirect, so we don't stick on the servername	mh

2010-08-18	add missing directive for ssl proxy vhosts	mh

2010-08-16	impelement itk plus mode	mh
	itk plus mode is an additional mode to deploy itk based hostings which should be a bit more performant. The idea is that we have two apache-instances running: A) prefork based, listening on the external interface B) itk based, listening on the loopback interface A) will serve all static webpages, as well as possibly serve all static content of dynamic websites. All requests to dynamic content will be redirected to B). The idea is that A) doesn't load any modules to server dynamic content at all. B) will serve all the dynamic scripts of a vhost. This will mean that for vhosts (static ones) as well as static content (all none dynamic scripts) we can benefit from the fast prefork model, while we can use itk's security model for all the dynamic scripts. There are two new additional run_modes: - proxy-itk: this just passes all requests to apache instance B). This one is similar to plain itk based mode and should be used for vhosts that shouldn't (yet) changed to the mixed mode. - static-itk: this passes only requests to dynamic scripts to B) while all static content is served by A). Beware that the user with which A) is running should be member of the run group of B) and all static files need to readable by the group. This reduces the security model you have with plain itk, as the prefork apache user will be able to read php (config-) files of any vhost that runs in static-itk mode. If you want to keep the level of security for a certain vhost, you need to run the specific vhost in proxy-itk mode. Note 1: you cannot run vhosts in itk mode and others in proxy or static itk mode. There is a duplicate file resource definition that blocks that possibility. Note 2: This mode works currently only on CentOS based systems, as no work have been done so far to implement an init.d script that's able to run 2 apache instances.
2010-08-11	introduce logmode feature	mh
	We are now able to select how apache should log accesses. These modes are: * default: as you would use it * semianonym: no ips are logged for CustomLog, ErrorLog still logs ips * anonym: no ips are logged for CustomLog, ErrorLog is sent to /dev/null * nologs: all logs are sent to /dev/null
2010-01-04	add $mod_security_relevantonly flag, enabled by default, logs only on ↵	Jerome Charaoui
	suspicious requests, set to 'false' to log all requests (as before)
2009-12-23	introduce config::global for global configs in conf.d and config::include ↵	Jerome Charaoui
	for vhost snippets in include.d
2009-12-23	change OS-specific vhost templates into links, add Debian (though not all ↵	Jerome Charaoui
	are tested on Debian)
2009-11-21	purge bin dir, only add php option if we actually added binaries	mh

2009-11-21	introduce php_default_charset to set charset header in php	mh

2009-11-18	renames and proc move from webhosting for php_safe_mode_exec_bins	Andreas

2009-11-18	added a dir for binaries (php safe_mode_exec_dir)	Andreas

2009-07-25	ending dash to prevent empty line	mh

2009-07-25	add variable to tweak php safe_mode	mh

2009-06-24	unified mod_sec stuff, turn audit engine off as well	mh

2009-06-13	introcuded ssl_mode only	mh

2009-06-13	we can now also enable the usage of pear	mh

2009-05-26	only enable smarty when told to	Marcel Haerry
	and include smarty then
2009-05-23	allow to include smarty templates from system	mh

2009-05-23	removing double add default charset, adding where it have been missing	Marcel Haerry

2009-05-17	whitespace cleanup	Marcel Haerry

2009-04-26	fixing ServerAdmin stuff	mh
	ServerAdmin was missing for ssl vhosts ServerAdmin was set if the variable have been set to 'absent'
2009-04-25	server_admin variable for ServerAdmin line in vhosts	andreas

2009-04-13	setting logging style of mod_sec	mh
	according to http://thread.gmane.org/gmane.comp.apache.mod-security.user/5257/focus=5260 it should be that way.
2009-04-01	always write the mod_sec logs to its own logfile	mh

2009-03-16	this isn't needed in the https section :-/	mh

2009-03-15	audit typ have to be serial	mh

2009-03-10	correct option	mh

2009-03-09	write mod_sec logfiles per vhost	mh

2009-03-07	fix upload und session php dir problem	mh

2008-12-18	do mod_itk as well on https	mh

2008-12-06	fixing ssl_mode decision, still set the directory stuff	mh

2008-12-06	finished sslmode config, added itk stuff to php vhost	mh

2008-12-06	- added default charset possiblity	mh
	- enabled ssl on all 3 vhost modes
2008-12-05	ignore absent	mh

2008-12-05	we need a new line	mh

2008-12-05	correct decision and made it more logical	mh

2008-12-05	correct test	mh