Dustin C. Hatch
8aa1e986d4
Using the PROXY protocol allows the publicly-facing reverse proxy to pass through the original source address of the client, without doing TLS termination. Clients on the internal network will not go through the proxy, though, so we have to disable the PROXY protocol for those addresses. Unfortunately, the syntax for this is kind of cumbersome, because Apache only has a deny list, not an allow list, so we have to enumerate all of the possible internal addresses _except_ the proxy.
50 lines
1.3 KiB
Django/Jinja
50 lines
1.3 KiB
Django/Jinja
{#- vim: set ft=apache.jinja : -#}
|
|
# vim: set sw=4 ts=4 sts=4 et :
|
|
{% macro proxypass() -%}
|
|
ProxyPreserveHost On
|
|
ProxyRequests Off
|
|
ProxyPass / http://localhost:3000/ nocanon
|
|
ProxyPassReverse / http://localhost:3000/
|
|
AllowEncodedSlashes NoDecode
|
|
{%- endmacro -%}
|
|
|
|
<VirtualHost _default_:80>
|
|
ServerName {{ gitea_http_domain }}
|
|
|
|
RewriteEngine on
|
|
RewriteCond %{HTTPS} !on
|
|
RewriteCond %{REQUEST_FILENAME} !\.ks$
|
|
RewriteRule /.* https://%{SERVER_NAME}$0 [R=301,L]
|
|
|
|
{{ proxypass() | indent(4) }}
|
|
</VirtualHost>
|
|
|
|
<VirtualHost _default_:443>
|
|
ServerName {{ gitea_http_domain }}
|
|
|
|
RemoteIPProxyProtocol On
|
|
RemoteIPProxyProtocolExceptions \
|
|
172.30.0.1/32 \
|
|
172.30.0.2/32 \
|
|
172.30.0.3/32 \
|
|
172.30.0.4/32 \
|
|
172.30.0.5/32 \
|
|
172.30.0.7/32 \
|
|
172.30.0.8/29 \
|
|
172.30.0.16/28 \
|
|
172.30.0.32/27 \
|
|
172.30.0.160/27 \
|
|
172.30.0.192/29 \
|
|
172.30.0.200/29 \
|
|
172.31.1.0/24
|
|
|
|
SSLCertificateFile {{ gitea_ssl_certificate }}
|
|
SSLCertificateKeyFile {{ gitea_ssl_certificate_key }}
|
|
SSLCertificateChainFile {{ gitea_ssl_certificate }}
|
|
|
|
Header always set \
|
|
Strict-Transport-Security "max-age=63072000; includeSubDomains"
|
|
|
|
{{ proxypass() | indent(4) }}
|
|
</VirtualHost>
|