- Redirect with separate identifiers so that they can retrieved separately.
- Enable virtual host log format that include name of the domain accessed so
that that information is preserved.
- There is no need to increment the apache app's version number as it has been
incremented earlier in the patch series (for this release).
Tests:
- In a fresh container, setup succeeds. Default apache sites 000-default.conf
and default-ssl.conf are disabled. freedombox-default.conf is enabled. Apache
access logs and error logs are sent to systemd journal.
- Without the patch applied, create a container. Run setup and access Plinth
interface. Apply the patches. Apache setup is run. a2query -s default and
a2query -s 000-default show that sites are not enabled. a2query -s
freedombox-default shows that site is enabled. Apache access logs and error logs
are sent to systemd journal.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- It is simpler to keep all the configuration in a single file. Any overrides
are expected to be done by writing additional configuration files with higher
priority.
- /etc/apache2/site-available/ is typically reserved for virtual host
configurations. Redirections and proxying for all virtual hosts rather belongs
in /etc/apache2/conf-available/.
- This looses the option of disabling plinth-ssl.conf when needed. In the
initial days of enabling TLS, there was a need felt to keep the option of easily
disabling redirection to TLS in case there is a need for it. However, TLS
certificate setup is mature and the limitations are well understood. There is no
longer a need for it. It still may be possible to avoid the redirection with an
additional configuration.
Tests:
- In a fresh container, setup succeeds. Redirecting to https:// for /plinth
works. FreedomBox web interface is available.
- Without the patch applied created a container. Run setup and access Plinth
interface. Apply the patches. Apache setup is run. a2query -s plinth and a2query
-s plinth-ssl show that sites are not enabled. Redirecting to https:// for
/plinth works. FreedomBox web interface is available.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Without the patch, run torsocks curl -kv http://DOMAIN.onion. Observe that
redirection to https happens.
- Without the patch, run curl -kv http://localhost. Observe that redirection to
https happens.
- With the patch, run torsocks curl -kv http://DOMAIN.onion. Observe that
redirection to https does not happen.
- With the patch, run curl -kv http://localhost. Observe that redirection to
https happens.
[sunil: Perform case insensitive match]
[sunil: Remove capture of domain name match]
[sunil: Strictly check that domain ends with .onion]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Tested-by: Sunil Mohan Adapa <sunil@medhas.org>
- We have switched to mod_ssl long time ago and are no longer using mod_gnutls.
- It is additional effort configure and test mod_gnutls.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Newer versions of Django axes have newly way to get the IP address of a client
using ipware library. This has multiple security issues
https://github.com/jazzband/django-axes/issues/286 . Workaround them by
controlling the X-FORWARDED-FOR header sent from Apache to FreedomBox and by
limiting the headers that ipware uses.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
I faced a situation that on my localhost resolved to an IPv6 address and
Apache was unable to connect to Plinth as Plinth does not yet listen on
IPv6 address. It is best to change this to an explict local IP address
at least until Plinth listens on IPv6 address.
- Don't hijack the entire SSL site for sake of Plinth.
- Serve both HTTP and HTTPS sites with default configuration.
- plinth-ssl configuration only make SSL compulsory.
- Document modules required for configuration to work properly.
- Don't disable default site during FreedomBox setup run. This is no
longer required.
- Request Apache to send X-Forwarded-Proto header.
- Use X-Forwarded-Proto header to understand original protocol
requested.
- Use X-Forwarded-Host header to understand original host requested.
- Allow any incoming host header so that FreedomBox can have any
hostname and when user requests for Plint with that hostname, it
works.
- Don't depend on Apache to rewrite the Location: header. Instead use
the original host and original scheme to set proper Location: header.
When Apache proxy forwards a request it usually makes the request to the
backend server with a new Host: header but sends the original host
information using a special header X-FORWARDED-HOST: header. It is a
common practise. The backend can be make the choice of which header to
use based on the knowledge that it is running behind a proxy server.
Since hostname of a FreedomBox machine could be anyting and it could
change during the operation of Plinth, having a list of incoming Host:
header values is not going to be easy in Plinth. If Apache were not to
force override this header, managing list of Host: header values will
become easiler in Plinth. If Plinth indeed wants to know the original
host name by which user refferred to it, it can use the
X-FORWARDED-HOST: header which is the norm in these situtations.
We are allowing modules to bring their own static content. If we need
to configure Apache to serve static URLs directly, Apache will have know
all the static URLs generated by all the modules. If these details are
provided, it will likely effect our modularity.
The current static URL given in Apache configuration is anyway
incorrect.
