dak/config/debian-security/apache.conf

# push changes with: sudo apache2-vhost-update security-master.debian.org

BrowserMatch ExtractorPro spammer
BrowserMatch EmailSiphon spammer

<Macro SecurityMasterConfiguration>
  ServerName security-master.debian.org
  ServerAdmin team@security.debian.org

  DocumentRoot /srv/security-master.debian.org/htdocs-security-master
  <Directory /srv/security-master.debian.org/htdocs-security-master>
    Require all granted
  </Directory>

  ErrorLog /var/log/apache2/security-master.debian.org-error.log
  CustomLog /var/log/apache2/security-master.debian.org-access.log combined
  LogLevel warn

  RewriteEngine on
  RewriteRule ^/$      https://www.debian.org/security/
</Macro>

<VirtualHost *:80>
  Use SecurityMasterConfiguration
  # TODO implement http to https redirection
</VirtualHost>

<VirtualHost *:443>
  Use SecurityMasterConfiguration
  Use common-debian-service-ssl security-master.debian.org
  Use common-ssl-HSTS
  Use http-pkp-security-master.debian.org

  Alias /debian-security /srv/security.debian.org/archive/debian-security/
  Alias /debian-security-buildd /srv/security-master.debian.org/buildd/debian-security-buildd/

  <LocationMatch "^/(debian-security|debian-security-buildd)/">
    Use DebianBuilddHostList

    # ftp-master.d.o; for code-signing service
    Require ip 192.91.235.231

    # whitelisted for Joerg Jaspert
    Require ip 78.46.40.15
    Require ip 2001:4dd0:ff00:df::2
    Require ip 213.146.108.162
    Require ip 2a01:198:5d0:0:21c:c0ff:fead:e3a3

    # Proxy node of ci.debian.net for autopkgtesting the embargoed queue
    Require ip 52.34.117.196

#    AuthName "security.debian.org"
#    AuthType Basic
#    AuthUserFile /srv/security-master.debian.org/apache.htpasswd
#    Require valid-user

  </LocationMatch>
</VirtualHost>