Rozdíly

Zde můžete vidět rozdíly mezi vybranou verzí a aktuální verzí dané stránky.

--- en_installation:apache [2022/05/24 14:16] – kozak
+++ en_installation:apache [2024/04/17 11:32] (aktuální) – [Apache configuration] kozak
@@ Řádek 15: / Řádek 15: @@
     </FilesMatch>
     <Directory /usr/lib/cgi-bin>
-        SSLOptions +StdEnvVars
+    SSLOptions +StdEnvVars
     </Directory>
     ErrorLog ${APACHE_LOG_DIR}/error.log
@@ Řádek 27: / Řádek 27: @@
     ProxyPassReverse / http://localhost:8080
     SSLEngine on
-    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
+    SSLProtocol   all -SSLv3 -TLSv1 -TLSv1.1
-    SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDH-ECDSA-AES-128-GCM-SHA256:ECDH-RSA-AES-128-GCM-SHA2>
+    SSLCipherSuite   ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDH-ECDSA-AES-128-GCM-SHA256:ECDH-RSA-AES-128-GCM-SHA2>
     SSLHonorCipherOrder     on
     SSLCompression          off
@@ Řádek 41: / Řádek 41: @@
     Header always set Referrer-Policy "same-origin"
     Header set Content-Security-Policy "script-src 'self' 'unsafe-eval' https:; object-src 'self' 'unsafe-eval' https:"
-    Header set Feature-Policy "vibrate 'self'; geolocation 'self'; notifications 'self'"
 </VirtualHost>
@@ Řádek 47: / Řádek 46: @@
     ServerName **blockchain.yourDomain**
     <FilesMatch "\.(cgi|shtml|phtml|php)$">
-        SSLOptions +StdEnvVars
+    SSLOptions +StdEnvVars
     </FilesMatch>
     <Directory /usr/lib/cgi-bin>
-        SSLOptions +StdEnvVars
+    SSLOptions +StdEnvVars
     </Directory>
     ErrorLog ${APACHE_LOG_DIR}/error.log
@@ Řádek 73: / Řádek 72: @@
     Header always set Referrer-Policy "same-origin"
     Header set Content-Security-Policy "script-src 'self' 'unsafe-eval' https:; object-src 'self' 'unsafe-eval' https:"
-    Header set Feature-Policy "vibrate 'self'; geolocation 'self'; notifications 'self'"
 </VirtualHost>
 </IfModule>
 </code>
+  * The **blockchain.yourDomain.conf**  configuration file needs to be included among the Apache configs
-  * To **/etc/apache2/ports.conf**  under **ssl_module** needs to be added ''Listen 3000''  for the gateway functionality
+      * ''sudo a2ensite blockchain.yourDomain''
+  * To **/etc/apache2/ports.conf**  under **ssl_module**  needs to be added ''Listen 3000''  for the gateway functionality
   * In **/etc/apache2/sites-available/000-default.conf**  it is advisable to add automatic redirect to https to the virtual host
       * ''Redirect permanent / [[https://blockchain.vaseDomena|https://blockchain.yourDomain]]''
-  * Remember that you need to have SSL and MD modules enabled
+  * The following modules need to be enabled:
+      * ''sudo a2enmod rewrite''
+      * ''sudo a2enmod ssl''
       * ''sudo a2enmod md''
-      * ''sudo a2enmod ssl''
+      * ''sudo a2enmod proxy''
+      * ''sudo a2enmod proxy_http''
+      * ''sudo a2enmod http2''
+      * ''sudo a2enmod headers''
 SSL certificates are automatically generated via the mod_md module built into Apache. If you want to add another domain for which certificates need to be generated (for example, your application running on a node under another domain), we recommend creating a new config, for example **application.yourDomain.conf**  in /etc/apache2/sites-available/ and include it to Apache configs running the command ''sudo a2ensite application.yourDomain''. Then restart Apache ''sudo systemctl restart apache2''  and certificates should start to be generated for this domain on a regular basis. Config for an application running on local port 8083 should look like this:
 <code>
@@ Řádek 100: / Řádek 104: @@
     </FilesMatch>
     <Directory /usr/lib/cgi-bin>
-       SSLOptions +StdEnvVars
+    SSLOptions +StdEnvVars
     </Directory>
     ErrorLog ${APACHE_LOG_DIR}/error.log
@@ Řádek 109: / Řádek 113: @@
     ProxyPassReverse / http://localhost:8083/
     SSLEngine on
-    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
+    SSLProtocol   all -SSLv3 -TLSv1 -TLSv1.1
-    SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDH-ECDSA-AES-128-GCM-SHA256:ECDH-RSA-AES-128-GCM-SHA2>
+    SSLCipherSuite   ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDH-ECDSA-AES-128-GCM-SHA256:ECDH-RSA-AES-128-GCM-SHA2>
     SSLHonorCipherOrder     on
     SSLCompression          off
@@ Řádek 123: / Řádek 127: @@
     Header always set Referrer-Policy "same-origin"
     Header set Content-Security-Policy "script-src 'self' 'unsafe-eval' https:; object-src 'self' 'unsafe-eval' https:"
-    Header set Feature-Policy "vibrate 'self'; geolocation 'self'; notifications 'self'"
 </VirtualHost>
 </IfModule>
+</code>
+==== Your own SSL certificates ====
+Just add the path to the certificate to the mentioned config **/etc/apache2/sites-available/blockchain.****yourDomain.****conf**
+th line ''MDomain **blockchain.yourDomain**'' rewrite to:
+<code>
+<MDomain **blockchain.yourDomain**>
+    MDCertificateFile    /etc/ssl/certs/ssl-cert.pem
+    MDCertificateKeyFile /etc/ssl/private/ssl-cert.key
+</MDomain>
 </code>