################################################################################
# Epic Apache configuration.                                                   #
################################################################################

########################################
# CentOS Apache configuration root.    #
########################################
ServerRoot "/etc/httpd"

########################################
# Modules.                             #
########################################
LoadModule alias_module          modules/mod_alias.so
LoadModule authz_core_module     modules/mod_authz_core.so
LoadModule deflate_module        modules/mod_deflate.so
LoadModule headers_module        modules/mod_headers.so
LoadModule http2_module          modules/mod_http2.so
LoadModule log_config_module     modules/mod_log_config.so
LoadModule mpm_event_module      modules/mod_mpm_event.so
LoadModule php7_module           modules/libphp7-zts.so
LoadModule proxy_module          modules/mod_proxy.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
LoadModule rewrite_module        modules/mod_rewrite.so
LoadModule security2_module      modules/mod_security2.so
LoadModule setenvif_module       modules/mod_setenvif.so
LoadModule socache_shmcb_module  modules/mod_socache_shmcb.so
LoadModule ssl_module            modules/mod_ssl.so
LoadModule systemd_module        modules/mod_systemd.so
LoadModule unique_id_module      modules/mod_unique_id.so
LoadModule unixd_module          modules/mod_unixd.so

############################################################
# Logging. Requires mod_log_config.                        #
# https://httpd.apache.org/docs/2.4/mod/core.html#loglevel #
############################################################
LogLevel  info
#LogLevel debug
CustomLog /var/log/httpd/access_log "%h %t %>s %r %b"
#CustomLog /var/log/httpd/access_log "%h %t %>s %r %b %{User-agent}i"

########################################
# Run as user. Requires mod_unixd.     #
########################################
User  apache
Group apache

########################################
# Prefer HTTP2. Requires mod_http2.    #
########################################
Protocols h2

########################################
# Performance enhancements.            #
########################################
EnableSendfile       on
MaxKeepAliveRequests 512

########################################
# Compression. Requires mod_deflate.   #
########################################
DeflateCompressionLevel 9

########################################
# Enforce explicit directory allow.    #
########################################
<Directory "/">
    AllowOverride none
    Options       none
    Require       all denied
</Directory>

########################################
# Deny access to .htaccess files.      #
########################################
<Files ".htaccess">
    Require all denied
</Files>

##############################################
# Fix broken clients. Requires mod_setenvif. #
##############################################
BrowserMatch "MSIE [2-5]" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

########################################
# Security. Requires mod_security2.    #
########################################
SecAuditEngine     relevantonly
SecAuditLog        /var/log/httpd/audit_log
SecDataDir         /var/lib/mod_security
SecRuleEngine      on
SecServerSignature " "
ServerSignature    off
ServerTokens       prod
TraceEnable        off

# Setup.
#Include /usr/lib/modsecurity.d/modsecurity_crs_10_setup.conf.example
Include modsecurity.d/modsecurity_crs_10_config.conf

# Base rules.
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_20_protocol_violations.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_21_protocol_anomalies.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_23_request_limits.conf
#Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_30_http_policy.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_35_bad_robots.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_40_generic_attacks.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_41_xss_attacks.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_42_tight_security.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_45_trojans.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_47_common_exceptions.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_48_local_exceptions.conf.example
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_49_inbound_blocking.conf
#Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_50_outbound.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_59_outbound_blocking.conf
Include /usr/lib/modsecurity.d/base_rules/modsecurity_crs_60_correlation.conf

# Experimental rules.
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_11_brute_force.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_11_dos_protection.conf
#Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_11_proxy_abuse.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_11_slow_dos_protection.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_16_scanner_integration.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_25_cc_track_pan.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_40_appsensor_detection_point_2.0_setup.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_40_appsensor_detection_point_2.1_request_exception.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_40_appsensor_detection_point_2.9_honeytrap.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_40_appsensor_detection_point_3.0_end.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_40_http_parameter_pollution.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_42_csp_enforcement.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_46_scanner_integration.conf
#Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_48_bayes_analysis.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_55_response_profiling.conf
Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_56_pvi_checks.conf
#Include /usr/lib/modsecurity.d/experimental_rules/modsecurity_crs_61_ip_forensics.conf

# Optional rules.
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_10_ignore_static.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_11_avs_traffic.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_13_xml_enabler.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_16_authentication_tracking.conf
#Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_16_session_hijacking.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_16_username_tracking.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_25_cc_known.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_42_comment_spam.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_43_csrf_protection.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_46_av_scanning.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_47_skip_outbound_checks.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_49_header_tagging.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_55_application_defects.conf
Include /usr/lib/modsecurity.d/optional_rules/modsecurity_crs_55_marketing.conf

# SLR rules.
Include /usr/lib/modsecurity.d/slr_rules/modsecurity_crs_46_slr_et_xss_attacks.conf

########################################
# Encryption. Requires mod_ssl.        #
########################################
SSLCertificateFile    "/etc/letsencrypt/live/cenari.us/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/cenari.us/privkey.pem"
#SSLCipherSuite        TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
SSLCipherSuite        TLSv1.3    TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384
SSLCipherSuite        SSL        ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384
#SSLCipherSuite        TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384
#SSLCipherSuite        TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384
SSLEngine             on
SSLHonorCipherOrder   on
SSLOpenSSLConfCmd     Curves secp521r1:secp384r1:X25519
SSLProtocol           -all +TLSv1.3 +TLSv1.2
SSLRandomSeed         startup "file:/dev/urandom" 1024
SSLSessionCache       "shmcb:/run/httpd/sslcache(1048576)"
SSLSessionTickets     off
SSLStaplingCache      "shmcb:logs/stapling-cache(1048576)"
SSLUseStapling        on

########################################
# Behavioral preferences.              #
########################################
AllowEncodedSlashes NoDecode
UseCanonicalName    On

########################################
# PHP Configuration. Requires: mod_php #
########################################
PHPIniDir /dev/null
php_value max_execution_time               30
php_value max_input_time                   30
php_value memory_limit                     16M
php_value pcre.jit                         0
php_value post_max_size                    16777220
php_value upload_max_filesize              16777220
php_value session.upload_progress.freq     16384
php_value session.upload_progress.min_freq 1

##########################################################
# HTTP-to-HTTPS redirect. Requires: mod_rewrite, mod_ssl #
##########################################################
Listen 0.0.0.0:80
<VirtualHost 0.0.0.0:80>

    # Configure server name(s).
    ServerName cenari.us

    # Disable encryption.
    SSLEngine off

    # Route all requests to HTTPS equivalent.
    RewriteEngine on
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

###############################################################
# HTTPS web server. Requires: mod_mpm_*, mod_rewrite, mod_ssl #
###############################################################
Listen 0.0.0.0:443 https
<VirtualHost 0.0.0.0:443>

    # Configure server name(s).
    ServerName  cenari.us
    ServerAlias www.cenari.us

    # Execute PHP.
    <FilesMatch \.php$>
        SetHandler application/x-httpd-php
    </FilesMatch>

    # Configure working directory.
    DocumentRoot "/var/www/html"
    <Directory "/var/www/html">

        # Configure permissions.
        Options symlinksifownermatch
        Require all granted

        # Route all requests to "index.php".
        RewriteEngine  on
        RewriteRule    ^(.*)$ index.php

    </Directory>

    # Configure PhpMyAdmin
    Alias "/phpmyadmin" "/warez/xampp/phpMyAdmin"
    <Directory "/usr/share/phpmyadmin">

        # Configure permissions.
        AllowOverride  all
        Options        all
        Require        all granted

        # Route all requests to "index.php".
        RewriteEngine  on
        RewriteRule    ^(.*)$ index.php

    </Directory>

</VirtualHost>

#########################################################################
# Websocket SSL proxy. Requires: mod_proxy, mod_ssl, mod_proxy_wstunnel #
#                                                                       #
# Don't forget to run: setsebool -P httpd_can_network_connect 1         #
#########################################################################
Listen 0.0.0.0:8080
<VirtualHost 0.0.0.0:8080>

    # Enable proxy encryption.
    SSLProxyEngine on

    # Configure connection.
    ProxyPass        /  ws://127.0.0.1:8081/ retry=0 keepalive=on
    ProxyPassReverse / wss://127.0.0.1:8080/ retry=0

</VirtualHost>