mirrors/Radicale
1
0
Fork 0
mirror of https://github.com/Kozea/Radicale.git synced 2025-04-01 20:27:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

Review: Apache reverse proxy config example

Browse source
This commit is contained in:
Peter Bieringer 2025-03-02 09:14:02 +01:00
parent 451712d01d
commit 7afff7ad2b
1 changed files with 122 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

175
contrib/apache/radicale.conf
View file

@ -4,6 +4,7 @@
## Apache acting as reverse proxy and forward requests via ProxyPass to a running "radicale" server ## Apache acting as reverse proxy and forward requests via ProxyPass to a running "radicale" server
# SELinux WARNING: To use this correctly, you will need to set: # SELinux WARNING: To use this correctly, you will need to set:
# setsebool -P httpd_can_network_connect=1 # setsebool -P httpd_can_network_connect=1
# URI prefix: /radicale
#Define RADICALE_SERVER_REVERSE_PROXY #Define RADICALE_SERVER_REVERSE_PROXY
@ -11,11 +12,12 @@
# MAY CONFLICT with other WSG servers on same system -> use then inside a VirtualHost # MAY CONFLICT with other WSG servers on same system -> use then inside a VirtualHost
# SELinux WARNING: To use this correctly, you will need to set: # SELinux WARNING: To use this correctly, you will need to set:
# setsebool -P httpd_can_read_write_radicale=1 # setsebool -P httpd_can_read_write_radicale=1
# URI prefix: /radicale
#Define RADICALE_SERVER_WSGI #Define RADICALE_SERVER_WSGI
### Extra options ### Extra options
## Apache starting a dedicated VHOST with SSL ## Apache starting a dedicated VHOST with SSL without "/radicale" prefix in URI on port 8443
#Define RADICALE_SERVER_VHOST_SSL #Define RADICALE_SERVER_VHOST_SSL
@ -27,8 +29,13 @@
#Define RADICALE_ENFORCE_SSL #Define RADICALE_ENFORCE_SSL
### enable authentication by web server (config: [auth] type = http_x_remote_user)
#Define RADICALE_SERVER_USER_AUTHENTICATION
### Particular configuration EXAMPLES, adjust/extend/override to your needs ### Particular configuration EXAMPLES, adjust/extend/override to your needs
########################## ##########################
### default host ### default host
########################## ##########################
@ -37,9 +44,14 @@
## RADICALE_SERVER_REVERSE_PROXY ## RADICALE_SERVER_REVERSE_PROXY
<IfDefine RADICALE_SERVER_REVERSE_PROXY> <IfDefine RADICALE_SERVER_REVERSE_PROXY>
RewriteEngine On RewriteEngine On
RewriteRule ^/radicale$ /radicale/ [R,L] RewriteRule ^/radicale$ /radicale/ [R,L]
<Location /radicale> RewriteCond %{REQUEST_METHOD} GET
RewriteRule ^/radicale/$ /radicale/.web/ [R,L]
<LocationMatch "^/radicale/\.web.*>
# Internal WebUI does not need authentication at all
RequestHeader set X-Script-Name /radicale RequestHeader set X-Script-Name /radicale
RequestHeader set X-Forwarded-Port "%{SERVER_PORT}s" RequestHeader set X-Forwarded-Port "%{SERVER_PORT}s"
@ -48,21 +60,40 @@
ProxyPass http://localhost:5232/ retry=0 ProxyPass http://localhost:5232/ retry=0
ProxyPassReverse http://localhost:5232/ ProxyPassReverse http://localhost:5232/
## User authentication handled by "radicale"
Require local Require local
<IfDefine RADICALE_PERMIT_PUBLIC_ACCESS> <IfDefine RADICALE_PERMIT_PUBLIC_ACCESS>
Require all granted Require all granted
</IfDefine> </IfDefine>
</LocationMatch>
## You may want to use apache's authentication (config: [auth] type = http_x_remote_user) <LocationMatch "^/radicale(?!/\.web)">
## e.g. create a new file with a testuser: htpasswd -c -B /etc/httpd/conf/htpasswd-radicale testuser RequestHeader set X-Script-Name /radicale
#AuthBasicProvider file
#AuthType Basic RequestHeader set X-Forwarded-Port "%{SERVER_PORT}s"
#AuthName "Enter your credentials" RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
#AuthUserFile /etc/httpd/conf/htpasswd-radicale
#AuthGroupFile /dev/null ProxyPass http://localhost:5232/ retry=0
#Require valid-user ProxyPassReverse http://localhost:5232/
#RequestHeader set X-Remote-User expr=%{REMOTE_USER}
<IfDefine !RADICALE_SERVER_USER_AUTHENTICATION>
## User authentication handled by "radicale"
Require local
<IfDefine RADICALE_PERMIT_PUBLIC_ACCESS>
Require all granted
</IfDefine>
</IfDefine>
<IfDefine RADICALE_SERVER_USER_AUTHENTICATION>
## You may want to use apache's authentication (config: [auth] type = http_x_remote_user)
## e.g. create a new file with a testuser: htpasswd -c -B /etc/httpd/conf/htpasswd-radicale testuser
AuthBasicProvider file
AuthType Basic
AuthName "Enter your credentials"
AuthUserFile /etc/httpd/conf/htpasswd-radicale
AuthGroupFile /dev/null
Require valid-user
RequestHeader set X-Remote-User expr=%{REMOTE_USER}
</IfDefine>
<IfDefine RADICALE_ENFORCE_SSL> <IfDefine RADICALE_ENFORCE_SSL>
<IfModule !ssl_module> <IfModule !ssl_module>
@ -70,7 +101,7 @@
</IfModule> </IfModule>
SSLRequireSSL SSLRequireSSL
</IfDefine> </IfDefine>
</Location> </LocationMatch>
</IfDefine> </IfDefine>
@ -96,24 +127,38 @@
WSGIScriptAlias /radicale /usr/share/radicale/radicale.wsgi WSGIScriptAlias /radicale /usr/share/radicale/radicale.wsgi
<Location /radicale> # Internal WebUI does not need authentication at all
<LocationMatch "^/radicale/\.web.*>
RequestHeader set X-Script-Name /radicale RequestHeader set X-Script-Name /radicale
## User authentication handled by "radicale"
Require local Require local
<IfDefine RADICALE_PERMIT_PUBLIC_ACCESS> <IfDefine RADICALE_PERMIT_PUBLIC_ACCESS>
Require all granted Require all granted
</IfDefine> </IfDefine>
</LocationMatch>
## You may want to use apache's authentication (config: [auth] type = http_x_remote_user) <LocationMatch "^/radicale(?!/\.web)">
## e.g. create a new file with a testuser: htpasswd -c -B /etc/httpd/conf/htpasswd-radicale testuser RequestHeader set X-Script-Name /radicale
#AuthBasicProvider file
#AuthType Basic <IfDefine !RADICALE_SERVER_USER_AUTHENTICATION>
#AuthName "Enter your credentials" ## User authentication handled by "radicale"
#AuthUserFile /etc/httpd/conf/htpasswd-radicale Require local
#AuthGroupFile /dev/null <IfDefine RADICALE_PERMIT_PUBLIC_ACCESS>
#Require valid-user Require all granted
#RequestHeader set X-Remote-User expr=%{REMOTE_USER} </IfDefine>
</IfDefine>
<IfDefine RADICALE_SERVER_USER_AUTHENTICATION>
## You may want to use apache's authentication (config: [auth] type = http_x_remote_user)
## e.g. create a new file with a testuser: htpasswd -c -B /etc/httpd/conf/htpasswd-radicale testuser
AuthBasicProvider file
AuthType Basic
AuthName "Enter your credentials"
AuthUserFile /etc/httpd/conf/htpasswd-radicale
AuthGroupFile /dev/null
Require valid-user
RequestHeader set X-Remote-User expr=%{REMOTE_USER}
</IfDefine>
<IfDefine RADICALE_ENFORCE_SSL> <IfDefine RADICALE_ENFORCE_SSL>
<IfModule !ssl_module> <IfModule !ssl_module>
@ -121,7 +166,7 @@
</IfModule> </IfModule>
SSLRequireSSL SSLRequireSSL
</IfDefine> </IfDefine>
</Location> </LocationMatch>
</IfModule> </IfModule>
<IfModule !wsgi_module> <IfModule !wsgi_module>
Error "RADICALE_SERVER_WSGI selected but wsgi module not loaded/enabled" Error "RADICALE_SERVER_WSGI selected but wsgi module not loaded/enabled"
@ -165,30 +210,51 @@ CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
## RADICALE_SERVER_REVERSE_PROXY ## RADICALE_SERVER_REVERSE_PROXY
<IfDefine RADICALE_SERVER_REVERSE_PROXY> <IfDefine RADICALE_SERVER_REVERSE_PROXY>
<Location /> RewriteEngine On
RequestHeader set X-Script-Name /
RewriteCond %{REQUEST_METHOD} GET
RewriteRule ^/$ /.web/ [R,L]
<LocationMatch "^/\.web.*>
RequestHeader set X-Forwarded-Port "%{SERVER_PORT}s" RequestHeader set X-Forwarded-Port "%{SERVER_PORT}s"
RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME} RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
ProxyPass http://localhost:5232/ retry=0 ProxyPass http://localhost:5232/ retry=0
ProxyPassReverse http://localhost:5232/ ProxyPassReverse http://localhost:5232/
## User authentication handled by "radicale"
Require local Require local
<IfDefine RADICALE_PERMIT_PUBLIC_ACCESS> <IfDefine RADICALE_PERMIT_PUBLIC_ACCESS>
Require all granted Require all granted
</IfDefine> </IfDefine>
</LocationMatch>
## You may want to use apache's authentication (config: [auth] type = http_x_remote_user) <LocationMatch "^(?!/\.web)">
## e.g. create a new file with a testuser: htpasswd -c -B /etc/httpd/conf/htpasswd-radicale testuser RequestHeader set X-Forwarded-Port "%{SERVER_PORT}s"
#AuthBasicProvider file RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
#AuthType Basic
#AuthName "Enter your credentials" ProxyPass http://localhost:5232/ retry=0
#AuthUserFile /etc/httpd/conf/htpasswd-radicale ProxyPassReverse http://localhost:5232/
#AuthGroupFile /dev/null
#Require valid-user <IfDefine !RADICALE_SERVER_USER_AUTHENTICATION>
</Location> ## User authentication handled by "radicale"
Require local
<IfDefine RADICALE_PERMIT_PUBLIC_ACCESS>
Require all granted
</IfDefine>
</IfDefine>
<IfDefine RADICALE_SERVER_USER_AUTHENTICATION>
## You may want to use apache's authentication (config: [auth] type = http_x_remote_user)
## e.g. create a new file with a testuser: htpasswd -c -B /etc/httpd/conf/htpasswd-radicale testuser
AuthBasicProvider file
AuthType Basic
AuthName "Enter your credentials"
AuthUserFile /etc/httpd/conf/htpasswd-radicale
AuthGroupFile /dev/null
Require valid-user
RequestHeader set X-Remote-User expr=%{REMOTE_USER}
</IfDefine>
</LocationMatch>
</IfDefine> </IfDefine>
@ -214,24 +280,27 @@ CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
WSGIScriptAlias / /usr/share/radicale/radicale.wsgi WSGIScriptAlias / /usr/share/radicale/radicale.wsgi
<Location /> <LocationMatch "^/(?!/\.web)">
RequestHeader set X-Script-Name / <IfDefine !RADICALE_SERVER_USER_AUTHENTICATION>
## User authentication handled by "radicale"
## User authentication handled by "radicale" Require local
Require local <IfDefine RADICALE_PERMIT_PUBLIC_ACCESS>
<IfDefine RADICALE_PERMIT_PUBLIC_ACCESS> Require all granted
Require all granted </IfDefine>
</IfDefine> </IfDefine>
## You may want to use apache's authentication (config: [auth] type = http_x_remote_user) <IfDefine RADICALE_SERVER_USER_AUTHENTICATION>
## e.g. create a new file with a testuser: htpasswd -c -B /etc/httpd/conf/htpasswd-radicale testuser ## You may want to use apache's authentication (config: [auth] type = http_x_remote_user)
#AuthBasicProvider file ## e.g. create a new file with a testuser: htpasswd -c -B /etc/httpd/conf/htpasswd-radicale testuser
#AuthType Basic AuthBasicProvider file
#AuthName "Enter your credentials" AuthType Basic
#AuthUserFile /etc/httpd/conf/htpasswd-radicale AuthName "Enter your credentials"
#AuthGroupFile /dev/null AuthUserFile /etc/httpd/conf/htpasswd-radicale
#Require valid-user AuthGroupFile /dev/null
</Location> Require valid-user
RequestHeader set X-Remote-User expr=%{REMOTE_USER}
</IfDefine>
</LocationMatch>
</IfModule> </IfModule>
<IfModule !wsgi_module> <IfModule !wsgi_module>
Error "RADICALE_SERVER_WSGI selected but wsgi module not loaded/enabled" Error "RADICALE_SERVER_WSGI selected but wsgi module not loaded/enabled"