Skip to content

Commit ec009f7

Browse files
stejskalleosstejskalleos
committed
:443 & :80 conf updated
added rails require: true skipped /pub configuration (handled in different PR)
1 parent 9564044 commit ec009f7

File tree

4 files changed

+202
-43
lines changed

4 files changed

+202
-43
lines changed

‎src/roles/foreman/templates/settings.yaml.j2‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
:ssl_priv_key: /etc/foreman/client_key.pem
77

88
:require_ssl: true
9-
:unattended: true
109

1110
:rails_cache_store:
1211
:type: redis

‎src/roles/httpd/templates/foreman-ssl-vhost.conf.j2‎

Lines changed: 83 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,24 @@
1515
RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
1616
RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
1717
RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"
18-
RequestHeader unset REMOTE_USER
1918
RequestHeader unset REMOTE-USER
19+
RequestHeader unset REMOTE_USER
20+
RequestHeader unset REMOTE-USER-EMAIL
21+
RequestHeader unset REMOTE-USER_EMAIL
22+
RequestHeader unset REMOTE_USER-EMAIL
23+
RequestHeader unset REMOTE_USER_EMAIL
24+
RequestHeader unset REMOTE-USER-FIRSTNAME
25+
RequestHeader unset REMOTE-USER_FIRSTNAME
26+
RequestHeader unset REMOTE_USER-FIRSTNAME
27+
RequestHeader unset REMOTE_USER_FIRSTNAME
28+
RequestHeader unset REMOTE-USER-LASTNAME
29+
RequestHeader unset REMOTE-USER_LASTNAME
30+
RequestHeader unset REMOTE_USER-LASTNAME
31+
RequestHeader unset REMOTE_USER_LASTNAME
32+
RequestHeader unset REMOTE-USER-GROUPS
33+
RequestHeader unset REMOTE-USER_GROUPS
34+
RequestHeader unset REMOTE_USER-GROUPS
35+
RequestHeader unset REMOTE_USER_GROUPS
2036

2137
## SSL directives
2238
SSLEngine on
@@ -45,6 +61,27 @@
4561
ProxyPass /pulp/container/ {{ httpd_pulp_content_backend }}/pulp/container/
4662
ProxyPassReverse /pulp/container/ {{ httpd_pulp_content_backend }}/pulp/container/
4763

64+
<Location "/pulp/deb">
65+
RequestHeader unset X-CLIENT-CERT
66+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
67+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
68+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
69+
</Location>
70+
71+
<Location "/pulp/isos">
72+
RequestHeader unset X-CLIENT-CERT
73+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
74+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
75+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
76+
</Location>
77+
78+
<Location "/pulp/repos">
79+
RequestHeader unset X-CLIENT-CERT
80+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
81+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
82+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
83+
</Location>
84+
4885
<Location "/pulp/content">
4986
RequestHeader unset X-CLIENT-CERT
5087
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
@@ -76,10 +113,52 @@
76113
ProxyAddHeaders On
77114
ProxyPass /pulp !
78115
ProxyPass /pub !
79-
ProxyPass /icons !
80-
ProxyPass /server-status !
81-
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900
116+
{# ProxyPass /icons ! #}
117+
{# ProxyPass /images ! #}
118+
{# ProxyPass /server-status ! #}
119+
{# ProxyPass /webpack ! #}
120+
{# ProxyPass /assets ! #}
121+
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900 upgrade=websocket
82122
ProxyPassReverse / {{ httpd_foreman_backend }}/
83123

124+
<FilesMatch \.css\.gz$>
125+
ForceType text/css
126+
Header set Content-Encoding gzip
127+
SetEnv no-gzip
128+
</FilesMatch>
129+
<FilesMatch \.js\.gz$>
130+
ForceType text/javascript
131+
Header set Content-Encoding gzip
132+
SetEnv no-gzip
133+
</FilesMatch>
134+
<FilesMatch \.svg\.gz$>
135+
ForceType image/svg+xml
136+
Header set Content-Encoding gzip
137+
SetEnv no-gzip
138+
</FilesMatch>
139+
140+
<LocationMatch "^/(assets|webpack)">
141+
Options SymLinksIfOwnerMatch
142+
AllowOverride None
143+
Require all granted
144+
145+
# Use standard http expire header for assets instead of ETag
146+
<IfModule mod_expires.c>
147+
Header unset ETag
148+
FileETag None
149+
ExpiresActive On
150+
ExpiresDefault "access plus 1 year"
151+
</IfModule>
152+
153+
# Return compressed assets if they are precompiled
154+
RewriteEngine On
155+
# Make sure the browser supports gzip encoding and file with .gz added
156+
# does exist on disc before we rewrite with the extension
157+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
158+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
159+
RewriteCond %{REQUEST_FILENAME}.gz -s
160+
RewriteRule ^(.+) $1.gz [L]
161+
</LocationMatch>
162+
84163
AddDefaultCharset UTF-8
85164
</VirtualHost>

‎src/roles/httpd/templates/foreman-vhost.conf.j2‎

Lines changed: 93 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -15,43 +15,118 @@
1515
RequestHeader set SSL-CLIENT-S-DN ""
1616
RequestHeader set SSL-CLIENT-CERT ""
1717
RequestHeader set SSL-CLIENT-VERIFY ""
18-
RequestHeader unset REMOTE_USER
1918
RequestHeader unset REMOTE-USER
19+
RequestHeader unset REMOTE_USER
20+
RequestHeader unset REMOTE-USER-EMAIL
21+
RequestHeader unset REMOTE-USER_EMAIL
22+
RequestHeader unset REMOTE_USER-EMAIL
23+
RequestHeader unset REMOTE_USER_EMAIL
24+
RequestHeader unset REMOTE-USER-FIRSTNAME
25+
RequestHeader unset REMOTE-USER_FIRSTNAME
26+
RequestHeader unset REMOTE_USER-FIRSTNAME
27+
RequestHeader unset REMOTE_USER_FIRSTNAME
28+
RequestHeader unset REMOTE-USER-LASTNAME
29+
RequestHeader unset REMOTE-USER_LASTNAME
30+
RequestHeader unset REMOTE_USER-LASTNAME
31+
RequestHeader unset REMOTE_USER_LASTNAME
32+
RequestHeader unset REMOTE-USER-GROUPS
33+
RequestHeader unset REMOTE-USER_GROUPS
34+
RequestHeader unset REMOTE_USER-GROUPS
35+
RequestHeader unset REMOTE_USER_GROUPS
2036

21-
ProxyPass /pulp_ansible/galaxy/ {{ httpd_pulp_api_backend }}/pulp_ansible/galaxy/
22-
ProxyPassReverse /pulp_ansible/galaxy/ {{ httpd_pulp_api_backend }}/pulp_ansible/galaxy/
37+
<Location "/pulp/deb">
38+
RequestHeader unset X-CLIENT-CERT
39+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
40+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
41+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
42+
</Location>
2343

24-
<Location "/pulpcore_registry/v2/">
25-
RequestHeader unset REMOTE_USER
26-
RequestHeader unset REMOTE-USER
27-
ProxyPass {{ httpd_pulp_api_backend }}/v2/
28-
ProxyPassReverse {{ httpd_pulp_api_backend }}/v2/
44+
<Location "/pulp/isos">
45+
RequestHeader unset X-CLIENT-CERT
46+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
47+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
48+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
2949
</Location>
3050

31-
ProxyPass /pulp/container/ {{ httpd_pulp_content_backend }}/pulp/container/
32-
ProxyPassReverse /pulp/container/ {{ httpd_pulp_content_backend }}/pulp/container/
51+
<Location "/pulp/repos">
52+
RequestHeader unset X-CLIENT-CERT
53+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
54+
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
55+
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
56+
</Location>
3357

3458
<Location "/pulp/content">
59+
RequestHeader unset X-CLIENT-CERT
60+
RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
61+
RequestHeader set X-FORWARDED-PROTO expr=%{REQUEST_SCHEME}
3562
ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
3663
ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
3764
</Location>
3865

39-
<Location "/pulp/api/v3">
40-
RedirectPermanent /pulp/api/v3 https://{{ ansible_facts['fqdn'] }}/pulp/api/v3
41-
</Location>
66+
Alias /pub /var/www/html/pub
4267

43-
ProxyPass /pulp/assets/ {{ httpd_pulp_api_backend }}/pulp/assets/
44-
ProxyPassReverse /pulp/assets/ {{ httpd_pulp_api_backend }}/pulp/assets/
68+
<Location /pub>
69+
Options +FollowSymLinks +Indexes
70+
Require all granted
71+
</Location>
4572

4673
## Proxy rules
4774
ProxyRequests Off
4875
ProxyPreserveHost On
4976
ProxyAddHeaders On
5077
ProxyPass /pulp !
51-
ProxyPass /icons !
52-
ProxyPass /server-status !
53-
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900
78+
ProxyPass /pub !
79+
{# ProxyPass /icons ! #}
80+
{# ProxyPass /images ! #}
81+
{# ProxyPass /server-status ! #}
82+
{# ProxyPass /webpack ! #}
83+
{# ProxyPass /assets ! #}
84+
ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900 upgrade=websocket
5485
ProxyPassReverse / {{ httpd_foreman_backend }}/
5586

87+
## Server aliases
88+
ServerAlias foreman
89+
90+
## Custom fragment
91+
# Set headers for all possible assets which are compressed
92+
<FilesMatch \.css\.gz$>
93+
ForceType text/css
94+
Header set Content-Encoding gzip
95+
SetEnv no-gzip
96+
</FilesMatch>
97+
<FilesMatch \.js\.gz$>
98+
ForceType text/javascript
99+
Header set Content-Encoding gzip
100+
SetEnv no-gzip
101+
</FilesMatch>
102+
<FilesMatch \.svg\.gz$>
103+
ForceType image/svg+xml
104+
Header set Content-Encoding gzip
105+
SetEnv no-gzip
106+
</FilesMatch>
107+
108+
<LocationMatch "^/(assets|webpack)">
109+
Options SymLinksIfOwnerMatch
110+
AllowOverride None
111+
Require all granted
112+
113+
# Use standard http expire header for assets instead of ETag
114+
<IfModule mod_expires.c>
115+
Header unset ETag
116+
FileETag None
117+
ExpiresActive On
118+
ExpiresDefault "access plus 1 year"
119+
</IfModule>
120+
121+
# Return compressed assets if they are precompiled
122+
RewriteEngine On
123+
# Make sure the browser supports gzip encoding and file with .gz added
124+
# does exist on disc before we rewrite with the extension
125+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
126+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
127+
RewriteCond %{REQUEST_FILENAME}.gz -s
128+
RewriteRule ^(.+) $1.gz [L]
129+
</LocationMatch>
130+
56131
AddDefaultCharset UTF-8
57132
</VirtualHost>

‎tests/httpd_test.py‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
HTTP_PORT = 80
33
HTTPS_PORT = 443
44
HTTPD_PUB_DIR = '/var/www/html/pub'
5+
CURL_CMD = "curl --silent --output /dev/null"
56

67
def test_httpd_service(server):
78
httpd = server.service("httpd")
@@ -16,25 +17,39 @@ def test_https_port(server):
1617
httpd = server.addr(HTTP_HOST)
1718
assert httpd.port(HTTPS_PORT).is_reachable
1819

20+
def test_http_foreman_ping(server, server_fqdn):
21+
cmd = server.run(f"{CURL_CMD} --write-out '%{{stderr}}%{{http_code}}' http://{server_fqdn}/api/v2/ping")
22+
assert cmd.succeeded
23+
assert cmd.stderr == '301'
24+
1925
def test_https_foreman_ping(server, certificates, server_fqdn):
20-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/api/v2/ping")
26+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/api/v2/ping")
2127
assert cmd.succeeded
2228
assert cmd.stdout == '200'
2329

24-
def test_https_pulp_status(server, certificates, server_fqdn):
25-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pulp/api/v3/status/")
30+
def test_http_pulp_api_status(server, server_fqdn):
31+
cmd = server.run(f"{CURL_CMD} --write-out '%{{http_code}}' http://{server_fqdn}/pulp/api/v3/status/")
32+
assert cmd.succeeded
33+
assert cmd.stdout == '404'
34+
35+
def test_https_pulp_api_status(server, certificates, server_fqdn):
36+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/pulp/api/v3/status/")
2637
assert cmd.succeeded
2738
assert cmd.stdout == '200'
2839

40+
def test_http_pulp_content(server, server_fqdn):
41+
cmd = server.run(f"{CURL_CMD} --write-out '%{{stderr}}%{{http_code}}' http://{server_fqdn}/pulp/content/")
42+
assert cmd.succeeded
43+
assert cmd.stderr == '200'
44+
2945
def test_https_pulp_content(server, certificates, server_fqdn):
30-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pulp/content/")
46+
cmd = server.run(f"curl --silent --cacert {certificates['ca_certificate']} https://{server_fqdn}/pulp/content/")
3147
assert cmd.succeeded
32-
assert cmd.stdout == '200'
48+
assert "Index of /pulp/content/" in cmd.stdout
3349

3450
def test_https_pulp_auth(server, certificates, server_fqdn):
35-
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --write-out '%{{stderr}}%{{http_code}}' --cert {certificates['client_certificate']} --key {certificates['client_key']} https://{server_fqdn}/pulp/api/v3/users/")
51+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' --cert {certificates['client_certificate']} --key {certificates['client_key']} https://{server_fqdn}/pulp/api/v3/users/")
3652
assert cmd.succeeded
37-
assert cmd.stderr == '200'
3853

3954
def test_pub_directory_exists(server):
4055
pub_dir = server.file(HTTPD_PUB_DIR)
@@ -51,23 +66,14 @@ def test_pub_ca_certificate_downloadable(server, certificates, server_fqdn):
5166
cmd = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://{server_fqdn}/pub/katello-server-ca.crt")
5267
assert cmd.succeeded
5368
assert cmd.stdout == '200'
54-
55-
def test_http_foreman_login(server, server_fqdn):
56-
cmd = server.run(f"curl --silent --output /dev/null --write-out '%{{http_code}}' http://{server_fqdn}/users/login")
57-
assert cmd.succeeded
5869
assert cmd.stdout == '200'
5970

60-
def test_http_pulp_status(server, server_fqdn):
61-
cmd = server.run(f"curl --silent --output /dev/null --write-out '%{{http_code}}' http://{server_fqdn}/pulp/api/v3/status/")
71+
def test_http_foreman_login(server, server_fqdn):
72+
cmd = server.run(f"{CURL_CMD} --write-out '%{{http_code}}' http://{server_fqdn}/users/login")
6273
assert cmd.succeeded
6374
assert cmd.stdout == '301'
6475

65-
def test_http_pulp_content(server, server_fqdn):
66-
cmd = server.run(f"curl --silent --output /dev/null --write-out '%{{http_code}}' http://{server_fqdn}/pulp/content/")
76+
def test_https_foreman_login(server, certificates, server_fqdn):
77+
cmd = server.run(f"{CURL_CMD} --cacert {certificates['ca_certificate']} --write-out '%{{http_code}}' https://{server_fqdn}/users/login")
6778
assert cmd.succeeded
6879
assert cmd.stdout == '200'
69-
70-
def test_http_pulp_content_response(server, server_fqdn):
71-
cmd = server.run(f"curl --silent http://{server_fqdn}/pulp/content/")
72-
assert cmd.succeeded
73-
assert "Index of /pulp/content/" in cmd.stdout

0 commit comments

Comments
 (0)