870451e554
At the moment services might have different MPM selected while all operating the same Apache setup, ie on metal setup. This results in failures to set selected MPMs, so eventually second run of roles after initial deployment will end up in failure (ie upgrade). This patch ensures that all except selected MPMs are disabled and do role get's the desired state of deployment. We also need to align selected MPM across all roles to avoid future conflicts. Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/930446 Change-Id: Ia3e4af7986166f0729840d2a61fb8f52ea053676
113 lines
3.5 KiB
YAML
113 lines
3.5 KiB
YAML
---
|
|
# Copyright 2016, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
cache_timeout: 600
|
|
|
|
keystone_distro_packages:
|
|
- git
|
|
- libldap-common
|
|
- openssh-server
|
|
- rsync
|
|
- cron
|
|
- libpython3-dev
|
|
|
|
keystone_devel_distro_packages:
|
|
- docutils-common
|
|
- libffi-dev
|
|
- libjs-sphinxdoc
|
|
- libjs-underscore
|
|
- libldap2-dev
|
|
- libsasl2-dev
|
|
- libsystemd-dev
|
|
- libssl-dev
|
|
- libxslt1.1
|
|
- libxslt1-dev
|
|
- libxml2-dev
|
|
- pkg-config
|
|
|
|
keystone_service_distro_packages:
|
|
- python3-keystone
|
|
- python3-systemd
|
|
|
|
keystone_apache_distro_packages:
|
|
- apache2
|
|
- apache2-utils
|
|
- libapache2-mod-proxy-uwsgi
|
|
|
|
keystone_idp_distro_packages:
|
|
- ssl-cert
|
|
- xmlsec1
|
|
|
|
# From 2.4.11, mod_auth_openidc ignores X-Forwarded headers unless explicitly configured
|
|
_keystone_sp_apache_mod_auth_openidc_gte_2_4_11: True
|
|
|
|
keystone_sp_apache_mod_packages:
|
|
- name: libapache2-mod-shib
|
|
state: "{{ keystone_sp_apache_mod_shib | ternary('present', 'absent') }}"
|
|
- name: libapache2-mod-auth-openidc
|
|
state: "{{ keystone_sp_apache_mod_auth_openidc | ternary('present', 'absent') }}"
|
|
|
|
keystone_developer_mode_distro_packages:
|
|
- build-essential
|
|
|
|
keystone_oslomsg_amqp1_distro_packages:
|
|
- libsasl2-modules
|
|
- sasl2-bin
|
|
|
|
keystone_apache_default_sites:
|
|
- "/etc/apache2/sites-enabled/000-default.conf"
|
|
|
|
keystone_apache_site_available: "/etc/apache2/sites-available/keystone-httpd.conf"
|
|
keystone_apache_site_enabled: "/etc/apache2/sites-enabled/keystone-httpd.conf"
|
|
keystone_apache_conf: "/etc/apache2/apache2.conf"
|
|
keystone_apache_default_log_folder: "/var/log/apache2"
|
|
keystone_apache_default_log_owner: "root"
|
|
keystone_apache_default_log_grp: "adm"
|
|
keystone_apache_security_conf: "/etc/apache2/conf-available/security.conf"
|
|
|
|
keystone_apache_configs:
|
|
- { src: "keystone-ports.conf.j2", dest: "/etc/apache2/ports.conf" }
|
|
- { src: "keystone-httpd.conf.j2", dest: "/etc/apache2/sites-available/keystone-httpd.conf" }
|
|
- { src: "keystone-httpd-mpm.conf.j2", dest: "/etc/apache2/mods-available/mpm_{{ keystone_httpd_mpm_backend }}.conf" }
|
|
|
|
keystone_apache_mpms:
|
|
- name: "mpm_event"
|
|
state: "{{ (keystone_httpd_mpm_backend == 'event') | ternary('present', 'absent') }}"
|
|
- name: "mpm_worker"
|
|
state: "{{ (keystone_httpd_mpm_backend == 'worker') | ternary('present', 'absent') }}"
|
|
- name: "mpm_prefork"
|
|
state: "{{ (keystone_httpd_mpm_backend == 'prefork') | ternary('present', 'absent') }}"
|
|
|
|
keystone_apache_modules:
|
|
- name: "ssl"
|
|
state: "{{ (keystone_backend_ssl | bool) | ternary('present', 'absent') }}"
|
|
- name: "shib"
|
|
state: "{{ keystone_sp_apache_mod_shib | ternary('present', 'absent') }}"
|
|
- name: "auth_openidc"
|
|
state: "{{ keystone_sp_apache_mod_auth_openidc | ternary('present', 'absent') }}"
|
|
- name: "proxy_uwsgi"
|
|
state: "present"
|
|
- name: "headers"
|
|
state: "present"
|
|
# This can be enabled when Apache2.5+ is available
|
|
# - name: "mod_journald"
|
|
# state: "present
|
|
|
|
keystone_system_service_name: "{{ (keystone_use_uwsgi | bool) | ternary('keystone-wsgi-public', 'apache2') }}"
|
|
|
|
keystone_uwsgi_bin: '/usr/bin'
|
|
|
|
keystone_sshd: ssh
|