X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fapache2%2Ftemplates%2Fpuppet-config.erb;h=7c38884a56298168dfa75dad55af27164d44c213;hb=0e0adab173d5961a4e13fc4adae018a306f4b030;hp=fca5a8b4428a160fa86b1d7d2946137f188d433f;hpb=b2a383c3f6d04206e8bae15f34022d691720d0c0;p=mirror%2Fdsa-puppet.git

diff --git a/modules/apache2/templates/puppet-config.erb b/modules/apache2/templates/puppet-config.erb
index fca5a8b44..7c38884a5 100644
--- a/modules/apache2/templates/puppet-config.erb
+++ b/modules/apache2/templates/puppet-config.erb
@@ -4,9 +4,31 @@
 
   # this is a list that seems suitable as of 2014-10, when running wheezy.  It
   # probably requires re-visiting regularly.
-  <% if @lsbmajdistrelease <= '7' -%>
+  <% if scope.call_function('versioncmp', [@lsbmajdistrelease, '7']) <= 0 -%>
     SSLCipherSuite ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
   <% else -%>
     SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
   <% end -%>
+
+  <%- if has_variable?("apache2deb9") && @apache2deb9 -%>
+    SSLUseStapling On
+
+    # the default size is 32k, but we make it 1M.
+    # | If more than a few SSL certificates are used for the server
+    # |
+    # | OCSP responses are stored in the SSL stapling cache. While the
+    # | responses are typically a few hundred to a few thousand bytes in size,
+    # | mod_ssl supports OCSP responses up to around 10K bytes in size. With more
+    # | than a few certificates, the stapling cache size (32768 bytes in the
+    # | example above) may need to be increased. Error message AH01929 will be
+    # | logged in case of an error storing a response.
+    # [ https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html#ocspstapling ]
+
+    SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling(1048576)
+    SSLStaplingReturnResponderErrors off
+  <% end -%>
+</IfModule>
+
+<IfModule mod_autoindex.c>
+  IndexOptions SuppressDescription
 </IfModule>