mirror of
https://github.com/lrnselfreliance/wrolpi.git
synced 2026-10-26 02:48:38 -04:00
fbb71e012d
- Replace nginx with Caddy as the web server for both Docker and native (RPi/Debian) deployments. Caddy handles HTTPS termination, reverse proxying to all services (API, React app, Controller, Kiwix, Help, Map), and serves the media/download file browsers. - Generate a Root CA and signed leaf certificates for HTTPS. The Root CA uses Name Constraints to restrict signing to local addresses only (.local, localhost, and RFC 1918 private IP ranges), mitigating MITM risk if the CA key is compromised. - Add an HTTP landing page that guides users through one-time CA certificate installation on iOS, Android, macOS, Windows, Linux, and Firefox, with auto-redirect when the cert is already trusted. - Add trailing-slash redirects for /controller, /docs, /media, and /download so bare paths don't fall through to the React catch-all. - Add a Root CA download link on the Settings page under Configs. - Update help.sh diagnostics for IPv6 listener detection and HTTP/2 status codes. - Remove all nginx config files and the https_proxy Docker container. - Bump wrolpi-help submodule with certificate documentation.
43 lines
1.8 KiB
ApacheConf
43 lines
1.8 KiB
ApacheConf
<VirtualHost *:9084>
|
|
# The ServerName directive sets the request scheme, hostname and port that
|
|
# the server uses to identify itself. This is used when creating
|
|
# redirection URLs. In the context of virtual hosts, the ServerName
|
|
# specifies what hostname must appear in the request's Host: header to
|
|
# match this virtual host. For the default virtual host (this file) this
|
|
# value is not decisive as it is used as a last resort host regardless.
|
|
# However, you must set it for any further virtual host explicitly.
|
|
#ServerName www.example.com
|
|
|
|
ServerAdmin webmaster@localhost
|
|
|
|
LoadTileConfigFile /etc/renderd.conf
|
|
ModTileRenderdSocketName /run/renderd/renderd.sock
|
|
# Timeout before giving up for a tile to be rendered
|
|
ModTileRequestTimeout 0
|
|
# Timeout before giving up for a tile to be rendered that is otherwise missing
|
|
ModTileMissingRequestTimeout 30
|
|
|
|
DocumentRoot /var/www/html
|
|
|
|
Header set Access-Control-Allow-Origin "*"
|
|
Header set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
|
|
Header set Access-Control-Allow-Headers "Content-Type"
|
|
|
|
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
|
|
# error, crit, alert, emerg.
|
|
# It is also possible to configure the loglevel for particular
|
|
# modules, e.g.
|
|
#LogLevel info ssl:warn
|
|
|
|
ErrorLog ${APACHE_LOG_DIR}/error.log
|
|
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
|
|
|
# For most configuration files from conf-available/, which are
|
|
# enabled or disabled at a global level, it is possible to
|
|
# include a line for only one particular virtual host. For example the
|
|
# following line enables the CGI configuration for this host only
|
|
# after it has been globally disabled with "a2disconf".
|
|
#Include conf-available/serve-cgi-bin.conf
|
|
</VirtualHost>
|
|
|
|
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
|