apache_helper.conf

# Leitet HTTP-Anfragen auf HTTPS weiter. Ab dann greift HTTPS und der Browser sollte immer automatisch auf HTTPS gehen.
# Außerdem ist die Weiterleitung hier permanent, also 301.
# Example:
# Use AutoRedirect test.satzweiss.com
#
<Macro AutoRedirect $domain>
	<VirtualHost *:80>
		ServerName $domain
		Include sites-includes/http-base.conf
	</VirtualHost>
</Macro>

# Restricts access to that Virtualhost to internal IPs only.
# Add extra internal IPs to: sites-includes/internal-ips.conf
# This file is for development or testing purposes only.
#
# Example:
# Use RestrictInternal
<Macro RestrictInternal>
	<Location />
		<RequireAny>
			# Can connect to itself
			Require ip 127.0.0.1
			# extra internal ips
			Include sites-includes/internal-ips.conf
		</RequireAny>
	</Location>
</Macro>

# Activate an existing Let's Encrypt certificate by its name.
#
# Example:
# Use LECert test.satzweiss.com
#
<Macro LECert $cert>
	Include sites-includes/ssl-base.conf
	
	SSLCertificateFile      /etc/letsencrypt/live/$cert/cert.pem
	SSLCertificateKeyFile   /etc/letsencrypt/live/$cert/privkey.pem
	SSLCertificateChainFile /etc/letsencrypt/live/$cert/chain.pem
</Macro>

# Give the log files a certain name.
#
# Example:
# Use Log www.satzweiss.com
<Macro Log $name>
	CustomLog /var/log/apache2/access_$name.log Combined
	ErrorLog /var/log/apache2/error_$name.log
</Macro>

# Leitet jede Domain, die mit www. anfängt, auf die nicht-www-Version weiter
#
# Example:
# Use NoWWW
<Macro NoWWW>
	RewriteEngine On
	RewriteCond %{HTTP_HOST} ^www\. [NC]
	RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
	RewriteRule ^ %{REQUEST_SCHEME}://%1%{REQUEST_URI} [L,NE,R=301]
</Macro>

# Leitet jede Domain, bei der das www. fehlt, auf die www-Version weiter
#
# Example:
# Use ForceWWW
<Macro ForceWWW>
	RewriteEngine On
	RewriteCond %{HTTP_HOST} !^www\. [NC]
	RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
	RewriteRule ^ %{REQUEST_SCHEME}://www.%1%{REQUEST_URI} [L,NE,R=301]
</Macro>

# Ban Google from crawling our site
#
# Example:
# Use NoGoogle
<Macro NoGoogle>
	<IfModule mod_headers.c>
		Header set X-Robots-Tag noindex
	</IfModule>
</Macro>

# Macht den Balancer-Manager unter der URL /balancer-manager verfügbar
#
# Example:
# Use BalancerManager
<Macro BalancerManager>
	<Location /balancer-manager>
		SetHandler balancer-manager
		Require all granted
	</Location>
</Macro>

# Leitet die Domain $domain immer zu $target um. Es wird ein temporärer Redirect gemacht.
# Dieses Makro greift nur bei HTTP-Anfragen. Für HTTPS-Anfragen muss AlwaysRedirectSSL
# genutzt werden.
# Pfade werden übernommen, d.h. a.com/pfad wird weitergeleitet auf b.com/pfad.
#
# Anwendungsbeispiel:
# Use AlwaysRedirect 110ecode.com http://satzweiss.com
<Macro AlwaysRedirect $domain $target>
	<VirtualHost *:80>
		Servername $domain
		ServerAdmin admin@satzweiss.com

		<Location "/.well-known">
			Require all granted
		</Location>

		DocumentRoot /var/www/certbot

		RewriteEngine On
		RewriteCond %{HTTPS} off
		RewriteCond %{REQUEST_URI} !^/.well-known/(.*)
		RewriteRule (.*) $target%{REQUEST_URI} [R=302,L]
	</VirtualHost>
</Macro>

# Das gleiche wie AlwaysRedirect, allerdings werden auch HTTPS-Anfragen erfasst. Dafür
# ist die Angabe des Zertifikats notwendig.
#
# Anwendungsbeispiel:
# Use AlwaysRedirectSSL 110ecode.com http://satzweiss.com 110ecode.com
<Macro AlwaysRedirectSSL $domain $target $lecert>
	Use AlwaysRedirect $domain $target
	
	<VirtualHost *:443>
		Servername $domain
		ServerAdmin admin@satzweiss.com
		
		Use LECert $lecert

		RewriteEngine On
		RewriteCond %{HTTPS} on
		RewriteRule (.*) $target%{REQUEST_URI} [R=302,L]
	</VirtualHost>
</Macro>

# Binds a Plone site with a certain name to a pre defined load balancer
#
# Example:
# <Proxy balancer://lb>
#	BalancerMember http://127.0.0.1:8080
# </Proxy>
# Use Plone myplonesite balancer://lb
#
<Macro Plone $balancer $sitename>
	<IfModule mod_proxy.c>
		ProxyVia on
		ProxyTimeout 1800
	
		# prevent the webserver from beeing used as proxy
		<LocationMatch "^[^/]">
			Require all denied
		</LocationMatch>

		<IfModule mod_rewrite.c>
			RewriteEngine on

			AllowEncodedSlashes NoDecode
			RewriteCond %{REQUEST_URI} !^/balancer-manager(.*)
			RewriteRule ^/(.*) $balancer/VirtualHostBase/%{REQUEST_SCHEME}/%{HTTP_HOST}:%{SERVER_PORT}/$sitename/VirtualHostRoot/$1 [P,L]
		</IfModule>
	</IfModule>
</Macro>

<Macro PloneRoot $balancer>
	Use Plone $balancer /
</Macro>

# Shorthand for a development Plone site.
# Only works if the certificate name is the same as the domain.
#
# Example:
# Use SSLPloneDevShort db.dev.bfd.satzweiss.info http://10.100.20.145:8080 bfd-db
<Macro SSLPloneDevShort $domain $backend $sitename>
	Use SWAutoRedirect $domain
	<VirtualHost *:443>
		ServerName $domain

		Use Log $domain

		Use NoGoogle
		Use BalancerManager
		#Use RestrictInternal

		Use LECert $domain

		Use Plone $backend $sitename
	</VirtualHost>
</Macro>

# Shorthand for the admin client of a Plone site.
# Only works if the certificate name is the same as the domain.
# Only accessible from Satzweiss Intranet
#
# Example:
# Use SSLPloneAdmin admin.prod.barf.satzweiss.info http://10.100.20.160:8183 /
<Macro SSLPloneAdmin $domain $backend $sitename>
	Use SWAutoRedirect $domain
	<VirtualHost *:443>
		ServerName $domain

		Use Log $domain

		Use NoGoogle
		Use BalancerManager
		Use RestrictInternal

		Use LECert $domain

		Use Plone $backend $sitename
	</VirtualHost>
</Macro>

<Macro RawProxy $url>
	# This sends the original IP address to the backend as a special header
	RemoteIPHeader X-Forwarded-For
	
	# This allows forward and backward slashes in a query string
	AllowEncodedSlashes NoDecode
	
	# This sends the original host name to the backend
	ProxyPreserveHost On
	ProxyPass / $url nocanon
	ProxyPassReverse / $url
</Macro>

<Macro RawProxySSL $url>
	SSLProxyEngine on
	
	# This is very insecure for backends we do not trust. Use with care!
	SSLProxyVerify none
	SSLProxyCheckPeerCN off
	SSLProxyCheckPeerName off
	SSLProxyCheckPeerExpire off

	Use RawProxy $url
</Macro>

# Anwendungsbeispiel:
# Use PHPSock /home/matomo/www/matomo php-fpm-matomo.sock 
#
<Macro PHPSock $directory $socket>
	<IfModule setenvif_module>
		SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
	</IfModule>

	<FilesMatch ".+\.ph(p[3457]?|t|tml)$">
		<If "-f %{SCRIPT_FILENAME}">
			SetHandler "proxy:unix:/run/php/$socket|fcgi://localhost"
		</If>
	</FilesMatch>
	<FilesMatch ".+\.phps$">
		Require all denied
	</FilesMatch>
	# Deny access to files without filename (e.g. '.php')
	<FilesMatch "^\.ph(p[3457]?|t|tml|ps)$">
		Require all denied
	</FilesMatch>

	<Directory "$directory">
		Options +FollowSymLinks
		AllowOverride All
		Require all granted
		Allow from all

		<IfModule mod_dav.c>
			Dav off
		</IfModule>
	</Directory>
</Macro>

# Anwendungsbeispiel:
# Use PHPAliasSock /matomo /home/matomo/www/matomo php-fpm-matomo.sock
#
<Macro PHPAliasSock $alias $directory $socket>
	Alias $alias $directory
	
	Use PHPHandler $socket $directory
	
	RewriteRule ^$alias(/.*)?$ "-" [L]
</Macro>