docs: updated nginx/apache configurations.

- websocket/channelstream configuration
- updated Apache to be as close as possible to Nginx config.

docs/admin/apache-conf-example.rst

@@ -1,114 +1,87 b''
 .. _apache-conf-eg:
 
-Apache Configuration Examples
------------------------------
+Apache Configuration Example
+----------------------------
+
+Use the following example to configure Apache as a your web server.
+Below config if for an Apache Reverse Proxy configuration.
+
+.. note::
+
+   Apache requires the following modules to be enabled. Below is an example
+   how to enable them on Ubuntu Server
+
 
-Use the following example to securely configure your Apache HTTP virtual hosts
-file.
+.. code-block:: bash
+
+    $ sudo a2enmod proxy
+    $ sudo a2enmod proxy_http
+    $ sudo a2enmod proxy_balancer
+    $ sudo a2enmod headers
+    $ sudo a2enmod ssl
+    $ sudo a2enmod rewrite
+
+    # requires Apache 2.4+, required to handle websockets/channelstream
+    $ sudo a2enmod proxy_wstunnel
+
 
 .. code-block:: apache
 
+    ## HTTP to HTTPS rewrite
     <VirtualHost *:80>
-        ServerName hg.myserver.com
-        ServerAlias hg.myserver.com
+       ServerName rhodecode.myserver.com
+       DocumentRoot /var/www/html
+       Redirect permanent / https://rhodecode.myserver.com/
+    </VirtualHost>
+
+    ## MAIN SSL enabled server
+    <VirtualHost *:443>
+
+        ServerName rhodecode.myserver.com
+        ServerAlias rhodecode.myserver.com
+
+        ## serve static files by Apache, recommended for performance
+        #Alias /_static /home/ubuntu/.rccontrol/community-1/static
+
+        RequestHeader set X-Forwarded-Proto "https"
+
+        ## channelstream websocket handling
+        ProxyPass /_channelstream ws://localhost:9800
+        ProxyPassReverse /_channelstream ws://localhost:9800
 
         <Proxy *>
           Order allow,deny
           Allow from all
         </Proxy>
 
-        # important !
-        # Directive to properly generate url (clone url) for pylons
-
+        # Directive to properly generate url (clone url) for RhodeCode
         ProxyPreserveHost On
 
-        #rhodecode instance
-        ProxyPass / http://127.0.0.1:5000/
-        ProxyPassReverse / http://127.0.0.1:5000/
+        # Url to running RhodeCode instance. This is shown as `- URL:` when
+        # running rccontrol status.
+        ProxyPass / http://127.0.0.1:10002/
+        ProxyPassReverse / http://127.0.0.1:10002/
 
-        # Set strict HTTPS
+        # strict http prevents from https -> http downgrade
         Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
 
         # Set x-frame options
         Header always append X-Frame-Options SAMEORIGIN
 
         # To enable https use line below
         # SetEnvIf X-Url-Scheme https HTTPS=1
 
-        # Secure your Diffie-hellmann deployment
+        # SSL setup
+        SSLEngine On
+        SSLCertificateFile /etc/apache2/ssl/rhodecode.myserver.pem
+        SSLCertificateKeyFile /etc/apache2/ssl/rhodecode.myserver.key
+
         SSLProtocol             all -SSLv2 -SSLv3
         SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
         SSLHonorCipherOrder     on
-        SSLOpenSSLConfCmd DHParameters "{path to dhparams.pem}"
+
+        # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+        #SSLOpenSSLConfCmd DHParameters "/etc/apache2/dhparam.pem"
 
     </VirtualHost>
 
-Use the following example to configure Apache for a multi-node setup. The
-timeout setting should be increased if you experience timeouts when working
-with large |repos|.
-
-.. code-block:: apache
-
-    #
-    # Timeout: The number of seconds before receives and sends time out.
-    #
-    Timeout 600
-
-    <VirtualHost *:80>
-
-            ProxyRequests off
-
-            #important !
-            #Directive to properly generate url (clone url) for pylons
-            ProxyPreserveHost On
-
-            ServerName your.rce.com
-            ServerAlias your.rce.com
-
-            <Proxy balancer://mycluster>
-                    # WebHead1
-                    BalancerMember http://10.58.1.171:10002 route=1
-                    # WebHead2
-                    BalancerMember http://10.58.1.172:10001 route=2
-
-                    # Security "technically we aren't blocking
-                    # anyone but this the place to make those
-                    # chages
-                    Order Deny,Allow
-                    Deny from none
-                    Allow from all
-
-                    # Load Balancer Settings
-                    # We will be configuring a simple Round
-                    # Robin style load balancer. This means
-                    # that all webheads take an equal share of
-                    # of the load.
-                    ProxySet stickysession=ROUTEID
-
-            </Proxy>
-
-            # balancer-manager
-            # This tool is built into the mod_proxy_balancer
-            # module and will allow you to do some simple
-            # modifications to the balanced group via a gui
-            # web interface.
-            <Location /balancer-manager>
-                    SetHandler balancer-manager
-
-                    # recommend locking this one down to your
-                    # your office
-                   Order deny,allow
-                    Allow from all
-            </Location>
-
-            # Point of Balance
-            # This setting will allow to explicitly name the
-            # the location in the site that we want to be
-            # balanced, in this example we will balance "/"
-            # or everything in the site.
-            ProxyPass /balancer-manager !
-            ProxyPass / balancer://mycluster/
-
-            ProxyPassReverse / balancer://mycluster/
-
-    </VirtualHost>

docs/admin/apache-config.rst

@@ -1,15 +1,14 b''
 .. _apache-ws-ref:
 
 Apache HTTP Server Configuration
 --------------------------------
 
 To set up your Apache Web Server for optimal performance and security, use
 the information in the following sections.
 
 .. toctree::
 
    apache-diffie-hellman
-   apache-conf-examples
+   apache-conf-example
    apache-subdirectory
-   apache-reverse-proxy
    apache-wsgi-coding

docs/admin/apache-subdirectory.rst

@@ -1,34 +1,35 b''
 .. _apache-sub-ref:
 
 Apache URL Prefix Configuration
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Use the following example to configure Apache to use a URL prefix.
 
 .. code-block:: apache
 
-    <Location /<someprefix>/ # Change <someprefix> into your chosen prefix
+    # Change someprefix into your chosen prefix
+    <Location /someprefix >
       ProxyPreserveHost On
       ProxyPass "http://127.0.0.1:5000/"
       ProxyPassReverse "http://127.0.0.1:5000/"
       Header set X-Url-Scheme https env=HTTPS
     </Location>
 
 In addition to the regular Apache setup you will need to add the following
 lines into the ``rhodecode.ini`` file.
 
 * Above ``[app:main]`` section of the ``rhodecode.ini`` file add the
   following section if it doesn't exist yet.
 
 .. code-block:: ini
 
     [filter:proxy-prefix]
     use = egg:PasteDeploy#prefix
     prefix = /<someprefix> # Change <someprefix> into your chosen prefix
 
 * In the the ``[app:main]`` section of your ``rhodecode.ini`` file add the
   following line.
 
 .. code-block:: ini
 
     filter-with = proxy-prefix

docs/admin/nginx-config-example.rst

@@ -1,120 +1,125 b''
 Nginx Configuration Example
 ---------------------------
 
 Use the following example to configure Nginx as a your web server.
 
+
 .. code-block:: nginx
 
     log_format log_custom '$remote_addr - $remote_user [$time_local] '
                           '"$request" $status $body_bytes_sent '
                           '"$http_referer" "$http_user_agent" '
                           '$request_time $upstream_response_time $pipe';
 
+    ## define upstream (local RhodeCode instance) to connect to
     upstream rc {
-
+        # Url to running RhodeCode instance.
+        # This is shown as `- URL:` in output from rccontrol status.
         server 127.0.0.1:10002;
 
         # add more instances for load balancing
         # server 127.0.0.1:10003;
         # server 127.0.0.1:10004;
     }
 
-    ## gist alias server, for serving nicer GIST urls
+    ## HTTP to HTTPS rewrite
+    server {
+        listen          80;
+        server_name     rhodecode.myserver.com;
 
+        if ($http_host = rhodecode.myserver.com) {
+            rewrite  (.*)  https://rhodecode.myserver.com$1 permanent;
+        }
+    }
+
+    ## Optional gist alias server, for serving nicer GIST urls.
     server {
         listen          443;
         server_name     gist.myserver.com;
         access_log      /var/log/nginx/gist.access.log log_custom;
         error_log       /var/log/nginx/gist.error.log;
 
         ssl on;
         ssl_certificate     gist.rhodecode.myserver.com.crt;
         ssl_certificate_key gist.rhodecode.myserver.com.key;
 
         ssl_session_timeout 5m;
 
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
         ssl_prefer_server_ciphers on;
         ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 
+        # strict http prevents from https -> http downgrade
         add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
 
         # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
         #ssl_dhparam /etc/nginx/ssl/dhparam.pem;
 
         rewrite ^/(.+)$ https://rhodecode.myserver.com/_admin/gists/$1;
         rewrite (.*)    https://rhodecode.myserver.com/_admin/gists;
     }
 
-    ## HTTP to HTTPS rewrite
-    server {
-        listen          80;
-        server_name     rhodecode.myserver.com;
-
-        if ($http_host = rhodecode.myserver.com) {
-            rewrite  (.*)  https://rhodecode.myserver.com$1 permanent;
-        }
-    }
 
     ## MAIN SSL enabled server
     server {
         listen       443 ssl;
         server_name  rhodecode.myserver.com;
 
         access_log   /var/log/nginx/rhodecode.access.log log_custom;
         error_log    /var/log/nginx/rhodecode.error.log;
 
         ssl on;
         ssl_certificate     rhodecode.myserver.com.crt;
         ssl_certificate_key rhodecode.myserver.com.key;
 
         ssl_session_timeout 5m;
 
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
         ssl_prefer_server_ciphers on;
         ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 
         # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
         #ssl_dhparam /etc/nginx/ssl/dhparam.pem;
 
         include     /etc/nginx/proxy.conf;
 
-        ## serve static files by nginx, recommended
+        ## serve static files by Nginx, recommended for performance
         # location /_static/rhodecode {
         #    alias /path/to/.rccontrol/enterprise-1/static;
         # }
 
-        ## channel stream live components
+        ## channelstream websocket handling
         location /_channelstream {
             rewrite /_channelstream/(.*) /$1 break;
+
             proxy_pass                  http://127.0.0.1:9800;
 
             proxy_connect_timeout        10;
             proxy_send_timeout           10m;
             proxy_read_timeout           10m;
             tcp_nodelay                  off;
             proxy_set_header             Host $host;
             proxy_set_header             X-Real-IP $remote_addr;
             proxy_set_header             X-Url-Scheme $scheme;
             proxy_set_header             X-Forwarded-Proto $scheme;
             proxy_set_header             X-Forwarded-For $proxy_add_x_forwarded_for;
             gzip                         off;
             proxy_http_version           1.1;
             proxy_set_header Upgrade     $http_upgrade;
             proxy_set_header Connection  "upgrade";
         }
 
         location / {
             try_files $uri @rhode;
         }
 
         location @rhode {
             proxy_pass      http://rc;
         }
 
         ## custom 502 error page
         error_page 502 /502.html;
         location = /502.html {
            root  /path/to/.rccontrol/enterprise-1/static;
         }
     }
  No newline at end of file

docs/admin/nginx-config.rst

@@ -1,14 +1,14 b''
 .. _nginx-ws-ref:
 
-Nginx Configuration
-===================
+Nginx HTTP Server Configuration
+-------------------------------
 
 To set up your Nginx Web Server for optimal performance and security, use
 the information in the following sections.
 
 .. toctree::
 
    nginx-diffie-hellman
    nginx-config-example
    nginx-tuning
    nginx-url-prefix