From 7bcd0a1831a9627d4b19fc91cd3046dda89de526 Mon Sep 17 00:00:00 2001 From: Leonid Makarov Date: Fri, 5 Jun 2026 11:53:27 +0200 Subject: [PATCH 1/3] Fix virtual host config overrides Load the standard (host.conf) config first and the override (httpd-vhost-overrides.conf) config last, so overrides actually take effect. --- conf/extra/httpd-vhosts.conf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/conf/extra/httpd-vhosts.conf b/conf/extra/httpd-vhosts.conf index 3d1221d..3d8cf2f 100644 --- a/conf/extra/httpd-vhosts.conf +++ b/conf/extra/httpd-vhosts.conf @@ -2,11 +2,11 @@ ServerName ${APACHE_SERVERNAME} # HTTP (default virtual host) - # Allow virtual-host config overrides (overrides go first, as Apache picks the first instance of a directive) - # Using a glob pattern in the file name to avoid creating an empty config by default - IncludeOptional conf/custom/httpd-vhost-overrides.con[f] # Standard virtual-host configuration Include conf/extra/includes/host.conf + # Allow virtual-host config overrides (overrides go last, as Apache uses the last instance of a directive) + # Using a glob pattern in the file name to avoid creating an empty config by default + IncludeOptional conf/custom/httpd-vhost-overrides.con[f] # HTTPS (default virtual host) @@ -24,11 +24,11 @@ ServerName ${APACHE_SERVERNAME} SSLSessionCacheTimeout 300 - # Allow virtual-host config overrides (overrides go first, as Apache picks the first instance of a directive) - # Using a glob pattern in the file name to avoid creating an empty config by default - IncludeOptional conf/custom/httpd-vhost-overrides.con[f] # Standard virtual-host configuration Include conf/extra/includes/host.conf + # Allow virtual-host config overrides (overrides go last, as Apache uses the last instance of a directive) + # Using a glob pattern in the file name to avoid creating an empty config by default + IncludeOptional conf/custom/httpd-vhost-overrides.con[f] SSLEngine on SSLCertificateFile /usr/local/apache2/conf/server.crt From 1e3b13485ce0950912cf7d9259cb73821ae715d7 Mon Sep 17 00:00:00 2001 From: Leonid Makarov Date: Fri, 5 Jun 2026 11:55:35 +0200 Subject: [PATCH 2/3] Update SSL configuration to allow TLSv1.2 and TLSv1.3 protocols --- conf/extra/httpd-vhosts.conf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/conf/extra/httpd-vhosts.conf b/conf/extra/httpd-vhosts.conf index 3d8cf2f..d128390 100644 --- a/conf/extra/httpd-vhosts.conf +++ b/conf/extra/httpd-vhosts.conf @@ -12,13 +12,13 @@ ServerName ${APACHE_SERVERNAME} # HTTPS (default virtual host) Listen 443 - # Restrict mod_ssl to use only TLSv1.2 ciphers + # Restrict mod_ssl to strong ciphers (TLSv1.3 ciphers are configured separately) SSLCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA SSLProxyCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA SSLHonorCipherOrder on - # Only allow the TLSv1.2 protocol - SSLProtocol TLSv1.2 - SSLProxyProtocol TLSv1.2 + # Allow TLSv1.2 and TLSv1.3 + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLProxyProtocol -all +TLSv1.2 +TLSv1.3 # Other SSL settings SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)" SSLSessionCacheTimeout 300 From e21a2d5bcf865721482afd90edcd9b35200f7cad Mon Sep 17 00:00:00 2001 From: Leonid Makarov Date: Fri, 5 Jun 2026 11:58:20 +0200 Subject: [PATCH 3/3] Add tests for Directory block configuration overrides --- .../httpd-vhost-overrides.conf | 5 ++++ tests/config/httpd-vhost-overrides.conf | 5 +++- tests/test.bats | 29 +++++++++++++++++++ 3 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 tests/config-directory-override/httpd-vhost-overrides.conf diff --git a/tests/config-directory-override/httpd-vhost-overrides.conf b/tests/config-directory-override/httpd-vhost-overrides.conf new file mode 100644 index 0000000..d452e34 --- /dev/null +++ b/tests/config-directory-override/httpd-vhost-overrides.conf @@ -0,0 +1,5 @@ +# Override the block from host.conf to deny access +# This tests that overrides at the same scope (container directive) take effect + + Require all denied + diff --git a/tests/config/httpd-vhost-overrides.conf b/tests/config/httpd-vhost-overrides.conf index c99d9c9..c0cd5ef 100644 --- a/tests/config/httpd-vhost-overrides.conf +++ b/tests/config/httpd-vhost-overrides.conf @@ -1 +1,4 @@ -DirectoryIndex index2.html +# Test that a override takes precedence over VirtualHost-level directives + + DirectoryIndex index2.html + diff --git a/tests/test.bats b/tests/test.bats index 2febc75..b9ef541 100755 --- a/tests/test.bats +++ b/tests/test.bats @@ -200,3 +200,32 @@ _healthcheck_wait () ### Cleanup ### make clean } + +@test "Configuration overrides - Directory block" { + [[ $SKIP == 1 ]] && skip + + ### Setup ### + VOLUMES=" \ + -v $(pwd)/tests/docroot:/var/www/docroot \ + -v $(pwd)/tests/config-directory-override:/var/www/.docksal/etc/apache" \ + make start + + run _healthcheck_wait + unset output + + ### Tests ### + + # Test that a override takes precedence over host.conf's block + # This verifies the include order fix (overrides must load after the standard config) + run curl -sSk -m 1 -I http://localhost:2580 + [[ "$output" =~ "HTTP/1.1 403 Forbidden" ]] + unset output + + # HTTPS should also be overridden + run curl -sSk -m 1 -I https://localhost:25443 + [[ "$output" =~ "HTTP/1.1 403 Forbidden" ]] + unset output + + ### Cleanup ### + make clean +}