opendev/system-config
Code Issues Proposed changes

Merge "Set up HTTPS for releases.openstack.org site"

Browse Source
This commit is contained in:
Jenkins 2016-08-22 20:44:38 +00:00 committed by Gerrit Code Review
commit dbb556d2df
3 changed files with 92 additions and 13 deletions
manifests
site.pp
modules/openstack_project
manifests
static.pp
templates
static-releases.vhost.erb

23
manifests/site.pp

@ -662,16 +662,19 @@ node 'static.openstack.org' {
sysadmins => hiera('sysadmins', []),
}
class { 'openstack_project::static':
project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
swift_authurl => 'https://identity.api.rackspacecloud.com/v2.0/',
swift_user => 'infra-files-ro',
swift_key => hiera('infra_files_ro_password'),
swift_tenant_name => hiera('infra_files_tenant_name', 'tenantname'),
swift_region_name => 'DFW',
swift_default_container => 'infra-files',
ssl_cert_file_contents => hiera('static_ssl_cert_file_contents'),
ssl_key_file_contents => hiera('static_ssl_key_file_contents'),
ssl_chain_file_contents => hiera('static_ssl_chain_file_contents'),
project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
swift_authurl => 'https://identity.api.rackspacecloud.com/v2.0/',
swift_user => 'infra-files-ro',
swift_key => hiera('infra_files_ro_password'),
swift_tenant_name => hiera('infra_files_tenant_name', 'tenantname'),
swift_region_name => 'DFW',
swift_default_container => 'infra-files',
ssl_cert_file_contents => hiera('static_ssl_cert_file_contents'),
ssl_key_file_contents => hiera('static_ssl_key_file_contents'),
ssl_chain_file_contents => hiera('static_ssl_chain_file_contents'),
releases_cert_file_contents => hiera('releases_ssl_cert_file_contents'),
releases_key_file_contents => hiera('releases_ssl_key_file_contents'),
releases_chain_file_contents => hiera('releases_ssl_chain_file_contents'),
}
}

37
modules/openstack_project/manifests/static.pp

@ -14,6 +14,9 @@ class openstack_project::static (
$ssl_key_file_contents = '',
$ssl_chain_file = '',
$ssl_chain_file_contents = '',
$releases_cert_file_contents = '',
$releases_key_file_contents = '',
$releases_chain_file_contents = '',
$jenkins_gitfullname = 'OpenStack Jenkins',
$jenkins_gitemail = 'jenkins@openstack.org',
) {
@ -362,17 +365,45 @@ class openstack_project::static (
###########################################################
# Releases
# Temporary separate HTTPS cert/key/chain for releases.o.o so that we
# don't have to renew the static.o.o cert just to add one SubjectAltName
file { '/etc/ssl/certs/releases.openstack.org.pem':
ensure => present,
owner => 'root',
group => 'root',
mode => '0644',
content => $releases_cert_file_contents,
require => File['/etc/ssl/certs'],
}
file { '/etc/ssl/private/releases.openstack.org.key':
ensure => present,
owner => 'root',
group => 'root',
mode => '0600',
content => $releases_key_file_contents,
require => File['/etc/ssl/private'],
}
file { '/etc/ssl/certs/releases.openstack.org_intermediate.pem':
ensure => present,
owner => 'root',
group => 'root',
mode => '0644',
content => $releases_chain_file_contents,
require => File['/etc/ssl/certs'],
before => File['/etc/ssl/certs/releases.openstack.org.pem'],
}
::httpd::vhost { 'releases.openstack.org':
port => 443, # Is required despite not being used.
docroot => '/srv/static/releases',
priority => '50',
ssl => true,
template => 'openstack_project/static-http-and-https.vhost.erb',
template => 'openstack_project/static-releases.vhost.erb',
vhost_name => 'releases.openstack.org',
require => [
File['/srv/static/releases'],
File[$cert_file],
File[$key_file],
File['/etc/ssl/certs/releases.openstack.org.pem'],
File['/etc/ssl/private/releases.openstack.org.key'],
],
}

45
modules/openstack_project/templates/static-releases.vhost.erb Normal file

@ -0,0 +1,45 @@
# ************************************
# Managed by Puppet
# ************************************
<VirtualHost *:80>
ServerName <%= @vhost_name %>
<% if @serveraliases.is_a? Array -%>
<% @serveraliases.each do |name| -%><%= " ServerAlias #{name}\n" %><% end -%>
<% elsif @serveraliases != '' -%>
<%= " ServerAlias #{@serveraliases}" %>
<% end -%>
RewriteEngine On
RewriteRule ^/(.*) https://<%= @vhost_name %>/$1 [last,redirect=permanent]
LogLevel warn
ErrorLog /var/log/apache2/<%= @vhost_name %>_error.log
CustomLog /var/log/apache2/<%= @vhost_name %>_access.log combined
ServerSignature Off
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName <%= @vhost_name %>
DocumentRoot <%= @docroot %>
SSLEngine on
SSLProtocol All -SSLv2 -SSLv3
# Once the machine is using something to terminate TLS that supports ECDHE
# then this should be edited to remove the RSA+AESGCM:RSA+AES so that PFS
# only is guarenteed.
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/releases.openstack.org.pem
SSLCertificateKeyFile /etc/ssl/private/releases.openstack.org.key
SSLCertificateChainFile /etc/ssl/certs/releases.openstack.org_intermediate.pem
<Directory <%= @docroot %>>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Satisfy Any
Require all granted
</Directory>
LogLevel warn
ErrorLog /var/log/apache2/<%= @vhost_name %>_error.log
CustomLog /var/log/apache2/<%= @vhost_name %>_access.log combined
ServerSignature Off
</VirtualHost>
</IfModule>