d6251506f7
This patch introduces an optional backend encryption for the Nova API service. When used in conjunction with enabling TLS for service API endpoints, network communcation will be encrypted end to end, from client through HAProxy to the Nova service. Change-Id: I48e1540b973016079d5686b328e82239dcffacfd Partially-Implements: blueprint add-ssl-internal-network
71 lines
2.6 KiB
Django/Jinja
71 lines
2.6 KiB
Django/Jinja
{% set nova_log_dir = '/var/log/kolla/nova' %}
|
|
{% set wsgi_directory = '/usr/bin' if nova_install_type == 'binary' else '/var/lib/kolla/venv/bin' %}
|
|
{% if nova_enable_tls_backend | bool %}
|
|
{% if kolla_base_distro in ['centos'] %}
|
|
LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
|
|
{% else %}
|
|
LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
|
|
{% endif %}
|
|
{% endif %}
|
|
Listen {{ api_interface_address | put_address_in_context('url') }}:{{ nova_api_listen_port }}
|
|
Listen {{ api_interface_address | put_address_in_context('url') }}:{{ nova_metadata_listen_port }}
|
|
|
|
ServerSignature Off
|
|
ServerTokens Prod
|
|
TraceEnable off
|
|
KeepAliveTimeout {{ kolla_httpd_keep_alive }}
|
|
|
|
<Directory "{{ wsgi_directory }}">
|
|
<FilesMatch "^nova-(api-wsgi|metadata-wsgi)$">
|
|
Options None
|
|
Require all granted
|
|
</FilesMatch>
|
|
</Directory>
|
|
|
|
ErrorLog "{{ nova_log_dir }}/apache-error.log"
|
|
<IfModule log_config_module>
|
|
CustomLog "{{ nova_log_dir }}/apache-access.log" common
|
|
</IfModule>
|
|
|
|
{% if nova_logging_debug | bool %}
|
|
LogLevel info
|
|
{% endif %}
|
|
|
|
<VirtualHost *:{{ nova_api_listen_port }}>
|
|
WSGIDaemonProcess nova-api processes={{ openstack_service_workers }} threads=1 user=nova group=nova display-name=%{GROUP}
|
|
WSGIProcessGroup nova-api
|
|
WSGIScriptAlias / {{ wsgi_directory }}/nova-api-wsgi
|
|
WSGIApplicationGroup %{GLOBAL}
|
|
WSGIPassAuthorization On
|
|
<IfVersion >= 2.4>
|
|
ErrorLogFormat "%{cu}t %M"
|
|
</IfVersion>
|
|
ErrorLog "{{ nova_log_dir }}/nova-api-error.log"
|
|
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat
|
|
CustomLog "{{ nova_log_dir }}/nova-api-access.log" logformat
|
|
{% if nova_enable_tls_backend | bool %}
|
|
SSLEngine on
|
|
SSLCertificateFile /etc/nova/certs/nova-cert.pem
|
|
SSLCertificateKeyFile /etc/nova/certs/nova-key.pem
|
|
{% endif %}
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:{{ nova_metadata_listen_port }}>
|
|
WSGIDaemonProcess nova-metadata processes={{ openstack_service_workers }} threads=1 user=nova group=nova display-name=%{GROUP}
|
|
WSGIProcessGroup nova-metadata
|
|
WSGIScriptAlias / {{ wsgi_directory }}/nova-metadata-wsgi
|
|
WSGIApplicationGroup %{GLOBAL}
|
|
WSGIPassAuthorization On
|
|
<IfVersion >= 2.4>
|
|
ErrorLogFormat "%{cu}t %M"
|
|
</IfVersion>
|
|
ErrorLog "{{ nova_log_dir }}/nova-metadata-error.log"
|
|
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat
|
|
CustomLog "{{ nova_log_dir }}/nova-metadata-access.log" logformat
|
|
{% if nova_enable_tls_backend | bool %}
|
|
SSLEngine on
|
|
SSLCertificateFile /etc/nova/certs/nova-cert.pem
|
|
SSLCertificateKeyFile /etc/nova/certs/nova-key.pem
|
|
{% endif %}
|
|
</VirtualHost>
|