opendev/system-config
Code Issues Proposed changes
0d83dd3ea0
system-config/playbooks/roles/mailman/templates/mailman.vhost.j2

61 lines
1.9 KiB
Plaintext
Raw Normal View History

Ansible mailman configs This converts our existing puppeted mailman configuration into a set of ansible roles and a new playbook. We don't try to do anything new and instead do our best to map from puppet to ansible as closely as possible. This helps reduce churn and will help us find problems more quickly if they happen. Followups will further cleanup the puppetry. Change-Id: If8cdb1164c9000438d1977d8965a92ca8eebe4df
2021-05-04 11:55:47 -07:00
<VirtualHost *:80>
ServerName {{ mailman_listdomain }}
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_listdomain }}-error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/{{ mailman_listdomain }}-access.log combined
Redirect all Mailman sites from HTTP to HTTPS For the past six months, all our mailing list sites have supported HTTPS without incident. The main downside to the current implementation is that Mailman itself writes some URLs with an explicit scheme, causing people submitting forms from pages served over HTTPS to get warnings because the forms are posting to plain HTTP URLs for the same site. In order to correct this, we need to tell Mailman to put https:// instead of http:// into these, but doing so essentially eliminates any reason for us to continue serving content over plain HTTP anyway. Configure the default URL scheme of all our Mailman sites to use HTTPS now, and set up permanent redirects from HTTP to HTTPS, per the examples in the project's documentation: https://wiki.list.org/DOC/4.27%20Securing%20Mailman%27s%20web%20GUI%20by%20using%20Secure%20HTTP-SSL%20%28HTTPS%29 Also update our testinfra functions to validate the blanket redirects and perform all other testing over HTTPS. Once this merges, the fix_url script will need to be run manually against all lists for the current sites, as noted in that document. Change-Id: I366bc915685fb47ef723f29d16211a2550e02e34
2022-06-30 16:59:39 +00:00
RedirectPermanent / https://{{ mailman_listdomain }}/
Ansible mailman configs This converts our existing puppeted mailman configuration into a set of ansible roles and a new playbook. We don't try to do anything new and instead do our best to map from puppet to ansible as closely as possible. This helps reduce churn and will help us find problems more quickly if they happen. Followups will further cleanup the puppetry. Change-Id: If8cdb1164c9000438d1977d8965a92ca8eebe4df
2021-05-04 11:55:47 -07:00
</VirtualHost>
Add HTTPS vhosts to mailman servers Add secondary vhosts for HTTPS to each mailman site, but don't remove the plain HTTP ones for now. Before switching to Mailman 3 we'll replace the current HTTP vhosts with blanket redirects to HTTPS. Add tests to make sure this is working, and also add a command-line test for the lists.openinfra.dev site now that it's got a first non-default list of its own. Also collect Apache logs from the test nodes so we can see for sure what might break. Change-Id: I4d93d643381f17c9a968595587909f0ba3dd6f92
2021-12-17 19:48:51 +00:00
<VirtualHost *:443>
ServerName {{ mailman_listdomain }}
ServerAdmin webmaster@openstack.org
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_listdomain }}-ssl-error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/{{ mailman_listdomain }}-ssl-access.log combined
SSLEngine on
SSLProtocol All -SSLv2 -SSLv3
# Note: this list should ensure ciphers that provide forward secrecy
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
SSLHonorCipherOrder on
SSLCertificateFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.cer
SSLCertificateKeyFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
SSLCertificateChainFile /etc/letsencrypt-certs/{{ inventory_hostname }}/ca.cer
RewriteEngine on
RewriteRule ^/$ /cgi-bin/mailman/listinfo [R]
ScriptAlias /cgi-bin/mailman/ /usr/lib/cgi-bin/mailman/
Alias /pipermail/ /var/lib/mailman/archives/public/
Alias /images/mailman/ /usr/share/images/mailman/
<Directory /usr/lib/cgi-bin/mailman/>
AllowOverride None
Options ExecCGI
AddHandler cgi-script .cgi
Order allow,deny
Allow from all
Require all granted
</Directory>
<Directory /var/lib/mailman/archives/public/>
Options FollowSymlinks
AllowOverride None
Order allow,deny
Allow from all
Require all granted
</Directory>
<Directory /usr/share/images/mailman/>
AllowOverride None
Order allow,deny
Allow from all
Require all granted
</Directory>
</VirtualHost>
Copy Permalink