daily autocommit

diff --git a/.etckeeper b/.etckeeper
index 377e24af0db1e0cc80078b9f5a1d3674e9dcad85..3700f4973e209ac177c663615d569190ee2efa4c 100755 (executable)
--- a/.etckeeper
+++ b/.etckeeper
@@ -128,6 +128,7 @@ maybe chmod 0755 'apache2'
 maybe chmod 0644 'apache2/apache2.conf'
 maybe chmod 0755 'apache2/conf-available'
 maybe chmod 0644 'apache2/conf-available/charset.conf'
+maybe chmod 0644 'apache2/conf-available/custom-log.conf'
 maybe chmod 0644 'apache2/conf-available/iredadmin.conf'
 maybe chmod 0644 'apache2/conf-available/javascript-common.conf'
 maybe chmod 0644 'apache2/conf-available/localized-error-pages.conf'
@@ -137,6 +138,7 @@ maybe chmod 0644 'apache2/conf-available/security.conf'
 maybe chmod 0644 'apache2/conf-available/serve-cgi-bin.conf'
 maybe chmod 0755 'apache2/conf-enabled'
 maybe chmod 0644 'apache2/envvars'
+maybe chmod 0644 'apache2/info_users_passwd'
 maybe chmod 0644 'apache2/magic'
 maybe chmod 0755 'apache2/mods-available'
 maybe chmod 0644 'apache2/mods-available/access_compat.load'
@@ -286,7 +288,9 @@ maybe chmod 0644 'apache2/mods-available/xml2enc.load'
 maybe chmod 0755 'apache2/mods-enabled'
 maybe chmod 0644 'apache2/ports.conf'
 maybe chmod 0755 'apache2/sites-available'
+maybe chmod 0644 'apache2/sites-available/000-default-ssl.conf'
 maybe chmod 0644 'apache2/sites-available/000-default.conf'
+maybe chmod 0644 'apache2/sites-available/default-include.conf'
 maybe chmod 0644 'apache2/sites-available/default-ssl.conf'
 maybe chmod 0755 'apache2/sites-enabled'
 maybe chmod 0755 'apm'
@@ -1167,6 +1171,7 @@ maybe chmod 0700 'letsencrypt/live'
 maybe chmod 0644 'letsencrypt/live/README'
 maybe chmod 0755 'letsencrypt/live/mail.uhu-banane.net'
 maybe chmod 0644 'letsencrypt/live/mail.uhu-banane.net/README'
+maybe chmod 0644 'letsencrypt/options-ssl-apache.conf'
 maybe chmod 0644 'letsencrypt/options-ssl-nginx.conf'
 maybe chmod 0755 'letsencrypt/renewal'
 maybe chmod 0755 'letsencrypt/renewal-hooks'

diff --git a/apache2/conf-available/custom-log.conf b/apache2/conf-available/custom-log.conf
new file mode 100644 (file)
index 0000000..3910749
--- /dev/null
+++ b/apache2/conf-available/custom-log.conf
@@ -0,0 +1,12 @@
+
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%T\" \"%v\" \"%f\"" full
+LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" \"%T\" \"%v\" \"%f\"" full_combined
+
+<IfModule logio_module>
+    # You need to enable mod_logio.c to use %I and %O
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"  \"%T\" \"%v\" \"%f\" %I %O" full_io
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+    LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" vhostio
+</IfModule>
+
+# vim: filetype=apache ts=4 sw=4 sts=4 sr noet

diff --git a/apache2/conf-enabled/custom-log.conf b/apache2/conf-enabled/custom-log.conf
new file mode 120000 (symlink)
index 0000000..bc5fa0f
--- /dev/null
+++ b/apache2/conf-enabled/custom-log.conf
@@ -0,0 +1 @@
+../conf-available/custom-log.conf
\ No newline at end of file

diff --git a/apache2/conf-enabled/iredadmin.conf b/apache2/conf-enabled/iredadmin.conf
new file mode 120000 (symlink)
index 0000000..c4bf1c7
--- /dev/null
+++ b/apache2/conf-enabled/iredadmin.conf
@@ -0,0 +1 @@
+../conf-available/iredadmin.conf
\ No newline at end of file

diff --git a/apache2/info_users_passwd b/apache2/info_users_passwd
new file mode 100644 (file)
index 0000000..a9cf5ab
--- /dev/null
+++ b/apache2/info_users_passwd
@@ -0,0 +1,3 @@
+monitoring:$apr1$rq/i6DzS$Qk6YAABQSeIgXe5Z0cc7K0
+uhu:$apr1$cFagqyiq$T2azAWwszStOUz/mmfONd/
+frank:$apr1$q0RMdmRi$5egjyB4c32Ts/swS3hkuN0

diff --git a/apache2/mods-available/info.conf b/apache2/mods-available/info.conf
index 78a0649e31068b03e84f3293b2aeefd5df72c850..4b1958496b120d0e10f32bd95255b87085b5e2fc 100644 (file)
--- a/apache2/mods-available/info.conf
+++ b/apache2/mods-available/info.conf
@@ -6,8 +6,16 @@
        #
        <Location /server-info>
                SetHandler server-info
-               Require local
+               #Require local
                #Require ip 192.0.2.0/24
+               AuthName "Server Status Access"
+               AuthType Basic
+               AuthBasicProvider file
+               AuthUserFile /etc/apache2/info_users_passwd
+               <RequireAny>
+                       Require local
+                       Require valid-user
+               </RequireAny>
        </Location>
 
 </IfModule>

diff --git a/apache2/mods-available/status.conf b/apache2/mods-available/status.conf
index 5f53ba7aa83cdfce58a6d4cda2b7268d883951ec..770142474c2021274dd0569305897c5941feffa6 100644 (file)
--- a/apache2/mods-available/status.conf
+++ b/apache2/mods-available/status.conf
@@ -5,8 +5,16 @@
 
        <Location /server-status>
                SetHandler server-status
-               Require local
+               #Require local
                #Require ip 192.0.2.0/24
+               AuthName "Server Status Access"
+               AuthType Basic
+               AuthBasicProvider file
+               AuthUserFile /etc/apache2/info_users_passwd
+               <RequireAny>
+                       Require local
+                       Require valid-user
+               </RequireAny>
        </Location>
 
        # Keep track of extended status information for each request

diff --git a/apache2/mods-enabled/socache_shmcb.load b/apache2/mods-enabled/socache_shmcb.load
new file mode 120000 (symlink)
index 0000000..f729f78
--- /dev/null
+++ b/apache2/mods-enabled/socache_shmcb.load
@@ -0,0 +1 @@
+../mods-available/socache_shmcb.load
\ No newline at end of file

diff --git a/apache2/mods-enabled/ssl.conf b/apache2/mods-enabled/ssl.conf
new file mode 120000 (symlink)
index 0000000..b0f14d1
--- /dev/null
+++ b/apache2/mods-enabled/ssl.conf
@@ -0,0 +1 @@
+../mods-available/ssl.conf
\ No newline at end of file

diff --git a/apache2/mods-enabled/ssl.load b/apache2/mods-enabled/ssl.load
new file mode 120000 (symlink)
index 0000000..9d79723
--- /dev/null
+++ b/apache2/mods-enabled/ssl.load
@@ -0,0 +1 @@
+../mods-available/ssl.load
\ No newline at end of file

diff --git a/apache2/sites-available/000-default-ssl.conf b/apache2/sites-available/000-default-ssl.conf
new file mode 100644 (file)
index 0000000..a6def1d
--- /dev/null
+++ b/apache2/sites-available/000-default-ssl.conf
@@ -0,0 +1,60 @@
+<IfModule mod_ssl.c>
+       <VirtualHost _default_:443>
+
+               Include sites-available/default-include.conf
+
+               SSLEngine on
+
+               SSLCertificateFile      /etc/letsencrypt/live/mail.uhu-banane.net/fullchain.pem
+               SSLCertificateKeyFile   /etc/letsencrypt/live/mail.uhu-banane.net/privkey.pem
+
+               Include /etc/letsencrypt/options-ssl-apache.conf
+
+               #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
+
+               #SSLCACertificatePath /etc/ssl/certs/
+               #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
+
+               #SSLCARevocationPath /etc/apache2/ssl.crl/
+               #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
+
+               #SSLVerifyClient require
+               #SSLVerifyDepth  10
+
+               #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+
+               <FilesMatch "\.(cgi|shtml|phtml|php)$">
+                       SSLOptions +StdEnvVars
+               </FilesMatch>
+               <Directory /usr/lib/cgi-bin>
+                       SSLOptions +StdEnvVars
+               </Directory>
+
+               BrowserMatch    "MSIE [2-6]" \
+                       nokeepalive ssl-unclean-shutdown \
+                       downgrade-1.0 force-response-1.0
+               # MSIE 7 and newer should be able to use keepalive
+               BrowserMatch    "MSIE [17-9]" ssl-unclean-shutdown
+
+               ServerName      mail.uhu-banane.net
+               ServerAlias     mail
+               ServerAlias     mail.brehm-berlin.de
+               ServerAlias     mail.brehm-online.com
+               ServerAlias     mail.brehm-online.eu
+               ServerAlias     mail.frankepedia.eu
+               ServerAlias     mail.hennig-berlin.org
+               ServerAlias     mail.uhu-banane.com
+               ServerAlias     mail.uhu-banane.de
+               ServerAlias     mail.uhu-banane.eu
+               ServerAlias     mail.uhu-banane.org
+               ServerAlias     sarah.uhu-banane.de
+               ServerAlias     sarah
+               ServerAlias     sarah.brehm-online.com
+               ServerAlias     sarah.uhu-banane.com
+               ServerAlias     sarah.uhu-banane.net
+               ServerAlias     sarah.uhu-banane.org
+
+       </VirtualHost>
+</IfModule>
+
+# vim: filetype=apache ts=8 sw=4 sts=4 sr noet

diff --git a/apache2/sites-available/000-default.conf b/apache2/sites-available/000-default.conf
index cfe8df57e401247f9c16058b98f37d0bf44a01dc..b1fc5d63d951f60212da3aa93456fb6d074a3fdd 100644 (file)
--- a/apache2/sites-available/000-default.conf
+++ b/apache2/sites-available/000-default.conf
@@ -1,31 +1,5 @@
 <VirtualHost *:80>
-       # The ServerName directive sets the request scheme, hostname and port that
-       # the server uses to identify itself. This is used when creating
-       # redirection URLs. In the context of virtual hosts, the ServerName
-       # specifies what hostname must appear in the request's Host: header to
-       # match this virtual host. For the default virtual host (this file) this
-       # value is not decisive as it is used as a last resort host regardless.
-       # However, you must set it for any further virtual host explicitly.
-       #ServerName www.example.com
-
-       ServerAdmin webmaster@localhost
-       DocumentRoot /var/www/html
-
-       # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
-       # error, crit, alert, emerg.
-       # It is also possible to configure the loglevel for particular
-       # modules, e.g.
-       #LogLevel info ssl:warn
-
-       ErrorLog ${APACHE_LOG_DIR}/error.log
-       CustomLog ${APACHE_LOG_DIR}/access.log combined
-
-       # For most configuration files from conf-available/, which are
-       # enabled or disabled at a global level, it is possible to
-       # include a line for only one particular virtual host. For example the
-       # following line enables the CGI configuration for this host only
-       # after it has been globally disabled with "a2disconf".
-       #Include conf-available/serve-cgi-bin.conf
+       Include sites-available/default-include.conf
 </VirtualHost>
 
 # vim: syntax=apache ts=4 sw=4 sts=4 sr noet

diff --git a/apache2/sites-available/default-include.conf b/apache2/sites-available/default-include.conf
new file mode 100644 (file)
index 0000000..c67b58a
--- /dev/null
+++ b/apache2/sites-available/default-include.conf
@@ -0,0 +1,38 @@
+#ServerName www.example.com
+
+ServerAdmin frank@brehm-online.com
+DocumentRoot /var/www/html
+
+#LogLevel info ssl:warn
+
+ErrorLog ${APACHE_LOG_DIR}/error.log
+CustomLog ${APACHE_LOG_DIR}/access.log full_combined
+
+#Include conf-available/serve-cgi-bin.conf
+
+#Alias /Debian/ /home/repo/repos/Debian/
+#<Directory "/home/repo/repos/Debian">
+#      Options Indexes FollowSymLinks
+#      AllowOverride All
+#      Order allow,deny
+#      Allow from all
+#</Directory>
+
+#Alias /Ubuntu/ /home/repo/repos/Ubuntu/
+#<Directory "/home/repo/repos/Ubuntu">
+#      Options Indexes FollowSymLinks
+#      AllowOverride All
+#      Order allow,deny
+#      Allow from all
+#</Directory>
+
+#Alias /public/ /home/repo/public/
+#<Directory "/home/repo/public">
+#      Options Indexes FollowSymLinks
+#      AllowOverride All
+#      Order allow,deny
+#      Allow from all
+#</Directory>
+
+
+# vim: filetype=apache ts=4 sw=4 sts=4 sr noet

diff --git a/apache2/sites-available/default-ssl.conf b/apache2/sites-available/default-ssl.conf
index 7e37a9c366d98e0fb1d0b523649c457cd6c8b064..341612d120feba81ed74469b7c64a43ccb6f73c0 100644 (file)
--- a/apache2/sites-available/default-ssl.conf
+++ b/apache2/sites-available/default-ssl.conf
@@ -128,6 +128,9 @@
                #               nokeepalive ssl-unclean-shutdown \
                #               downgrade-1.0 force-response-1.0
 
+               WSGIScriptAlias /iredadmin /opt/www/iredadmin/iredadmin.py/
+               Alias /iredadmin/static /opt/www/iredadmin/static/
+
        </VirtualHost>
 </IfModule>
 

diff --git a/apache2/sites-enabled/000-default-ssl.conf b/apache2/sites-enabled/000-default-ssl.conf
new file mode 120000 (symlink)
index 0000000..596612a
--- /dev/null
+++ b/apache2/sites-enabled/000-default-ssl.conf
@@ -0,0 +1 @@
+../sites-available/000-default-ssl.conf
\ No newline at end of file

diff --git a/letsencrypt/options-ssl-apache.conf b/letsencrypt/options-ssl-apache.conf
new file mode 100644 (file)
index 0000000..8113ee8
--- /dev/null
+++ b/letsencrypt/options-ssl-apache.conf
@@ -0,0 +1,26 @@
+# This file contains important security parameters. If you modify this file
+# manually, Certbot will be unable to automatically provide future security
+# updates. Instead, Certbot will print and log an error message with a path to
+# the up-to-date file that you will need to refer to when manually updating
+# this file.
+
+SSLEngine on
+
+# Intermediate configuration, tweak to your needs
+SSLProtocol             all -SSLv2 -SSLv3
+SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
+SSLHonorCipherOrder     on
+SSLCompression          off
+
+SSLOptions +StrictRequire
+
+# Add vhost name to log entries:
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
+LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
+
+#CustomLog /var/log/apache2/access.log vhost_combined
+#LogLevel warn
+#ErrorLog /var/log/apache2/error.log
+
+# Always ensure Cookies have "Secure" set (JAH 2012/1)
+#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"

diff --git a/motd b/motd
index 51285e42794254c2d6e5fed053b7f98d6146e4b0..aabc6488411ab8a754cf1b3b34f96d6ccd0fa5f6 100644 (file)
--- a/motd
+++ b/motd
@@ -6,8 +6,13 @@ Debian GNU/Linux 10 (buster)
 |____/ \__,_|_|  \__,_|_| |_|
                              
 
-Wer führen will, muß lernen, Emotionen zu produzieren.
-               -- Ruperet Lay
+Leitfaden durch die Phraseologie wissenschaftlicher Veröffentlichungen:
+Englisch:
+  Besides the obvious scientific value of this study, an understanding
+  of the structure of X may also be important clinically.
+Deutsch:
+  Der wissenschaftliche Wert der Untersuchung ist durchschnittlich und
+  eine klinische Anwendung nicht absehbar.
 
 Today is Pungenday, the 20th day of Discord in the YOLD 3187