From ff232ae31670356593a0d2d1262aaddcc0335260 Mon Sep 17 00:00:00 2001 From: Kevin Carter Date: Sun, 7 Feb 2016 14:38:30 -0600 Subject: [PATCH] Enable SSL termination for all services This change makes it so that all services are expecting SSL termination at the load balancer by default. This is more indicative of how a real world deployment will be setup and is being added such that we can test a more production like deployment system by default. The AIO will now terminate SSL in HAProxy using a self-signed cert. Change-Id: Ibbeca3325947b549ae00d11e60bf719741b4b0e4 Re-Implementation-Of: https://review.openstack.org/#/c/277199/9 Signed-off-by: Kevin Carter --- defaults/main.yml | 7 +++++++ tasks/horizon_apache.yml | 1 + templates/openstack_dashboard.conf.j2 | 3 +++ 3 files changed, 11 insertions(+) diff --git a/defaults/main.yml b/defaults/main.yml index 23703010..7c6d7793 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -96,6 +96,13 @@ horizon_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ horizo #horizon_user_ssl_key: #horizon_user_ssl_ca_cert: +# Set this to True if you do ssl termination on an external device, like the +# load balancer +horizon_ssl_external: true +# Set this to the header that your device sets when doing ssl termination +horizon_secure_proxy_ssl_header: "X-Forwarded-Proto" +horizon_secure_proxy_ssl_header_django: "HTTP_{{ horizon_secure_proxy_ssl_header | replace('-', '_') | upper }}" + # For multiple regions uncomment this configuration, and # add the extra endpoints below the first list item. # horizon_available_regions: diff --git a/tasks/horizon_apache.yml b/tasks/horizon_apache.yml index b26b306d..a8e8e889 100644 --- a/tasks/horizon_apache.yml +++ b/tasks/horizon_apache.yml @@ -51,6 +51,7 @@ - { state: absent, name: mpm_event } - { state: present, name: mpm_worker } - { state: present, name: rewrite } + - { state: present, name: headers } notify: Restart apache2 tags: - horizon-apache-config diff --git a/templates/openstack_dashboard.conf.j2 b/templates/openstack_dashboard.conf.j2 index 3b71b643..979fd3e3 100644 --- a/templates/openstack_dashboard.conf.j2 +++ b/templates/openstack_dashboard.conf.j2 @@ -29,6 +29,9 @@ SSLHonorCipherOrder On SSLCipherSuite {{ horizon_ssl_cipher_suite }} SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown +{% else %} + RequestHeader set {{ horizon_secure_proxy_ssl_header }} "https" +{% endif %} WSGIScriptAlias / {{ horizon_lib_wsgi_file }} WSGIDaemonProcess horizon user={{ horizon_system_user_name }} group={{ horizon_system_group_name }} processes={{ horizon_wsgi_processes | default(wsgi_threads) }} threads={{ horizon_wsgi_threads | default(wsgi_threads) }}