954ece8642
A new cert bundle and key have been obtained for static.openstack.org with SubjectAltNames for most of its relevant vhosts. Switch it into place and generalize the current HTTPS configuration for security.openstack.org in preparation for adding HTTPS support to the remaining vhosts in subsequent commits. Also add sane snakeoil fallback behavior for undefined certificate/key files. Change-Id: I65b7dbc3b5ad8735c158a1ac0b41b848ad5d2077
317 lines
8.8 KiB
Puppet
317 lines
8.8 KiB
Puppet
# == Class: openstack_project::static
|
|
#
|
|
class openstack_project::static (
|
|
$swift_authurl = '',
|
|
$swift_user = '',
|
|
$swift_key = '',
|
|
$swift_tenant_name = '',
|
|
$swift_region_name = '',
|
|
$swift_default_container = '',
|
|
$project_config_repo = '',
|
|
$ssl_cert_file = '',
|
|
$ssl_cert_file_contents = '',
|
|
$ssl_key_file = '',
|
|
$ssl_key_file_contents = '',
|
|
$ssl_chain_file = '',
|
|
$ssl_chain_file_contents = '',
|
|
$jenkins_gitfullname = 'OpenStack Jenkins',
|
|
$jenkins_gitemail = 'jenkins@openstack.org',
|
|
) {
|
|
class { 'project_config':
|
|
url => $project_config_repo,
|
|
}
|
|
|
|
include openstack_project
|
|
class { 'jenkins::jenkinsuser':
|
|
ssh_key => $openstack_project::jenkins_ssh_key,
|
|
gitfullname => $jenkins_gitfullname,
|
|
gitemail => $jenkins_gitemail,
|
|
}
|
|
|
|
include ::httpd
|
|
include ::httpd::mod::wsgi
|
|
|
|
httpd_mod { 'rewrite':
|
|
ensure => present,
|
|
}
|
|
httpd_mod { 'proxy':
|
|
ensure => present,
|
|
}
|
|
httpd_mod { 'proxy_http':
|
|
ensure => present,
|
|
}
|
|
|
|
if ! defined(File['/srv/static']) {
|
|
file { '/srv/static':
|
|
ensure => directory,
|
|
}
|
|
}
|
|
|
|
file { '/etc/ssl/certs':
|
|
ensure => directory,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0755',
|
|
}
|
|
|
|
file { '/etc/ssl/private':
|
|
ensure => directory,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0700',
|
|
}
|
|
|
|
# To use the standard ssl-certs package snakeoil certificate, leave both
|
|
# $ssl_cert_file and $ssl_cert_file_contents empty. To use an existing
|
|
# certificate, specify its path for $ssl_cert_file and leave
|
|
# $ssl_cert_file_contents empty. To manage the certificate with puppet,
|
|
# provide $ssl_cert_file_contents and optionally specify the path to use for
|
|
# it in $ssl_cert_file.
|
|
if ($ssl_cert_file == '') and ($ssl_cert_file_contents == '') {
|
|
$cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem'
|
|
} else {
|
|
if $ssl_cert_file == '' {
|
|
$cert_file = "/etc/ssl/certs/${::fqdn}.pem"
|
|
} else {
|
|
$cert_file = $ssl_cert_file
|
|
}
|
|
if $ssl_cert_file_contents != '' {
|
|
file { $cert_file:
|
|
ensure => present,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
content => $ssl_cert_file_contents,
|
|
require => File['/etc/ssl/certs'],
|
|
}
|
|
}
|
|
}
|
|
|
|
# To use the standard ssl-certs package snakeoil key, leave both
|
|
# $ssl_key_file and $ssl_key_file_contents empty. To use an existing key,
|
|
# specify its path for $ssl_key_file and leave $ssl_key_file_contents empty.
|
|
# To manage the key with puppet, provide $ssl_key_file_contents and
|
|
# optionally specify the path to use for it in $ssl_key_file.
|
|
if ($ssl_key_file == '') and ($ssl_key_file_contents == '') {
|
|
$key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'
|
|
} else {
|
|
if $ssl_key_file == '' {
|
|
$key_file = "/etc/ssl/private/${::fqdn}.key"
|
|
} else {
|
|
$key_file = $ssl_key_file
|
|
}
|
|
if $ssl_key_file_contents != '' {
|
|
file { $key_file:
|
|
ensure => present,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0600',
|
|
content => $ssl_key_file_contents,
|
|
require => File['/etc/ssl/private'],
|
|
}
|
|
}
|
|
}
|
|
|
|
# To avoid using an intermediate certificate chain, leave both
|
|
# $ssl_chain_file and $ssl_chain_file_contents empty. To use an existing
|
|
# chain, specify its path for $ssl_chain_file and leave
|
|
# $ssl_chain_file_contents empty. To manage the chain with puppet, provide
|
|
# $ssl_chain_file_contents and optionally specify the path to use for it in
|
|
# $ssl_chain_file.
|
|
if ($ssl_chain_file == '') and ($ssl_chain_file_contents == '') {
|
|
$chain_file = ''
|
|
} else {
|
|
if $ssl_chain_file == '' {
|
|
$chain_file = "/etc/ssl/certs/${::fqdn}_intermediate.pem"
|
|
} else {
|
|
$chain_file = $ssl_chain_file
|
|
}
|
|
if $ssl_chain_file_contents != '' {
|
|
file { $chain_file:
|
|
ensure => present,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
content => $ssl_chain_file_contents,
|
|
require => File['/etc/ssl/certs'],
|
|
before => File[$cert_file],
|
|
}
|
|
}
|
|
}
|
|
|
|
###########################################################
|
|
# Tarballs
|
|
|
|
::httpd::vhost { 'tarballs.openstack.org':
|
|
port => 80,
|
|
priority => '50',
|
|
docroot => '/srv/static/tarballs',
|
|
require => File['/srv/static/tarballs'],
|
|
}
|
|
|
|
file { '/srv/static/tarballs':
|
|
ensure => directory,
|
|
owner => 'jenkins',
|
|
group => 'jenkins',
|
|
require => User['jenkins'],
|
|
}
|
|
|
|
###########################################################
|
|
# legacy ci.openstack.org site redirect
|
|
|
|
::httpd::vhost { 'ci.openstack.org':
|
|
port => 80,
|
|
priority => '50',
|
|
docroot => 'MEANINGLESS_ARGUMENT',
|
|
template => 'openstack_project/ci.vhost.erb',
|
|
}
|
|
|
|
###########################################################
|
|
# Logs
|
|
class { 'openstackci::logserver':
|
|
jenkins_ssh_key => $openstack_project::jenkins_ssh_key,
|
|
domain => 'openstack.org',
|
|
swift_authurl => $swift_authurl,
|
|
swift_user => $swift_user,
|
|
swift_key => $swift_key,
|
|
swift_tenant_name => $swift_tenant_name,
|
|
swift_region_name => $swift_region_name,
|
|
swift_default_container => $swift_default_container,
|
|
}
|
|
|
|
###########################################################
|
|
# Docs-draft
|
|
|
|
::httpd::vhost { 'docs-draft.openstack.org':
|
|
port => 80,
|
|
priority => '50',
|
|
docroot => '/srv/static/docs-draft',
|
|
require => File['/srv/static/docs-draft'],
|
|
}
|
|
|
|
file { '/srv/static/docs-draft':
|
|
ensure => directory,
|
|
owner => 'jenkins',
|
|
group => 'jenkins',
|
|
require => User['jenkins'],
|
|
}
|
|
|
|
file { '/srv/static/docs-draft/robots.txt':
|
|
ensure => present,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0444',
|
|
source => 'puppet:///modules/openstack_project/disallow_robots.txt',
|
|
require => File['/srv/static/docs-draft'],
|
|
}
|
|
|
|
###########################################################
|
|
# Security
|
|
|
|
::httpd::vhost { 'security.openstack.org':
|
|
port => 443, # Is required despite not being used.
|
|
docroot => '/srv/static/security',
|
|
priority => '50',
|
|
ssl => true,
|
|
template => 'openstack_project/security.vhost.erb',
|
|
vhost_name => 'security.openstack.org',
|
|
require => [
|
|
File['/srv/static/security'],
|
|
File[$cert_file],
|
|
File[$key_file],
|
|
],
|
|
}
|
|
|
|
file { '/srv/static/security':
|
|
ensure => directory,
|
|
owner => 'jenkins',
|
|
group => 'jenkins',
|
|
require => User['jenkins'],
|
|
}
|
|
|
|
#TODO(fungi) this cleanup can be removed once puppet has deleted them
|
|
file { '/etc/ssl/certs/security.openstack.org.pem':
|
|
ensure => absent,
|
|
}
|
|
file { '/etc/ssl/private/security.openstack.org.key':
|
|
ensure => absent,
|
|
}
|
|
file { '/etc/ssl/certs/security.openstack.org_intermediate.pem':
|
|
ensure => absent,
|
|
}
|
|
|
|
###########################################################
|
|
# Governance
|
|
|
|
::httpd::vhost { 'governance.openstack.org':
|
|
port => 80,
|
|
priority => '50',
|
|
docroot => '/srv/static/governance',
|
|
require => File['/srv/static/governance'],
|
|
}
|
|
|
|
file { '/srv/static/governance':
|
|
ensure => directory,
|
|
owner => 'jenkins',
|
|
group => 'jenkins',
|
|
require => User['jenkins'],
|
|
}
|
|
|
|
###########################################################
|
|
# Specs
|
|
|
|
::httpd::vhost { 'specs.openstack.org':
|
|
port => 80,
|
|
priority => '50',
|
|
docroot => '/srv/static/specs',
|
|
require => File['/srv/static/specs'],
|
|
}
|
|
|
|
file { '/srv/static/specs':
|
|
ensure => directory,
|
|
owner => 'jenkins',
|
|
group => 'jenkins',
|
|
require => User['jenkins'],
|
|
}
|
|
|
|
###########################################################
|
|
# legacy summit.openstack.org site redirect
|
|
|
|
::httpd::vhost { 'summit.openstack.org':
|
|
port => 80,
|
|
priority => '50',
|
|
docroot => 'MEANINGLESS_ARGUMENT',
|
|
template => 'openstack_project/summit.vhost.erb',
|
|
}
|
|
|
|
###########################################################
|
|
# legacy devstack.org site redirect
|
|
|
|
::httpd::vhost { 'devstack.org':
|
|
port => 80,
|
|
priority => '50',
|
|
docroot => 'MEANINGLESS_ARGUMENT',
|
|
serveraliases => ['*.devstack.org'],
|
|
template => 'openstack_project/devstack.vhost.erb',
|
|
}
|
|
|
|
###########################################################
|
|
# Trystack
|
|
|
|
::httpd::vhost { 'trystack.openstack.org':
|
|
port => 80,
|
|
priority => '50',
|
|
docroot => '/opt/trystack',
|
|
template => 'openstack_project/trystack.vhost.erb',
|
|
serveraliases => ['trystack.org', 'www.trystack.org'],
|
|
require => Vcsrepo['/opt/trystack'],
|
|
}
|
|
|
|
vcsrepo { '/opt/trystack':
|
|
ensure => latest,
|
|
provider => git,
|
|
revision => 'master',
|
|
source => 'https://git.openstack.org/openstack-infra/trystack-site',
|
|
}
|
|
}
|