49643313d7
For the past six months, all our mailing list sites have supported HTTPS without incident. The main downside to the current implementation is that Mailman itself writes some URLs with an explicit scheme, causing people submitting forms from pages served over HTTPS to get warnings because the forms are posting to plain HTTP URLs for the same site. In order to correct this, we need to tell Mailman to put https:// instead of http:// into these, but doing so essentially eliminates any reason for us to continue serving content over plain HTTP anyway. Configure the default URL scheme of all our Mailman sites to use HTTPS now, and set up permanent redirects from HTTP to HTTPS, per the examples in the project's documentation: https://wiki.list.org/DOC/4.27%20Securing%20Mailman%27s%20web%20GUI%20by%20using%20Secure%20HTTP-SSL%20%28HTTPS%29 Also update our testinfra functions to validate the blanket redirects and perform all other testing over HTTPS. Once this merges, the fix_url script will need to be run manually against all lists for the current sites, as noted in that document. Change-Id: I366bc915685fb47ef723f29d16211a2550e02e34
61 lines
1.9 KiB
Django/Jinja
61 lines
1.9 KiB
Django/Jinja
<VirtualHost *:80>
|
|
ServerName {{ mailman_listdomain }}
|
|
|
|
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_listdomain }}-error.log
|
|
|
|
# Possible values include: debug, info, notice, warn, error, crit,
|
|
# alert, emerg.
|
|
LogLevel warn
|
|
|
|
CustomLog ${APACHE_LOG_DIR}/{{ mailman_listdomain }}-access.log combined
|
|
|
|
RedirectPermanent / https://{{ mailman_listdomain }}/
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:443>
|
|
ServerName {{ mailman_listdomain }}
|
|
ServerAdmin webmaster@openstack.org
|
|
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_listdomain }}-ssl-error.log
|
|
LogLevel warn
|
|
CustomLog ${APACHE_LOG_DIR}/{{ mailman_listdomain }}-ssl-access.log combined
|
|
|
|
SSLEngine on
|
|
SSLProtocol All -SSLv2 -SSLv3
|
|
# Note: this list should ensure ciphers that provide forward secrecy
|
|
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
|
|
SSLHonorCipherOrder on
|
|
|
|
SSLCertificateFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.cer
|
|
SSLCertificateKeyFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
|
|
SSLCertificateChainFile /etc/letsencrypt-certs/{{ inventory_hostname }}/ca.cer
|
|
|
|
RewriteEngine on
|
|
RewriteRule ^/$ /cgi-bin/mailman/listinfo [R]
|
|
|
|
ScriptAlias /cgi-bin/mailman/ /usr/lib/cgi-bin/mailman/
|
|
Alias /pipermail/ /var/lib/mailman/archives/public/
|
|
Alias /images/mailman/ /usr/share/images/mailman/
|
|
|
|
<Directory /usr/lib/cgi-bin/mailman/>
|
|
AllowOverride None
|
|
Options ExecCGI
|
|
AddHandler cgi-script .cgi
|
|
Order allow,deny
|
|
Allow from all
|
|
Require all granted
|
|
</Directory>
|
|
<Directory /var/lib/mailman/archives/public/>
|
|
Options FollowSymlinks
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
Require all granted
|
|
</Directory>
|
|
<Directory /usr/share/images/mailman/>
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
Require all granted
|
|
</Directory>
|
|
</VirtualHost>
|