docs: updated documentation structure
This commit is contained in:
Marcin Kuzminski
parent
434efcd94f
commit
eddc784e19
47 changed files with 158 additions and 98 deletions
107
docs/admin/system_admin/apache/apache-conf-example.rst
Normal file
107
docs/admin/system_admin/apache/apache-conf-example.rst
Normal file
|
|
@ -0,0 +1,107 @@
|
|||
.. _apache-conf-eg:
|
||||
|
||||
Apache Configuration Example
|
||||
----------------------------
|
||||
|
||||
Use the following example to configure Apache as a your web server.
|
||||
Below config if for an Apache Reverse Proxy configuration.
|
||||
|
||||
.. note::
|
||||
|
||||
Apache requires the following modules to be enabled. Below is an example
|
||||
how to enable them on Ubuntu Server
|
||||
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
$ sudo a2enmod proxy
|
||||
$ sudo a2enmod proxy_http
|
||||
$ sudo a2enmod proxy_balancer
|
||||
$ sudo a2enmod headers
|
||||
$ sudo a2enmod ssl
|
||||
$ sudo a2enmod rewrite
|
||||
|
||||
# requires Apache 2.4+, required to handle websockets/channelstream
|
||||
$ sudo a2enmod proxy_wstunnel
|
||||
|
||||
|
||||
.. code-block:: apache
|
||||
|
||||
## HTTP to HTTPS rewrite
|
||||
<VirtualHost *:80>
|
||||
ServerName rhodecode.myserver.com
|
||||
DocumentRoot /var/www/html
|
||||
Redirect permanent / https://rhodecode.myserver.com/
|
||||
</VirtualHost>
|
||||
|
||||
## MAIN SSL enabled server
|
||||
<VirtualHost *:443>
|
||||
|
||||
ServerName rhodecode.myserver.com
|
||||
ServerAlias rhodecode.myserver.com
|
||||
|
||||
## Skip ProxyPass the _static to backend server
|
||||
#ProxyPass /_static !
|
||||
|
||||
## serve static files by Apache, recommended for performance
|
||||
#Alias /_static/rhodecode /home/ubuntu/.rccontrol/community-1/static
|
||||
|
||||
## Allow Apache to access the static files in this directory
|
||||
#<Directory /home/ubuntu/.rccontrol/community-1/static/>
|
||||
# AllowOverride none
|
||||
# Require all granted
|
||||
#</Directory>
|
||||
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
## channelstream websocket handling
|
||||
ProxyPass /_channelstream ws://localhost:9800
|
||||
ProxyPassReverse /_channelstream ws://localhost:9800
|
||||
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
|
||||
# Directive to properly generate url (clone url) for RhodeCode
|
||||
ProxyPreserveHost On
|
||||
|
||||
# It allows request bodies to be sent to the backend using chunked transfer encoding.
|
||||
SetEnv proxy-sendchunked 1
|
||||
|
||||
# Increase headers size for large Mercurial headers sent with many branches
|
||||
LimitRequestLine 16380
|
||||
|
||||
# Url to running RhodeCode instance. This is shown as `- URL:` when
|
||||
# running rccontrol status.
|
||||
|
||||
ProxyPass / http://127.0.0.1:10002/ timeout=7200 Keepalive=On
|
||||
ProxyPassReverse / http://127.0.0.1:10002/
|
||||
|
||||
# strict http prevents from https -> http downgrade
|
||||
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
|
||||
|
||||
# Set x-frame options
|
||||
Header always append X-Frame-Options SAMEORIGIN
|
||||
|
||||
# To enable https use line below
|
||||
# SetEnvIf X-Url-Scheme https HTTPS=1
|
||||
|
||||
# SSL setup
|
||||
SSLEngine On
|
||||
SSLCertificateFile /etc/apache2/ssl/rhodecode.myserver.pem
|
||||
SSLCertificateKeyFile /etc/apache2/ssl/rhodecode.myserver.key
|
||||
|
||||
SSLProtocol all -SSLv2 -SSLv3
|
||||
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
|
||||
SSLHonorCipherOrder on
|
||||
|
||||
# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
|
||||
#SSLOpenSSLConfCmd DHParameters "/etc/apache2/dhparam.pem"
|
||||
|
||||
## custom 502 error page. Will be displayed while RhodeCode server
|
||||
## is turned off
|
||||
ErrorDocument 502 /path/to/.rccontrol/enterprise-1/static/502.html
|
||||
|
||||
</VirtualHost>
|
||||
|
||||
34
docs/admin/system_admin/apache/apache-diffie-hellman.rst
Normal file
34
docs/admin/system_admin/apache/apache-diffie-hellman.rst
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
.. _dh-apache:
|
||||
|
||||
Diffie-Hellman Security
|
||||
-----------------------
|
||||
|
||||
To secure your web server, the `Guide to Deploying Diffie-Hellman for TLS`_
|
||||
contains important information worth reading. This link contains some good
|
||||
`secure Apache configuration`_ examples.
|
||||
|
||||
To secure your deployment of Diffie-Hellman, configure the following:
|
||||
|
||||
1. Generate a strong Diffie-hellman group, 2048-bit or stronger.
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
# to generate your dhparam.pem file, run in the terminal
|
||||
openssl dhparam -out /etc/apache/ssl/dhparam.pem 2048
|
||||
|
||||
2. Configure your server to only use modern, secure cipher suites in the
|
||||
virtual hosts configuration file.
|
||||
|
||||
.. code-block:: apache
|
||||
|
||||
# Set the protocol to only use modern, secure cipher suites.
|
||||
SSLProtocol all -SSLv2 -SSLv3
|
||||
SSLHonorCipherOrder on
|
||||
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
|
||||
|
||||
# Specify your DH params file as follows
|
||||
SSLOpenSSLConfCmd DHParameters "{path to dhparams.pem}"
|
||||
|
||||
|
||||
.. _Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html
|
||||
.. _secure Apache configuration: http://www.apache-ssl.org/httpd.conf.example
|
||||
35
docs/admin/system_admin/apache/apache-subdirectory.rst
Normal file
35
docs/admin/system_admin/apache/apache-subdirectory.rst
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
.. _apache-sub-ref:
|
||||
|
||||
Apache URL Prefix Configuration
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Use the following example to configure Apache to use a URL prefix.
|
||||
|
||||
.. code-block:: apache
|
||||
|
||||
# Change someprefix into your chosen prefix
|
||||
<Location /someprefix >
|
||||
ProxyPreserveHost On
|
||||
ProxyPass "http://127.0.0.1:5000/"
|
||||
ProxyPassReverse "http://127.0.0.1:5000/"
|
||||
Header set X-Url-Scheme https env=HTTPS
|
||||
</Location>
|
||||
|
||||
In addition to the regular Apache setup you will need to add the following
|
||||
lines into the ``rhodecode.ini`` file.
|
||||
|
||||
* Above ``[app:main]`` section of the ``rhodecode.ini`` file add the
|
||||
following section if it doesn't exist yet.
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
[filter:proxy-prefix]
|
||||
use = egg:PasteDeploy#prefix
|
||||
prefix = /<someprefix> # Change <someprefix> into your chosen prefix
|
||||
|
||||
* In the the ``[app:main]`` section of your ``rhodecode.ini`` file add the
|
||||
following line.
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
filter-with = proxy-prefix
|
||||
55
docs/admin/system_admin/apache/apache-wsgi-coding.rst
Normal file
55
docs/admin/system_admin/apache/apache-wsgi-coding.rst
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
.. _apache-wsgi-ref:
|
||||
|
||||
Apache WSGI Configuration
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
|RCE| can also be set up with Apache under ``mod_wsgi``. To configure this
|
||||
use the following steps.
|
||||
|
||||
1. Install ``mod_wsgi`` using the following command:
|
||||
``aptitude install libapache2-mod-wsgi``.
|
||||
2. Enable ``mod_wsgi`` using the following command: ``a2enmod wsgi``
|
||||
3. Create a ``wsgi`` dispatch script, using the following examples.
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
WSGIDaemonProcess pylons \
|
||||
threads=4 \
|
||||
# check the python virtual env location
|
||||
python-path=/home/web/rhodecode/pyenv/lib/python2.6/site-packages
|
||||
# Check the install location
|
||||
WSGIScriptAlias / /home/web/rhodecode/dispatch.wsgi
|
||||
WSGIPassAuthorization On
|
||||
# user=www-data group=www-data # Enable if running Apache as root
|
||||
|
||||
.. note::
|
||||
|
||||
Do not set ``processes=num`` in this configuration file. Running |RCE| in
|
||||
multiprocess mode with Apache is not supported.
|
||||
|
||||
The following is an example ``wsgi`` dispatch script.
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
import os
|
||||
os.environ["HGENCODING"] = "UTF-8"
|
||||
os.environ['PYTHON_EGG_CACHE'] = '/home/web/rhodecode/.egg-cache'
|
||||
|
||||
# Set the current dir
|
||||
os.chdir('/home/web/rhodecode/')
|
||||
|
||||
import site
|
||||
site.addsitedir("/home/web/rhodecode/pyenv/lib/python2.6/site-packages")
|
||||
|
||||
from paste.deploy import loadapp
|
||||
from paste.script.util.logging_config import fileConfig
|
||||
|
||||
fileConfig('/home/web/rhodecode/production.ini')
|
||||
application = loadapp('config:/home/web/rhodecode/production.ini')
|
||||
|
||||
.. note::
|
||||
|
||||
When using `mod_wsgi` the same version of |hg| must be running in your
|
||||
system's |PY| environment and on |RCE|. To check the |RCE| version,
|
||||
on the interface go to
|
||||
:menuselection:`Admin --> Settings --> System Info`
|
||||
Loading…
Add table
Add a link
Reference in a new issue