apache2-paivana.conf (2697B)
1 # Make sure to enable the following Apache modules before 2 # integrating this into your configuration: 3 # 4 # a2enmod proxy 5 # a2enmod proxy_http 6 # a2enmod headers 7 # 8 # Apache's configuration language has no XML comments: '<!--' parses as 9 # the opening of a container directive named "!--", so a block comment 10 # here made `apachectl configtest' fail and the site impossible to 11 # enable. 12 13 <Location "/"> 14 # paivana-httpd is started with -f (see paivana-httpd.service), so it 15 # takes the client address for the access cookie from the forwarding 16 # headers. It believes the RIGHTMOST element of the chain, which is 17 # whatever the hop it accepted from wrote, so what matters is that 18 # every one of these headers is written here rather than forwarded 19 # from the client. mod_proxy's ProxyAddHeaders (on by default) does 20 # write X-Forwarded-For -- appending is fine, our element still ends 21 # up rightmost -- but it writes none of the others, and Apache 22 # forwards the client's copies of those untouched. Dropping them all 23 # first is what makes the rest of this block exhaustive. 24 # 25 # If this Apache is itself behind another proxy, remove these, 26 # configure mod_remoteip (RemoteIPHeader / RemoteIPInternalProxy) for 27 # that hop, and list it in paivana's TRUSTED_PROXIES so the walk may 28 # step past it. 29 RequestHeader unset X-Forwarded-For 30 RequestHeader unset X-Forwarded-Proto 31 RequestHeader unset X-Forwarded-Host 32 RequestHeader unset X-Forwarded-Port 33 RequestHeader unset Forwarded 34 35 # RFC 7239, which paivana-httpd prefers over the X-Forwarded-* headers 36 # mod_proxy adds. Apache emits no Forwarded of its own, so build the 37 # element here. "set" rather than "append": this is the outermost hop, 38 # so a client-supplied element must not survive. 39 # 40 # It has to be an expr= value. mod_headers' %{NAME}e reads the CGI 41 # environment, which ap_add_common_vars() fills in for a handler and 42 # which is empty at the fixup stage where RequestHeader runs: the 43 # %{REMOTE_ADDR}e spelling emits the literal string "(null)" for all 44 # three, paivana-httpd then finds no address in the element, falls 45 # back to a UNIX socket peer that has none either, and every payment 46 # fails to redeem. ap_expr resolves the same names correctly. 47 # 48 # Note that %{REMOTE_ADDR} yields an unbracketed IPv6 address where 49 # RFC 7239 ยง6 asks for for="[...]"; paivana-httpd accepts both. 50 RequestHeader set Forwarded "expr=for=%{REMOTE_ADDR};proto=%{REQUEST_SCHEME};host=%{HTTP_HOST}" 51 52 # The path paivana-httpd.socket actually listens on, and that the 53 # tmpfiles snippet creates. /var/lib/paivana/httpd/paivana.sock was 54 # a socket nothing anywhere creates. 55 ProxyPass "unix:/run/paivana/httpd/paivana-http.sock|http://example.com/" 56 </Location>