idds/rest/httpd-idds-443-py36-cc7.conf.template

0001 # Licensed under the Apache License, Version 2.0 (the "License");
0002 # You may not use this file except in compliance with the License.
0003 # You may obtain a copy of the License at
0004 # http://www.apache.org/licenses/LICENSE-2.0
0005 #
0006 # Authors:
0007 # - Wen Guan, <wen.guan@cern.ch>, 2019
0008
0009 TimeOut 600
0010 KeepAliveTimeout 600
0011 SSLSessionCacheTimeout 600
0012
0013 # Built-in modules
0014 LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
0015
0016 # # LoadModule log_config_module    /usr/lib64/httpd/modules/mod_log_config.so
0017 # # LoadModule ssl_module           /usr/lib64/httpd/modules/mod_ssl.so
0018 # # LoadModule gridsite_module      /usr/lib64/httpd/modules/mod_gridsite.so
0019 # # LoadModule mime_module          /usr/lib64/httpd/modules/mod_mime.so
0020 # # LoadModule dir_module           /usr/lib64/httpd/modules/mod_dir.so
0021 # # LoadModule alias_module         /usr/lib64/httpd/modules/mod_alias.so
0022 # # LoadModule cgi_module           /usr/lib64/httpd/modules/mod_cgi.so
0023
0024 # External modules
0025 LoadModule gridsite_module /usr/lib64/httpd/modules/mod_gridsite.so
0026 #LoadModule wsgi_module /usr/lib64/httpd/modules/mod_wsgi.so
0027 LoadModule wsgi_module {python_site_packages_path}/mod_wsgi/server/mod_wsgi-py36.cpython-36m-x86_64-linux-gnu.so
0028
0029 WSGIPythonHome {python_site_home_path}
0030 WSGIPythonPath {python_site_packages_path}
0031
0032 <IfModule mod_wsgi.c>
0033     WSGIDaemonProcess idds_daemon processes=25 threads=2 request-timeout=600 queue-timeout=600 python-home={python_site_home_path} python-path={python_site_packages_path}
0034     WSGIProcessGroup idds_daemon
0035     WSGIApplicationGroup %{GLOBAL}
0036     WSGIScriptAlias /idds {python_site_bin_path}/idds.wsgi
0037     # WSGIScriptAliasMatch ^/idds/(.+)$ /opt/idds/etc/idds/rest/test.wsgi
0038     WSGISocketPrefix /var/log/idds/wsgisocks/wsgi
0039     WSGIPassAuthorization On
0040 </IfModule>
0041
0042 Listen 443
0043
0044 RewriteEngine on
0045 RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
0046 RewriteRule .* - [F]
0047 RedirectMatch 403 /\..*$
0048 TraceEnable off
0049
0050 Alias "/website"     "/opt/idds/website/data"
0051 Alias "/monitor"     "/opt/idds/monitor/data"
0052
0053 <VirtualHost *:443>
0054     # ServerName aipanda182.cern.ch:443
0055     ServerAdmin wguan@cern.ch
0056
0057     SSLEngine on
0058     SSLCertificateFile /etc/grid-security/hostcert.pem
0059     SSLCertificateKeyFile /etc/grid-security/hostkey.pem
0060     SSLCACertificatePath /etc/grid-security/certificates
0061     SSLCARevocationPath /etc/grid-security/certificates
0062     SSLVerifyClient optional
0063     SSLVerifyDepth 16
0064     SSLOptions +StdEnvVars +ExportCertData
0065
0066     # CERN security recommendation to only allow the seven strongest ssl ciphers
0067     SSLProtocol  all -SSLv2 -SSLv3
0068     SSLCipherSuite HIGH:!CAMELLIA:!ADH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!3DES
0069     SSLHonorCipherOrder on
0070
0071     LogLevel debug
0072     ErrorLog /var/log/idds/httpd_error_log
0073     TransferLog /var/log/idds/httpd_access_log
0074
0075     # Proxy authentication via mod_gridsite
0076     <LocationMatch /auth/x509_proxy>
0077         GridSiteIndexes on
0078         GridSiteAuth on
0079         GridSiteDNlists /etc/grid-security/dn-lists/
0080         GridSiteGSIProxyLimit 16
0081         GridSiteEnvs on
0082         GridSiteACLPath /opt/idds/etc/idds/rest/gacl
0083     </LocationMatch>
0084
0085     <LocationMatch "^/idds">
0086         GridSiteIndexes on
0087         GridSiteAuth on
0088         GridSiteDNlists /etc/grid-security/dn-lists/
0089         GridSiteGSIProxyLimit 16
0090         GridSiteEnvs on
0091         GridSiteACLPath /opt/idds/etc/idds/rest/gacl
0092         # GridSiteMethods GET
0093     </LocationMatch>
0094
0095     <Directory {python_site_packages_path}>
0096         Order deny,allow
0097         Allow from all
0098         Require all granted
0099     </Directory>
0100
0101     <Directory {python_site_bin_path}>
0102         Order deny,allow
0103         Allow from all
0104         Require all granted
0105     </Directory>
0106
0107     <Directory /opt/idds/website/data>
0108         Order deny,allow
0109         Allow from all
0110         Require all granted
0111     </Directory>
0112
0113     <Directory /opt/idds/monitor/data>
0114         Order deny,allow
0115         Allow from all
0116         Require all granted
0117         DirectoryIndex dashboard.html
0118         DirectoryIndex index.html
0119     </Directory>
0120 </VirtualHost>