Question

How do I set up my FogBugz 7 for Linux install to run only over SSL? I want to run all traffic over https.

Answer 1

First, configure your regular Apache web server to support SSL.

In the fogbugz directory, there is a conf/fogbugz-redirect.conf file. One of the lines is a RedirectMatch rule. Change this line (and only this line) to refer to https.

There is also a conf/httpd.conf file. Edit the Listen line to read "Listen 127.0.0.1:7066".

Now FogBugz will only listen to localhost and your SSL requests will be redirected to it.

Configuring apache to enable SSL is a platform dependent operation, so there's no way to do it, but you'll need to edit your apache config files (likely to be located somewhere under /etc). One example for turning on SSL is a chunk like the following:

<VirtualHost *:80>
    ...
    RewriteEngine  on
    RewriteCond %{HTTPS}                    off
    RewriteCond %{REQUEST_URI}              ^/FogBugz/(.*)
    RewriteRule ^/(.*)$                     https://yoursite/$1 [R=301,L]
    ...
</VirtualHost>

For more info, refer to http://edin.no-ip.com/content/apache-https-redirect-debian-mini-howto

Answer 2

The RedirectMatch in conf/fogbugz-redirect.conf will only match exactly /fogbugz (no trailing slash). If you type in the URL like http://name.site.com/fogbugz/ (with a trailing slash), you would not get redirected and would end up at the non-SSL version of the site. It would also be a problem for URLs of the form http://name.site.com/fogbugz/default.asp?776 - these would just flow right past that RedirectMatch, which is meant just to add a trailing slash to a naked fogbugz.

To make sure FogBugz can never ever possibly serve non-SSL pages (even if you misconfigure the site), you have to remove the Include "/srv/fogbugz/conf/fogbugz-redirect.conf" line from httpd.conf and place it in a <VirtualHost *:443> block.

You can then add the following redirect to aggressively insure that people always end up on the SSL version of the site no matter how they type the URL.

<VirtualHost *:80>
        ServerName name.site.com
        Redirect permanent /fogbugz/ https://name.site.com/fogbugz/
</VirtualHost>

Answer 3

Ken posted in a duplicate question that you can also do something like this if you don't want to turn on SSL for your entire site:

<VirtualHost *:80>
        ...
        RewriteEngine  on
        RewriteCond %{HTTPS}                    off
        RewriteCond %{REQUEST_URI}              ^/FogBugz/(.*)
        RewriteRule ^/(.*)$                     https://yoursite/$1 [R=301,L]
        ...
</VirtualHost>