Is it okay to modify /etc/httpd/conf.d/ipa-rewrite.conf in order to put the WebGUI behind a Loadbalancer? Or will it break something I am not aware of?
Modified version looks like this:
# VERSION 7 - DO NOT REMOVE THIS LINE
RewriteEngine on
RequestHeader edit Referer ^https://ipa%5C.linux%5C.mydomain%5C.at/ https://pipa08.linux.mydomain.at/
# By default forward all requests to /ipa. If you don't want IPA # to be the default on your web server comment this line out. #RewriteRule ^/$ https://pipa08.linux.mydomain.at/ipa/ui [L,NC,R=301]
# Redirect to the fully-qualified hostname. Not redirecting to secure # port so configuration files can be retrieved without requiring SSL. #RewriteCond %{HTTP_HOST} !^pipa08.linux.mydomain.at$ [NC] #RewriteCond %{HTTP_HOST} !^ipa-ca.linux.mydomain.at$ [NC] #RewriteRule ^/ipa/(.*) http://pipa08.linux.mydomain.at/ipa/$1 [L,R=301]
# Redirect to the secure port if not displaying an error or retrieving # configuration. #RewriteCond %{SERVER_PORT} !^443$ #RewriteCond %{REQUEST_URI} !^/ipa/(errors|config|crl) #RewriteCond %{REQUEST_URI} !^/ipa/[^?]+(.js|.css|.png|.gif|.ico|.woff|.svg|.ttf|.eot)$ #RewriteRule ^/ipa/(.*) https://pipa08.linux.mydomain.at/ipa/$1 [L,R=301,NC]
RewriteCond %{HTTP_HOST} ^ipa-ca.linux.mydomain.at$ [NC] RewriteCond %{REQUEST_URI} !^/ipa/crl RewriteCond %{REQUEST_URI} !^/(ca|kra|pki|acme) RewriteRule ^/(.*) https://pipa08.linux.mydomain.at/$1 [L,R=301]
# Rewrite for plugin index, make it like it's a static file RewriteRule ^/ipa/ui/js/freeipa/plugins.js$ /ipa/wsgi/plugins.py [PT]
Ronald Wimmer via FreeIPA-users wrote:
Is it okay to modify /etc/httpd/conf.d/ipa-rewrite.conf in order to put the WebGUI behind a Loadbalancer? Or will it break something I am not aware of?
It is safe to change this but keep a separate copy with your modifications.
The VERSION line is used to determine when the template needs to be re-applied by upgrades. If it is not present then the upgrader assumes it is version 0 and re-applies the template, so don't remove it.
We haven't made a ton of changes to this template over the years but if/when we do the VERSION will be increased and the file will be re-written, losing your custom changes.
So it will need to be part of your upgrade process to re-verify this file against your expected changes.
rob
Modified version looks like this:
# VERSION 7 - DO NOT REMOVE THIS LINE RewriteEngine on
RequestHeader edit Referer ^https://ipa%5C.linux%5C.mydomain%5C.at/ https://pipa08.linux.mydomain.at/
# By default forward all requests to /ipa. If you don't want IPA # to be the default on your web server comment this line out. #RewriteRule ^/$ https://pipa08.linux.mydomain.at/ipa/ui [L,NC,R=301]
# Redirect to the fully-qualified hostname. Not redirecting to secure # port so configuration files can be retrieved without requiring SSL. #RewriteCond %{HTTP_HOST} !^pipa08.linux.mydomain.at$ [NC] #RewriteCond %{HTTP_HOST} !^ipa-ca.linux.mydomain.at$ [NC] #RewriteRule ^/ipa/(.*) http://pipa08.linux.mydomain.at/ipa/$1 [L,R=301]
# Redirect to the secure port if not displaying an error or retrieving # configuration. #RewriteCond %{SERVER_PORT} !^443$ #RewriteCond %{REQUEST_URI} !^/ipa/(errors|config|crl) #RewriteCond %{REQUEST_URI} !^/ipa/[^?]+(.js|.css|.png|.gif|.ico|.woff|.svg|.ttf|.eot)$ #RewriteRule ^/ipa/(.*) https://pipa08.linux.mydomain.at/ipa/$1 [L,R=301,NC]
RewriteCond %{HTTP_HOST} ^ipa-ca.linux.mydomain.at$ [NC] RewriteCond %{REQUEST_URI} !^/ipa/crl RewriteCond %{REQUEST_URI} !^/(ca|kra|pki|acme) RewriteRule ^/(.*) https://pipa08.linux.mydomain.at/$1 [L,R=301]
# Rewrite for plugin index, make it like it's a static file RewriteRule ^/ipa/ui/js/freeipa/plugins.js$ /ipa/wsgi/plugins.py [PT]
freeipa-users@lists.fedorahosted.org