Merge "Enable SSL termination for all services"

defaults/main.yml

@@ -96,6 +96,13 @@ horizon_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ horizo
 #horizon_user_ssl_key: <path to cert on ansible deployment host>
 #horizon_user_ssl_ca_cert: <path to cert on ansible deployment host>
 
+# Set this to True if you do ssl termination on an external device, like the
+# load balancer
+horizon_ssl_external: true
+# Set this to the header that your device sets when doing ssl termination
+horizon_secure_proxy_ssl_header: "X-Forwarded-Proto"
+horizon_secure_proxy_ssl_header_django: "HTTP_{{ horizon_secure_proxy_ssl_header | replace('-', '_') | upper }}"
+
 # For multiple regions uncomment this configuration, and
 # add the extra endpoints below the first list item.
 # horizon_available_regions:

tasks/horizon_apache.yml

@@ -51,6 +51,7 @@
     - { state: absent, name: mpm_event }
     - { state: present, name: mpm_worker }
     - { state: present, name: rewrite }
+    - { state: present, name: headers }
   notify: Restart apache2
   tags:
     - horizon-apache-config

templates/openstack_dashboard.conf.j2

@@ -29,6 +29,9 @@
     SSLHonorCipherOrder On
     SSLCipherSuite {{ horizon_ssl_cipher_suite }}
     SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
+{% else %}
+    RequestHeader set {{ horizon_secure_proxy_ssl_header }} "https"
+{% endif %}
 
     WSGIScriptAlias / {{ horizon_lib_wsgi_file }}
     WSGIDaemonProcess horizon user={{ horizon_system_user_name }} group={{ horizon_system_group_name }} processes={{ horizon_wsgi_processes | default(wsgi_threads) }} threads={{ horizon_wsgi_threads | default(wsgi_threads) }}