Only switch FTP conntrack to explicit CT target for stretch hosts

[mirror/dsa-puppet.git] / modules / apache2 / templates / puppet-config.erb

diff --git a/modules/apache2/templates/puppet-config.erb b/modules/apache2/templates/puppet-config.erb
index fa9a210..7c38884 100644 (file)
--- a/modules/apache2/templates/puppet-config.erb
+++ b/modules/apache2/templates/puppet-config.erb
@@ -4,13 +4,13 @@
 
   # this is a list that seems suitable as of 2014-10, when running wheezy.  It
   # probably requires re-visiting regularly.
-  <% if @lsbmajdistrelease <= '7' -%>
+  <% if scope.call_function('versioncmp', [@lsbmajdistrelease, '7']) <= 0 -%>
     SSLCipherSuite ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
   <% else -%>
     SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
   <% end -%>
 
-  <%- if has_variable?("apache2deb9") && apache2deb9 == "true" -%>
+  <%- if has_variable?("apache2deb9") && @apache2deb9 -%>
     SSLUseStapling On
 
     # the default size is 32k, but we make it 1M.
@@ -25,5 +25,10 @@
     # [ https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html#ocspstapling ]
 
     SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling(1048576)
+    SSLStaplingReturnResponderErrors off
   <% end -%>
 </IfModule>
+
+<IfModule mod_autoindex.c>
+  IndexOptions SuppressDescription
+</IfModule>