Skip to content

Commit a0a1736

Browse files
JedMeisterJedMeister
authored
Merge pull request #334 from JedMeister/tomcat
Trixie Tomcat updates - add config for Tomcat 11
2 parents 8a264d8 + 0e09bc4 commit a0a1736

4 files changed

Lines changed: 397 additions & 0 deletions

File tree

‎overlays/tomcat-apache/etc/tomcat11/tomcat11/mod_jk.conf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
RedirectMatch ^/manager[/]$ /manager/html
2+
JkMount /manager ajp13_worker
3+
JkMount /manager/* ajp13_worker
4+
5+
RedirectMatch ^/host-manager[/]$ /host-manager/html
6+
JkMount /host-manager ajp13_worker
7+
JkMount /host-manager/* ajp13_worker

‎overlays/tomcat-apache/etc/tomcat11/tomcat11/server.xml‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<!-- Note: A "Server" is not itself a "Container", so you may not
19+
define subcomponents such as "Valves" at this level.
20+
Documentation at /docs/config/server.html
21+
-->
22+
<Server port="-1" shutdown="SHUTDOWN">
23+
<Listener className="org.apache.catalina.startup.VersionLoggerListener" />
24+
<!-- Security listener. Documentation at /docs/config/listeners.html
25+
<Listener className="org.apache.catalina.security.SecurityListener" />
26+
-->
27+
<!--APR library loader. Documentation at /docs/apr.html -->
28+
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
29+
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
30+
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
31+
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
32+
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
33+
34+
<!-- Global JNDI resources
35+
Documentation at /docs/jndi-resources-howto.html
36+
-->
37+
<GlobalNamingResources>
38+
<!-- Editable user database that can also be used by
39+
UserDatabaseRealm to authenticate users
40+
-->
41+
<Resource name="UserDatabase" auth="Container"
42+
type="org.apache.catalina.UserDatabase"
43+
description="User database that can be updated and saved"
44+
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
45+
pathname="conf/tomcat-users.xml" />
46+
</GlobalNamingResources>
47+
48+
<!-- A "Service" is a collection of one or more "Connectors" that share
49+
a single "Container" Note: A "Service" is not itself a "Container",
50+
so you may not define subcomponents such as "Valves" at this level.
51+
Documentation at /docs/config/service.html
52+
-->
53+
<Service name="Catalina">
54+
55+
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
56+
<!--
57+
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
58+
maxThreads="150" minSpareThreads="4"/>
59+
-->
60+
61+
62+
<!-- A "Connector" represents an endpoint by which requests are received
63+
and responses are returned. Documentation at :
64+
Java HTTP Connector: /docs/config/http.html
65+
Java AJP Connector: /docs/config/ajp.html
66+
APR (HTTP/AJP) Connector: /docs/apr.html
67+
Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
68+
-->
69+
<!--
70+
<Connector port="8080" protocol="HTTP/1.1"
71+
connectionTimeout="20000"
72+
redirectPort="8443" />
73+
-->
74+
<!-- A "Connector" using the shared thread pool-->
75+
<!--
76+
<Connector executor="tomcatThreadPool"
77+
port="8080" protocol="HTTP/1.1"
78+
connectionTimeout="20000"
79+
redirectPort="8443" />
80+
-->
81+
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
82+
This connector uses the NIO implementation. The default
83+
SSLImplementation will depend on the presence of the APR/native
84+
library and the useOpenSSL attribute of the
85+
AprLifecycleListener.
86+
Either JSSE or OpenSSL style configuration may be used regardless of
87+
the SSLImplementation selected. JSSE style configuration is used below.
88+
-->
89+
<!--
90+
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
91+
maxThreads="150" SSLEnabled="true">
92+
<SSLHostConfig>
93+
<Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
94+
type="RSA" />
95+
</SSLHostConfig>
96+
</Connector>
97+
-->
98+
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
99+
This connector uses the APR/native implementation which always uses
100+
OpenSSL for TLS.
101+
Either JSSE or OpenSSL style configuration may be used. OpenSSL style
102+
configuration is used below.
103+
-->
104+
<!--
105+
<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
106+
maxThreads="150" SSLEnabled="true" >
107+
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
108+
<SSLHostConfig>
109+
<Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
110+
certificateFile="conf/localhost-rsa-cert.pem"
111+
certificateChainFile="conf/localhost-rsa-chain.pem"
112+
type="RSA" />
113+
</SSLHostConfig>
114+
</Connector>
115+
-->
116+
117+
<!-- Define an AJP 1.3 Connector on port 8009 -->
118+
<!-- Important: if you allow Tomcat to listen on all interfaces, to maximise
119+
security, a secret should be set & required. -->
120+
<Connector protocol="AJP/1.3"
121+
address="127.0.0.1"
122+
port="8009"
123+
redirectPort="8443"
124+
secretRequired="false" />
125+
126+
<!-- An Engine represents the entry point (within Catalina) that processes
127+
every request. The Engine implementation for Tomcat stand alone
128+
analyzes the HTTP headers included with the request, and passes them
129+
on to the appropriate Host (virtual host).
130+
Documentation at /docs/config/engine.html -->
131+
132+
<!-- You should set jvmRoute to support load-balancing via AJP ie :
133+
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
134+
-->
135+
<Engine name="Catalina" defaultHost="localhost">
136+
137+
<!--For clustering, please take a look at documentation at:
138+
/docs/cluster-howto.html (simple how to)
139+
/docs/config/cluster.html (reference documentation) -->
140+
<!--
141+
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
142+
-->
143+
144+
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
145+
via a brute-force attack -->
146+
<Realm className="org.apache.catalina.realm.LockOutRealm">
147+
<!-- This Realm uses the UserDatabase configured in the global JNDI
148+
resources under the key "UserDatabase". Any edits
149+
that are performed against this UserDatabase are immediately
150+
available for use by the Realm. -->
151+
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
152+
resourceName="UserDatabase"/>
153+
</Realm>
154+
155+
<Host name="localhost" appBase="webapps"
156+
unpackWARs="true" autoDeploy="true">
157+
158+
<!-- SingleSignOn valve, share authentication between web applications
159+
Documentation at: /docs/config/valve.html -->
160+
<!--
161+
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
162+
-->
163+
164+
<!-- Access log processes all example.
165+
Documentation at: /docs/config/valve.html
166+
Note: The pattern used is equivalent to using pattern="common" -->
167+
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
168+
prefix="localhost_access_log" suffix=".txt"
169+
pattern="%h %l %u %t &quot;%r&quot; %s %b" />
170+
171+
</Host>
172+
</Engine>
173+
</Service>
174+
</Server>

‎overlays/tomcat/etc/tomcat11/tomcat11/server.xml‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<!-- Note: A "Server" is not itself a "Container", so you may not
19+
define subcomponents such as "Valves" at this level.
20+
Documentation at /docs/config/server.html
21+
-->
22+
<Server port="-1" shutdown="SHUTDOWN">
23+
<Listener className="org.apache.catalina.startup.VersionLoggerListener" />
24+
<!-- Security listener. Documentation at /docs/config/listeners.html
25+
<Listener className="org.apache.catalina.security.SecurityListener" />
26+
-->
27+
<!--APR library loader. Documentation at /docs/apr.html -->
28+
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
29+
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
30+
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
31+
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
32+
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
33+
34+
<!-- Global JNDI resources
35+
Documentation at /docs/jndi-resources-howto.html
36+
-->
37+
<GlobalNamingResources>
38+
<!-- Editable user database that can also be used by
39+
UserDatabaseRealm to authenticate users
40+
-->
41+
<Resource name="UserDatabase" auth="Container"
42+
type="org.apache.catalina.UserDatabase"
43+
description="User database that can be updated and saved"
44+
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
45+
pathname="conf/tomcat-users.xml" />
46+
</GlobalNamingResources>
47+
48+
<!-- A "Service" is a collection of one or more "Connectors" that share
49+
a single "Container" Note: A "Service" is not itself a "Container",
50+
so you may not define subcomponents such as "Valves" at this level.
51+
Documentation at /docs/config/service.html
52+
-->
53+
<Service name="Catalina">
54+
55+
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
56+
<!--
57+
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
58+
maxThreads="150" minSpareThreads="4"/>
59+
-->
60+
61+
62+
<!-- A "Connector" represents an endpoint by which requests are received
63+
and responses are returned. Documentation at :
64+
Java HTTP Connector: /docs/config/http.html
65+
Java AJP Connector: /docs/config/ajp.html
66+
APR (HTTP/AJP) Connector: /docs/apr.html
67+
Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
68+
-->
69+
<!--
70+
<Connector port="8080" protocol="HTTP/1.1"
71+
connectionTimeout="20000"
72+
redirectPort="8443" />
73+
-->
74+
75+
<!-- TurnKey Linux default HTTP connector on port 80 -->
76+
<Connector port="80" protocol="HTTP/1.1"
77+
connectionTimeout="20000"
78+
URIEncoding="UTF-8"
79+
redirectPort="443"
80+
server="Secret" />
81+
82+
<!-- A "Connector" using the shared thread pool-->
83+
<!--
84+
<Connector executor="tomcatThreadPool"
85+
port="8080" protocol="HTTP/1.1"
86+
connectionTimeout="20000"
87+
redirectPort="8443" />
88+
-->
89+
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
90+
This connector uses the NIO implementation. The default
91+
SSLImplementation will depend on the presence of the APR/native
92+
library and the useOpenSSL attribute of the
93+
AprLifecycleListener.
94+
Either JSSE or OpenSSL style configuration may be used regardless of
95+
the SSLImplementation selected. JSSE style configuration is used below.
96+
-->
97+
<!--
98+
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
99+
maxThreads="150" SSLEnabled="true">
100+
<SSLHostConfig>
101+
<Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
102+
type="RSA" />
103+
</SSLHostConfig>
104+
</Connector>
105+
-->
106+
107+
<!-- TurnKey Linux default HTTPS connector on port 443 -->
108+
<Connector
109+
port="443"
110+
protocol="org.apache.coyote.http11.Http11NioProtocol"
111+
SSLEnabled="true"
112+
maxThreads="150"
113+
scheme="https"
114+
secure="true"
115+
URIEncoding="UTF-8"
116+
clientAuth="false"
117+
server="Secret">
118+
119+
<SSLHostConfig
120+
protocols="TLSv1.2,TLSv1.3"
121+
ciphers="ZZ_SSL_CIPHERS"
122+
disableSessionTickets="true"
123+
honorCipherOrder="false">
124+
125+
<Certificate
126+
certificateKeystoreFile="/etc/tomcat10/cert.p12"
127+
certificateKeystorePassword="turnkey" />
128+
</SSLHostConfig>
129+
</Connector>
130+
131+
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
132+
This connector uses the APR/native implementation which always uses
133+
OpenSSL for TLS.
134+
Either JSSE or OpenSSL style configuration may be used. OpenSSL style
135+
configuration is used below.
136+
-->
137+
<!--
138+
<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
139+
maxThreads="150" SSLEnabled="true" >
140+
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
141+
<SSLHostConfig>
142+
<Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
143+
certificateFile="conf/localhost-rsa-cert.pem"
144+
certificateChainFile="conf/localhost-rsa-chain.pem"
145+
type="RSA" />
146+
</SSLHostConfig>
147+
</Connector>
148+
-->
149+
150+
<!-- Define an AJP 1.3 Connector on port 8009 -->
151+
<!--
152+
<Connector protocol="AJP/1.3"
153+
address="::1"
154+
port="8009"
155+
redirectPort="8443" />
156+
-->
157+
158+
<!-- An Engine represents the entry point (within Catalina) that processes
159+
every request. The Engine implementation for Tomcat stand alone
160+
analyzes the HTTP headers included with the request, and passes them
161+
on to the appropriate Host (virtual host).
162+
Documentation at /docs/config/engine.html -->
163+
164+
<!-- You should set jvmRoute to support load-balancing via AJP ie :
165+
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
166+
-->
167+
<Engine name="Catalina" defaultHost="localhost">
168+
169+
<!--For clustering, please take a look at documentation at:
170+
/docs/cluster-howto.html (simple how to)
171+
/docs/config/cluster.html (reference documentation) -->
172+
<!--
173+
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
174+
-->
175+
176+
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
177+
via a brute-force attack -->
178+
<Realm className="org.apache.catalina.realm.LockOutRealm">
179+
<!-- This Realm uses the UserDatabase configured in the global JNDI
180+
resources under the key "UserDatabase". Any edits
181+
that are performed against this UserDatabase are immediately
182+
available for use by the Realm. -->
183+
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
184+
resourceName="UserDatabase"/>
185+
</Realm>
186+
187+
<Host name="localhost" appBase="webapps"
188+
unpackWARs="true" autoDeploy="true">
189+
190+
<!-- SingleSignOn valve, share authentication between web applications
191+
Documentation at: /docs/config/valve.html -->
192+
<!--
193+
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
194+
-->
195+
196+
<!-- Access log processes all example.
197+
Documentation at: /docs/config/valve.html
198+
Note: The pattern used is equivalent to using pattern="common" -->
199+
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
200+
prefix="localhost_access_log" suffix=".txt"
201+
pattern="%h %l %u %t &quot;%r&quot; %s %b" />
202+
203+
</Host>
204+
</Engine>
205+
</Service>
206+
</Server>

0 commit comments

Comments
 (0)