Ori.livneh has uploaded a new change for review.
https://gerrit.wikimedia.org/r/214773
Change subject: people.wikimedia.org: HTTPS only
......................................................................
people.wikimedia.org: HTTPS only
Use the standard blob we use to make Apaches that sit behind Varnish to use
HTTPS only.
Change-Id: I2577bd04f93841d8a6b9ad01bb6177aac2248e63
---
M modules/publichtml/manifests/init.pp
M modules/publichtml/templates/apacheconfig.erb
2 files changed, 8 insertions(+), 0 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/73/214773/1
diff --git a/modules/publichtml/manifests/init.pp
b/modules/publichtml/manifests/init.pp
index 3fa17e3..bbc46fc 100644
--- a/modules/publichtml/manifests/init.pp
+++ b/modules/publichtml/manifests/init.pp
@@ -9,6 +9,7 @@
include ::apache::mod::cgi
include ::apache::mod::php5
include ::apache::mod::rewrite
+ include ::apache::mod::headers
system::role { 'publichtml':
description => 'web server of public_html directories',
diff --git a/modules/publichtml/templates/apacheconfig.erb
b/modules/publichtml/templates/apacheconfig.erb
index 1c32b8d..4fc6917 100644
--- a/modules/publichtml/templates/apacheconfig.erb
+++ b/modules/publichtml/templates/apacheconfig.erb
@@ -8,6 +8,13 @@
ServerAdmin <%= @server_admin %>
ServerName <%= @sitename %>
+ RewriteEngine On
+ RewriteCond %{HTTP:X-Forwarded-Proto} !https
+ RewriteCond %{REQUEST_URI} !^/status$
+ RewriteRule ^/(.*)$ https://%{HTTP_HOST}%{REQUEST_URI}
[R=301,E=ProtoRedirect]
+ Header always merge Vary X-Forwarded-Proto env=ProtoRedirect
+ Header always set Strict-Transport-Security "max-age=604800"
+
DocumentRoot <%= @docroot %>
UserDir public_html
--
To view, visit https://gerrit.wikimedia.org/r/214773
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I2577bd04f93841d8a6b9ad01bb6177aac2248e63
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Ori.livneh <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
