From 303fe32a0260831642d9c2bb41a200ef3bf2542d Mon Sep 17 00:00:00 2001
From: Sam Gleske <sag47@drexel.edu>
Date: Wed, 25 Sep 2013 10:42:02 -0400
Subject: [PATCH] SSL and non-SSL apache configurations

---
 web-server/apache/gitlab-ssl.conf | 66 +++++++++++++++++++++++++++++++
 web-server/apache/gitlab.conf     | 17 --------
 2 files changed, 66 insertions(+), 17 deletions(-)
 create mode 100644 web-server/apache/gitlab-ssl.conf

diff --git a/web-server/apache/gitlab-ssl.conf b/web-server/apache/gitlab-ssl.conf
new file mode 100644
index 0000000..d8cdeab
--- /dev/null
+++ b/web-server/apache/gitlab-ssl.conf
@@ -0,0 +1,66 @@
+#This configuration has been tested on GitLab 6.0.0 and GitLab 6.0.1
+#Note this config assumes unicorn is listening on default port 8080.
+#Module dependencies
+#  mod_rewrite
+#  mod_ssl
+#  mod_proxy
+#  mod_proxy_balancer
+#  mod_proxy_http
+<VirtualHost *:80>
+  ServerName gitlab.example.com
+  ServerSignature Off
+
+  RewriteEngine on
+  RewriteCond %{HTTPS} !=on
+  RewriteRule ^(.*) https://%{SERVER_NAME}$1 [R,L]
+</VirtualHost>
+<VirtualHost *:443>
+  SSLEngine on
+  #strong encryption ciphers only
+  #see ciphers(1) http://www.openssl.org/docs/apps/ciphers.html
+  SSLCipherSuite SSLv3:TLSv1:+HIGH:!SSLv2:!MD5:!MEDIUM:!LOW:!EXP:!ADH:!eNULL:!aNULL
+  SSLCertificateFile    /etc/httpd/ssl.crt/gitlab.example.com.crt
+  SSLCertificateKeyFile /etc/httpd/ssl.key/gitlab.example.com.key
+  SSLCACertificateFile  /etc/httpd/ssl.crt/your-ca.crt
+
+  ServerName gitlab.example.com
+  ServerSignature Off
+
+  #apache equivalent of nginx try files
+  # http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files
+  # http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab
+  RewriteEngine on
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteRule ^/(.*)$ balancer://unicornservers%{REQUEST_URI} [P,QSA,L]
+
+  ProxyPreserveHost On
+  ProxyPass /uploads !
+  ProxyPass /error !
+
+  <Proxy balancer://unicornservers>
+    BalancerMember http://127.0.0.1:8080
+    ProxyPassReverse http://127.0.0.1:8080
+    ProxyPassReverse http://gitlab.example.com:8080
+  </Proxy>
+
+  # needed for downloading attachments
+  DocumentRoot /home/git/gitlab/public
+
+  #Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up.
+  ErrorDocument 404 /404.html
+  ErrorDocument 422 /422.html
+  ErrorDocument 500 /500.html
+  ErrorDocument 503 /deploy.html
+
+  <Location />
+    Order deny,allow
+    Allow from all
+  </Location>
+
+  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
+  ErrorLog  /var/log/httpd/logs/gitlab.example.com_error.log
+  CustomLog /var/log/httpd/logs/gitlab.example.com_forwarded.log common_forwarded
+  CustomLog /var/log/httpd/logs/gitlab.example.com_access.log combined env=!dontlog
+  CustomLog /var/log/httpd/logs/gitlab.example.com.log combined
+
+</VirtualHost>
diff --git a/web-server/apache/gitlab.conf b/web-server/apache/gitlab.conf
index d8cdeab..98eac76 100644
--- a/web-server/apache/gitlab.conf
+++ b/web-server/apache/gitlab.conf
@@ -2,7 +2,6 @@
 #Note this config assumes unicorn is listening on default port 8080.
 #Module dependencies
 #  mod_rewrite
-#  mod_ssl
 #  mod_proxy
 #  mod_proxy_balancer
 #  mod_proxy_http
@@ -10,22 +9,6 @@
   ServerName gitlab.example.com
   ServerSignature Off
 
-  RewriteEngine on
-  RewriteCond %{HTTPS} !=on
-  RewriteRule ^(.*) https://%{SERVER_NAME}$1 [R,L]
-</VirtualHost>
-<VirtualHost *:443>
-  SSLEngine on
-  #strong encryption ciphers only
-  #see ciphers(1) http://www.openssl.org/docs/apps/ciphers.html
-  SSLCipherSuite SSLv3:TLSv1:+HIGH:!SSLv2:!MD5:!MEDIUM:!LOW:!EXP:!ADH:!eNULL:!aNULL
-  SSLCertificateFile    /etc/httpd/ssl.crt/gitlab.example.com.crt
-  SSLCertificateKeyFile /etc/httpd/ssl.key/gitlab.example.com.key
-  SSLCACertificateFile  /etc/httpd/ssl.crt/your-ca.crt
-
-  ServerName gitlab.example.com
-  ServerSignature Off
-
   #apache equivalent of nginx try files
   # http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files
   # http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab