Stop listening on IPs we haven't had for years
[sysconfig/apache2.git] / sites-available / mit-proxy.conf
index b3d06f6e24c184f617e01894426f40001cddd1cb..3319b0bfa4a191583583cd89e44577598624d611 100644 (file)
@@ -17,9 +17,7 @@
     SSLProxyVerify require
     SSLProxyVerifyDepth 2
     SSLProxyCACertificatePath /etc/ssl/certs
-    # Really I want to validate that the name matches squaresdb.dehnerts.com,
-    # but apparently that's not a thing, AFAICT.
-    SSLProxyCheckPeerName off
+    SSLProxyCheckPeerName on
     ProxyPass "/"  "https://squaresdb.lushan-vms.dehnerts.com/"
     ProxyPassReverse "/"  "https://squaresdb.lushan-vms.dehnerts.com/"
     ProxyPreserveHost on
     SSLCertificateKeyFile /etc/letsencrypt/live/squaresdb.dehnerts.com/privkey.pem
 </VirtualHost>
 </IfModule>
+
+<VirtualHost *:80>
+    ServerName zulip.dehnerts.com
+    ServerAlias *.zulip.dehnerts.com
+    ProxyPassReverse "/"  "http://zulip.lushan-vms.dehnerts.com/"
+    ProxyPreserveHost on
+
+    DocumentRoot /var/www/letsencrypt-verify/
+    RewriteEngine on
+    RewriteCond /var/www/letsencrypt-verify/%{REQUEST_URI} !-f
+    RewriteRule ^/.well-known/acme-challenge/(.*)$ http://zulip.lushan-vms.dehnerts.com/.well-known/acme-challenge/$1 [P,QSA,L]
+</VirtualHost>
+
+<IfModule mod_ssl.c>
+<VirtualHost *:443>
+    ServerName zulip.dehnerts.com
+    ServerAlias *.zulip.dehnerts.com
+    SSLProxyEngine on
+    SSLProxyVerify require
+    SSLProxyVerifyDepth 2
+    SSLProxyCACertificatePath /etc/ssl/certs
+    SSLProxyCheckPeerName on
+    ProxyPass "/"  "https://zulip.lushan-vms.dehnerts.com/"
+    ProxyPassReverse "/"  "https://zulip.lushan-vms.dehnerts.com/"
+    ProxyPreserveHost on
+    Include sites-common/ssl-common
+    SSLCertificateFile /etc/letsencrypt/live/zulip.dehnerts.com/fullchain.pem
+    SSLCertificateChainFile /etc/letsencrypt/live/zulip.dehnerts.com/fullchain.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/zulip.dehnerts.com/privkey.pem
+</VirtualHost>
+</IfModule>