diff options
Diffstat (limited to 'apache2.4-ssl.conf.example')
| -rw-r--r-- | apache2.4-ssl.conf.example | 72 |
1 files changed, 72 insertions, 0 deletions
diff --git a/apache2.4-ssl.conf.example b/apache2.4-ssl.conf.example new file mode 100644 index 000000000000..5609314b5f2b --- /dev/null +++ b/apache2.4-ssl.conf.example @@ -0,0 +1,72 @@ +#This configuration has been tested on GitLab 6.0.0 and GitLab 6.0.1 +#Note this config assumes unicorn is listening on default port 8080. +#Module dependencies +# mod_rewrite +# mod_ssl +# mod_proxy +# mod_proxy_http +# mod_headers + +# This section is only needed if you want to redirect http traffic to https. +# You can live without it but clients will have to type in https:// to reach gitlab. +<VirtualHost *:80> + ServerName gitlab.example.com + ServerSignature Off + + RewriteEngine on + RewriteCond %{HTTPS} !=on + RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [NE,R,L] +</VirtualHost> + +<VirtualHost *:443> + SSLEngine on + #strong encryption ciphers only + #see ciphers(1) http://www.openssl.org/docs/apps/ciphers.html + SSLProtocol all -SSLv2 -SSLv3 + SSLHonorCipherOrder on +# SSLCipherSuite "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" + SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA" + Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains" + SSLCompression Off + SSLCertificateFile /etc/httpd/ssl.crt/gitlab.example.com.crt + SSLCertificateKeyFile /etc/httpd/ssl.key/gitlab.example.com.key + SSLCACertificateFile /etc/httpd/ssl.crt/your-ca.crt + + ServerName gitlab.example.com + ServerSignature Off + + ProxyPreserveHost On + + <Location /> + # New authorization commands for apache 2.4 and up + # http://httpd.apache.org/docs/2.4/upgrading.html#access + Require all granted + + ProxyPassReverse http://127.0.0.1:8080 + ProxyPassReverse http://gitlab.example.com/ + </Location> + + #apache equivalent of nginx try files + # http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files + # http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab + RewriteEngine on + RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f + RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA] + RequestHeader set X_FORWARDED_PROTO 'https' + + # needed for downloading attachments + DocumentRoot /usr/share/webapps/gitlab/public + + #Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up. + ErrorDocument 404 /404.html + ErrorDocument 422 /422.html + ErrorDocument 500 /500.html + ErrorDocument 503 /deploy.html + + LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded + ErrorLog /var/log/httpd/logs/gitlab.example.com_error.log + CustomLog /var/log/httpd/logs/gitlab.example.com_forwarded.log common_forwarded + CustomLog /var/log/httpd/logs/gitlab.example.com_access.log combined env=!dontlog + CustomLog /var/log/httpd/logs/gitlab.example.com.log combined + +</VirtualHost> |