ServerName admin.imperium.com.ar # DocumentRoot /var/www/html/redirect-fidelitas DocumentRoot /var/www/html/admin.imperium DirectoryIndex default.cfm index.cfm index.html index.htm Options Indexes FollowSymLinks AllowOverride All Require all granted Alias /rpt "/var/www/html/compartido/reportes" AllowOverride All Deny from all Require all granted Allow from all EnableMMAP Off SSLCertificateFile /etc/letsencrypt/live/admin.imperium.com.ar/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/admin.imperium.com.ar/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf ServerName blue.fidelitas.com.ar DocumentRoot /var/www/html/blue DirectoryIndex default.cfm index.cfm index.html index.htm Options Indexes FollowSymLinks AllowOverride All Require all granted #SSLCertificateFile /etc/letsencrypt/live/blue.fidelitas.ai/fullchain.pem #SSLCertificateKeyFile /etc/letsencrypt/live/blue.fidelitas.ai/privkey.pem #Include /etc/letsencrypt/options-ssl-apache.conf SSLCertificateFile /etc/letsencrypt/live/blue.fidelitas.com.ar/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/blue.fidelitas.com.ar/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf ServerName clientes.imperium.com.ar # DocumentRoot /var/www/html/redirect-fidelitas DocumentRoot /var/www/html/cliente.imperium DirectoryIndex default.cfm index.cfm index.html index.htm Options Indexes FollowSymLinks AllowOverride All Require all granted Alias /logos "/var/www/html/compartido/imperium/logos" AllowOverride All Deny from all Require all granted Allow from all EnableMMAP Off Alias /instructivos "/var/www/html/compartido/instructivos" AllowOverride All Deny from all Require all granted Allow from all EnableMMAP Off Alias /docs "/var/www/html/compartido/temp/_docs" AllowOverride All Deny from all Require all granted Allow from all EnableMMAP Off Alias /informes "/var/www/html/compartido/informes" AllowOverride All Deny from all Require all granted Allow from all EnableMMAP Off ErrorLog /var/www/html/cliente.imperium/cliimp.log SSLCertificateFile /etc/letsencrypt/live/clientes.imperium.com.ar/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/clientes.imperium.com.ar/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf ServerName serf.fidelitas.com.ar # TLS (completar con rutas de certbot) SSLEngine on SSLCertificateFile /etc/letsencrypt/live/serf.fidelitas.com.ar/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/serf.fidelitas.com.ar/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf # Seguridad TLS SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384 SSLHonorCipherOrder off # Headers de seguridad globales Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Header always set X-Robots-Tag "noindex, nofollow" Header always set X-Frame-Options "DENY" Header always set X-Content-Type-Options "nosniff" # TODO para el equipo de www: implementar referrer-policy que preserve el canonical Header always set Referrer-Policy "strict-origin" # Proxy total hacia Node.js — SIN excluir rutas (ni /portadas ni /data son accesibles directamente) ProxyPreserveHost On ProxyRequests Off ProxyPass / http://127.0.0.1:3200/ ProxyPassReverse / http://127.0.0.1:3200/ # Logs CustomLog /var/log/apache2/serf-access.log combined ErrorLog /var/log/apache2/serf-error.log # robots.txt servido por Node.js (ruta /robots.txt en public.js) ServerName serfadmin.fidelitas.com.ar SSLEngine on SSLCertificateFile /etc/letsencrypt/live/serfadmin.fidelitas.com.ar/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/serfadmin.fidelitas.com.ar/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384 Header always set Strict-Transport-Security "max-age=31536000" Header always set X-Robots-Tag "noindex, nofollow" Header always set X-Frame-Options "DENY" Header always set X-Content-Type-Options "nosniff" # Restricción por IP — PRIMERA línea de defensa Require ip 186.189.232.93 Require ip 10.20.30.0/24 Require ip 10.20.40.0/24 ProxyPreserveHost On ProxyRequests Off RedirectMatch ^/$ /serfadmin/login ProxyPass / http://127.0.0.1:3200/ ProxyPassReverse / http://127.0.0.1:3200/ CustomLog /var/log/apache2/serfadmin-access.log combined ErrorLog /var/log/apache2/serfadmin-error.log