Log SSL protocol and cipher details for web requests

[chef.git] / cookbooks / web / templates / default / apache.frontend.erb

diff --git a/cookbooks/web/templates/default/apache.frontend.erb b/cookbooks/web/templates/default/apache.frontend.erb
index a86c0d13a3cfb3dfce883e66178abb0698a6ef98..6525d1abe6a4bdb56594e824308239864ef6c272 100644 (file)
--- a/cookbooks/web/templates/default/apache.frontend.erb
+++ b/cookbooks/web/templates/default/apache.frontend.erb
@@ -14,12 +14,13 @@
   # Enable SSL
   #
   SSLEngine on
   # Enable SSL
   #
   SSLEngine on

+  SSLProxyEngine on

 <% end -%>
 
   #
   # Setup logging
   #
 <% end -%>
 
   #
   # Setup logging
   #

-  LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %Ts" combined_with_time
+  LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %Ts %{SSL_PROTOCOL}x %{SSL_CIPHER}x" combined_with_time

   CustomLog /var/log/apache2/access.log combined_with_time
   ErrorLog /var/log/apache2/error.log
 
   CustomLog /var/log/apache2/access.log combined_with_time
   ErrorLog /var/log/apache2/error.log
 


@@ -29,6 +30,11 @@
   ExpiresActive On
   RewriteEngine on
 
   ExpiresActive On
   RewriteEngine on
 

+  #
+  # Add the unique ID to the request headers
+  #
+  RequestHeader set X-Request-Id %{UNIQUE_ID}e
+

   #
   # Block troublesome GPX data scrapping
   #
   #
   # Block troublesome GPX data scrapping
   #


@@ -135,8 +141,14 @@
   RailsEnv production
   PassengerMinInstances 10
   PassengerMaxRequests 5000
   RailsEnv production
   PassengerMinInstances 10
   PassengerMaxRequests 5000

+  PassengerMaxRequestQueueSize 250
+<% if port == 443 -%>
+  PassengerPreStart https://www.openstreetmap.org/
+<% else -%>

   PassengerPreStart http://www.openstreetmap.org/
   PassengerPreStart http://www.openstreetmap.org/

-  Alias /favicon.ico <%= node[:web][:base_directory] %>/rails/app/assets/images/favicon.ico
+<% end -%>
+  SetEnv SECRET_KEY_BASE <%= @secret_key_base %>
+  Alias /favicon.ico <%= node[:web][:base_directory] %>/rails/app/assets/favicons/favicon.ico

   Alias /openlayers <%= node[:web][:base_directory] %>/rails/vendor/assets/openlayers
   Alias /stats /store/rails/stats
   Alias /user/image /store/rails/user/image
   Alias /openlayers <%= node[:web][:base_directory] %>/rails/vendor/assets/openlayers
   Alias /stats /store/rails/stats
   Alias /user/image /store/rails/user/image


@@ -160,18 +172,19 @@
   </Proxy>
 
   #
   </Proxy>
 
   #

-  # Pass other heavy duty API calls to the bulkapi backends via a load balancer
+  # Pass some other API calls to the backends via a load balancer

   #
   #

-  ProxyPass /api/0.6/map balancer://bulkapi/api/0.6/map
-  ProxyPass /api/0.6/tracepoints balancer://bulkapi/api/0.6/tracepoints
-  ProxyPass /api/0.6/amf/read balancer://bulkapi/api/0.6/amf/read
-  ProxyPass /api/0.6/swf/trackpoints balancer://bulkapi/api/0.6/swf/trackpoints
-  ProxyPassMatch ^(/api/0.6/changeset/[0-9]+/(upload|download))$ balancer://bulkapi$1
-  ProxyPassMatch ^(/api/0.6/.*/(full|history|search|ways))$ balancer://bulkapi$1
-  ProxyPass /api/0.6/nodes balancer://bulkapi/api/0.6/nodes
-  ProxyPass /api/0.6/ways balancer://bulkapi/api/0.6/ways
-  ProxyPass /api/0.6/relations balancer://bulkapi/api/0.6/relations
-  ProxyPassMatch ^(/trace/[0-9]+/data(|/|.xml))$ balancer://bulkapi$1
+  ProxyPass /api/0.6/map balancer://backend/api/0.6/map
+  ProxyPass /api/0.6/tracepoints balancer://backend/api/0.6/tracepoints
+  ProxyPass /api/0.6/amf/read balancer://backend/api/0.6/amf/read
+  ProxyPass /api/0.6/swf/trackpoints balancer://backend/api/0.6/swf/trackpoints
+  ProxyPassMatch ^(/api/0\.6/changeset/[0-9]+/(upload|download))$ balancer://backend$1
+  ProxyPassMatch ^(/api/0\.6/(node|way|relation)/[0-9]+)$ balancer://backend$1
+  ProxyPassMatch ^(/api/0\.6/(node|way|relation)/[0-9]+/(full|history|search|ways))$ balancer://backend$1
+  ProxyPass /api/0.6/nodes balancer://backend/api/0.6/nodes
+  ProxyPass /api/0.6/ways balancer://backend/api/0.6/ways
+  ProxyPass /api/0.6/relations balancer://backend/api/0.6/relations
+  ProxyPassMatch ^(/trace/[0-9]+/data(|/|.xml))$ balancer://backend$1

 
   #
   # Redirect trac and wiki requests to the right places
 
   #
   # Redirect trac and wiki requests to the right places


@@ -186,18 +199,24 @@
   RedirectPermanent /images/cc_button.png http://www.openstreetmap.org/assets/cc_button.png
 
   #
   RedirectPermanent /images/cc_button.png http://www.openstreetmap.org/assets/cc_button.png
 
   #

-  # Define a load balancer for the bulkapi backends
+  # Define a load balancer for the backends

   #
   #

-  <Proxy balancer://bulkapi>
+  <Proxy balancer://backend>

     ProxySet lbmethod=bybusyness
     ProxySet lbmethod=bybusyness

+<% if port == 443 -%>
+    BalancerMember https://rails1 disablereuse=on
+    BalancerMember https://rails2 disablereuse=on
+    BalancerMember https://rails3 disablereuse=on
+<% else -%>

     BalancerMember http://rails1
     BalancerMember http://rails2
     BalancerMember http://rails3
     BalancerMember http://rails1
     BalancerMember http://rails2
     BalancerMember http://rails3

+<% end -%>

   </Proxy>
 <% if port == 80 -%>
 
   #
   </Proxy>
 <% if port == 80 -%>
 
   #

-  # Redirect requests which should be secure to the SSL site
+  # Redirect requests which should be secure to https

   #
   RewriteCond %{REQUEST_URI} ^/login(\.html)?$ [OR]
   RewriteCond %{REQUEST_URI} ^/user/(new|create-account\.html)$ [OR]
   #
   RewriteCond %{REQUEST_URI} ^/login(\.html)?$ [OR]
   RewriteCond %{REQUEST_URI} ^/user/(new|create-account\.html)$ [OR]


@@ -222,27 +241,17 @@
 <% elsif port == 443 -%>
 
   #
 <% elsif port == 443 -%>
 
   #

-  # Redirect api requests to api.osm.org over http
+  # Redirect api requests made to www.osm.org to api.osm.org

   #
   #

-  RewriteRule ^/api/(.*)$ http://api.openstreetmap.org/api/$1 [L,NE,R=permanent]
+#  RewriteCond %{HTTP_HOST} =www.openstreetmap.org
+#  RewriteRule ^/api/(.*)$ https://api.openstreetmap.org/api/$1 [L,NE,R=permanent]

 
   #
 
   #

-  # Redirect requests which do not need to be secure over http
+  # Redirect non-api requests made to api.osm.org to www.osm.org

   #
   #

-  RewriteCond %{REQUEST_URI} !^/login(.html)?$
-  RewriteCond %{REQUEST_URI} !^/user/(new|create-account.html)$
-  RewriteCond %{REQUEST_URI} !^/user/terms$
-  RewriteCond %{REQUEST_URI} !^/user/save$
-  RewriteCond %{REQUEST_URI} !^/user/go_public$
-  RewriteCond %{REQUEST_URI} !^/user/([^/]+)/account$
-  RewriteCond %{REQUEST_URI} !^/user/reset-password$
-  RewriteCond %{REQUEST_URI} !^/preview/
-  RewriteCond %{REQUEST_URI} !^/assets/
-  RewriteCond %{REQUEST_URI} !^/javascripts/
-  RewriteCond %{REQUEST_URI} !^/images/
-  RewriteCond %{REQUEST_URI} !^/stylesheets/
-  RewriteCond %{REQUEST_URI} !^/openlayers/
-  RewriteRule ^(.*)$ http://www.openstreetmap.org$1 [L,NE,R=permanent]
+  RewriteCond %{HTTP_HOST} =api.openstreetmap.org
+  RewriteCond %{REQUEST_URI} !^/api/
+  RewriteRule ^(.*)$ https://www.openstreetmap.org$1 [L,NE,R=permanent]

 <% end -%>
 </VirtualHost>
 
 <% end -%>
 </VirtualHost>
 


@@ -254,20 +263,48 @@
   ServerAlias maps.openstreetmap.com mapz.openstreetmap.com
   ServerAlias openstreetmap.net www.openstreetmap.net
   ServerAlias maps.openstreetmap.net mapz.openstreetmap.net
   ServerAlias maps.openstreetmap.com mapz.openstreetmap.com
   ServerAlias openstreetmap.net www.openstreetmap.net
   ServerAlias maps.openstreetmap.net mapz.openstreetmap.net

+  ServerAlias openstreetmap.ca www.openstreetmap.ca
+  ServerAlias maps.openstreetmap.ca mapz.openstreetmap.ca
+  ServerAlias openstreetmap.eu www.openstreetmap.eu
+  ServerAlias maps.openstreetmap.eu mapz.openstreetmap.eu
+  ServerAlias openstreetmap.pro www.openstreetmap.pro
+  ServerAlias maps.openstreetmap.pro mapz.openstreetmap.pro

   ServerAlias openstreetmaps.org www.openstreetmaps.org
   ServerAlias maps.openstreetmaps.org mapz.openstreetmaps.org
   ServerAlias osm.org www.osm.org
   ServerAlias maps.osm.org mapz.osm.org
   ServerAlias openmaps.org www.openmaps.org
   ServerAlias maps.openmaps.org mapz.openmaps.org
   ServerAlias openstreetmaps.org www.openstreetmaps.org
   ServerAlias maps.openstreetmaps.org mapz.openstreetmaps.org
   ServerAlias osm.org www.osm.org
   ServerAlias maps.osm.org mapz.osm.org
   ServerAlias openmaps.org www.openmaps.org
   ServerAlias maps.openmaps.org mapz.openmaps.org

+  ServerAlias openstreetmap.io www.openstreetmap.io
+  ServerAlias maps.openstreetmap.io mapz.openstreetmap.io
+  ServerAlias osm.io www.osm.io
+  ServerAlias maps.osm.io mapz.osm.io

   ServerAlias openworldmap.org www.openworldmap.org
   ServerAlias maps.openworldmap.org mapz.openworldmap.org
   ServerAlias freeosm.org www.freeosm.org
   ServerAlias maps.freeosm.org mapz.freeosm.org
   ServerAlias openworldmap.org www.openworldmap.org
   ServerAlias maps.openworldmap.org mapz.openworldmap.org
   ServerAlias freeosm.org www.freeosm.org
   ServerAlias maps.freeosm.org mapz.freeosm.org

+  ServerAlias open-maps.org www.open-maps.org
+  ServerAlias maps.open-maps.org mapz.open-maps.org
+  ServerAlias open-maps.com www.open-maps.com
+  ServerAlias maps.open-maps.com mapz.open-maps.com
+  ServerAlias osmbugs.org www.osmbugs.org
+  ServerAlias maps.osmbugs.org mapz.osmbugs.org
+
+  #Third Party Sites
+  ServerAlias openstreetmap.pm www.openstreetmap.pm

 
   RedirectPermanent / http://www.openstreetmap.org/
 </VirtualHost>
 
 
   RedirectPermanent / http://www.openstreetmap.org/
 </VirtualHost>
 

+<VirtualHost *:443>
+  ServerName openstreetmap.org
+  ServerAlias maps.openstreetmap.org mapz.openstreetmap.org
+
+  SSLEngine on
+
+  RedirectPermanent / https://www.openstreetmap.org/
+</VirtualHost>
+

 <VirtualHost *:80>
   ServerName openstreetmap.org.uk
   ServerAlias www.openstreetmap.org.uk
 <VirtualHost *:80>
   ServerName openstreetmap.org.uk
   ServerAlias www.openstreetmap.org.uk


@@ -277,3 +314,27 @@
   RedirectPermanent /events.ics http://calendar.openstreetmap.org.uk/events.ics
   RedirectPermanent / http://www.openstreetmap.org/
 </VirtualHost>
   RedirectPermanent /events.ics http://calendar.openstreetmap.org.uk/events.ics
   RedirectPermanent / http://www.openstreetmap.org/
 </VirtualHost>

+
+<Directory <%= node[:web][:base_directory] %>/rails/public>
+  Require all granted
+</Directory>
+
+<Directory /srv/www.openstreetmap.org/rails/app/assets>
+  Require all granted
+</Directory>
+
+<Directory /srv/www.openstreetmap.org/rails/vendor/assets>
+  Require all granted
+</Directory>
+
+<Directory /store/rails/stats>
+  Require all granted
+</Directory>
+
+<Directory /store/rails/user/image>
+  Require all granted
+</Directory>
+
+<Directory /store/rails/attachments>
+  Require all granted
+</Directory>