Skip to content

Commit 6e28ce9

Browse files
stejskalleosstejskalleos
committed
httpd configuration
* SSL & non-SSL configs for httpd * Rails require_ssl: true * Updated httpd tests
1 parent e0c259a commit 6e28ce9

File tree

5 files changed

+258
-11
lines changed

5 files changed

+258
-11
lines changed

‎src/roles/foreman/templates/settings.yaml.j2‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
:ssl_ca_file: /etc/foreman/katello-default-ca.crt
66
:ssl_priv_key: /etc/foreman/client_key.pem
77

8+
:require_ssl: true
9+
810
:rails_cache_store:
911
:type: redis
1012
:urls:

‎src/roles/httpd/tasks/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,14 @@
5858
remote_src: true
5959
mode: "0644"
6060

61+
- name: Configure foreman vhost
62+
ansible.builtin.template:
63+
src: foreman-vhost.conf.j2
64+
dest: /etc/httpd/conf.d/foreman.conf
65+
mode: "0644"
66+
notify:
67+
- Restart httpd
68+
6169
- name: Configure foreman-ssl vhost
6270
ansible.builtin.template:
6371
src: foreman-ssl-vhost.conf.j2

‎src/roles/httpd/templates/foreman-ssl-vhost.conf.j2‎

Lines changed: 83 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,24 @@
1515
RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
1616
RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
1717
RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"
18-
RequestHeader unset REMOTE_USER
1918
RequestHeader unset REMOTE-USER
19+
RequestHeader unset REMOTE_USER
20+
RequestHeader unset REMOTE-USER-EMAIL
21+
RequestHeader unset REMOTE-USER_EMAIL
22+
RequestHeader unset REMOTE_USER-EMAIL
23+
RequestHeader unset REMOTE_USER_EMAIL
24+
RequestHeader unset REMOTE-USER-FIRSTNAME
25+
RequestHeader unset REMOTE-USER_FIRSTNAME
26+
RequestHeader unset REMOTE_USER-FIRSTNAME
27+
RequestHeader unset REMOTE_USER_FIRSTNAME
28+
RequestHeader unset REMOTE-USER-LASTNAME
29+
RequestHeader unset REMOTE-USER_LASTNAME
30+
RequestHeader unset REMOTE_USER-LASTNAME
31+
RequestHeader unset REMOTE_USER_LASTNAME
32+
RequestHeader unset REMOTE-USER-GROUPS
33+
RequestHeader unset REMOTE-USER_GROUPS
34+
RequestHeader unset REMOTE_USER-GROUPS
35+
RequestHeader unset REMOTE_USER_GROUPS
2036

2137
## SSL directives
2238
SSLEngine on
@@ -45,6 +61,27 @@
4561
ProxyPass /pulp/container/ {{ httpd_pulp_content_backend }}/pulp/container/
4662
ProxyPassReverse /pulp/container/ {{ httpd_pulp_content_backend }}/pulp/container/
4763

64+
<Location "/pulp/deb">
65+
RequestHeader unset X-CLIENT-CERT
66+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
67+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
68+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
69+
</Location>
70+
71+
<Location "/pulp/isos">
72+
RequestHeader unset X-CLIENT-CERT
73+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
74+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
75+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
76+
</Location>
77+
78+
<Location "/pulp/repos">
79+
RequestHeader unset X-CLIENT-CERT
80+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
81+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
82+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
83+
</Location>
84+
4885
<Location "/pulp/content">
4986
RequestHeader unset X-CLIENT-CERT
5087
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
@@ -76,10 +113,52 @@
76113
ProxyAddHeaders On
77114
ProxyPass /pulp !
78115
ProxyPass /pub !
79-
ProxyPass /icons !
80-
ProxyPass /server-status !
81-
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900
116+
{# ProxyPass /icons ! #}
117+
{# ProxyPass /images ! #}
118+
{# ProxyPass /server-status ! #}
119+
{# ProxyPass /webpack ! #}
120+
{# ProxyPass /assets ! #}
121+
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900 upgrade=websocket
82122
ProxyPassReverse / {{ httpd_foreman_backend }}/
83123

124+
<FilesMatch \.css\.gz$>
125+
ForceType text/css
126+
Header set Content-Encoding gzip
127+
SetEnv no-gzip
128+
</FilesMatch>
129+
<FilesMatch \.js\.gz$>
130+
ForceType text/javascript
131+
Header set Content-Encoding gzip
132+
SetEnv no-gzip
133+
</FilesMatch>
134+
<FilesMatch \.svg\.gz$>
135+
ForceType image/svg+xml
136+
Header set Content-Encoding gzip
137+
SetEnv no-gzip
138+
</FilesMatch>
139+
140+
<LocationMatch "^/(assets|webpack)">
141+
Options SymLinksIfOwnerMatch
142+
AllowOverride None
143+
Require all granted
144+
145+
# Use standard http expire header for assets instead of ETag
146+
<IfModule mod_expires.c>
147+
Header unset ETag
148+
FileETag None
149+
ExpiresActive On
150+
ExpiresDefault "access plus 1 year"
151+
</IfModule>
152+
153+
# Return compressed assets if they are precompiled
154+
RewriteEngine On
155+
# Make sure the browser supports gzip encoding and file with .gz added
156+
# does exist on disc before we rewrite with the extension
157+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
158+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
159+
RewriteCond %{REQUEST_FILENAME}.gz -s
160+
RewriteRule ^(.+) $1.gz [L]
161+
</LocationMatch>
162+
84163
AddDefaultCharset UTF-8
85164
</VirtualHost>

‎src/roles/httpd/templates/foreman-vhost.conf.j2‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
<VirtualHost *:80>
2+
ServerName {{ ansible_facts['fqdn'] }}
3+
4+
## Load additional static includes
5+
IncludeOptional "/etc/httpd/conf.d/05-foreman.d/*.conf"
6+
7+
## Logging
8+
ErrorLog "/var/log/httpd/foreman_error.log"
9+
ServerSignature Off
10+
CustomLog "/var/log/httpd/foreman_access.log" combined
11+
12+
## Request header rules
13+
## as per http://httpd.apache.org/docs/2.4/mod/mod_headers.html#requestheader
14+
RequestHeader set X-FORWARDED-PROTO "http"
15+
RequestHeader set SSL-CLIENT-S-DN ""
16+
RequestHeader set SSL-CLIENT-CERT ""
17+
RequestHeader set SSL-CLIENT-VERIFY ""
18+
RequestHeader unset REMOTE-USER
19+
RequestHeader unset REMOTE_USER
20+
RequestHeader unset REMOTE-USER-EMAIL
21+
RequestHeader unset REMOTE-USER_EMAIL
22+
RequestHeader unset REMOTE_USER-EMAIL
23+
RequestHeader unset REMOTE_USER_EMAIL
24+
RequestHeader unset REMOTE-USER-FIRSTNAME
25+
RequestHeader unset REMOTE-USER_FIRSTNAME
26+
RequestHeader unset REMOTE_USER-FIRSTNAME
27+
RequestHeader unset REMOTE_USER_FIRSTNAME
28+
RequestHeader unset REMOTE-USER-LASTNAME
29+
RequestHeader unset REMOTE-USER_LASTNAME
30+
RequestHeader unset REMOTE_USER-LASTNAME
31+
RequestHeader unset REMOTE_USER_LASTNAME
32+
RequestHeader unset REMOTE-USER-GROUPS
33+
RequestHeader unset REMOTE-USER_GROUPS
34+
RequestHeader unset REMOTE_USER-GROUPS
35+
RequestHeader unset REMOTE_USER_GROUPS
36+
37+
<Location "/pulp/deb">
38+
RequestHeader unset X-CLIENT-CERT
39+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
40+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
41+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
42+
</Location>
43+
44+
<Location "/pulp/isos">
45+
RequestHeader unset X-CLIENT-CERT
46+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
47+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
48+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
49+
</Location>
50+
51+
<Location "/pulp/repos">
52+
RequestHeader unset X-CLIENT-CERT
53+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
54+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
55+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
56+
</Location>
57+
58+
<Location "/pulp/content">
59+
RequestHeader unset X-CLIENT-CERT
60+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
61+
RequestHeader set X-FORWARDED-PROTO expr=%{REQUEST_SCHEME}
62+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
63+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
64+
</Location>
65+
66+
Alias /pub /var/www/html/pub
67+
68+
<Location /pub>
69+
Options +FollowSymLinks +Indexes
70+
Require all granted
71+
</Location>
72+
73+
## Proxy rules
74+
ProxyRequests Off
75+
ProxyPreserveHost On
76+
ProxyAddHeaders On
77+
ProxyPass /pulp !
78+
ProxyPass /pub !
79+
{# ProxyPass /icons ! #}
80+
{# ProxyPass /images ! #}
81+
{# ProxyPass /server-status ! #}
82+
{# ProxyPass /webpack ! #}
83+
{# ProxyPass /assets ! #}
84+
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900 upgrade=websocket
85+
ProxyPassReverse / {{ httpd_foreman_backend }}/
86+
87+
## Server aliases
88+
ServerAlias foreman
89+
90+
## Custom fragment
91+
# Set headers for all possible assets which are compressed
92+
<FilesMatch \.css\.gz$>
93+
ForceType text/css
94+
Header set Content-Encoding gzip
95+
SetEnv no-gzip
96+
</FilesMatch>
97+
<FilesMatch \.js\.gz$>
98+
ForceType text/javascript
99+
Header set Content-Encoding gzip
100+
SetEnv no-gzip
101+
</FilesMatch>
102+
<FilesMatch \.svg\.gz$>
103+
ForceType image/svg+xml
104+
Header set Content-Encoding gzip
105+
SetEnv no-gzip
106+
</FilesMatch>
107+
108+
<LocationMatch "^/(assets|webpack)">
109+
Options SymLinksIfOwnerMatch
110+
AllowOverride None
111+
Require all granted
112+
113+
# Use standard http expire header for assets instead of ETag
114+
<IfModule mod_expires.c>
115+
Header unset ETag
116+
FileETag None
117+
ExpiresActive On
118+
ExpiresDefault "access plus 1 year"
119+
</IfModule>
120+
121+
# Return compressed assets if they are precompiled
122+
RewriteEngine On
123+
# Make sure the browser supports gzip encoding and file with .gz added
124+
# does exist on disc before we rewrite with the extension
125+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
126+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
127+
RewriteCond %{REQUEST_FILENAME}.gz -s
128+
RewriteRule ^(.+) $1.gz [L]
129+
</LocationMatch>
130+
131+
AddDefaultCharset UTF-8
132+
</VirtualHost>

‎tests/httpd_test.py‎

Lines changed: 33 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
HTTP_PORT = 80
33
HTTPS_PORT = 443
44
HTTPD_PUB_DIR = '/var/www/html/pub'
5+
CURL_CMD = "curl --silent --output /dev/null"
56

67
def test_httpd_service(server):
78
httpd = server.service("httpd")
@@ -16,25 +17,39 @@ def test_https_port(server):
1617
httpd = server.addr(HTTP_HOST)
1718
assert httpd.port(HTTPS_PORT).is_reachable
1819

20+
def test_http_foreman_ping(server, server_fqdn):
21+
cmd = server.run(f"{CURL_CMD} --write-out '%{{stderr}}%{{http_code}}' http://{server_fqdn}/api/v2/ping")
22+
assert cmd.succeeded
23+
assert cmd.stderr == '301'
24+
1925
def test_https_foreman_ping(server, certificates, server_fqdn):
20-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/api/v2/ping")
26+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/api/v2/ping")
2127
assert cmd.succeeded
2228
assert cmd.stdout == '200'
2329

24-
def test_https_pulp_status(server, certificates, server_fqdn):
25-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pulp/api/v3/status/")
30+
def test_http_pulp_api_status(server, server_fqdn):
31+
cmd = server.run(f"{CURL_CMD} --write-out '%{{http_code}}' http://{server_fqdn}/pulp/api/v3/status/")
32+
assert cmd.succeeded
33+
assert cmd.stdout == '404'
34+
35+
def test_https_pulp_api_status(server, certificates, server_fqdn):
36+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/pulp/api/v3/status/")
2637
assert cmd.succeeded
2738
assert cmd.stdout == '200'
2839

40+
def test_http_pulp_content(server, server_fqdn):
41+
cmd = server.run(f"{CURL_CMD} --write-out '%{{stderr}}%{{http_code}}' http://{server_fqdn}/pulp/content/")
42+
assert cmd.succeeded
43+
assert cmd.stderr == '200'
44+
2945
def test_https_pulp_content(server, certificates, server_fqdn):
30-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pulp/content/")
46+
cmd = server.run(f"curl --silent --cacert {certificates['ca_certificate']} https://{server_fqdn}/pulp/content/")
3147
assert cmd.succeeded
32-
assert cmd.stdout == '200'
48+
assert "Index of /pulp/content/" in cmd.stdout
3349

3450
def test_https_pulp_auth(server, certificates, server_fqdn):
35-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --write-out '%{{stderr}}%{{http_code}}' --cert {certificates['client_certificate']} --key {certificates['client_key']} https://{server_fqdn}/pulp/api/v3/users/")
51+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' --cert {certificates['client_certificate']} --key {certificates['client_key']} https://{server_fqdn}/pulp/api/v3/users/")
3652
assert cmd.succeeded
37-
assert cmd.stderr == '200'
3853

3954
def test_pub_directory_exists(server):
4055
pub_dir = server.file(HTTPD_PUB_DIR)
@@ -51,3 +66,14 @@ def test_pub_ca_certificate_downloadable(server, certificates, server_fqdn):
5166
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pub/katello-server-ca.crt")
5267
assert cmd.succeeded
5368
assert cmd.stdout == '200'
69+
assert cmd.stdout == '200'
70+
71+
def test_http_foreman_login(server, server_fqdn):
72+
cmd = server.run(f"{CURL_CMD} --write-out '%{{http_code}}' http://{server_fqdn}/users/login")
73+
assert cmd.succeeded
74+
assert cmd.stdout == '301'
75+
76+
def test_https_foreman_login(server, certificates, server_fqdn):
77+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/users/login")
78+
assert cmd.succeeded
79+
assert cmd.stdout == '200'

0 commit comments

Comments
 (0)