[Git][debian-edu/debian-edu-config][mr/implement-apache2-update-allowlist] Rename Apache2 host allowlist to TJENER alias map.

Daniel Teichmann pushed to branch mr/implement-apache2-update-allowlist at Debian Edu / debian-edu-config


Commits:
7edfcae0 by Daniel Teichmann at 2026-08-18T10:02:28+02:00
Rename Apache2 host allowlist to TJENER alias map.

Avoid confusion with Debian Edu hosts (devices). The map lists
HTTP Host header values that refer to TJENER, not client machines.

Also document the timer as 15 minutes after boot, then daily, and
add the author email to debian-edu-apache2-update-tjener-aliases.

- - - - -


8 changed files:

- Makefile
- debian/debian-edu-config.cron.daily
- debian/debian-edu-config.debian-edu-apache2-update-allowlist.service → debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service
- debian/debian-edu-config.debian-edu-apache2-update-allowlist.timer → debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer
- debian/rules
- etc/apache2/sites-available/debian-edu-default.conf
- libexec/debian-edu-apache2-update-allowlist → libexec/debian-edu-apache2-update-tjener-aliases
- share/debian-edu-config/apache2_host-allowlist.map → share/debian-edu-config/apache2_tjener-aliases.map


Changes:

=====================================
Makefile
=====================================
@@ -22,7 +22,7 @@ SPROGS = \
 	$(NULL)
 
 LIBEXECPROGS = \
-	debian-edu-apache2-update-allowlist \
+	debian-edu-apache2-update-tjener-aliases \
 	debian-edu-cups-queue-autoflush-for-netgroup-hosts \
 	debian-edu-cups-queue-autoreenable-for-netgroup-hosts \
 	debian-edu-fsautoresize-for-netgroup-hosts \
@@ -361,7 +361,7 @@ install: install-testsuite
 	$(INSTALL_DATA) sbin/debian-edu-fsautoresizetab $(DESTDIR)/usr/share/debian-edu-config/fsautoresizetab
 
 	set -e ; for f in \
-		share/debian-edu-config/apache2_host-allowlist.map \
+		share/debian-edu-config/apache2_tjener-aliases.map \
 		share/debian-edu-config/avahi.smb.service \
 		share/debian-edu-config/rsyslog-collector \
 		share/debian-edu-config/rsyslog-filters \


=====================================
debian/debian-edu-config.cron.daily
=====================================
@@ -10,7 +10,7 @@ if [ -x /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgr
 	exec /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts
 fi
 
-# regularly run Apache2 allowlist update if the script is present
-if [ -x /usr/libexec/debian-edu-config/debian-edu-apache2-update-allowlist ]; then
-	exec /usr/libexec/debian-edu-config/debian-edu-apache2-update-allowlist
+# regularly update Apache2 TJENER alias map if the script is present
+if [ -x /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases ]; then
+	exec /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
 fi


=====================================
debian/debian-edu-config.debian-edu-apache2-update-allowlist.service → debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service
=====================================
@@ -1,6 +1,6 @@
 [Unit]
-Description=Update Apache2 allowlist at /usr/share/debian-edu-config/apache2_host-allowlist.map
+Description=Update Apache2 TJENER alias map at /usr/share/debian-edu-config/apache2_tjener-aliases.map
 
 [Service]
 Type=oneshot
-ExecStart=/usr/libexec/debian-edu-config/debian-edu-apache2-update-allowlist
+ExecStart=/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases


=====================================
debian/debian-edu-config.debian-edu-apache2-update-allowlist.timer → debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer
=====================================
@@ -1,5 +1,5 @@
 [Unit]
-Description=Run debian-edu-apache2-update-allowlist.service every day.
+Description=Run debian-edu-apache2-update-tjener-aliases.service 15 minutes after boot and then once a day.
 
 [Timer]
 OnBootSec=15min


=====================================
debian/rules
=====================================
@@ -23,7 +23,7 @@ override_dh_installsystemd:
 	dh_installsystemd --no-start --name firefox-ldapconf
 	dh_installsystemd --no-start --name debian-edu-fsautoresize
 	dh_installsystemd --no-start --name debian-edu-update-netblock
-	dh_installsystemd --no-start --name debian-edu-apache2-update-allowlist
+	dh_installsystemd --no-start --name debian-edu-apache2-update-tjener-aliases
 	dh_installsystemd --no-start --name debian-edu-cups-queue-autoflush
 	dh_installsystemd --no-start --name debian-edu-cups-queue-autoreenable
 


=====================================
etc/apache2/sites-available/debian-edu-default.conf
=====================================
@@ -4,32 +4,32 @@
 
 	DocumentRoot /etc/debian-edu/www/
 
-# ---- <Host-Based Redirection Logic> ----
+# ---- <TJENER-alias redirect logic> ----
 	UseCanonicalName On
 
 	RewriteEngine On
-	RewriteMap hostallow "txt:/usr/share/debian-edu-config/apache2_host-allowlist.map"
+	RewriteMap tjeneralias "txt:/usr/share/debian-edu-config/apache2_tjener-aliases.map"
 
 	# 1. Exclusions: Skip the redirect rules entirely for wpad.dat and Debian-Edu_rootCA.crt
 	RewriteCond %{REQUEST_URI} \.(?:dat|crt)$ [NC]
 	RewriteRule ^ - [L]
 
-	# 2. Check if the requested host matches Edu IP subnet e.g. 10.x.x.x/8 subnet..
-	#    NOTE: Single IPs should be part of allow map.
+	# 2. Check if the requested HTTP Host matches Edu IP subnet e.g. 10.x.x.x/8 subnet..
+	#    NOTE: Single IPs should be part of the TJENER alias map.
 	#    NOTE: .999.999 is technically possible, but harmless.
 	RewriteCond %1 ^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$ [OR]
 
-	# 3. Path A (The Happy Path): Host is VALID in the map
-	#    We strip the port, check the map. If it matches, redirect preserving the user's host.
+	# 3. Path A (The Happy Path): HTTP Host is a known TJENER alias
+	#    We strip the port, check the map. If it matches, redirect preserving the requested name.
 	RewriteCond %{HTTP_HOST} ^([^:]+)
-	RewriteCond ${hostallow:%1|DENY} ^ALLOW$ [NC]
+	RewriteCond ${tjeneralias:%1|DENY} ^ALLOW$ [NC]
 	RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
 
-	# 4. Path B (The Fallback): Host is INVALID or missing from the map
+	# 4. Path B (The Fallback): HTTP Host is not a known TJENER alias
 	#    If the request makes it past Rule 3 without triggering the [L] flag,
-	#    it means the Host was not allowed. We safely redirect to the static ServerName.
+	#    it means the name was not in the map. We safely redirect to the static ServerName.
 	RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L]
-# ---- </Host-Based Redirection Logic> ----
+# ---- </TJENER-alias redirect logic> ----
 
 	<Directory /etc/debian-edu/www/ >
 		Options Indexes FollowSymLinks MultiViews


=====================================
libexec/debian-edu-apache2-update-allowlist → libexec/debian-edu-apache2-update-tjener-aliases
=====================================
@@ -1,15 +1,15 @@
 #!/bin/bash
 #
-# Author:  Daniel Teichmann
+# Author:  Daniel 'dzatoah' Teichmann <[email protected]>
 # Date:    2026-03-21
 # License: GNU General Public License v2 or later (GPL-2+)
 #
 
 # =============================================================================
 # Queries LDAP for cNAMERecord entries under the Debian Edu DNS zone and
-# smartly merges them into the Apache2 host allowlist map file.
+# smartly merges them into the Apache2 TJENER alias map file.
 #
-# Usage:   /usr/libexec/debian-edu-config/update-apache2-allowlist.sh
+# Usage:   /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
 # =============================================================================
 
 set -euo pipefail
@@ -17,12 +17,12 @@ set -euo pipefail
 # -----------------------------------------------------------------------------
 # Configuration
 # -----------------------------------------------------------------------------
-SCRIPT_PATH="/usr/libexec/debian-edu-config/update-apache2-allowlist.sh"
-MAP_FILE="/usr/share/debian-edu-config/apache2_host-allowlist.map"
-BACKUP_DIR="/var/backups/apache2-allowlist"
+SCRIPT_PATH="/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases"
+MAP_FILE="/usr/share/debian-edu-config/apache2_tjener-aliases.map"
+BACKUP_DIR="/var/backups/apache2-tjener-aliases"
 LDAP_BASE="relativeDomainName=tjener,zoneName=intern,cn=tjener,ou=servers,ou=systems,dc=skole,dc=skolelinux,dc=no"
 LDAP_OPTS="-x"
-LOG_TAG="update-apache2-allowlist"
+LOG_TAG="update-apache2-tjener-aliases"
 
 # Debian Edu default hostnames (short + .intern variants) — always included
 # in the auto-generated block regardless of LDAP output.
@@ -49,12 +49,12 @@ command -v ldapsearch >/dev/null 2>&1 || die "ldapsearch not found. Install ldap
 # -----------------------------------------------------------------------------
 mkdir -p "$BACKUP_DIR"
 if [[ -f "$MAP_FILE" ]]; then
-    BACKUP_FILE="$BACKUP_DIR/apache2_host-allowlist.map.$(date '+%Y%m%d_%H%M%S')"
+    BACKUP_FILE="$BACKUP_DIR/apache2_tjener-aliases.map.$(date '+%Y%m%d_%H%M%S')"
     cp "$MAP_FILE" "$BACKUP_FILE"
     log "Backed up existing map to: $BACKUP_FILE"
 
     # Prune backups older than 30 days
-    find "$BACKUP_DIR" -name "apache2_host-allowlist.map.*" -mtime +30 -delete
+    find "$BACKUP_DIR" -name "apache2_tjener-aliases.map.*" -mtime +30 -delete
 fi
 
 # -----------------------------------------------------------------------------
@@ -135,11 +135,12 @@ trap 'rm -f "$TMPFILE"' EXIT
 {
 # ── Static header ─────────────────────────────────────────────────────────────
 cat <<HEADER
-# /usr/share/debian-edu-config/apache2_host-allowlist.map
-# Format: <hostname_or_IP> ALLOW
+# /usr/share/debian-edu-config/apache2_tjener-aliases.map
+# Format: <server_alias_or_IP> ALLOW
 #
 # IMPORTANT: This file will be changed daily by a script using cron/systemd.
-#            It contains allowed \`HOST:\` entries for the Apache2 webserver.
+#            It contains allowed HTTP Host: header values (TJENER aliases
+#            and IPs), not client machines.
 #            The script tries to smartly merge existing hand-made entries,
 #            but you should execute the script manually once to make sure your
 #            changes are sticking:


=====================================
share/debian-edu-config/apache2_host-allowlist.map → share/debian-edu-config/apache2_tjener-aliases.map
=====================================
@@ -1,12 +1,13 @@
-# /usr/share/debian-edu-config/apache2_host-allowlist.map
-# Format: <hostname_or_IP> ALLOW
+# /usr/share/debian-edu-config/apache2_tjener-aliases.map
+# Format: <server_alias_or_IP> ALLOW
 #
 # IMPORTANT: This file will be changed daily by a script using cron/systemd.
-#            It contains allowed `HOST:` entries for the Apache2 webserver.
+#            It contains allowed HTTP Host: header values (TJENER aliases
+#            and IPs), not client machines.
 #            The script tries to smartly merge existing hand-made entries,
 #            but you should execute the script manually once to make sure your
 #            changes are sticking:
-#            $ /usr/libexec/debian-edu-config/update-apache2-allowlist.sh
+#            $ /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
 #
 # WARNING: If you can read this and the file modification date is more than 24h
 #          in the past, then there is an issue with the automatic updating



View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/7edfcae0074739a445e5ade74b281fff0fbcdc86

-- 
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/7edfcae0074739a445e5ade74b281fff0fbcdc86
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help

_______________________________________________
debian-edu-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-edu-commits