| … | … | @@ -31,14 +31,23 @@ export function generateVhosts (registry) { |
| 31 | 31 | if (!node) continue |
| 32 | 32 | assertSafe(node.ip, 'node ip') |
| 33 | 33 | assertSafe(h.name, 'host name') |
| 34 | | if (!/^[a-z0-9.-]+$/i.test(h.serverName)) { |
| 34 | if (!/^(\*\.)?[a-z0-9.-]+$/i.test(h.serverName)) { |
| 35 | 35 | throw new Error(`unsafe serverName for Apache config: ${JSON.stringify(h.serverName)}`) |
| 36 | 36 | } |
| 37 | 37 | const backend = `http://${node.ip}:${h.port}` |
| 38 | const wildcard = h.serverName.startsWith('*.') |
| 38 | 39 | |
| 39 | 40 | lines.push(`# === ${h.name} → ${h.serverName} → ${node.ip}:${h.port} ===`) |
| 40 | 41 | lines.push('<VirtualHost *:443>') |
| 41 | | lines.push(` ServerName ${h.serverName}`) |
| 42 | // A wildcard needs a concrete ServerName + a ServerAlias for the glob (Apache matches |
| 43 | // exact ServerNames first, so specific vhosts like pds.7rnx.net still win). Subdomains |
| 44 | // only — *.7rnx.net does not match the apex 7rnx.net (its path-based site is untouched). |
| 45 | if (wildcard) { |
| 46 | lines.push(` ServerName ${h.serverName.replace('*', 'wildcard')}`) |
| 47 | lines.push(` ServerAlias ${h.serverName}`) |
| 48 | } else { |
| 49 | lines.push(` ServerName ${h.serverName}`) |
| 50 | } |
| 42 | 51 | lines.push(' SSLEngine on') |
| 43 | 52 | lines.push(' # mod_md supplies the *.7rnx.net certificate for this host.') |
| 44 | 53 | lines.push(' ProxyPreserveHost On') |