316b0496b3
This patch introduces an optional backend encryption for the Ironic API and Ironic Inspector service. When used in conjunction with enabling TLS for service API endpoints, network communcation will be encrypted end to end, from client through HAProxy to the Ironic service. Change-Id: I3e82c8ec112e53f907e89fea0c8c849072dcf957 Partially-Implements: blueprint add-ssl-internal-network Depends-On: https://review.opendev.org/#/c/742776/
51 lines
1.8 KiB
Django/Jinja
51 lines
1.8 KiB
Django/Jinja
{% set ironic_log_dir = '/var/log/kolla/ironic' %}
|
|
{% set wsgi_directory = '/usr/bin' if ironic_install_type == 'binary' else '/var/lib/kolla/venv/bin' %}
|
|
{% if ironic_enable_tls_backend | bool %}
|
|
{% if kolla_base_distro in ['centos'] %}
|
|
LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
|
|
{% else %}
|
|
LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
|
|
{% endif %}
|
|
{% endif %}
|
|
Listen {{ api_interface_address | put_address_in_context('url') }}:{{ ironic_inspector_listen_port }}
|
|
|
|
ServerSignature Off
|
|
ServerTokens Prod
|
|
TraceEnable off
|
|
KeepAliveTimeout {{ kolla_httpd_keep_alive }}
|
|
|
|
<Directory "{{ wsgi_directory }}">
|
|
<FilesMatch "^ironic-inspector-wsgi$">
|
|
Options None
|
|
Require all granted
|
|
</FilesMatch>
|
|
</Directory>
|
|
|
|
ErrorLog "{{ ironic_log_dir }}/apache-error-ironic-inspector.log"
|
|
<IfModule log_config_module>
|
|
CustomLog "{{ ironic_log_dir }}/apache-access-ironic-inspector.log" common
|
|
</IfModule>
|
|
|
|
{% if ironic_logging_debug | bool %}
|
|
LogLevel info
|
|
{% endif %}
|
|
|
|
<VirtualHost *:{{ ironic_inspector_listen_port }}>
|
|
WSGIDaemonProcess ironic-inspector processes={{ openstack_service_workers }} threads=1 user=ironic group=ironic display-name=%{GROUP}
|
|
WSGIProcessGroup ironic-inspector
|
|
WSGIScriptAlias / {{ wsgi_directory }}/ironic-inspector-wsgi
|
|
WSGIApplicationGroup %{GLOBAL}
|
|
WSGIPassAuthorization On
|
|
<IfVersion >= 2.4>
|
|
ErrorLogFormat "%{cu}t %M"
|
|
</IfVersion>
|
|
ErrorLog "{{ ironic_log_dir }}/ironic-inspector-error.log"
|
|
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat
|
|
CustomLog "{{ ironic_log_dir }}/ironic-inspector-access.log" logformat
|
|
{% if ironic_enable_tls_backend | bool %}
|
|
SSLEngine on
|
|
SSLCertificateFile /etc/ironic/certs/ironic-cert.pem
|
|
SSLCertificateKeyFile /etc/ironic/certs/ironic-key.pem
|
|
{% endif %}
|
|
</VirtualHost>
|