journalist.conf

ServerName {{ securedrop_app_apache_listening_address }}
<VirtualHost {{ securedrop_app_apache_listening_address }}:8080>

WSGIDaemonProcess journalist processes=2 threads=30 display-name=%{GROUP} python-path=/var/www/securedrop
WSGIScriptAlias / /var/www/journalist.wsgi process-group=journalist application-group=journalist
WSGIPassAuthorization On

# Tell the browser not to cache HTML responses in order to minimize the chance
# of the inadvertent release or retention of sensitive data. For more, see
# https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.2.
Header set Cache-Control "no-store"

Alias /static /var/www/securedrop/static
<Directory /var/www/securedrop/static>
  Order allow,deny
  Allow from all
  # Cache static resources for 1 hour
  Header set Cache-Control "max-age=3600"
</Directory>

XSendFile        On
XSendFilePath    /var/lib/securedrop/store/
XSendFilePath    /var/lib/securedrop/tmp/

Header edit Set-Cookie ^(.*)$ $1;HttpOnly
Header always append X-Frame-Options: DENY
Header set Referrer-Policy "no-referrer"
Header set X-XSS-Protection: "1; mode=block"
Header set X-Content-Type-Options: nosniff
Header set X-Download-Options: noopen
Header set X-Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
Header set Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"

# Limit the max submitted size of requests.
LimitRequestBody 524288000

<Directory />
  Options None
  AllowOverride None
  Order deny,allow
  Deny from all
</Directory>

<Directory /var/www/>
  Options {{ apache_dir_options | default('None') }}
  AllowOverride None
  <Limit GET POST HEAD DELETE>
    Order allow,deny
    allow from {{ securedrop_app_apache_allow_from }}
  </Limit>
  <LimitExcept GET POST HEAD DELETE>
    Order deny,allow
    Deny from all
  </LimitExcept>
</Directory>

<Directory /var/www/securedrop>
  Options {{ apache_dir_options | default('None') }}
  AllowOverride None
  <Limit GET POST HEAD DELETE>
    Order allow,deny
    allow from {{ securedrop_app_apache_allow_from }}
  </Limit>
  <LimitExcept GET POST HEAD DELETE>
    Order deny,allow
    Deny from all
  </LimitExcept>
</Directory>

RewriteEngine On
RewriteCond %{THE_REQUEST} !HTTP/1\.1$
RewriteRule .* - [F]

ErrorLog /var/log/apache2/journalist-error.log
CustomLog /var/log/apache2/journalist-access.log combined
LogLevel info

</VirtualHost>