c1c91886b4
This should now be a largely functional deployment of mailman 3. There are still some bits that need testing but we'll use followup changes to force failure and hold nodes. This deployment of mailman3 uses upstream docker container images. We currently hack up uids and gids to accomodate that. We also hack up the settings file and bind mount it over the upstream file in order to use host networking. We override the hyperkitty index type to xapian. All list domains are hosted in a single installation and we use native vhosting to handle that. We'll deploy this to a new server and migrate one mailing list domain at a time. This will allow us to start with lists.opendev.org and test things like dmarc settings before expanding to the remaining lists. A migration script is also included, which has seen extensive testing on held nodes for importing copies of the production data sets. Change-Id: Ic9bf5cfaf0b87c100a6ce003a6645010a7b50358
70 lines
2.3 KiB
Django/Jinja
70 lines
2.3 KiB
Django/Jinja
<VirtualHost *:80>
|
|
ServerName {{ mailman_sites.0.listdomain }}
|
|
{% for site in mailman_sites[1:] -%}
|
|
ServerAlias {{ site.listdomain }}
|
|
{% endfor -%}
|
|
|
|
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_sites.0.listdomain }}-error.log
|
|
|
|
# Possible values include: debug, info, notice, warn, error, crit,
|
|
# alert, emerg.
|
|
LogLevel warn
|
|
|
|
CustomLog ${APACHE_LOG_DIR}/{{ mailman_sites.0.listdomain }}-access.log combined
|
|
|
|
# Use mod rewrite to redirect as we want to preserve the FQDN for each
|
|
# mm3 vhost.
|
|
RewriteEngine On
|
|
RewriteRule "/(.*)" "https://%{HTTP_HOST}/$1" [R=301]
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:443>
|
|
ServerName {{ mailman_sites.0.listdomain }}
|
|
{% for site in mailman_sites[1:] -%}
|
|
ServerAlias {{ site.listdomain }}
|
|
{% endfor -%}
|
|
ServerAdmin webmaster@openstack.org
|
|
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_sites.0.listdomain }}-ssl-error.log
|
|
LogLevel warn
|
|
CustomLog ${APACHE_LOG_DIR}/{{ mailman_sites.0.listdomain }}-ssl-access.log combined
|
|
|
|
SSLEngine on
|
|
SSLProtocol All -SSLv2 -SSLv3
|
|
# Note: this list should ensure ciphers that provide forward secrecy
|
|
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
|
|
SSLHonorCipherOrder on
|
|
|
|
SSLCertificateFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.cer
|
|
SSLCertificateKeyFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
|
|
SSLCertificateChainFile /etc/letsencrypt-certs/{{ inventory_hostname }}/ca.cer
|
|
|
|
Alias /static /var/lib/mailman/web-data/static
|
|
Alias /favicon.ico /var/lib/mailman/web-data/static/hyperkitty/img/favicon.ico
|
|
|
|
<Location "/admin">
|
|
Require local
|
|
</Location>
|
|
|
|
RewriteEngine On
|
|
RewriteRule "/pipermail/(.*)" "/var/lib/mailman/web-data/mm2archives/%{HTTP_HOST}/public/$1"
|
|
RewriteRule "/cgi-bin/mailman/listinfo/(.*)" "https://%{HTTP_HOST}/postorius/lists/$1.%{HTTP_HOST}/"
|
|
RewriteRule "/cgi-bin/mailman/listinfo" "https://%{HTTP_HOST}/postorius/lists/"
|
|
|
|
ProxyPassMatch ^/static/ !
|
|
ProxyPass "/" "uwsgi://localhost:8080/"
|
|
|
|
<Directory /var/lib/mailman/web-data/static/>
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
Require all granted
|
|
</Directory>
|
|
|
|
<Directory /var/lib/mailman/web-data/mm2archives/>
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
Require all granted
|
|
</Directory>
|
|
</VirtualHost>
|