######################################################################## # General apache configuration options ######################################################################## #### # This file should be copied from # /app/tools/sysadmin/apache2/rshosts.conf. For some reason with # the apache configuration on STAGING64 sections were being # ignored. I suspect this has to do with SELinux, but I haven't # to figured out how to fix it yet. # # Anyway, don't edit this file directly. #### # This is an attempt to get remote IP stuff working, but doesn't seem # to at this time (Apr 2017). This is supposed to indicate who we trust # as a source for this header info (or something like that). RemoteIPHeader X-Forwarded-For RemoteIPInternalProxy 172.31.0.0/16 User apache Group apache ServerAdmin webmaster@royaltyshare.com ServerName www.royaltyshare.com LogLevel warn LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined #LogFormat "%v %h %P %l %u %t \"%r\" %>s %b" common #LogFormat "%v %h \#%{remoteip-proxy-ip-list}n\# %P %l %u %t \"%r\" %>s %b" common LogFormat "%v %h %a %{remoteip-proxy-ip-list}n #%{X-Forwarded-For}i# %P %l %u %t \"%r\" %>s %b" common LogFormat "%{Referer}i -> %U" referer LogFormat "%{User-agent}i" agent ErrorLog /etc/httpd/logs/error_log CustomLog /etc/httpd/logs/access_log common DirectoryIndex index.html ExpiresActive On Options Indexes Includes FollowSymLinks MultiViews Require all granted # 1 year ExpiresDefault A31536000 Header append Cache-Control "public" Options Indexes Includes FollowSymLinks MultiViews Require all granted # 1 year ExpiresDefault A31536000 Header append Cache-Control "public" ######################################################################## # Configure RoyaltyShare virtual hosts ######################################################################## ### # Login Website (login.royaltyshare.com) ### ServerAdmin webmaster@royaltyshare.com ServerName login.royaltyshare.com Redirect /index.html https://login.royaltyshare.com/rps/login Redirect permanent / https://login.royaltyshare.com/ ServerAdmin webmaster@royaltyshare.com ServerName portal.royaltyshare.com Redirect /index.html https://portal.royaltyshare.com/ Redirect permanent / https://portal.royaltyshare.com/ ServerAdmin webmaster@royaltyshare.com ServerName login.royaltyshare.com #PerlSetEnv CLIENT_ID 0 SSLEngine on SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4 SSLCertificateKeyFile /etc/httpd/ssl.key/server.key SSLCertificateFile /etc/httpd/ssl.crt/STAR_royaltyshare_com.crt SSLCertificateChainFile /etc/httpd/ssl.crt/STAR_royaltyshare_com.ca-bundle Redirect /index.html https://login.royaltyshare.com/rps/login ### # Corporate Website (www.royaltyshare.com) ### ServerAdmin webmaster@royaltyshare.com ServerName www.royaltyshare.com ServerAlias royaltyshare.com Redirect /index.html http://www.royaltyshare.com/corp/main ServerAdmin webmaster@royaltyshare.com ServerName www.royaltyshare.com ServerAlias royaltyshare.com SSLEngine on SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4 SSLCertificateKeyFile /etc/httpd/ssl.key/server.key SSLCertificateFile /etc/httpd/ssl.crt/STAR_royaltyshare_com.crt SSLCertificateChainFile /etc/httpd/ssl.crt/STAR_royaltyshare_com.ca-bundle SetEnvIf User-Agent ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 Redirect /index.html https://www.royaltyshare.com/corp/main ######################################################################## # Configure all client virtual hosts # # Dynamic Apache configuration using client information from # RSCOMMON.client # # To create a new virtual host update the database using # client_name_clean as the site hostname. Then reload the apache # configuration. ######################################################################## # httpd won't start? need to add the following line to /etc/sysconfig/httpd: # export PERL5LIB=/usr/local/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi:/usr/local/lib/perl5/site_perl:/usr/local/lib64/perl5/5.8.8/x86_64-linux-thread-multi:/usr/local/lib/perl5/5.8.8 # Tried to in-line it here, but it's too late for core modules. For example, # core Carp seems to be loaded already, which makes our local Carp::Heavy # unhappy. use lib '/app/tools/common/lib'; use Common::RSDB; use Common::RSApp; use Common::Client; use Common::DB::Item::Client; # Used for debugging, needed for Apache2::PerlSections->dump # $Apache2::PerlSections::Save = 1; my @vhosts; my @ssl_vhosts; my $envDBFile = '/var/run/royaltyshare/envdb'; my $singleton = new Common::RSApp( clientID => 0 ); ### # Setup aliases for logo.gif ### my $logo = Common::RSApp::IsProductionServer() ? "logo.gif" : "logo_test.gif"; push @Alias, [ "/logo.gif" => "/app/tools/common/production/images/$logo" ]; push @Alias, [ "/production/images/logo.gif" => "/app/tools/common/production/images/$logo" ]; ### # Setup client virtual hosts ### my @clients = getClients(); # Iterate through each client on this box and configure a vhost foreach my $client (@clients) { if ( Common::DB::Item::Client->Lookup( client_id => $client ) ) { next if ( $client == 989 ); # skip payee portal my $clientObj = new Common::Client( clientID => $client ); my $host = $clientObj->ClientNameClean() . ".royaltyshare.com"; print STDERR "Configure vhost for: $host\n"; push( @vhosts, getVhostConf($clientObj) ); push( @ssl_vhosts, getSSLVhostConf($clientObj) ); } } $VirtualHost{"*:80"} = \@vhosts; $VirtualHost{"*:443"} = \@ssl_vhosts; $singleton = undef; sub getClients { if (Common::RSApp::IsProductionServer) { return Common::RSDB::GetAllClientIDs; } elsif ( -e $envDBFile ) { my $envDB = `cat $envDBFile|tr -d '\n'`; return Common::RSDB::GetLocalClientIDs($envDB); } else { return Common::RSDB::GetLocalClientIDs; } } sub getVhostConf { my $client = shift; my $host = $client->ClientNameClean() || die "Client clean name not defined"; my $alias = $client->WebAlias(); my $config = { ServerName => "$host.royaltyshare.com", ServerAdmin => 'webmaster@royaltyshare.com', # Rewrite all requests to HTTPS RewriteEngine => "ON", # Except for ELB load balanced request # kind of, need to consider spoofing... RewriteCond => qw(%{HTTP:X-Forwarded-Proto} =http), RewriteRule => [ [qw(.* https://%{SERVER_NAME}%{REQUEST_URI} [R,NE,L])] ], }; if ($alias) { print STDERR " - Server Alias: $alias.royaltyshare.com\n"; $config->{ServerAlias} = "$alias.royaltyshare.com"; } return $config; } sub getSSLVhostConf { my $client = shift; my $host = $client->ClientNameClean() || die "Client clean name not defined"; my $id = $client->ClientID() || die "Client ID not defined"; my $alias = $client->WebAlias(); my $mainPage = $client->MainPage(); my $config = { ServerName => "$host.royaltyshare.com", ServerAdmin => 'webmaster@royaltyshare.com', PerlSetEnv => [ [ CLIENT_ID, $id ] ], SetEnv => [ [ CLIENT_ID, $id ] ], SSLEngine => "On", SSLProtocol => "all -SSLv2 -SSLv3", #SSLCipherSuite => "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4", SSLCertificateKeyFile => "/etc/httpd/ssl.key/server.key", SSLCertificateFile => "/etc/httpd/ssl.crt/STAR_royaltyshare_com.crt", SSLCertificateChainFile => "/etc/httpd/ssl.crt/STAR_royaltyshare_com.ca-bundle", # Rewrite the main index page # RewriteEngine => "ON", RewriteRule => [ [ '^/$ ' . $mainPage . ' [R,L]' ] ], }; # $config->{PerlInitHandler} = "Apache2::Reload" # unless( Common::RSApp::IsProductionServer ); push( @{ $config->{PerlSetEnv} }, [ DEBUG => $id ] ) unless (Common::RSApp::IsProductionServer); if ($alias) { $config->{ServerAlias} = "$alias.royaltyshare.com"; } return $config; } ### # If you want to see the apache configuration that is perl generated ### # # print STDERR Apache2::PerlSections->dump; # ######################################################################## # Final Apache Configurations. The aliases need to be after the # dynamic vhost configurations because the /production alais would # override the logo.gif alias. ######################################################################## Alias /notfound.html /app/tools/common/production/html/notfound.html Alias /error.html /app/tools/common/production/html/error.html Alias /production /app/tools/common/production Alias /images/charts /app/data/charts ErrorDocument 500 /error.html ErrorDocument 404 /notfound.html ### # Include application configuration ### Include /app/tools/common/conf/rsapp.conf Include /app/tools/rps/conf/rps.conf Include /app/tools/mediaserve/conf/mediaserve.conf Include /app/tools/support/conf/support.conf Include /app/tools/admin/conf/admin.conf Include /app/tools/bookpub/conf/bookpub.conf Include /app/tools/portal/conf/portal.conf Include /app/tools/api/conf/api.conf