ucdlib-keycloak/apache-example.conf at main · UCDavisLibrary/ucdlib-keycloak · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
<VirtualHost *:80>
  ServerName sandbox.auth.library.ucdavis.edu
  Redirect permanent / https://sandbox.auth.library.ucdavis.edu/
</VirtualHost>
<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerName sandbox.auth.library.ucdavis.edu

    <Location "/admin">
        Require ip 172.19.19.0/24 169.237.102.0/26 169.237.102.128/25
    </Location>
    <Location "/js">
        Require ip 172.19.19.0/24 169.237.102.0/26 169.237.102.128/25
    </Location>
    <Location "/welcome">
        Require ip 172.19.19.0/24 169.237.102.0/26 169.237.102.128/25
    </Location>
    <Location "/metrics">
        Require ip 172.19.19.0/24 169.237.102.0/26 169.237.102.128/25
    </Location>
    <Location "/health">
        Require ip 172.19.19.0/24 169.237.102.0/26 169.237.102.128/25
    </Location>

    ProxyPreserveHost On
    ProxyRequests Off
    RequestHeader set x-forwarded-proto "https"
    RequestHeader set x-forwarded-host "sandbox.auth.library.ucdavis.edu"
    RequestHeader set x-ssl-client-cert "%{SSL_CLIENT_CERT}s"

    ProxyPass / http://localhost:3123/
    ProxyPassReverse / http://localhost:3123/

    SSLEngine on
    SSLCertificateFile	/etc/ssl/certs/auth_library_ucdavis_edu_cert.pem
    SSLCertificateKeyFile /etc/pki/tls/private/auth.library.ucdavis.edu.key

  </VirtualHost>
</IfModule>