From: Ian Kelling Date: Mon, 8 Aug 2016 01:23:07 +0000 (-0700) Subject: apache: use more verbose log for goaccess, a bit of cleanup X-Git-Url: https://iankelling.org/git/?a=commitdiff_plain;h=2fab2d0cee66545f1572a3127e0842ba629d41a5;p=basic-https-conf apache: use more verbose log for goaccess, a bit of cleanup --- diff --git a/apache-site b/apache-site index d99bf96..90a9837 100755 --- a/apache-site +++ b/apache-site @@ -13,6 +13,9 @@ # See the License for the specific language governing permissions and # limitations under the License. +# run as root. +[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" + set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR @@ -86,10 +89,10 @@ fi # https://mozilla.github.io/server-side-tls/ssl-config-generator/ -sudo rm -f /etc/apache2/sites-enabled/000-default.conf +rm -f /etc/apache2/sites-enabled/000-default.conf -sudo mkdir -p $root -sudo dd of=/etc/apache2/sites-enabled/$h.conf < ServerName $h ServerAlias www.$h @@ -97,24 +100,23 @@ sudo dd of=/etc/apache2/sites-enabled/$h.conf < ServerAdmin webmaster@localhost DocumentRoot /var/www/html - ErrorLog ${APACHE_LOG_DIR}/error.log - CustomLog ${APACHE_LOG_DIR}/access.log combined + CustomLog ${APACHE_LOG_DIR}/httpsredir-access.log combined RewriteEngine on # ian: removed so it's for all sites @@ -123,8 +125,11 @@ RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent] EOF - sudo mkdir -p /etc/letsencrypt - sudo dd of=/etc/letsencrypt/options-ssl-apache.conf <<'EOF' + mkdir -p /etc/letsencrypt + + base_file=/etc/letsencrypt/options-ssl-apache.conf + # this is from cerbot, see below. + dd of=$base_file <<'EOF' # Baseline setting to Include for SSL sites SSLEngine on @@ -149,14 +154,33 @@ LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common #Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4" EOF + upstream=https://github.com/certbot/certbot/raw/master/certbot-apache/certbot_apache/options-ssl-apache.conf + if ! diff -c <(wget -q -O - $upstream) $base_file; then + cat < # vim: syntax=apache ts=4 sw=4 sts=4 sr noet EOF -sudo a2enmod ssl rewrite # rewrite needed for httpredir -sudo service apache2 restart +a2enmod ssl rewrite # rewrite needed for httpredir +service apache2 restart + +# I rarely look at how much traffic I get, so let's keep that info +# around for longer than the default of 2 weeks. +sed -ri --follow-symlinks 's/^(\s*rotate\s).*/\1 365/' /etc/logrotate.d/apache2