vim /etc/apache2/sites-enabled/default-ssl.conf

-

 


Apache base virtual host file, default ssl conf file.




Vim /etc/apache2/sites-enabled/default-ssl.conf:

<IfModule mod_ssl.c>

    <VirtualHost xxx.xx.xxx.xxx:443>

        ServerName jobsite.com

        ServerAlias *.jobsite.com

        LogLevel debug

        ErrorLog /var/log/apache2/jobsite_com_error.log

        CustomLog /var/log/apache2/jobsite_com_custom.log combined


        SSLEngine on


        SSLCertificateFile /etc/ssl/jobsite_com/jobsite_com.crt

        SSLCertificateKeyFile /etc/ssl/jobsite_com/jobsite_com.key

        # SSLCertificateChainFile /etc/ssl/jobsite_com/intermediate.crt


        RewriteEngine On


        RewriteCond %{HTTPS} off [OR]

        RewriteCond %{HTTP_HOST} ^jobsite\.com [NC,OR]

        RewriteCond %{SERVER_NAME} xxx.xx.xxx.xxx

        RewriteRule /(.*) https://www.jobsite.com/$1 [R=301,L]


        RewriteCond %{HTTPS} off

        RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]


        LimitRequestBody 31457280


        # WSGIDaemonProcess www.jobsite.com python-home=/root/.virtualenvs/jobsite_com \

        #    python-path=/home/admin/production/hnj:/root/.virtualenvs/jobsite_com/lib/python2.7/site-packages \

        #    processes=10 threads=100 maximum-requests=1000 display-name=%{GROUP}

        # /usr/local/venvs/jobsite_com/bin/python

        WSGIDaemonProcess www.jobsite.com \

            python-home=/usr/local/venvs/jobsite_com/lib/python2.7/site-packages \

            python-path=/home/admin/production/hnj

        WSGIScriptAlias / /home/admin/production/hnj/hnj/wsgi.py

        WSGIProcessGroup www.jobsite.com


        # WSGIDaemonProcess www.jobsite.com processes=10 threads=100 maximum-requests=1000 display-name=%{GROUP}

        # WSGIProcessGroup www.jobsite.com

        # WSGIScriptAlias / /home/admin/production/hnj/hnj/wsgi.py


        # SetEnvIfNoCase Host "^[^_]+\.heeft-nieuwe-jobs\.website" VALID_HOST

        <Files wsgi.py>

            # <RequireAll>

            #    Require all granted

            #    Require env VALID_HOST

            # </RequireAll>

            Require expr %{HTTP_HOST} =~ m#^[^_]+\.jobsite\.com#

        </Files>


        Alias /media/uploads/ /var/www/jobsite_com/media/uploads/

        <Location "/media/uploads">

            SetHandler None

            Options -Indexes

            AddType text/html php

            Require expr %{HTTP_HOST} =~ m#^[^_]+\.jobsite\.com#

        </Location>


        Alias /static/ /var/www/jobsite_com/static/

        <Location "/static">

            SetHandler None

            Options -Indexes

            AddType text/html php

            Require expr %{HTTP_HOST} =~ m#^[^_]+\.jobsite\.com#

        </Location>


        ExpiresActive On

        ExpiresDefault A0


        # Set up caching on media files for 1 week

        <FilesMatch "\.(gif|jpg|jpeg|png|swf)$">

            ExpiresDefault A604800

            Header append Cache-Control "public"

        </FilesMatch>

        # Set up caching on media files for 1 month

        <FilesMatch "\.(ttf|eot|woff|svg|woff2)$">

            ExpiresDefault A2592000

            Header append Cache-Control "public"

        </FilesMatch>

        # Set up 1 Day caching on commonly updated files

        <FilesMatch "\.(js|css)$">

            ExpiresDefault A86400

            Header append Cache-Control "proxy-revalidate"

        </FilesMatch>

        # Set up 2 Hour caching on commonly updated files

        <FilesMatch "\.(xml|txt|html)$">

            ExpiresDefault A7200

            Header append Cache-Control "proxy-revalidate"

        </FilesMatch>


        <FilesMatch "\.(cgi|shtml|phtml|php)$">

            SSLOptions +StdEnvVars

        </FilesMatch>


        <Directory /usr/lib/cgi-bin>

            SSLOptions +StdEnvVars

        </Directory>


        # Guarantee HTTPS for 1 Year including Sub Domains 

        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"


        BrowserMatch "MSIE [2-6]" \

            nokeepalive ssl-unclean-shutdown \

            downgrade-1.0 force-response-1.0

        # MSIE 7 and newer should be able to use keepalive

        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

        SSLCipherSUite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \

                    EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA \

                    !CAMELLIA !SEED !3DES !RC4 !aNULL !eNULL !LOW !MD5 !EXP !PSK !SRP !DSS"

    </VirtualHost>

</IfModule>


Comments

Post a Comment

Popular posts from this blog

Installing the Certbot Let’s Encrypt Client for NGINX on Amazon Linux 2

-
Image
Installing the Certbot Let’s Encrypt Client The certbot package is not available through the package manager by default. You will need to enable the  EPEL  repository to install Certbot. sudo yum install epel-release sudo yum install certbot-nginx Set Up NGINX certbot  can automatically configure  NGINX  for SSL/TLS. It looks for and modifies the server block in your  NGINX  configuration that contains a server_name directive with the domain name you’re requesting a certificate for. In our example, the domain is  www.mydomain.com . Assuming you’re starting with a fresh NGINX install, use a text editor to create a file in the  /etc/nginx/conf.d  directory named  domain_name.conf  (so in our example, www.mydomain.com.conf). Specify your domain name (and variants, if any) with the  server_name  directive: server { listen 80 default_server; listen [::]:80 default_server; root /var/www/html; server_name myd...
Read more

psql: error: connection to server at "localhost" (127.0.0.1), port 5433 failed: ERROR: failed to authenticate with backend using SCRAM DETAIL: valid password not found

-
Image
ERROR psql: error: connection to server at "localhost" (127.0.0.1), port 5433 failed: ERROR: failed to authenticate with backend using SCRAM DETAIL: valid password not found Since Pgpool-II is a PostgreSQL proxy that works between clients and PostgreSQL servers, the authentication comprises two steps: Authentication between client and Pgpool-II Authentication between Pgpool-II and PostgreSQL servers Starting with Pgpool-II 4.0, Pgpool-II supports scram-sha-256 authentication. scram-sha-256 authentication method is strongly recommended because it is the most secure password-based authentication method. Solution 1 If PostgreSQL servers require  MD5  or  SCRAM  authentication for some user’s authentication but the password for that user is not present in  pool_passwd , then enabling  allow_clear_text_frontend_auth  will allow the  Pgpool-II  to use clear-text-password authentication with user to get the password in plain text form from the user ...
Read more

Deploy Nuxt.js app using Apache 2

-
  Deploy your dynamic Nuxt.js app Nuxt.js is an amazing server side rendering application framework for Vue.js. In this article we will see how to deploy Nuxt.js application to AWS instance in universal app mode. Where in Nuxt.js you can choose between Universal, Static Generated or Single Page application. Before we start deploying our dynamic app, if you want just to deploy a static website, you can run this command: npm run generate and it will generate the files and put them in  dist  folder which you can upload to any server you want. But this will not work for universal apps. 1. Build your app To build a ssr app you need to run the following command: npm run build The generated files will not be in the  dist  folder as for the static app, but you can find all generated files in  .nuxt  folder which will be the entry point. 2. Upload to the server There are two ways to do this upload your whole application with the source code or just upload the n...
Read more