doc: reverse proxy: update HTTP->HTTPS redirect configuration, remove logging options

[github/shaarli/Shaarli.git] / doc / md / Server-configuration.md

diff --git a/doc/md/Server-configuration.md b/doc/md/Server-configuration.md
index d32cc786cd852467ce83ee8087ded450e5a0ca03..c1cf43103d86189e57b3a14aa5740f2544c843cd 100644 (file)
--- a/doc/md/Server-configuration.md
+++ b/doc/md/Server-configuration.md
@@ -1,7 +1,5 @@
 # Server configuration
 
-
-
 ## Requirements
 
 ### Operating system and web server
@@ -24,6 +22,7 @@ Setup a **firewall** (using `iptables`, [ufw](https://www.digitalocean.com/commu
 
 Shaarli makes outbound HTTP/HTTPS connections to websites you bookmark to fetch page information (title, thumbnails), the server must then have access to the Internet as well, and a working DNS resolver.
 
+--------------------------------------------------------------------------------
 
 ### PHP
 
@@ -128,20 +127,22 @@ sudo nano /etc/apache2/sites-available/shaarli.mydomain.org.conf
     ServerName shaarli.mydomain.org
     DocumentRoot /var/www/shaarli.mydomain.org/
 
-    # Redirect HTTP requests to HTTPS
+    # Redirect HTTP requests to HTTPS, except Let's Encrypt ACME challenge requests
     RewriteEngine on
     RewriteRule ^.well-known/acme-challenge/ - [L]
-    # except for Let's Encrypt ACME challenge requests
     RewriteCond %{HTTP_HOST} =shaarli.mydomain.org
     RewriteRule  ^ https://shaarli.mydomain.org%{REQUEST_URI} [END,NE,R=permanent]
+    # If you are using mod_md, use this instead
+    #MDCertificateAgreement accepted
+    #MDContactEmail admin@shaarli.mydomain.org
+    #MDPrivateKeys RSA 4096
 </VirtualHost>
 
 <VirtualHost *:443>
     ServerName   shaarli.mydomain.org
     DocumentRoot /var/www/shaarli.mydomain.org/
 
-    # SSL/TLS configuration (for Let's Encrypt certificates)
-    # If certificates were acquired from certbot standalone
+    # SSL/TLS configuration for Let's Encrypt certificates acquired with certbot standalone
     SSLEngine             on
     SSLCertificateFile    /etc/letsencrypt/live/shaarli.mydomain.org/fullchain.pem
     SSLCertificateKeyFile /etc/letsencrypt/live/shaarli.mydomain.org/privkey.pem
@@ -152,6 +153,9 @@ sudo nano /etc/apache2/sites-available/shaarli.mydomain.org.conf
     SSLSessionTickets       off
     SSLOptions +StrictRequire
 
+    # SSL/TLS configuration for Let's Encrypt certificates acquired with mod_md
+    #MDomain shaarli.mydomain.org
+
     # SSL/TLS configuration (for self-signed certificates)
     #SSLEngine             on
     #SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
@@ -397,6 +401,8 @@ maxretry = 3
 bantime = -1
 ```
 
+Then restart the service: `sudo systemctl restart fail2ban`
+
 #### References
 
 - [Apache/PHP - error log per VirtualHost - StackOverflow](http://stackoverflow.com/q/176)