Allows access to the mod_wsgi files for source and journalist app

Without the access to the /var/www, our apps can not be accessed.
freedomofpress · Feb 23, 2021 · f6e958d · f6e958d
1 parent 1bd79fd
commit f6e958d
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/install_files/ansible-base/roles/app/templates/sites-available/focal/journalist.conf b/install_files/ansible-base/roles/app/templates/sites-available/focal/journalist.conf
@@ -36,6 +36,18 @@ LimitRequestBody 524288000
   Require all denied
 </Directory>
 
+# Permit limited access specifically to the SecureDrop wsgi files.
+<Directory /var/www/>
+  Options None
+  AllowOverride None
+  <Limit GET POST HEAD>
+    Require ip {{ securedrop_app_apache_allow_from }}
+  </Limit>
+  <LimitExcept GET POST HEAD>
+    Require all denied
+  </LimitExcept>
+</Directory>
+
 # Permit limited access specifically to the SecureDrop application directory.
 <Directory /var/www/securedrop>
   Options None

diff --git a/install_files/ansible-base/roles/app/templates/sites-available/focal/source.conf b/install_files/ansible-base/roles/app/templates/sites-available/focal/source.conf
@@ -63,6 +63,18 @@ LimitRequestBody 524288000
   Require all denied
 </Directory>
 
+# Permit limited access specifically to the SecureDrop wsgi files.
+<Directory /var/www/>
+  Options None
+  AllowOverride None
+  <Limit GET POST HEAD>
+    Require ip {{ securedrop_app_apache_allow_from }}
+  </Limit>
+  <LimitExcept GET POST HEAD>
+    Require all denied
+  </LimitExcept>
+</Directory>
+
 # Permit limited access specifically to the SecureDrop application directory.
 <Directory /var/www/securedrop>
   Options None