diff --git a/README.md b/README.md index b16cb4b..e518bfa 100644 --- a/README.md +++ b/README.md @@ -31,54 +31,52 @@ docker run --rm -v /home/docker/portainer/data:/data portainer/helper-reset-pass ## Apache ### http-portainer.conf ``` -DocumentRoot "/var/www/html" -ServerName portainer.gmolab.net -ServerAlias portainer -CustomLog logs/portainer_access_log common -ErrorLog logs/portainer_error_log - -# Redirect http to https -Redirect / https://portainer.gmolab.net/ - - - Options FollowSymLinks - AllowOverride None - Require all granted - + ServerName portainer.gmolab.net + ServerAlias portainer + CustomLog logs/portainer_access_log common + ErrorLog logs/portainer_error_log + # redirect to https + RewriteEngine on + RewriteCond %{SERVER_NAME} =portainer [OR] + RewriteCond %{SERVER_NAME} =portainer.gmolab.net + RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] + ``` ### https-portainer.conf ``` -DocumentRoot "/var/www/html" -ServerName portainer.gmolab.net -ServerAlias portainer -CustomLog logs/portainer_access_log common -ErrorLog logs/portainer_error_log +## +## SSL Virtual Host Context +## +# General setup for the virtual host + + ServerName portainer.gmolab.net + ServerAlias portainer + CustomLog logs/portainer_access_log common + ErrorLog logs/portainer_error_log -SSLEngine on - -SSLHonorCipherOrder on -SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 -SSLHonorCipherOrder on -SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA- -CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 -# Enable HTTP/2, if available -Protocols h2 http/1.1 -# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) -Header always set Strict-Transport-Security "max-age=63072000" - -SSLCertificateFile "/etc/httpd/auth/cert/gmolab.net.crt" -SSLCertificateKeyFile "/etc/httpd/auth/cert/gmolab.net.key" -SSLCertificateChainFile "/etc/httpd/auth/cert/gmolabCA.crt" - - Options FollowSymLinks - AllowOverride None - Require all granted - -SSLProxyEngine On -ProxyPreserveHost On -ProxyRequests off -ProxyPass "/" "https://127.0.0.1:9443/" -ProxyPassReverse "/" "https://127.0.0.1:9443/" +# SSL + SSLEngine on + SSLHonorCipherOrder on + SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 + SSLHonorCipherOrder on + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE- +RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 + # Enable HTTP/2, if available + Protocols h2 http/1.1 + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" +# certificats + SSLCertificateFile "/etc/httpd/auth/cert/gmolab.net.crt" + SSLCertificateKeyFile "/etc/httpd/auth/cert/gmolab.net.key" + SSLCertificateChainFile "/etc/httpd/auth/cert/gmolabCA.crt" +# proxy + SSLProxyEngine On + ProxyPreserveHost On + ProxyRequests off + ProxyPass "/" "https://127.0.0.1:9443/" + ProxyPassReverse "/" "https://127.0.0.1:9443/" + ``` ## Access https://portainer.gmolab.net