websites-role umgebaut

templates/apache-ssl.conf.j2

@@ -1,24 +1,26 @@
+# {{ ansible_managed }}
 <IfModule mod_ssl.c>
-        <VirtualHost :443>
-                ServerName {{ domainname }}
-                ServerAlias {{ serveralias | default(domainname) }}
-                ServerAdmin webmaster@{{ domainname }}
+        <VirtualHost *:443>
+                ServerName {{ site.domain }}
+{% if site.aliases %}
+                ServerAlias {{ site.aliases | join(' ') }}
+{% endif %}
+                ServerAdmin webmaster@{{ site.domain }}
 
-                DocumentRoot "{{ docroot }}"
-                <Directory "{{ docroot }}">
+                DocumentRoot "{{ site.docroot }}"
+                <Directory "{{ site.docroot }}">
                         Options Indexes MultiViews Includes FollowSymLinks
                         AddOutputFilter Includes html
                         AllowOverride All
-                        Order allow,deny
-                        Allow from all
+                        Require all granted
                 </Directory>
 
-                ErrorLog ${APACHE_LOG_DIR}/{{ domainname }}.error.log
-                CustomLog ${APACHE_LOG_DIR}/{{ domainname }}.access.log combined
+                ErrorLog ${APACHE_LOG_DIR}/{{ site.domain }}.error.log
+                CustomLog ${APACHE_LOG_DIR}/{{ site.domain }}.access.log combined
 
                 SSLEngine on
-                SSLCertificateFile      /etc/ssl/certs/{{ domainname }}.pem
-                SSLCertificateKeyFile /etc/ssl/private/{{ domainname }}.key
+                SSLCertificateFile      /etc/ssl/certs/{{ site.domain }}.pem
+                SSLCertificateKeyFile /etc/ssl/private/{{ site.domain }}.key
 
                 <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                 SSLOptions +StdEnvVars
@@ -26,6 +28,36 @@
                 <Directory /usr/lib/cgi-bin>
                                 SSLOptions +StdEnvVars
                 </Directory>
-                IncludeOptional /etc/apache2/conf-available/{{ domainname }}-ssl-optionalDirectives.conf
+{% if site.proxy_pass %}
+{%   set path = site.proxy_path | string %}
+{%   set target = site.proxy_pass if (site.proxy_pass.endswith('/') or not path.endswith('/')) else site.proxy_pass ~ '/' %}
+{%   set opts = [] %}
+{%   if site.proxy_timeout | string | length %}{% set _ = opts.append('timeout=' ~ site.proxy_timeout) %}{% endif %}
+{%   if site.proxy_websocket | bool %}{% set _ = opts.append('upgrade=websocket') %}{% endif %}
+{%   if site.proxy_options %}{% set _ = opts.append(site.proxy_options) %}{% endif %}
+
+                # reverse proxy
+                ProxyRequests Off
+                ProxyPreserveHost {{ 'On' if site.proxy_preserve_host | bool else 'Off' }}
+{%   if site.proxy_forwarded_headers | bool %}
+                RequestHeader set X-Forwarded-Proto "https"
+                RequestHeader set X-Forwarded-Port "443"
+{%   endif %}
+{%   if target is match('https://') %}
+                SSLProxyEngine On
+{%     if not site.proxy_ssl_verify | bool %}
+                SSLProxyVerify none
+                SSLProxyCheckPeerName off
+                SSLProxyCheckPeerCN off
+                SSLProxyCheckPeerExpire off
+{%     endif %}
+{%   endif %}
+                ProxyPass "{{ path }}" "{{ target }}"{{ (' ' ~ opts | join(' ')) if opts else '' }}
+                ProxyPassReverse "{{ path }}" "{{ target }}"
+{% endif %}
+{% if site.extra_directives %}
+
+{{ site.extra_directives | trim | indent(16, true) }}
+{% endif %}
         </VirtualHost>
 </IfModule>

templates/apache.conf.j2

@@ -1,13 +1,17 @@
+# {{ ansible_managed }}
 <VirtualHost *:80>
-        ServerName {{ domainname }}
+        ServerName {{ site.domain }}
+{% if site.aliases %}
+        ServerAlias {{ site.aliases | join(' ') }}
+{% endif %}
 
-        ServerAdmin webmaster@{{ domainname }}
-        DocumentRoot "{{ docroot }}"
+        ServerAdmin webmaster@{{ site.domain }}
+        DocumentRoot "{{ site.docroot }}"
 
-        ErrorLog ${APACHE_LOG_DIR}/{{ domainname }}.error.log
-        CustomLog ${APACHE_LOG_DIR}/{{ domainname }}.access.log combined
+        ErrorLog ${APACHE_LOG_DIR}/{{ site.domain }}.error.log
+        CustomLog ${APACHE_LOG_DIR}/{{ site.domain }}.access.log combined
 
-        #rewrite transparent to https, keep uri 
+        #rewrite transparent to https, keep uri
         RewriteEngine On
         RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
         RewriteCond %{HTTPS} off

templates/includeOptional.conf.j2

@@ -1 +0,0 @@
-{{ optionalDirectives | default('')}}