From d86fa16cf2e05e486209233cc1dc31fde1df4688 Mon Sep 17 00:00:00 2001
From: torn <torn@autistici.org>
Date: Tue, 24 Jan 2017 17:17:19 +0100
Subject: [PATCH] File di configurazione Apache

---
 cable.conf | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 cable.conf

diff --git a/cable.conf b/cable.conf
new file mode 100644
index 0000000..2977c67
--- /dev/null
+++ b/cable.conf
@@ -0,0 +1,74 @@
+<VirtualHost *:443>
+	ServerName cable-service-ca.cable.im
+	SSLEngine On
+
+	# Su cable-service-ca.cable.im serve un certificato valido (letsencrypt).
+	# È l'hostname a cui si connette Twilio per ottenere le informazioni
+	# necessarie a fare la verifica del numero tramite chiamata vocale.
+
+	SSLCertificateFile /etc/letsencrypt/live/cable-service-ca.cable.im/cert.pem
+	SSLCertificateKeyFile /etc/letsencrypt/live/cable-service-ca.cable.im/privkey.pem
+	Include /etc/letsencrypt/options-ssl-apache.conf
+	SSLCertificateChainFile /etc/letsencrypt/live/cable-service-ca.cable.im/chain.pem
+
+	ProxyVia On
+	ProxyPreserveHost On
+	ProxyPass / http://127.0.0.1:4242/
+	ProxyPassReverse / http://127.0.0.1:4242/
+</VirtualHost>
+
+<VirtualHost *:443>
+	ServerName cable-service.cable.im
+	SSLEngine On
+
+	# Per il servizio Signal vero e proprio usiamo invece il certificato self-signed.
+	# Nel keystore del'app Android è il root certificate della nostra CA, assicurando
+	# così che l'app riconosca come validi solo i certificati emessi dalla nostra CA.
+
+	SSLCertificateFile /home/cable/certificati/whisper.crt
+	SSLCertificateKeyFile /home/cable/certificati/whisper.key
+	Include /etc/letsencrypt/options-ssl-apache.conf
+	#SSLCertificateChainFile /home/cable/certificati/whisper.crt
+
+	# Per proxare websocket (ws://) serve questa roba:
+	#
+	# https://httpd.apache.org/docs/2.4/mod/mod_proxy_wstunnel.html
+
+	ProxyVia On
+	ProxyPreserveHost On
+	ProxyPass / ws://127.0.0.1:4242/
+	ProxyPassReverse / ws://127.0.0.1:4242/
+</VirtualHost>
+
+<VirtualHost *:80>
+	ServerName giphy.com
+	ServerAlias *.giphy.com
+	ProxyRequests On
+	ProxyVia Block
+	ProxyPreserveHost On
+
+	## The AllowConnect directive specifies a list of ports
+	## to which the proxy CONNECT method may connect.
+	AllowConnect 443
+
+	## Only ever allow incoming HTTP CONNECT requests.
+	## Explicitly deny other request types like GET, POST, etc.
+	## This tells Apache to return a 403 Forbidden if this virtual
+	## host receives anything other than an HTTP CONNECT.
+	<Location />
+		<LimitExcept CONNECT>
+			Order allow,deny
+			Deny from all
+		</LimitExcept>
+	</Location>
+
+	<Proxy *>
+		Order allow,deny
+		Deny from all
+	</Proxy>
+
+	<Proxy "*.giphy.com:443">
+		Allow from all
+	</Proxy>
+</VirtualHost>
+