X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/e76c27656e216accb551db4ac1d61de9183fcfa9..760d6ef7a14a6bcd89804c10aa9b20775f1af3fc:/cookbooks/chef/templates/default/apache.erb

diff --git a/cookbooks/chef/templates/default/apache.erb b/cookbooks/chef/templates/default/apache.erb
index 88c1cb6a3..4f57bba7d 100644
--- a/cookbooks/chef/templates/default/apache.erb
+++ b/cookbooks/chef/templates/default/apache.erb
@@ -8,6 +8,7 @@
 	CustomLog /var/log/apache2/chef.openstreetmap.org-access.log combined
 	ErrorLog /var/log/apache2/chef.openstreetmap.org-error.log
 
+	RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
 	Redirect permanent / https://chef.openstreetmap.org/
 </VirtualHost>
 
@@ -15,16 +16,21 @@
 	ServerName chef.openstreetmap.org
 	ServerAdmin webmaster@openstreetmap.org
 
-	SSLEngine on
-	SSLProtocol all -SSLv2
-	SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
-	SSLCertificateFile /etc/ssl/certs/openstreetmap.pem
-	SSLCertificateKeyFile /etc/ssl/private/openstreetmap.key
-
 	CustomLog /var/log/apache2/chef.openstreetmap.org-access.log combined
 	ErrorLog /var/log/apache2/chef.openstreetmap.org-error.log
 
+	DocumentRoot /var/lib/git
+
+	SSLEngine on
 	SSLProxyEngine on
+	SSLCertificateFile /etc/ssl/certs/chef.openstreetmap.org.pem
+	SSLCertificateKeyFile /etc/ssl/private/chef.openstreetmap.org.key
 
+	ProxyPassMatch ^/.*\.git/ !
 	ProxyPass / https://<%= node[:fqdn] %>:4443/
+	ProxyPreserveHost on
 </VirtualHost>
+
+<Directory /var/lib/git>
+	Require ip <%= @git_allowed.sort.join(" ") %>
+</Directory>