# {{ ansible_managed }}
# create virtual hosts for NTLM 
{%- set is_require = 0 %}
{%- if ansible_distribution == 'CentOS' and ansible_distribution_major_version == '7' %}
{%- set is_require = 1 %}
{% endif %}

<IfModule !auth_ntlm_winbind_module.c>
	LoadModule auth_ntlm_winbind_module modules/mod_auth_ntlm_winbind.so
</IfModule>

Listen {{ ntlm_http_port }}
Listen {{ ntlm_https_port }}

<IfModule !ssl_module.c>
	LoadModule ssl_module modules/mod_ssl.so
    {% if is_require > 0 %}
    # httpd 2.4
    LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
	SSLSessionCache			shmcb:/var/cache/httpd/ssl/scache(512000)

    {% else %}
    # httpd 2.2
    SSLMutex                default
	SSLSessionCache			shmcb:/var/cache/mod_ssl/scache(512000)

    {% endif %}

	SSLPassPhraseDialog		builtin
	SSLSessionCacheTimeout	300
	SSLRandomSeed startup file:/dev/urandom  256
	SSLRandomSeed connect builtin
	SSLCryptoDevice builtin
    SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
    SSLProtocol All -SSLv2 -SSLv3
</IfModule>

# {{ ansible_managed }}
# create virtual hosts for NTLM 
# site: {{ item.SiteName }}
#
{%- set is_require = 0 %}
{%- if ansible_distribution == 'CentOS' and ansible_distribution_major_version == '7' %}
{%- set is_require = 1 %}
{% endif %}

<VirtualHost *:{{ ntlm_http_port }}>

    ServerAdmin webmaster@localhost
    ServerName {{ item.ServerName }}
    ServerAlias *.{{ item.ServerName }}
	DocumentRoot {{ item.DocumentRoot }}
	KeepAlive On

	# Possible values include: debug, info, notice, warn, error, crit, alert, emerg.
	LogLevel warn
	ErrorLog logs/{{ item.SiteShort }}_error_log
    #CustomLog logs/{{ item.SiteShort }}_access_log combined
    #

    {% if item.SiteCharset == 'windows-1251' -%}
    # configure {{ item.SiteCharset }}
    php_admin_value mbstring.internal_encoding cp1251
    php_admin_value mbstring.func_overload 0
    php_admin_value default_charset cp1251
    {% endif %}

    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>

    <DirectoryMatch .*\.(svn|git|hg)/.*>
    {% if is_require > 0 -%}
        Require all denied
    {% else -%}
        Deny From All
    {% endif %}
    </DirectoryMatch>

    <DirectoryMatch {{ item.DocumentRoot }}/bitrix/(cache|managed_cache|local_cache|stack_cache)>
        AllowOverride none
        AddType text/plain php,php3,php4,php5,php6,phtml,pl,asp,aspx,cgi,dll,exe,ico,shtm,shtml,fcg,fcgi,fpl,asmx,pht
        php_value engine off
    </DirectoryMatch>

    <DirectoryMatch {{ item.DocumentRoot }}/(upload|bitrix/images|bitrix/tmp)>
        AllowOverride none
        AddType text/plain php,php3,php4,php5,php6,phtml,pl,asp,aspx,cgi,dll,exe,ico,shtm,shtml,fcg,fcgi,fpl,asmx,pht
        php_value engine off
    </DirectoryMatch>

	<Directory {{ item.DocumentRoot }}/>
		Options FollowSymLinks MultiViews
		AllowOverride All
		DirectoryIndex index.php index.html index.htm

		AuthName "NTLM Authentication thingy"
		NTLMAuth on
		NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
		NTLMBasicAuthoritative on
		AuthType NTLM
		Require valid-user

		php_admin_value session.save_path {{ item.phpSessionDir }}
		php_admin_value upload_tmp_dir {{ item.phpUploadDir }}
	</Directory>

    <Directory {{ item.DocumentRoot }}/upload/support/not_image>
        AllowOverride none
        {% if is_require > 0 -%}
            Require all denied
        {% else -%}
            Order allow,deny
            Deny from all
        {% endif %}
    </Directory>

</VirtualHost>

{% if item.HTTPSConf != '' -%}
<VirtualHost *:{{ ntlm_https_port }}>
	ServerAdmin webmaster@localhost
    ServerName {{ item.ServerName }}
    ServerAlias *.{{ item.ServerName }}
	DocumentRoot {{ item.DocumentRoot }}
	KeepAlive On
  
	# Possible values include: debug, info, notice, warn, error, crit, alert, emerg.
	LogLevel warn
	ErrorLog logs/{{ item.SiteShort }}_error_log
  #CustomLog logs/{{ item.SiteShort }}_access_log combined

	SSLEngine on
	SSLProtocol all -SSLv2
	SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
    # CERTIFICATE ANSIBLE MANAGED BLOCK
	SSLCertificateFile {{ item.HTTPSCert }}
	SSLCertificateKeyFile {{ item.HTTPSPriv }}
    # CERTIFICATE ANSIBLE MANAGED BLOCK

    {% if item.SiteCharset == 'windows-1251' -%}
    # configure {{ item.SiteCharset }}
    php_admin_value mbstring.internal_encoding cp1251
    php_admin_value default_charset cp1251
    {% endif %}


    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>

    <DirectoryMatch .*\.(svn|git|hg)/.*>
    {% if is_require > 0 -%}
        Require all denied
    {% else -%}
        Deny From All
    {% endif %}
    </DirectoryMatch>

    <DirectoryMatch {{ item.DocumentRoot }}/bitrix/(cache|managed_cache|local_cache|stack_cache)>
        AllowOverride none
        AddType text/plain php,php3,php4,php5,php6,phtml,pl,asp,aspx,cgi,dll,exe,ico,shtm,shtml,fcg,fcgi,fpl,asmx,pht
        php_value engine off
    </DirectoryMatch>

    <DirectoryMatch {{ item.DocumentRoot }}/(upload|bitrix/images|bitrix/tmp)>
        AllowOverride none
        AddType text/plain php,php3,php4,php5,php6,phtml,pl,asp,aspx,cgi,dll,exe,ico,shtm,shtml,fcg,fcgi,fpl,asmx,pht
        php_value engine off
    </DirectoryMatch>

	<Directory {{ item.DocumentRoot }}/>
		Options FollowSymLinks MultiViews
		AllowOverride All
		DirectoryIndex index.php index.html index.htm

		AuthName "NTLM Authentication thingy"
		NTLMAuth on
		NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
		NTLMBasicAuthoritative on
		AuthType NTLM
		Require valid-user

		php_admin_value session.save_path {{ item.phpSessionDir }}
		php_admin_value upload_tmp_dir {{ item.phpUploadDir }}
	</Directory>

    <Directory {{ item.DocumentRoot }}/upload/support/not_image>
        AllowOverride none
        {% if is_require > 0 -%}
            Require all denied
        {% else -%}
            Order allow,deny
            Deny from all
        {% endif %}
    </Directory>
</VirtualHost>
{%- endif %}