ServerAdmin email-admin@MONDOMAINE.fr
CustomLog /var/log/apache2/access.log combined
ErrorLog /var/log/apache2/error.log

# Securite de base
ServerSignature Off
ServerTokens Prod
<Files ~ "test\.php|~$|\.conf|\.cf|\.bak">
Require all denied
</Files>
<Directory />
Require all denied
AllowOverride None
Options -Indexes
</Directory>

# Bloquer les acces directs sur adresse IP
<VirtualHost *:80>
ServerName a.b.c.d
ServerAlias a:b:cd::e
Redirect 403 /
ErrorDocument 403 "<h1>Forbidden</h1><p>Direct IP access not
allowed.</p>"
</VirtualHost>

# Redirection => https (Mobiles => formulaire autoconf)
<VirtualHost *:80>
ServerName mail-autoconf.MONDOMAINE.fr
Redirect "/" "https://mail-autoconf.MONDOMAINE.fr/";
</VirtualHost>

# Redirection => https (Thunderbird personnels)
<VirtualHost *:80>
ServerName autoconfig.MONDOMAINE.fr
Redirect "/" "https://autoconfig.MONDOMAINE.fr/";
</VirtualHost>

# Redirection => https (Thunderbird subdomaine)
<VirtualHost *:80>
ServerName autoconfig.subdomaine.MONDOMAINE.fr
Redirect "/" "https://autoconfig.subdomaine.MONDOMAINE.fr/";
</VirtualHost>

# Thunderbird se connecter en HTTP, mais peut suivre une redirection HTTPS
# Les clients Microsoft se connectent toujours en HTTPS

#SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling(128000)
<VirtualHost *:443>

ServerName  mail-autoconf.MONDOMAINE.fr
ServerAlias  autodiscover.MONDOMAINE.fr
ServerAlias    autoconfig.MONDOMAINE.fr
ServerAlias  autodiscover.subdomaine.MONDOMAINE.fr
ServerAlias    autoconfig.subdomaine.MONDOMAINE.fr

<IfModule mod_wsgi.c>
WSGIScriptAliasMatch (?i)^/.+/config-v1.1.xml /usr/local/lib/automx/automx_wsgi.py
WSGIScriptAliasMatch (?i)^/.+/autodiscover.xml /usr/local/lib/automx/automx_wsgi.py
WSGIScriptAliasMatch (?i)^/.+/Autodiscover.xml /usr/local/lib/automx/automx_wsgi.py
WSGIScriptAliasMatch (?i)^/mobileconfig /usr/local/lib/automx/automx_wsgi.py
<Directory "/usr/local/lib/automx">
Require all granted
</Directory>
</IfModule>

DocumentRoot /var/www/automx

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

SSLEngine On
SSLCertificateKeyFile /etc/apache2/ssl/mail-autoconf.MONDOMAINE.fr.key
SSLCertificateFile /etc/apache2/ssl/mail-autoconf.MONDOMAINE.fr.crt
SSLCertificateChainFile /etc/apache2/ssl/DigiCertCA.crt
SSLProtocol ALL -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
SSLCompression Off
#SSLUseStapling On
#SSLStaplingResponderTimeout 5
#SSLStaplingReturnResponderErrors off

</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet