X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Froles%2Ftemplates%2Fstatic-mirroring%2Fvhost%2Fstatic-vhosts-simple.erb;h=4c33fe192f850fef140f46112b229344361fcd57;hb=1511fdf6245bda62b05148123b233a196d6b6f4d;hp=2765157d227ba5590ea0c09c2e8b2da01967c0c4;hpb=7cf8b7eb558549cc7c5ff4c7c6e8356d91b91077;p=mirror%2Fdsa-puppet.git

diff --git a/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb b/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
index 2765157d2..4c33fe192 100644
--- a/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
+++ b/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
@@ -14,7 +14,7 @@
 	Redirect /debian-security/  http://cdn-fastly.deb.debian.org/debian-security/
 </Macro>
 
-<VirtualHost <%= vhost_listen_443 %> >
+<VirtualHost <%= @vhost_listen_443 %> >
 	ServerName deb.debian.org
 
 	ErrorLog /var/log/apache2/deb.debian.org-error.log
@@ -36,7 +36,7 @@
 		Require all granted
 	</Directory>
 
-	Header set Surrogate-Key <%= hostname %>
+	Header set Surrogate-Key <%= @hostname %>
 
 	AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
 
@@ -147,6 +147,11 @@
 	RewriteRule ^/source/([a-z0-9-]+)/?$ /${source-map:$1} [L,R,NE]
 	# Versioned request
 	RewriteRule ^/source/([a-z0-9-]+)/([a-zA-Z0-9.+:~-]+)$ /${source-map:$1/$2} [L,R,NE]
+
+	Header always set Content-Security-Policy "default-src 'self'; media-src 'none'; object-src 'none';"
+	<FilesMatch "\.(svg)$">
+		Header always set Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline';"
+	</FilesMatch>
 </Macro>
 
 <%=
@@ -197,8 +202,10 @@ vhost(lines, "security-team.debian.org"      , :ssl => true)
 vhost(lines, "d-i.debian.org"                , :ssl => true)
 vhost(lines, "appstream.debian.org"          , :ssl => true)
 vhost(lines, "apt.buildd.debian.org"         , :ssl => true)
+vhost(lines, "dpl.debian.org"                , :ssl => true)
 vhost(lines, "dsa.debian.org"                , :ssl => true)
 vhost(lines, "rtc.debian.org"                , :ssl => true)
+vhost(lines, "mirror-master.debian.org"      , :ssl => true)
 vhost(lines, "onion.debian.org"              , :ssl => true)
 vhost(lines, "manpages.debian.org"           , :ssl => true, :extra => true)
 
@@ -233,7 +240,7 @@ lines.join("\n")
 # www.backports.org is the historical place for the backports
 # website and archive.  It is now a CNAME to backports.debian.org:
 # redirect http requests.
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName www.backports.org
 	ServerAlias lists.backports.org
 	ServerAdmin debian-admin@debian.org
@@ -241,27 +248,27 @@ lines.join("\n")
 </VirtualHost>
 
 ######################
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName www.debian-ports.org
 	ServerAlias debian-ports.org
 	ServerAdmin debian-admin@debian.org
 	RedirectPermanent / https://www.ports.debian.org/
 </VirtualHost>
 
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName ports.debian.org
 	ServerAlias ports.debian.net
 	ServerAdmin debian-admin@debian.org
 	RedirectPermanent / https://www.ports.debian.org/
 </VirtualHost>
 
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName incoming.debian-ports.org
 	ServerAdmin debian-admin@debian.org
 	RedirectPermanent / http://incoming.ports.debian.org/
 </VirtualHost>
 
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName ftp.debian-ports.org
 	ServerAdmin debian-admin@debian.org
 	RedirectPermanent /archive http://www.ports.debian.org
@@ -270,7 +277,7 @@ lines.join("\n")
 	RedirectPermanent / http://ftp.ports.debian.org/
 </VirtualHost>
 
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName video.debian.net
 	ServerAdmin debian-admin@debian.org
 	Redirect / http://meetings-archive.debian.net/pub/debian-meetings/
@@ -279,7 +286,7 @@ lines.join("\n")
 # historical sites
 ##################
 # now only redirects remain
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName women.debian.org
 	ServerAdmin debian-admin@debian.org
 
@@ -296,23 +303,60 @@ lines.join("\n")
 	RedirectPermanent /profiles/ http://www.debian.org/women/profiles/
 </VirtualHost>
 
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName volatile.debian.org
 	ServerAlias volatile-master.debian.org
 	ServerAdmin debian-admin@debian.org
 	RedirectPermanent / http://www.debian.org/volatile/
 </VirtualHost>
 
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName ftp-master.metadata.debian.org
 	ServerAdmin debian-admin@debian.org
 	RedirectPermanent / http://metadata.ftp-master.debian.org/
 </VirtualHost>
 
-<VirtualHost <%= vhost_listen %> >
+<VirtualHost <%= @vhost_listen %> >
 	ServerName backports-master.debian.org
 	ServerAdmin debian-admin@debian.org
 	RedirectPermanent / https://backports.debian.org/
 </VirtualHost>
 
+<VirtualHost <%= @vhost_listen %> >
+	ServerName manpages.debian.net
+	ServerAdmin debian-admin@debian.org
+	Redirect / https://manpages.debian.org/
+</VirtualHost>
+
+# error pages
+#############
+
+Use common-dsa-vhost-https-redirect archive.debian.net
+<VirtualHost <%= @vhost_listen_443 %> >
+	ServerName archive.debian.net
+	ServerAdmin debian-admin@debian.org
+	ErrorLog /var/log/apache2/archive.debian.net-error.log
+	CustomLog /var/log/apache2/archive.debian.net-access.log privacyssl
+
+	Use common-debian-service-ssl archive.debian.net
+	Use common-ssl-HSTS
+
+	<IfModule mod_userdir.c>
+		UserDir disabled
+	</IfModule>
+	ServerSignature On
+
+	DocumentRoot /srv/static.debian.org/puppet/archive.debian.net
+	<Directory /srv/static.debian.org/puppet/archive.debian.net>
+		AllowOverride FileInfo Indexes Options=Multiviews
+		Options Indexes SymLinksIfOwnerMatch
+		Require all granted
+	</Directory>
+
+	RedirectMatch 503 ^/(?!503\.html)
+	ErrorDocument 503 /503.html
+	Header always set Retry-After "18000"
+</VirtualHost>
+
+
 # vim:ft=apache: