forked from linux/WebHosting
hollerandgitadmin
d3f333d3d2
TLS is terminated at the proxy; Apache receives plain HTTP on :80. Merge all rules into a single *:80 vhost (the :443 vhost was never reached) and make the HTTPS redirect conditional on X-Forwarded-Proto: http. Fixes ERR_TOO_MANY_REDIRECTS.
100 lines
4.3 KiB
Plaintext
100 lines
4.3 KiB
Plaintext
# ============================================================
|
|
# omny-test.psi.ch — behind an SSL-terminating reverse proxy
|
|
#
|
|
# The proxy terminates HTTPS and forwards requests to this
|
|
# Apache as plain HTTP on port 80. Therefore:
|
|
# * everything (auth-gate rewrites, deny rules) lives in the
|
|
# *:80 vhost — there is no *:443 vhost on this host
|
|
# * the HTTP->HTTPS redirect fires ONLY when the proxy
|
|
# explicitly reports "X-Forwarded-Proto: http". If the
|
|
# header is absent, no redirect happens (loop-proof).
|
|
#
|
|
# Requirements (for the administrators):
|
|
# * mod_rewrite enabled. The vhost will intentionally FAIL
|
|
# to load without it, rather than silently serving
|
|
# everything unauthenticated.
|
|
# * PHP execution active for .php files in /var/www/omny.
|
|
# * IMPORTANT: mod_remoteip configured with the proxy's IP
|
|
# (RemoteIPHeader X-Forwarded-For +
|
|
# RemoteIPInternalProxy <proxy-ip>), so REMOTE_ADDR shows
|
|
# the real client. Several endpoints authorize by client
|
|
# IP; without mod_remoteip they see only the proxy address.
|
|
# ============================================================
|
|
|
|
<VirtualHost *:80>
|
|
ServerName omny-test.psi.ch
|
|
DocumentRoot /var/www/omny
|
|
|
|
ErrorLog ${APACHE_LOG_DIR}/omny-test_error.log
|
|
CustomLog ${APACHE_LOG_DIR}/omny-test_access.log combined
|
|
|
|
<Directory "/var/www/omny">
|
|
Options +ExecCGI -Indexes
|
|
AllowOverride None
|
|
Require all granted
|
|
# Bare "/" is normally caught by the catch-all rewrite
|
|
# below; DirectoryIndex kept as fallback.
|
|
DirectoryIndex login.php index.html index.php
|
|
</Directory>
|
|
|
|
# --------------------------------------------------------
|
|
# Block direct filesystem access to sensitive / junk files.
|
|
# (Apache's default "^\.ht" rule does NOT cover
|
|
# users.htpasswd / session.htpasswd — they don't start
|
|
# with ".ht".)
|
|
# --------------------------------------------------------
|
|
<FilesMatch "(\.htpasswd|\.gen|\.inc|~)$">
|
|
Require all denied
|
|
</FilesMatch>
|
|
|
|
RewriteEngine On
|
|
|
|
# --------------------------------------------------------
|
|
# 0. HTTPS enforcement, loop-proof behind the proxy:
|
|
# redirect ONLY if the proxy explicitly reports that the
|
|
# original request was plain HTTP. If the proxy does not
|
|
# send X-Forwarded-Proto, this never matches -> no loop.
|
|
# --------------------------------------------------------
|
|
RewriteCond %{HTTP:X-Forwarded-Proto} =http
|
|
RewriteRule ^ https://omny-test.psi.ch%{REQUEST_URI} [R=301,L]
|
|
|
|
# 1. URL-level deny before any rewriting.
|
|
RewriteRule \.(htpasswd|gen)$ - [F,L]
|
|
|
|
# 2. Guard: forbid direct client requests that pass the
|
|
# internal _file parameter to the gate scripts (would
|
|
# otherwise let a logged-in user stream PHP source incl.
|
|
# TOKEN_SECRET). Internal rewrites are unaffected: the
|
|
# gate rewrites below use [END], which skips rule
|
|
# re-processing.
|
|
RewriteCond %{QUERY_STRING} (^|&)_file=
|
|
RewriteRule ^/(samples/)?auth_gate\.php$ - [F,L]
|
|
|
|
# 3. Pass-throughs (no cookie check) — first match wins.
|
|
RewriteRule ^/login\.php$ - [L]
|
|
RewriteRule ^/upload\.php$ - [L]
|
|
RewriteRule ^/session_query\.php$ - [L]
|
|
RewriteRule ^/set_password\.php$ - [L]
|
|
RewriteRule ^/info\.php$ - [L]
|
|
RewriteRule ^/auth_gate\.php$ - [L]
|
|
RewriteRule ^/samples/auth_gate\.php$ - [L]
|
|
RewriteRule ^/\.well-known/acme-challenge/ - [L]
|
|
RewriteRule ^/samples/upload\.php$ - [L]
|
|
RewriteRule ^/samples/newmeasurement\.php$ - [L]
|
|
|
|
# 4. Normalize /samples -> /samples/ so it hits the samples
|
|
# gate instead of falling through to the main gate.
|
|
RewriteRule ^/samples$ /samples/ [R=301,L]
|
|
|
|
# 5. Samples area: fixed users only.
|
|
# [END] (not [L]) is essential: Apache re-runs the rule
|
|
# set after internal redirects; without END this rule
|
|
# would match its own output and loop.
|
|
# [QSA] appends the original query string, e.g.
|
|
# /samples/x.json?t=1 -> _file=x.json&t=1
|
|
# (auth_gate.php handles this form via strtok).
|
|
RewriteRule ^/samples/(.*)$ /samples/auth_gate.php?_file=$1 [END,QSA]
|
|
|
|
# 6. Everything else: main auth gate.
|
|
RewriteRule ^/(.*)$ /auth_gate.php?_file=$1 [END,QSA]
|
|
</VirtualHost> |