docker-always-https/start.sh at master · SUNET/docker-always-https · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
#!/bin/sh

rm -f /etc/apache2/sites-available/*
rm -f /etc/apache2/sites-enabled/*

# optionally ship acme challenges to an external tool

if [ ! -z "${ACME_URL}" ]; then

cat>/etc/apache2/conf-available/acme.conf<<EOF
ProxyPass /.well-known/acme-challenge ${ACME_URL}/.well-known/acme-challenge/
ProxyPassReverse /.well-known/acme-challenge ${ACME_URL}/.well-known/acme-challenge/
EOF
a2enconf acme
a2enmod proxy proxy_http

fi

# health check file, excluded from the https redirect in both modes
mkdir -p /var/www
echo "ok" > /var/www/_lvs.txt

if [ -z "${URLS}" ]; then

# In this mode we only redirect to https on $self

   cat>/etc/apache2/sites-available/default.conf<<EOF
<VirtualHost *:80>
       ServerAdmin noc@sunet.se
       ServerName localhost
       DocumentRoot /var/www/

       RewriteEngine On
       RewriteCond %{HTTPS} off
       RewriteRule !(_lvs.txt|.well-known/acme-challenge.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301]
</VirtualHost>
EOF

a2ensite default

else

## In this mode we redirect everything on https on an external URL
## while preserving the query parameters
## http

   cat>/etc/apache2/sites-available/default.conf<<EOF
<VirtualHost *:80>
       ServerAdmin noc@sunet.se
       DocumentRoot /var/www/

       RewriteEngine On
       RewriteCond %{HTTPS} off
       RewriteRule !(_lvs.txt|.well-known/acme-challenge.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301]
</VirtualHost>
EOF

## https

KEYDIR=/etc/ssl
mkdir -p $KEYDIR
export KEYDIR

if [ ! -f "$KEYDIR/private/${HOSTNAME}.key" -o ! -f "$KEYDIR/certs/${HOSTNAME}.crt" ]; then
   make-ssl-cert generate-default-snakeoil --force-overwrite
   cp /etc/ssl/private/ssl-cert-snakeoil.key "$KEYDIR/private/${HOSTNAME}.key"
   cp /etc/ssl/certs/ssl-cert-snakeoil.pem "$KEYDIR/certs/${HOSTNAME}.crt"
fi

CHAINSPEC=""
export CHAINSPEC
if [ -f "$KEYDIR/certs/${HOSTNAME}.chain" ]; then
   CHAINSPEC="SSLCertificateChainFile $KEYDIR/certs/${HOSTNAME}.chain"
elif [ -f "$KEYDIR/certs/${HOSTNAME}-chain.crt" ]; then
   CHAINSPEC="SSLCertificateChainFile $KEYDIR/certs/${HOSTNAME}-chain.crt"
elif [ -f "$KEYDIR/certs/${HOSTNAME}.chain.crt" ]; then
   CHAINSPEC="SSLCertificateChainFile $KEYDIR/certs/${HOSTNAME}.chain.crt"
elif [ -f "$KEYDIR/certs/chain.crt" ]; then
   CHAINSPEC="SSLCertificateChainFile $KEYDIR/certs/chain.crt"
elif [ -f "$KEYDIR/certs/chain.pem" ]; then
   CHAINSPEC="SSLCertificateChainFile $KEYDIR/certs/chain.pem"
fi

   cat>/etc/apache2/sites-available/default-ssl.conf<<EOF
<VirtualHost *:443>
       ServerAdmin noc@sunet.se
       DocumentRoot /var/www/

       ServerName ${HOSTNAME}
       SSLProtocol -all +TLSv1.2 +TLSv1.3
       SSLCompression Off
       SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+AESGCM EECDH EDH+AESGCM EDH+aRSA HIGH !MEDIUM !LOW !aNULL !eNULL !LOW !RC4 !MD5 !EXP !PSK !SRP !DSS"
       SSLEngine On
       SSLCertificateFile $KEYDIR/certs/${HOSTNAME}.crt
       ${CHAINSPEC}
       SSLCertificateKeyFile $KEYDIR/private/${HOSTNAME}.key

       RewriteEngine On
EOF
   for map in ${URLS}; do
      from=`echo $map | awk -F% '{print $1}'`
      to=`echo $map | awk -F% '{print $2}'`
      echo "       RewriteRule ^$from\$ $to%{QUERY_STRING} [R=301,END]" >> /etc/apache2/sites-available/default-ssl.conf
   done
cat>>/etc/apache2/sites-available/default-ssl.conf<<EOF
</VirtualHost>
EOF

a2enmod ssl
a2ensite default-ssl
a2ensite default
fi

if ! grep -q "ErrorLog /dev/stderr" /etc/apache2/apache2.conf; then
    sed -i -E 's#^ErrorLog .+$#ErrorLog /dev/stderr#g' /etc/apache2/apache2.conf
fi

if ! grep -q "TransferLog /dev/stdout" /etc/apache2/apache2.conf; then
    echo "TransferLog /dev/stdout" >> /etc/apache2/apache2.conf
    a2disconf other-vhosts-access-log
fi

mkdir -p /var/log/apache2 /var/lock/apache2 /var/run/apache2
chown -R www-data:www-data /var/log/apache2 /var/lock/apache2 /var/run/apache2

rm -f /var/run/apache2/apache2.pid

. /etc/apache2/envvars &&  apache2 -DFOREGROUND