b6fe07ecf8
Security headers are HTTP response headers, that when set increase the security of your application by restricting modern browsers from running easily preventable vulnerabilities. You can inspect your site using https://securityheaders.com/ This patch implements the following headers: - strict-transport-security - HSTS enforces the use of HTTPS - x-content-type-options - Stops the browser from changing the Content-Type - referrer-policy - Control what information a browser includes when it navigates from a page - content-security-policy - CSP protects sites from XSS attacks by controlling what resources a browser is able to load Only enabled if HTTPS in use. There is the option to extend to all haproxy services in the future, but as the headers are only used by browser there maybe limited benefit to doing this other than for keystone and console services. Each of the headers set should have no effect on the operation of the site apart from the CSP header. As the CSP header restricts what resources a browser is allowed to load, if for example a Openstack instance is using federated login, CSP will block the redirect. To fix the the admin will need to override the CSP, using `haproxy_horizon_csp` to set the allowed list of resources. Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/818532 Change-Id: Ia99da8e4687b0a1d440f86d1c8be723ce2bfe061
Team and repository tags
OpenStack-Ansible
OpenStack-Ansible is an official OpenStack project which aims to deploy production environments from source in a way that makes it scalable while also being simple to operate, upgrade, and grow.
For an overview of the mission, repositories and related Wiki home page, please see the formal Home Page for the project.
For those looking to test OpenStack-Ansible using an All-In-One (AIO) build, please see the Quick Start guide.
For more detailed Installation and Operator documentation, please see the Deployment Guide.
If OpenStack-Ansible is missing something you'd like to see included, then we encourage you to see the Developer Documentation for more details on how you can get involved.
Developers wishing to work on the OpenStack-Ansible project should always base their work on the latest code, available from the master GIT repository at Source.
If you have some questions, or would like some assistance with
achieving your goals, then please feel free to reach out to us on the OpenStack Mailing Lists
(particularly openstack-discuss) or on IRC in
#openstack-ansible on the OFTC network.
OpenStack-Ansible Roles
OpenStack-Ansible offers separate role repositories for each individual role that OpenStack-Ansible supports. For individual role configuration options, see the Role Documentation.
An individual role's source code can be found at: https://opendev.org/openstack/openstack-ansible-<ROLENAME>.
Resources
- License: Apache License, Version 2.0
- Documentation: https://docs.openstack.org/openstack-ansible/latest/
- Source: https://opendev.org/openstack/openstack-ansible
- Bugs: https://bugs.launchpad.net/openstack-ansible
- Release notes: https://docs.openstack.org/releasenotes/openstack-ansible/