<!--
	For problematic rules, see CERN.ch-problematic.xml.


	Nonfunctional domains:

		- cern.ch subdomains:

			- cernvm	(redirects to login.cern.ch, self-signed)
			- library	(shows invenio-demo; mismatched, CN: invenio-demo.cern.ch)
			- line-mode	(dropped)
			- lxroot02	(shows root, self-signed)

			- web subdomains:

				- alpha *
				- first-website *
				- itssb *
				- home *
				- library *
				- photoclub *

		- cerncourier.org	(redirects to http; mismatched, CN: *.iop.org)
		- (www.)cernland.net	(prints "cernland.net does not exist"; mismatched, CN: *.infomaniak.ch)

	* Redirects to login.cern.ch, valid cert


	Problematic cern.ch subdomains:

		- info		(404; mismatched, CN: *.web.cern.ch)
		- sft.its	(works, self-signed)
		- photoclub	(works; mismatched, CN: CERN.CH)
		- root		($ 403s, drupal/ works; self-signed)
		- listboxservices.web	(mismatched, CN: *.cern.ch)


	Partially covered subdomains:

		- listboxservices.web	(→ simba3.web)


	Fully covered subdomains:

		- (www.)
		- bulletin
		- cds
		- cdsmedia
		- cdsweb
		- edms
		- ert
		- espace
		- indico
		- login
		- mtf
		- savannah

		- web subdomains:

			- ^
			- ab-dep-op-elogbook
			- atlas
			- committees
			- education
			- egee-uig
			- environmental-impact
			- framework
			- hie-isolde
			- hr-dept
			- hr-info
			- hr-recruit
			- indico
			- isolde
			- isolde-project-rilis
			- job
			- oraweb
			- outreach
			- press
			- project-voisins
			- public
			- service-portal
			- simba3
			- user
			- webservices


	Observed cookie domains:

		- cds ¹
		- cdsweb ¹
		- cernvm ²
		- .cernvm ²
		- invenio-demo
		- sft.its ³
		- root ³
		- .root ³
		- savannah ¹

		- web subdomains:

			- alpha ²
			- first-website ²
			- home ²
			- itssb ²
			- library ²
			- photoclub ²

	¹ Secured by us <= complete coverage
	² Not secured by us <= we don't touch http cookies
	³ Secured by us when set via https

-->
<ruleset name="CERN (partial)">

	<target host="cern.ch" />
	<target host="*.cern.ch" />


	<securecookie host=".*\.cern\.ch$" name=".+" />


	<rule from="^http://((?:association|bulletin|cds|cdsmedia|cdsweb|edms|ert|espace|indico|login|mtf|savannah|(?:(?:ab-dep-op-elogbook|atlas|committees|education|egee-uig|environmental-impact|framework|hie-isolde|hr-dept|hr-info|hr-recruit|indico|isolde(?:-project-rilis)?|job|oraweb|outreach|press|project-voisins|public|service-portal|simba3|user|webservices)\.)?web|www)\.)?cern\.ch/"
		to="https://$1cern.ch/" />

	<!--	Redirects like so:
					-->
	<rule from="^https?://listboxservices\.web\.cern\.ch/listboxservices/simba2/"
		to="https://simba3.web.cern.ch/simba3/simba2/" />

	<!--	Protocol-relative redirect from user.web:
							-->
	<rule from="^https://home\.web\.cern\.ch/"
		to="http://home.web.cern.ch/" downgrade="1" />

</ruleset>
