view modules/apache/templates/vhost/_directories.erb @ 106:ef0926ee389a puppet-3.6

Lock down Apache headers for security, based on https://securityheaders.io/
author IBBoard <dev@ibboard.co.uk>
date Sat, 14 May 2016 17:10:10 +0100
parents 37675581a273
children 675c1cc61eaf
line wrap: on
line source

<% if @_directories and ! @_directories.empty? -%>

  ## Directories, there should at least be a declaration for <%= @docroot %>
  <%- [@_directories].flatten.compact.each do |directory| -%>
    <%- if directory['path'] and directory['path'] != '' -%>
      <%- if directory['provider'] and directory['provider'].match('(directory|location|files)') -%>
        <%- if /^(.*)match$/ =~ directory['provider'] -%>
          <%- provider = $1.capitalize + 'Match' -%>
        <%- else -%>
          <%- provider = directory['provider'].capitalize -%>
        <%- end -%>
      <%- else -%>
        <%- provider = 'Directory' -%>
      <%- end -%>
      <%- path = directory['path'] -%>

  <<%= provider %> "<%= path %>">
      <%- if directory['headers'] -%>
        <%- Array(directory['headers']).each do |header| -%>
    Header <%= header %>
      <%- end -%>
    <%- end -%>
    <%- if directory['options'] -%>
    Options <%= Array(directory['options']).join(' ') %>
    <%- end -%>
    <%- if provider == 'Directory' -%>
      <%- if directory['index_options'] -%>
    IndexOptions <%= Array(directory['index_options']).join(' ') %>
      <%- end -%>
      <%- if directory['index_order_default'] -%>
    IndexOrderDefault <%= Array(directory['index_order_default']).join(' ') %>
      <%- end -%>
      <%- if directory['allow_override'] -%>
    AllowOverride <%= Array(directory['allow_override']).join(' ') %>
      <%- elsif provider == 'Directory' -%>
    AllowOverride None
      <%- end -%>
    <%- end -%>
    <%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%>
      <%- if directory['require'] and directory['require'] != '' -%>
    Require <%= Array(directory['require']).join(' ') %>
      <%- end -%>
      <%- if directory['auth_require'] -%>
    Require <%= directory['auth_require'] %>
      <%- end -%>
      <%- if !(directory['require'] and directory['require'] != '') && !(directory['auth_require']) -%>
    Require all granted
      <%- end -%>
    <%- else -%>
      <%- if directory['auth_require'] -%>
    Require <%= directory['auth_require'] %>
      <%- end -%>
      <%- if directory['order'] and directory['order'] != '' -%>
    Order <%= Array(directory['order']).join(',') %>
      <%- else -%>
    Order allow,deny
      <%- end -%>
      <%- if directory['deny'] and directory['deny'] != '' -%>
    Deny <%= directory['deny'] %>
      <%- end -%>
      <%- if directory['allow'] and ! [ false, 'false', '' ].include?(directory['allow']) -%>
        <%- if directory['allow'].kind_of?(Array) -%>
          <%- Array(directory['allow']).each do |access| -%>
    Allow <%=  access %>
        <%- end -%>
      <%- else -%>
    Allow <%= directory['allow'] %>
      <%- end -%>
      <%- elsif [ 'from all', 'from All' ].include?(directory['deny']) -%>
      <%- elsif ! directory['deny'] and [ false, 'false', '' ].include?(directory['allow']) -%>
    Deny from all
      <%- else -%>
    Allow from all
      <%- end -%>
      <%- if directory['satisfy'] and directory['satisfy'] != '' -%>
    Satisfy <%= directory['satisfy'] %>
      <%- end -%>
    <%- end -%>
    <%- if directory['addhandlers'] and ! directory['addhandlers'].empty? -%>
      <%- [directory['addhandlers']].flatten.compact.each do |addhandler| -%>
    AddHandler <%= addhandler['handler'] %> <%= Array(addhandler['extensions']).join(' ') %>
      <%- end -%>
    <%- end -%>
    <%- if directory['sethandler'] and directory['sethandler'] != '' -%>
    SetHandler <%= directory['sethandler'] %>
    <%- end -%>
    <%- if directory['passenger_enabled'] and directory['passenger_enabled'] != '' -%>
    PassengerEnabled <%= directory['passenger_enabled'] %>
    <%- end -%>
    <%- if directory['php_flags'] and ! directory['php_flags'].empty? -%>
      <%- directory['php_flags'].sort.each do |flag,value| -%>
        <%- value = if value =~ /true|yes|on|1/i then 'on' else 'off' end -%>
    php_flag <%= "#{flag} #{value}" %>
      <%- end -%>
    <%- end -%>
    <%- if directory['php_values'] and ! directory['php_values'].empty? -%>
      <%- directory['php_values'].sort.each do |key,value| -%>
    php_value <%= "#{key} #{value}" %>
      <%- end -%>
    <%- end -%>
    <%- if directory['php_admin_flags'] and ! directory['php_admin_flags'].empty? -%>
      <%- directory['php_admin_flags'].sort.each do |flag,value| -%>
        <%- value = if value =~ /true|yes|on|1/i then 'on' else 'off' end -%>
    php_admin_flag <%= "#{flag} #{value}" %>
      <%- end -%>
    <%- end -%>
    <%- if directory['php_admin_values'] and ! directory['php_admin_values'].empty? -%>
      <%- directory['php_admin_values'].sort.each do |key,value| -%>
    php_admin_value <%= "#{key} #{value}" %>
      <%- end -%>
    <%- end -%>
    <%- if directory['directoryindex'] and directory['directoryindex'] != '' -%>
    DirectoryIndex <%= directory['directoryindex'] %>
    <%- end -%>
    <%- if directory['error_documents'] and ! directory['error_documents'].empty? -%>
      <%- [directory['error_documents']].flatten.compact.each do |error_document| -%>
    ErrorDocument <%= error_document['error_code'] %> <%= error_document['document'] %>
      <%- end -%>
    <%- end -%>
    <%- if directory['auth_type'] -%>
    AuthType <%= directory['auth_type'] %>
    <%- end -%>
    <%- if directory['auth_name'] -%>
    AuthName "<%= directory['auth_name'] %>"
    <%- end -%>
    <%- if directory['auth_digest_algorithm'] -%>
    AuthDigestAlgorithm <%= directory['auth_digest_algorithm'] %>
    <%- end -%>
    <%- if directory['auth_digest_domain'] -%>
    AuthDigestDomain <%= Array(directory['auth_digest_domain']).join(' ') %>
    <%- end -%>
    <%- if directory['auth_digest_nonce_lifetime'] -%>
    AuthDigestNonceLifetime <%= directory['auth_digest_nonce_lifetime'] %>
    <%- end -%>
    <%- if directory['auth_digest_provider'] -%>
    AuthDigestProvider <%= directory['auth_digest_provider'] %>
    <%- end -%>
    <%- if directory['auth_digest_qop'] -%>
    AuthDigestQop <%= directory['auth_digest_qop'] %>
    <%- end -%>
    <%- if directory['auth_digest_shmem_size'] -%>
    AuthDigestShmemSize <%= directory['auth_digest_shmem_size'] %>
    <%- end -%>
    <%- if directory['auth_basic_authoritative'] -%>
    AuthBasicAuthoritative <%= directory['auth_basic_authoritative'] %>
    <%- end -%>
    <%- if directory['auth_basic_fake'] -%>
    AuthBasicFake <%= directory['auth_basic_fake'] %>
    <%- end -%>
    <%- if directory['auth_basic_provider'] -%>
    AuthBasicProvider <%= directory['auth_basic_provider'] %>
    <%- end -%>
    <%- if directory['auth_user_file'] -%>
    AuthUserFile <%= directory['auth_user_file'] %>
    <%- end -%>
    <%- if directory['auth_group_file'] -%>
    AuthGroupFile <%= directory['auth_group_file'] %>
    <%- end -%>
    <%- if directory['fallbackresource'] -%>
    FallbackResource <%= directory['fallbackresource'] %>
    <%- end -%>
    <%- if directory['expires_active'] -%>
    ExpiresActive <%= directory['expires_active'] %>
    <%- end -%>
    <%- if directory['expires_default'] -%>
    ExpiresDefault <%= directory['expires_default'] %>
    <%- end -%>
    <%- if directory['expires_by_type'] -%>
    <%- Array(directory['expires_by_type']).each do |rule| -%>
    ExpiresByType <%= rule %>
    <%- end -%>
    <%- end -%>
    <%- if directory['force_type'] -%>
    ForceType <%= directory['force_type'] %>
    <%- end -%>
    <%- if directory['ssl_options'] -%>
    SSLOptions <%= Array(directory['ssl_options']).join(' ') %>
    <%- end -%>
    <%- if directory['suphp'] and @suphp_engine == 'on' -%>
    suPHP_UserGroup <%= directory['suphp']['user'] %> <%= directory['suphp']['group'] %>
    <%- end -%>
    <%- if directory['fcgiwrapper'] -%>
    FcgidWrapper <%= directory['fcgiwrapper']['command'] %> <%= directory['fcgiwrapper']['suffix'] %> <%= directory['fcgiwrapper']['virtual'] %>
    <%- end -%>
    <%- if directory['rewrites'] -%>
    # Rewrite rules
    RewriteEngine On
      <%- directory['rewrites'].flatten.compact.each do |rewrite_details| -%>
        <%- if rewrite_details['comment'] -%>
    #<%= rewrite_details['comment'] %>
        <%- end -%>
        <%- if rewrite_details['rewrite_base'] -%>
    RewriteBase <%= rewrite_details['rewrite_base'] %>
        <%- end -%>
        <%- if rewrite_details['rewrite_cond'] -%>
          <%- Array(rewrite_details['rewrite_cond']).each do |commands| -%>
            <%- Array(commands).each do |command| -%>
    RewriteCond <%= command %>
            <%- end -%>
          <%- end -%>
        <%- end -%>
        <%- Array(rewrite_details['rewrite_rule']).each do |commands| -%>
          <%- Array(commands).each do |command| -%>
    RewriteRule <%= command %>
          <%- end -%>
        <%- end -%>
      <%- end -%>
    <%- end -%>
    <%- if directory['setenv'] -%>
      <%- Array(directory['setenv']).each do |setenv| -%>
    SetEnv <%= setenv %>
      <%- end -%>
    <%- end -%>
    <%- if @shibboleth_enabled -%>
      <%- if directory['shib_require_session'] and ! directory['shib_require_session'].empty? -%>
    ShibRequireSession <%= directory['shib_require_session'] %>
      <%- end -%>
      <%- if directory['shib_request_settings'] and ! directory['shib_request_settings'].empty? -%>
        <%- directory['shib_request_settings'].each do |key,value| -%>
    ShibRequestSetting <%= key %> <%= value %>
        <%- end -%>
      <%- end -%>
      <%- if directory['shib_use_headers'] and ! directory['shib_use_headers'].empty? -%>
    ShibUseHeaders <%= directory['shib_use_headers'] %>
      <%- end -%>
    <%- end -%>
    <%- if directory['custom_fragment'] -%>
    <%= directory['custom_fragment'] %>
    <%- end -%>
  </<%= provider %>>
    <%- end -%>
  <%- end -%>
<% end -%>