Skip to content

chore(roles/apache_httpd): bump crs to 4.27.0 #276

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danyalberchtoldlf merged 1 commit into from
Jun 2, 2026
Merged

chore(roles/apache_httpd): bump crs to 4.27.0 #276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
* **role:monitoring_plugins**: `install_method: 'source'` now reads the per-Python-LTS lockfile under `lockfiles/pyXX/requirements.txt` (`py39` ... `py314`) from both the `monitoring-plugins` and `lib` repos, picking the directory that matches the target host's Python. The previous root-level `requirements.txt` no longer exists upstream. No variable changes; rsync sources updated.
* **CONTRIBUTING**: `meta/argument_specs.yml` must declare the `__dependent_var` slot for any variable that `setup_*` playbooks inject into the role via `vars:`. Dict variables fed by external lookups like `linuxfabrik.lfops.bitwarden_item` should use `type: 'dict'` without strict sub-options, since the lookup returns the full item with additional keys.
* **role:example**: Demonstrate the `delegate_to: 'localhost'` + `become: false` pattern (download on the controller, copy to the target) so role authors can copy it consistently.
* **role:apache_httpd**: bump Core Rule Set to 4.26.0
* **role:apache_httpd**: bump Core Rule Set to 4.27.0
* **role:apache_httpd**: Update the two reverse-proxy snippets in `EXAMPLES.md` to use `ProxyPass` instead of `RewriteRule ^/(.*) ... [proxy,last]`. The RewriteRule variant `%`-decodes the URI pattern and forwards characters such as `?` unencoded to the backend, which breaks WebDAV apps (file-not-found on rename in Nextcloud). The examples now also carry a comment explaining the choice and link to the corresponding [blog post](https://www.linuxfabrik.ch/blog/nextcloud-rewriterules-vs-proxypass).

### Fixed
Expand Down
4 changes: 2 additions & 2 deletions roles/apache_httpd/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -743,7 +743,7 @@ apache_httpd__mod_log_config_custom_log: 'logs/access.log combined'

* The OWASP ModSecurity Core Rule Set (CRS) version number without "v".
* Type: String.
* Default: `'4.26.0'`
* Default: `'4.27.0'`

`apache_httpd__skip_mod_security_coreruleset`

Expand All @@ -755,7 +755,7 @@ Example:
```yaml
# optional - mod_security
apache_httpd__mod_security_coreruleset_url: 'https://github.com/coreruleset/coreruleset/archive'
apache_httpd__mod_security_coreruleset_version: '4.24.1'
apache_httpd__mod_security_coreruleset_version: '4.27.0'
apache_httpd__skip_mod_security_coreruleset: true
```

Expand Down
2 changes: 1 addition & 1 deletion roles/apache_httpd/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,7 +231,7 @@ apache_httpd__mpm_worker_threads_per_child: 25
# get details from https://coreruleset.org/installation/
# origin: https://github.com/coreruleset/coreruleset/releases
apache_httpd__mod_security_coreruleset_url: 'https://github.com/coreruleset/coreruleset/archive'
apache_httpd__mod_security_coreruleset_version: '4.26.0'
apache_httpd__mod_security_coreruleset_version: '4.27.0'

# mod_ssl
apache_httpd__mod_ssl_ssl_use_stapling: 'on'
Expand Down