Skip to content

Commit 8df2f52

Browse files
stejskalleosstejskalleos
authored
httpd configuration
* SSL & non-SSL configs for httpd * Rails require_ssl: true
1 parent dab6353 commit 8df2f52

File tree

6 files changed

+141
-14
lines changed

6 files changed

+141
-14
lines changed

‎src/roles/foreman/templates/settings.yaml.j2‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
:ssl_ca_file: /etc/foreman/katello-default-ca.crt
66
:ssl_priv_key: /etc/foreman/client_key.pem
77

8+
:require_ssl: true
9+
810
:rails_cache_store:
911
:type: redis
1012
:urls:

‎src/roles/httpd/tasks/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,14 @@
5858
remote_src: true
5959
mode: "0644"
6060

61+
- name: Configure foreman vhost
62+
ansible.builtin.template:
63+
src: foreman-vhost.conf.j2
64+
dest: /etc/httpd/conf.d/foreman.conf
65+
mode: "0644"
66+
notify:
67+
- Restart httpd
68+
6169
- name: Configure foreman-ssl vhost
6270
ansible.builtin.template:
6371
src: foreman-ssl-vhost.conf.j2

‎src/roles/httpd/templates/foreman-ssl-vhost.conf.j2‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,24 @@
1515
RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
1616
RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
1717
RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"
18-
RequestHeader unset REMOTE_USER
1918
RequestHeader unset REMOTE-USER
19+
RequestHeader unset REMOTE_USER
20+
RequestHeader unset REMOTE-USER-EMAIL
21+
RequestHeader unset REMOTE-USER_EMAIL
22+
RequestHeader unset REMOTE_USER-EMAIL
23+
RequestHeader unset REMOTE_USER_EMAIL
24+
RequestHeader unset REMOTE-USER-FIRSTNAME
25+
RequestHeader unset REMOTE-USER_FIRSTNAME
26+
RequestHeader unset REMOTE_USER-FIRSTNAME
27+
RequestHeader unset REMOTE_USER_FIRSTNAME
28+
RequestHeader unset REMOTE-USER-LASTNAME
29+
RequestHeader unset REMOTE-USER_LASTNAME
30+
RequestHeader unset REMOTE_USER-LASTNAME
31+
RequestHeader unset REMOTE_USER_LASTNAME
32+
RequestHeader unset REMOTE-USER-GROUPS
33+
RequestHeader unset REMOTE-USER_GROUPS
34+
RequestHeader unset REMOTE_USER-GROUPS
35+
RequestHeader unset REMOTE_USER_GROUPS
2036

2137
## SSL directives
2238
SSLEngine on
@@ -77,8 +93,9 @@
7793
ProxyPass /pulp !
7894
ProxyPass /pub !
7995
ProxyPass /icons !
96+
ProxyPass /images !
8097
ProxyPass /server-status !
81-
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900
98+
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900 upgrade=websocket
8299
ProxyPassReverse / {{ httpd_foreman_backend }}/
83100

84101
AddDefaultCharset UTF-8

‎src/roles/httpd/templates/foreman-vhost.conf.j2‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<VirtualHost *:80>
2+
ServerName {{ ansible_facts['fqdn'] }}
3+
4+
## Load additional static includes
5+
IncludeOptional "/etc/httpd/conf.d/05-foreman.d/*.conf"
6+
7+
## Logging
8+
ErrorLog "/var/log/httpd/foreman_error.log"
9+
ServerSignature Off
10+
CustomLog "/var/log/httpd/foreman_access.log" combined
11+
12+
## Request header rules
13+
## as per http://httpd.apache.org/docs/2.4/mod/mod_headers.html#requestheader
14+
RequestHeader set X-FORWARDED-PROTO "http"
15+
RequestHeader set SSL-CLIENT-S-DN ""
16+
RequestHeader set SSL-CLIENT-CERT ""
17+
RequestHeader set SSL-CLIENT-VERIFY ""
18+
RequestHeader unset REMOTE-USER
19+
RequestHeader unset REMOTE_USER
20+
RequestHeader unset REMOTE-USER-EMAIL
21+
RequestHeader unset REMOTE-USER_EMAIL
22+
RequestHeader unset REMOTE_USER-EMAIL
23+
RequestHeader unset REMOTE_USER_EMAIL
24+
RequestHeader unset REMOTE-USER-FIRSTNAME
25+
RequestHeader unset REMOTE-USER_FIRSTNAME
26+
RequestHeader unset REMOTE_USER-FIRSTNAME
27+
RequestHeader unset REMOTE_USER_FIRSTNAME
28+
RequestHeader unset REMOTE-USER-LASTNAME
29+
RequestHeader unset REMOTE-USER_LASTNAME
30+
RequestHeader unset REMOTE_USER-LASTNAME
31+
RequestHeader unset REMOTE_USER_LASTNAME
32+
RequestHeader unset REMOTE-USER-GROUPS
33+
RequestHeader unset REMOTE-USER_GROUPS
34+
RequestHeader unset REMOTE_USER-GROUPS
35+
RequestHeader unset REMOTE_USER_GROUPS
36+
37+
<Location "/pulp/content">
38+
RequestHeader unset X-CLIENT-CERT
39+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
40+
RequestHeader set X-FORWARDED-PROTO expr=%{REQUEST_SCHEME}
41+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
42+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
43+
</Location>
44+
45+
Alias /pub /var/www/html/pub
46+
47+
<Location /pub>
48+
Options +FollowSymLinks +Indexes
49+
Require all granted
50+
</Location>
51+
52+
## Proxy rules
53+
ProxyRequests Off
54+
ProxyPreserveHost On
55+
ProxyAddHeaders On
56+
ProxyPass /pulp !
57+
ProxyPass /pub !
58+
ProxyPass /icons !
59+
ProxyPass /images !
60+
ProxyPass /server-status !
61+
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900 upgrade=websocket
62+
ProxyPassReverse / {{ httpd_foreman_backend }}/
63+
64+
AddDefaultCharset UTF-8
65+
</VirtualHost>

‎tests/foreman_test.py‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22

33
import pytest
44

5-
65
FOREMAN_HOST = 'localhost'
76
FOREMAN_PORT = 3000
7+
88
RECURRING_INSTANCES = [
99
"reports-daily",
1010
"db-sessions-clear",
@@ -16,10 +16,9 @@
1616
"ldap-refresh_usergroups",
1717
]
1818

19-
2019
@pytest.fixture(scope="module")
2120
def foreman_status_curl(server):
22-
return server.run(f"curl --silent --write-out '%{{stderr}}%{{http_code}}' http://{FOREMAN_HOST}:{FOREMAN_PORT}/api/v2/ping")
21+
return server.run(f"curl --header 'X-FORWARDED-PROTO: https' --silent --write-out '%{{stderr}}%{{http_code}}' http://{FOREMAN_HOST}:{FOREMAN_PORT}/api/v2/ping")
2322

2423

2524
@pytest.fixture(scope="module")

‎tests/httpd_test.py‎

Lines changed: 45 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
HTTP_PORT = 80
33
HTTPS_PORT = 443
44
HTTPD_PUB_DIR = '/var/www/html/pub'
5+
CURL_CMD = "curl --silent --output /dev/null"
56

67
def test_httpd_service(server):
78
httpd = server.service("httpd")
@@ -16,38 +17,73 @@ def test_https_port(server):
1617
httpd = server.addr(HTTP_HOST)
1718
assert httpd.port(HTTPS_PORT).is_reachable
1819

20+
def test_http_foreman_ping(server, server_fqdn):
21+
cmd = server.run(f"{CURL_CMD} --write-out '%{{redirect_url}}' http://{server_fqdn}/api/v2/ping")
22+
assert cmd.succeeded
23+
assert cmd.stdout == f'https://{server_fqdn}/api/v2/ping'
24+
1925
def test_https_foreman_ping(server, certificates, server_fqdn):
20-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/api/v2/ping")
26+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/api/v2/ping")
2127
assert cmd.succeeded
2228
assert cmd.stdout == '200'
2329

24-
def test_https_pulp_status(server, certificates, server_fqdn):
25-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pulp/api/v3/status/")
30+
def test_http_pulp_api_status(server, server_fqdn):
31+
cmd = server.run(f"{CURL_CMD} --write-out '%{{http_code}}' http://{server_fqdn}/pulp/api/v3/status/")
32+
assert cmd.succeeded
33+
assert cmd.stdout == '404'
34+
35+
def test_https_pulp_api_status(server, certificates, server_fqdn):
36+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/pulp/api/v3/status/")
2637
assert cmd.succeeded
2738
assert cmd.stdout == '200'
2839

40+
def test_http_pulp_content(server, server_fqdn):
41+
cmd = server.run(f"{CURL_CMD} --write-out '%{{stderr}}%{{http_code}}' http://{server_fqdn}/pulp/content/")
42+
assert cmd.succeeded
43+
assert cmd.stderr == '200'
44+
2945
def test_https_pulp_content(server, certificates, server_fqdn):
30-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pulp/content/")
46+
cmd = server.run(f"curl --silent --cacert {certificates['ca_certificate']} https://{server_fqdn}/pulp/content/")
3147
assert cmd.succeeded
32-
assert cmd.stdout == '200'
48+
assert "Index of /pulp/content/" in cmd.stdout
3349

3450
def test_https_pulp_auth(server, certificates, server_fqdn):
35-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --write-out '%{{stderr}}%{{http_code}}' --cert {certificates['client_certificate']} --key {certificates['client_key']} https://{server_fqdn}/pulp/api/v3/users/")
51+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' --cert {certificates['client_certificate']} --key {certificates['client_key']} https://{server_fqdn}/pulp/api/v3/users/")
3652
assert cmd.succeeded
37-
assert cmd.stderr == '200'
53+
assert cmd.stdout == '200'
3854

3955
def test_pub_directory_exists(server):
4056
pub_dir = server.file(HTTPD_PUB_DIR)
4157
assert pub_dir.exists
4258
assert pub_dir.is_directory
4359
assert pub_dir.mode == 0o755
4460

45-
def test_pub_directory_accessible(server, certificates, server_fqdn):
61+
def test_http_pub_directory_accessible(server, server_fqdn):
62+
cmd = server.run(f"curl --silent --output /dev/null --write-out '%{{http_code}}' http://{server_fqdn}/pub/")
63+
assert cmd.succeeded
64+
assert cmd.stdout == '200'
65+
66+
def test_https_pub_directory_accessible(server, certificates, server_fqdn):
4667
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pub/")
4768
assert cmd.succeeded
4869
assert cmd.stdout == '200'
4970

50-
def test_pub_ca_certificate_downloadable(server, certificates, server_fqdn):
71+
def test_http_pub_ca_certificate_downloadable(server, server_fqdn):
72+
cmd = server.run(f"curl --silent --output /dev/null --write-out '%{{http_code}}' http://{server_fqdn}/pub/katello-server-ca.crt")
73+
assert cmd.succeeded
74+
assert cmd.stdout == '200'
75+
76+
def test_https_pub_ca_certificate_downloadable(server, certificates, server_fqdn):
5177
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pub/katello-server-ca.crt")
5278
assert cmd.succeeded
5379
assert cmd.stdout == '200'
80+
81+
def test_http_foreman_login(server, server_fqdn):
82+
cmd = server.run(f"{CURL_CMD} --write-out '%{{http_code}}' http://{server_fqdn}/users/login")
83+
assert cmd.succeeded
84+
assert cmd.stdout == '301'
85+
86+
def test_https_foreman_login(server, certificates, server_fqdn):
87+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/users/login")
88+
assert cmd.succeeded
89+
assert cmd.stdout == '200'

0 commit comments

Comments
 (0)