diff options
Diffstat (limited to 'installation/pleroma-apache.conf')
| -rw-r--r-- | installation/pleroma-apache.conf | 20 |
1 files changed, 11 insertions, 9 deletions
diff --git a/installation/pleroma-apache.conf b/installation/pleroma-apache.conf index 992c0c900..6174c85c0 100644 --- a/installation/pleroma-apache.conf +++ b/installation/pleroma-apache.conf @@ -1,24 +1,26 @@ #Example configuration for when Apache httpd and Pleroma are on the same host. -#Needed modules: headers proxy proxy_http proxy_wstunnel rewrite ssl +#Needed modules: define headers proxy proxy_http proxy_wstunnel rewrite ssl #This assumes a Debian style Apache config. Put this in /etc/apache2/sites-available #Install your TLS certificate, possibly using Let's Encrypt. #Replace 'pleroma.example.com' with your instance's domain wherever it appears -ServerName pleroma.example.com +Define servername pleroma.example.com + +ServerName ${servername} ServerTokens Prod ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined <VirtualHost *:80> - Redirect permanent / https://pleroma.example.com + Redirect permanent / https://${servername} </VirtualHost> <VirtualHost *:443> SSLEngine on - SSLCertificateFile /etc/letsencrypt/live/pleroma.example.com/cert.pem - SSLCertificateKeyFile /etc/letsencrypt/live/pleroma.example.com/privkey.pem - SSLCertificateChainFile /etc/letsencrypt/live/pleroma.example.com/fullchain.pem + SSLCertificateFile /etc/letsencrypt/live/${servername}/cert.pem + SSLCertificateKeyFile /etc/letsencrypt/live/${servername}/privkey.pem + SSLCertificateChainFile /etc/letsencrypt/live/${servername}/fullchain.pem # Mozilla modern configuration, tweak to your needs SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 @@ -31,7 +33,7 @@ CustomLog ${APACHE_LOG_DIR}/access.log combined Header always set X-Frame-Options "DENY" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy same-origin - Header always set Content-Security-Policy "default-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://pleroma.example.tld; upgrade-insecure-requests;" + Header always set Content-Security-Policy "default-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://${servername}; upgrade-insecure-requests;" # Uncomment this only after you get HTTPS working. # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" @@ -45,7 +47,7 @@ CustomLog ${APACHE_LOG_DIR}/access.log combined ProxyPass / http://localhost:4000/ ProxyPassReverse / http://localhost:4000/ - RequestHeader set Host "pleroma.example.com" + RequestHeader set Host ${servername} ProxyPreserveHost On </VirtualHost> @@ -53,4 +55,4 @@ CustomLog ${APACHE_LOG_DIR}/access.log combined SSLUseStapling on SSLStaplingResponderTimeout 5 SSLStaplingReturnResponderErrors off -SSLStaplingCache shmcb:/var/run/ocsp(128000)
\ No newline at end of file +SSLStaplingCache shmcb:/var/run/ocsp(128000) |