May 1, 2025 update

2025-05-01 21:19:17 -07:00
parent a2cdf26594
commit b33d54d723
261 changed files with 2451 additions and 12859 deletions
--- a/jails/config/web-diyit/httpd.conf
+++ b/jails/config/web-diyit/httpd.conf
@ -178,6 +178,7 @@ LoadModule dir_module libexec/apache24/mod_dir.so
 #LoadModule userdir_module libexec/apache24/mod_userdir.so
 LoadModule alias_module libexec/apache24/mod_alias.so
 LoadModule rewrite_module libexec/apache24/mod_rewrite.so
+#LoadModule php_module         libexec/apache24/libphp.so

 # Third party modules
 IncludeOptional etc/apache24/modules.d/[0-9][0-9][0-9]_*.conf
@ -551,6 +552,14 @@ SSLRandomSeed connect builtin

 Include etc/apache24/Includes/*.conf

+# https://ssl-config.mozilla.org/#server=apache&version=2.4.60&config=intermediate&openssl=3.1.0&guideline=5.7
+
+<VirtualHost *:80>
+    RewriteEngine On
+    RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/
+    RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,QSA,L]
+</VirtualHost>
+
 <VirtualHost *:443>
    ServerName www.diyit.org
    ServerAlias *.diyit.org
@ -560,16 +569,20 @@ Include etc/apache24/Includes/*.conf

    DocumentRoot "/usr/local/www/apache24/data/"

+    # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
+    Header always set Strict-Transport-Security "max-age=63072000"
+
    SSLEngine on
-    SSLCertificateFile "/mnt/certs/diyfullchain.pem"
-    SSLCertificateKeyFile "/mnt/certs/diyprivkey.pem"
-    #SSLCertificateChainFile "/mnt/certs/diyfullchain.pem"
-    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
-    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
-    SSLHonorCipherOrder off
-    SSLSessionTickets off
-    SSLOptions +StrictRequire
-#    SSLCompression off
+    SSLCertificateFile "/mnt/certs/fullchain.pem"
+    SSLCertificateKeyFile "/mnt/certs/privkey.pem"
+#    SSLCertificateChainFile "/mnt/certs/fullchain.pem"
+    SSLCACertificateFile "/mnt/certs/cacert.pem"
+
+    SSLProtocol             -all +TLSv1.2 +TLSv1.3
+    SSLOpenSSLConfCmd       Curves X25519:prime256v1:secp384r1
+    SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
+    SSLHonorCipherOrder     off
+    SSLSessionTickets       off

    RewriteEngine On
    RewriteCond %{HTTP:Authorization} ^(.*)
--- a/jails/config/web-diyit/pkg-list-details-old.txt
+++ b/jails/config/web-diyit/pkg-list-details-old.txt
@ -1,26 +1,27 @@
-pkgp-freebsd-pkg____apache24-2.4.54
-pkgp-freebsd-pkg____bash-5.2.9
-pkgp-freebsd-pkg____bash-completion-2.11_1,2
-pkgp-freebsd-pkg____blackbox_exporter-0.22.0_3
-pkgp-freebsd-pkg____nano-6.4
-pkgp-freebsd-pkg____php81-8.1.12
-pkgp-freebsd-pkg____php81-bcmath-8.1.12
-pkgp-freebsd-pkg____php81-ctype-8.1.12
-pkgp-freebsd-pkg____php81-curl-8.1.12
-pkgp-freebsd-pkg____php81-dom-8.1.12
-pkgp-freebsd-pkg____php81-exif-8.1.12
-pkgp-freebsd-pkg____php81-fileinfo-8.1.12
-pkgp-freebsd-pkg____php81-filter-8.1.12
-pkgp-freebsd-pkg____php81-ftp-8.1.12
-pkgp-freebsd-pkg____php81-iconv-8.1.12
-pkgp-freebsd-pkg____php81-mbstring-8.1.12
-pkgp-freebsd-pkg____php81-mysqli-8.1.12
-pkgp-freebsd-pkg____php81-pecl-imagick-3.7.0
-pkgp-freebsd-pkg____php81-session-8.1.12
-pkgp-freebsd-pkg____php81-sockets-8.1.12
-pkgp-freebsd-pkg____php81-sodium-8.1.12
-pkgp-freebsd-pkg____php81-tokenizer-8.1.12
-pkgp-freebsd-pkg____php81-xml-8.1.12
-pkgp-freebsd-pkg____php81-zip-8.1.12
-pkgp-freebsd-pkg____php81-zlib-8.1.12
-pkgp-freebsd-pkg____pkg-1.18.4
+pkgp123____pkg-2.1.2
+pkgp-freebsd-pkg____apache24-2.4.63
+pkgp-freebsd-pkg____bash-5.2.37
+pkgp-freebsd-pkg____bash-completion-2.14.0,2
+pkgp-freebsd-pkg____blackbox_exporter-0.26.0_2
+pkgp-freebsd-pkg____mod_php84-8.4.6
+pkgp-freebsd-pkg____nano-8.4
+pkgp-freebsd-pkg____php84-8.4.6
+pkgp-freebsd-pkg____php84-bcmath-8.4.6
+pkgp-freebsd-pkg____php84-ctype-8.4.6
+pkgp-freebsd-pkg____php84-curl-8.4.6
+pkgp-freebsd-pkg____php84-dom-8.4.6
+pkgp-freebsd-pkg____php84-exif-8.4.6
+pkgp-freebsd-pkg____php84-fileinfo-8.4.6
+pkgp-freebsd-pkg____php84-filter-8.4.6
+pkgp-freebsd-pkg____php84-ftp-8.4.6
+pkgp-freebsd-pkg____php84-iconv-8.4.6
+pkgp-freebsd-pkg____php84-mbstring-8.4.6
+pkgp-freebsd-pkg____php84-mysqli-8.4.6
+pkgp-freebsd-pkg____php84-pecl-imagick-3.7.0_5
+pkgp-freebsd-pkg____php84-session-8.4.6
+pkgp-freebsd-pkg____php84-sockets-8.4.6
+pkgp-freebsd-pkg____php84-sodium-8.4.6
+pkgp-freebsd-pkg____php84-tokenizer-8.4.6
+pkgp-freebsd-pkg____php84-xml-8.4.6
+pkgp-freebsd-pkg____php84-zip-8.4.6
+pkgp-freebsd-pkg____php84-zlib-8.4.6
--- a/jails/config/web-diyit/pkg-list-details.txt
+++ b/jails/config/web-diyit/pkg-list-details.txt
@ -1,26 +1,27 @@
-pkgp-freebsd-pkg____apache24-2.4.54
-pkgp-freebsd-pkg____bash-5.2.12
-pkgp-freebsd-pkg____bash-completion-2.11_2,2
-pkgp-freebsd-pkg____blackbox_exporter-0.22.0_3
-pkgp-freebsd-pkg____nano-7.0
-pkgp-freebsd-pkg____php81-8.1.13
-pkgp-freebsd-pkg____php81-bcmath-8.1.13
-pkgp-freebsd-pkg____php81-ctype-8.1.13
-pkgp-freebsd-pkg____php81-curl-8.1.13
-pkgp-freebsd-pkg____php81-dom-8.1.13
-pkgp-freebsd-pkg____php81-exif-8.1.13
-pkgp-freebsd-pkg____php81-fileinfo-8.1.13
-pkgp-freebsd-pkg____php81-filter-8.1.13
-pkgp-freebsd-pkg____php81-ftp-8.1.13
-pkgp-freebsd-pkg____php81-iconv-8.1.13
-pkgp-freebsd-pkg____php81-mbstring-8.1.13
-pkgp-freebsd-pkg____php81-mysqli-8.1.13
-pkgp-freebsd-pkg____php81-pecl-imagick-3.7.0
-pkgp-freebsd-pkg____php81-session-8.1.13
-pkgp-freebsd-pkg____php81-sockets-8.1.13
-pkgp-freebsd-pkg____php81-sodium-8.1.13
-pkgp-freebsd-pkg____php81-tokenizer-8.1.13
-pkgp-freebsd-pkg____php81-xml-8.1.13
-pkgp-freebsd-pkg____php81-zip-8.1.13
-pkgp-freebsd-pkg____php81-zlib-8.1.13
-pkgp-freebsd-pkg____pkg-1.18.4
+pkgp123____pkg-2.1.2
+pkgp-freebsd-pkg____apache24-2.4.63
+pkgp-freebsd-pkg____bash-5.2.37
+pkgp-freebsd-pkg____bash-completion-2.14.0,2
+pkgp-freebsd-pkg____blackbox_exporter-0.26.0_2
+pkgp-freebsd-pkg____mod_php84-8.4.6
+pkgp-freebsd-pkg____nano-8.4
+pkgp-freebsd-pkg____php84-8.4.6
+pkgp-freebsd-pkg____php84-bcmath-8.4.6
+pkgp-freebsd-pkg____php84-ctype-8.4.6
+pkgp-freebsd-pkg____php84-curl-8.4.6
+pkgp-freebsd-pkg____php84-dom-8.4.6
+pkgp-freebsd-pkg____php84-exif-8.4.6
+pkgp-freebsd-pkg____php84-fileinfo-8.4.6
+pkgp-freebsd-pkg____php84-filter-8.4.6
+pkgp-freebsd-pkg____php84-ftp-8.4.6
+pkgp-freebsd-pkg____php84-iconv-8.4.6
+pkgp-freebsd-pkg____php84-mbstring-8.4.6
+pkgp-freebsd-pkg____php84-mysqli-8.4.6
+pkgp-freebsd-pkg____php84-pecl-imagick-3.7.0_5
+pkgp-freebsd-pkg____php84-session-8.4.6
+pkgp-freebsd-pkg____php84-sockets-8.4.6
+pkgp-freebsd-pkg____php84-sodium-8.4.6
+pkgp-freebsd-pkg____php84-tokenizer-8.4.6
+pkgp-freebsd-pkg____php84-xml-8.4.6
+pkgp-freebsd-pkg____php84-zip-8.4.6
+pkgp-freebsd-pkg____php84-zlib-8.4.6
--- a/jails/config/web-diyit/pkg-list-old.txt
+++ b/jails/config/web-diyit/pkg-list-old.txt
@ -1 +1 @@
-apache24 bash bash-completion blackbox_exporter nano php81 php81-bcmath php81-ctype php81-curl php81-dom php81-exif php81-fileinfo php81-filter php81-ftp php81-iconv php81-mbstring php81-mysqli php81-pecl-imagick php81-session php81-sockets php81-sodium php81-tokenizer php81-xml php81-zip php81-zlib pkg
+apache24 bash bash-completion blackbox_exporter mod_php84 nano php84 php84-bcmath php84-ctype php84-curl php84-dom php84-exif php84-fileinfo php84-filter php84-ftp php84-iconv php84-mbstring php84-mysqli php84-pecl-imagick php84-session php84-sockets php84-sodium php84-tokenizer php84-xml php84-zip php84-zlib pkg
--- a/jails/config/web-diyit/pkg-list.txt
+++ b/jails/config/web-diyit/pkg-list.txt
@ -1 +1 @@
-apache24 bash bash-completion blackbox_exporter nano php81 php81-bcmath php81-ctype php81-curl php81-dom php81-exif php81-fileinfo php81-filter php81-ftp php81-iconv php81-mbstring php81-mysqli php81-pecl-imagick php81-session php81-sockets php81-sodium php81-tokenizer php81-xml php81-zip php81-zlib pkg
+apache24 bash bash-completion blackbox_exporter mod_php84 nano php84 php84-bcmath php84-ctype php84-curl php84-dom php84-exif php84-fileinfo php84-filter php84-ftp php84-iconv php84-mbstring php84-mysqli php84-pecl-imagick php84-session php84-sockets php84-sodium php84-tokenizer php84-xml php84-zip php84-zlib pkg