| 192 |
- |
1 |
|
|
|
2 |
<VirtualHost *:443>
|
|
|
3 |
DocumentRoot "/var/www/munatrading"
|
|
|
4 |
ServerName www.dev.munatrading.com
|
|
|
5 |
ServerAlias dev.munatrading.com
|
|
|
6 |
|
|
|
7 |
ErrorLog logs/ssl_error_log
|
|
|
8 |
TransferLog logs/ssl_access_log
|
|
|
9 |
LogLevel warn
|
|
|
10 |
|
|
|
11 |
# HSTS (15768000 seconds = 6 month)
|
|
|
12 |
Header always set Strict-Transport-Security "max-age=15768000; preload"
|
|
|
13 |
# Prevent browsers from incorrectly detecting non-scripts as scripts
|
|
|
14 |
Header always set X-Content-Type-Options nosniff
|
|
|
15 |
# Cors
|
|
|
16 |
Header always set Access-Control-Allow-Origin "*"
|
|
|
17 |
# CSP calculated by FF Addon Laboratory
|
|
|
18 |
###Header always set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self' https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com; frame-src data:; img-src 'self' data: https://counters.auctiva.com https://i.ebayimg.com https://i.thenile.io https://img.comc.com https://ir.ebaystatic.com https://scimg.auctiva.com https://storage.googleapis.com https://*.ebaystatic.com https://ti2.auctiva.com https://www.thenile.com.au https://cdn.shopify.com; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js https://cdn.jsdelivr.net/npm/lodash@4.17.11/lodash.min.js https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.7.3/Chart.min.js https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.2/js/bootstrap-select.js https://cdnjs.cloudflare.com/ajax/libs/moment-timezone/0.5.23/moment-timezone-with-data-2012-2022.min.js https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.23.0/moment.min.js https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js https://maps.googleapis.com/maps-api-v3/api/js/ https://maps.googleapis.com/maps/api/js https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.2/css/ https://fonts.googleapis.com/ https://img.comc.com/Content/eBay/ https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/css/ https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ https://scrollinggallery.auctiva.com/gallery/css/2(0)/AUCTIVA/1362185/0/25/ https://storage.googleapis.com/ebay-assets/grandeagle/css/ https://www.w3schools.com/w3css/4/;frame-ancestors 'self'"
|
|
|
19 |
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
|
|
|
20 |
Header always set Referrer-Policy "no-referrer"
|
|
|
21 |
# Only allow my site to frame itself
|
|
|
22 |
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
|
|
|
23 |
Header always set X-Frame-Options SAMEORIGIN
|
|
|
24 |
# XSS Protection
|
|
|
25 |
Header set X-XSS-Protection "1; mode=block"
|
|
|
26 |
# Redirect all non-www access to www
|
|
|
27 |
RewriteEngine On
|
|
|
28 |
RewriteCond %{HTTP_HOST} !^www\. [NC]
|
|
|
29 |
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
|
|
30 |
|
|
|
31 |
SSLEngine on
|
|
|
32 |
SSLProtocol all -SSLv2 -SSLv3
|
|
|
33 |
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
|
|
|
34 |
SSLHonorCipherOrder On
|
|
|
35 |
SSLCertificateFile /etc/letsencrypt/live/dev.munatrading.com/cert.pem
|
|
|
36 |
SSLCertificateKeyFile /etc/letsencrypt/live/dev.munatrading.com/privkey.pem
|
|
|
37 |
SSLCertificateChainFile /etc/letsencrypt/live/dev.munatrading.com/chain.pem
|
|
|
38 |
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
|
|
39 |
SSLOptions +StdEnvVars
|
|
|
40 |
</Files>
|
|
|
41 |
<Directory "/var/www/cgi-bin">
|
|
|
42 |
SSLOptions +StdEnvVars
|
|
|
43 |
</Directory>
|
|
|
44 |
<Directory "/var/www/munatrading/ebay/listings">
|
|
|
45 |
Options +Indexes
|
|
|
46 |
IndexOptions IgnoreCase FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* SuppressHTMLPreamble
|
|
|
47 |
</Directory>
|
|
|
48 |
SetEnvIf User-Agent ".*MSIE.*" \
|
|
|
49 |
nokeepalive ssl-unclean-shutdown \
|
|
|
50 |
downgrade-1.0 force-response-1.0
|
|
|
51 |
CustomLog logs/ssl_request_log \
|
|
|
52 |
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
|
53 |
</VirtualHost>
|
|
|
54 |
|
|
|
55 |
<VirtualHost *:443>
|
|
|
56 |
DocumentRoot "/var/www/cheapmusic/www"
|
|
|
57 |
ServerName www.dev.findcheapmusic.com
|
|
|
58 |
ServerAlias dev.findcheapmusic.com
|
|
|
59 |
|
|
|
60 |
ErrorDocument 403 /index.php
|
|
|
61 |
ErrorDocument 404 /index.php
|
|
|
62 |
|
|
|
63 |
ErrorLog logs/ssl_error_log
|
|
|
64 |
TransferLog logs/ssl_access_log
|
|
|
65 |
LogLevel warn
|
|
|
66 |
|
|
|
67 |
# HSTS (31536000 seconds = 1 year)
|
|
|
68 |
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
|
69 |
# Prevent browsers from incorrectly detecting non-scripts as scripts
|
|
|
70 |
Header always set X-Content-Type-Options nosniff
|
|
|
71 |
# Cors
|
|
|
72 |
Header always set Access-Control-Allow-Origin "*"
|
|
|
73 |
# Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https
|
|
|
74 |
###Header always set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self' data: https://fonts.gstatic.com https://use.fontawesome.com; form-action 'self'; frame-src https://www.google.com https://www.youtube-nocookie.com; img-src 'self' data: http://abs.twimg.com https://abs.twimg.com https://*.walmartimages.com https://images.samash.com https://img.discogs.com https://*.googleusercontent.com https://*.ebaystatic.com https://www.fye.com https://www.musicnotes.com https://platform-lookaside.fbsbx.com https://ad.linksynergy.com https://www.lduhtrp.net https://*.wal.co https://cj.dotomi.com https://www.awltovhc.com https://www.ftjcfx.com https://www.tqlkg.com https://www.emjcd.com https://www.yceml.net https://beacon.affil.walmart.com https://assets.sheetmusicplus.com https://www0.alibris-static.com https://*.mzstatic.com https://via.placeholder.com https://images-na.ssl-images-amazon.com/images/ https://transform.dis.commercecloud.salesforce.com https://www.google-analytics.com https://m.media-amazon.com/images/ https://www.facebook.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ajax.googleapis.com/ajax/libs/jquery/ https://cdnjs.cloudflare.com/ajax/libs/popper.js/ https://maxcdn.bootstrapcdn.com/bootstrap/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://ssl.gstatic.com https://www.googletagmanager.com/gtag/js https://www.google-analytics.com https://use.fontawesome.com/releases/ https://connect.facebook.net/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ https://maxcdn.bootstrapcdn.com/bootstrap/;frame-ancestors 'self';manifest-src 'self'"
|
|
|
75 |
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
|
|
|
76 |
Header always set Referrer-Policy "no-referrer"
|
|
|
77 |
# Only allow my site to frame itself
|
|
|
78 |
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
|
|
|
79 |
Header always set X-Frame-Options SAMEORIGIN
|
|
|
80 |
# XSS Protection
|
|
|
81 |
Header set X-XSS-Protection "1; mode=block"
|
|
|
82 |
# Redirect all non-www access to www
|
|
|
83 |
RewriteEngine On
|
|
|
84 |
RewriteCond %{HTTP_HOST} !^www\. [NC]
|
|
|
85 |
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
|
|
86 |
|
|
|
87 |
SSLEngine on
|
|
|
88 |
# intermediate configuration
|
|
|
89 |
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
|
|
|
90 |
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
|
|
91 |
SSLHonorCipherOrder off
|
|
|
92 |
|
|
|
93 |
SSLCertificateFile /etc/letsencrypt/live/dev.findcheapmusic.com/cert.pem
|
|
|
94 |
SSLCertificateKeyFile /etc/letsencrypt/live/dev.findcheapmusic.com/privkey.pem
|
|
|
95 |
SSLCertificateChainFile /etc/letsencrypt/live/dev.findcheapmusic.com/chain.pem
|
|
|
96 |
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
|
|
97 |
SSLOptions +StdEnvVars
|
|
|
98 |
</Files>
|
|
|
99 |
<Directory "/var/www/cgi-bin">
|
|
|
100 |
SSLOptions +StdEnvVars
|
|
|
101 |
</Directory>
|
|
|
102 |
SetEnvIf User-Agent ".*MSIE.*" \
|
|
|
103 |
nokeepalive ssl-unclean-shutdown \
|
|
|
104 |
downgrade-1.0 force-response-1.0
|
|
|
105 |
CustomLog logs/ssl_request_log \
|
|
|
106 |
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
|
107 |
</VirtualHost>
|
|
|
108 |
|
|
|
109 |
|
|
|
110 |
<VirtualHost *:443>
|
|
|
111 |
DocumentRoot "/var/www/archerygear"
|
|
|
112 |
ServerName www.dev.archerygearonline.com
|
|
|
113 |
ServerAlias dev.archerygearonline.com
|
|
|
114 |
|
|
|
115 |
ErrorDocument 403 /index.html
|
|
|
116 |
ErrorDocument 404 /index.html
|
|
|
117 |
|
|
|
118 |
ErrorLog logs/ssl_error_log
|
|
|
119 |
TransferLog logs/ssl_access_log
|
|
|
120 |
LogLevel warn
|
|
|
121 |
|
|
|
122 |
# HSTS (31536000 seconds = 1 year)
|
|
|
123 |
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
|
124 |
# Prevent browsers from incorrectly detecting non-scripts as scripts
|
|
|
125 |
Header always set X-Content-Type-Options nosniff
|
|
|
126 |
# Cors
|
|
|
127 |
Header always set Access-Control-Allow-Origin "*"
|
|
|
128 |
# CSP calculated by FF Addon Laboratory
|
|
|
129 |
#Header always set Content-Security-Policy "default-src 'none'; frame-src https://ws-na.amazon-adsystem.com https://www.youtube-nocookie.com; img-src 'self' data: https://www.google-analytics.com; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/js; style-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/;frame-ancestors 'self'"
|
|
|
130 |
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
|
|
|
131 |
Header always set Referrer-Policy "no-referrer"
|
|
|
132 |
# Only allow my site to frame itself
|
|
|
133 |
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
|
|
|
134 |
Header always set X-Frame-Options SAMEORIGIN
|
|
|
135 |
# XSS Protection
|
|
|
136 |
Header set X-XSS-Protection "1; mode=block"
|
|
|
137 |
# Redirect all non-www access to www
|
|
|
138 |
RewriteEngine On
|
|
|
139 |
RewriteCond %{HTTP_HOST} !^www\. [NC]
|
|
|
140 |
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
|
|
141 |
|
|
|
142 |
SSLEngine on
|
|
|
143 |
# intermediate configuration
|
|
|
144 |
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
|
|
|
145 |
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
|
|
146 |
SSLHonorCipherOrder off
|
|
|
147 |
|
|
|
148 |
SSLCertificateFile /etc/letsencrypt/live/dev.archerygearonline.com/cert.pem
|
|
|
149 |
SSLCertificateKeyFile /etc/letsencrypt/live/dev.archerygearonline.com/privkey.pem
|
|
|
150 |
SSLCertificateChainFile /etc/letsencrypt/live/dev.archerygearonline.com/chain.pem
|
|
|
151 |
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
|
|
152 |
SSLOptions +StdEnvVars
|
|
|
153 |
</Files>
|
|
|
154 |
<Directory "/var/www/cgi-bin">
|
|
|
155 |
SSLOptions +StdEnvVars
|
|
|
156 |
</Directory>
|
|
|
157 |
SetEnvIf User-Agent ".*MSIE.*" \
|
|
|
158 |
nokeepalive ssl-unclean-shutdown \
|
|
|
159 |
downgrade-1.0 force-response-1.0
|
|
|
160 |
CustomLog logs/ssl_request_log \
|
|
|
161 |
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
|
162 |
</VirtualHost>
|