summaryrefslogtreecommitdiff
path: root/templates/vhosts/php_drupal/CentOS.erb
blob: f92e3b05e78aec4f2153872250945819c531f445 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
# <%= servername %>
<VirtualHost *:80>
    Include conf.d/defaults.inc

    ServerName <%= servername %>
    <%- unless serveralias.to_s.empty? then -%>
    ServerAlias <%= serveralias %>
    <%- end -%> 
    <%- unless server_admin.to_s.empty? or server_admin.to_s == 'absent' then -%>
    ServerAdmin <%= server_admin %>
    <%- end -%>
    DocumentRoot <%= documentroot %>/

    ErrorLog <%= logdir %>/error_log
    CustomLog <%= logdir %>/access_log combined
    <%- if ssl_mode.to_s == 'force' then -%>
    Redirect permanent / https://<%= servername %>/
    <%- end -%>
    <%- if default_charset.to_s != 'absent' then -%>
    AddDefaultCharset <%= default_charset %>
    <%- end -%>
    <%- if run_mode.to_s == 'itk' -%>
    <IfModule mpm_itk_module>
        AssignUserId <%= run_uid+" "+run_gid %>
    </IfModule>
    <%- end -%>
    <%- if not ssl_mode.to_s == 'force' then -%>
    <Directory "<%= documentroot %>/">
        AllowOverride <%= allow_override %>
        <%- if options.to_s != 'absent' or do_includes.to_s == 'true' then -%>
        Options <%- unless options.to_s == 'absent' then -%><%= options %><%- end -%><%- if do_includes.to_s == 'true' and not options.include?('+Includes') then -%> +Includes<%- end -%>

        <%- end -%>
        <%- unless htpasswd_file.to_s == 'absent' then -%>
        AuthType Basic
        AuthName "Access fuer <%= servername %>"
        AuthUserFile <%= real_htpasswd_path %>
        require valid-user
        <%- end -%>
        php_admin_flag engine on
        php_admin_value open_basedir <%= documentroot %>:<%= real_php_upload_tmp_dir %>:<%= real_php_session_save_path %>
        php_admin_value upload_tmp_dir <%= real_php_upload_tmp_dir %>
        php_admin_value session.save_path <%= real_php_session_save_path %>

        php_value magic_quotes_gpc                0
        php_value register_globals                0
        php_value session.auto_start              0
        php_value mbstring.http_input             pass
        php_value mbstring.http_output            pass
        php_value mbstring.encoding_translation   0

        # Protect files and directories from prying eyes.
        <FilesMatch "\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template)$">
            Order allow,deny
        </FilesMatch>

        # Customized error messages.
        ErrorDocument 404 /index.php

        RewriteEngine on
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
    </Directory>
    <Directory "<%= documentroot %>/files/">
        SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
        Options None
        Options +FollowSymLinks
    </Directory>
    <%- end -%>
	
    <IfModule mod_security2.c>
        <%- if mod_security.to_s == 'true' then -%>
        SecRuleEngine On
        SecAuditLogType Concurrent
        SecAuditLogStorageDir <%= logdir %>/
        SecAuditLog <%= logdir %>/mod_security_audit.log
        SecDebugLog <%= logdir %>/mod_security_debug.log
        <%- else -%>
        SecRuleEngine Off
        <%- end -%>
    </IfModule>

    <%- unless additional_options.to_s == 'absent' then -%>
    <%= additional_options %>
    <%- end -%>
</VirtualHost>

<%- unless ssl_mode.to_s == 'false'  then -%>
<VirtualHost *:443>
    Include conf.d/defaults.inc
    Include conf.d/ssl_defaults.inc

    ServerName <%= servername %>
    <%- unless serveralias.to_s.empty? then -%>
    ServerAlias <%= serveralias %>
    <%- end -%> 
    <%- unless server_admin.to_s.empty? or server_admin.to_s == 'absent' then -%>
    ServerAdmin <%= server_admin %>
    <%- end -%>
    DocumentRoot <%= documentroot %>/

    ErrorLog <%= logdir %>/error_log
    CustomLog <%= logdir %>/access_log combined
    <%- if default_charset.to_s != 'absent' then -%>
    AddDefaultCharset <%= default_charset %>
    <%- end -%>
    <%- if run_mode.to_s == 'itk' -%>
    <IfModule mpm_itk_module>
        AssignUserId <%= run_uid+" "+run_gid %>
    </IfModule>
    <%- end -%>
    <%- if default_charset.to_s != 'absent' then -%>
    AddDefaultCharset <%= default_charset %>
    <%- end -%>
    <Directory "<%= documentroot %>/">
        AllowOverride <%= allow_override %>
        <%- if options.to_s != 'absent' or do_includes.to_s == 'true' then -%>
        Options <%- unless options.to_s == 'absent' then -%><%= options %><%- end -%><%- if do_includes.to_s == 'true' and not options.include?('+Includes') then -%> +Includes<%- end -%>

        <%- end -%>
        <%- unless htpasswd_file.to_s == 'absent' then -%>
        AuthType Basic
        AuthName "Access fuer <%= servername %>"
        AuthUserFile <%= real_htpasswd_path %>
        require valid-user
        <%- end -%>
        php_admin_flag engine on
        php_admin_value open_basedir <%= documentroot %>:<%= real_php_upload_tmp_dir %>:<%= real_php_session_save_path %>
        php_admin_value upload_tmp_dir <%= real_php_upload_tmp_dir %>
        php_admin_value session.save_path <%= real_php_session_save_path %>

        php_value magic_quotes_gpc                0       
        php_value register_globals                0       
        php_value session.auto_start              0       
        php_value mbstring.http_input             pass    
        php_value mbstring.http_output            pass    
        php_value mbstring.encoding_translation   0

        # Protect files and directories from prying eyes.
        <FilesMatch "\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template)$">
            Order allow,deny                  
        </FilesMatch>                                         

        # Customized error messages.
        ErrorDocument 404 /index.php

        RewriteEngine on
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteRule ^(.*)$ index.php?q=$1 [L,QSA] 
    </Directory>
    <Directory "<%= documentroot %>/files/">
        SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
        Options None
        Options +FollowSymLinks
    </Directory>

    <IfModule mod_security2.c>
        <%- if mod_security.to_s == 'true' then -%>
        SecRuleEngine On
        SecAuditLogType Concurrent
        SecAuditLogStorageDir <%= logdir %>/
        SecAuditLog <%= logdir %>/mod_security_audit.log
        SecDebugLog <%= logdir %>/mod_security_debug.log
        <%- else -%>
        SecRuleEngine Off
        <%- end -%>
    </IfModule>

    <%- unless additional_options.to_s == 'absent' then -%>
    <%= additional_options %>
    <%- end -%>
</VirtualHost>
<%- end -%>