Skip to content

Commit a40f72f

Browse files
ekohlekohl
committed
[WIP] Add HTTP / HTTPS vhost management
The goal of this is that the module can either manage the vhost itself or attach fragments to another vhost to embed the application. This allows composition.
1 parent 4c61e73 commit a40f72f

File tree

4 files changed

+124
-58
lines changed

4 files changed

+124
-58
lines changed

‎manifests/apache.pp‎

Lines changed: 94 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,115 @@
11
# Configure an Apache vhost
22
# @api private
3-
class pulpcore::apache {
3+
class pulpcore::apache (
4+
String[1] $vhost_priority = '10',
5+
Stdlib::Port $http_port = 80,
6+
Stdlib::Port $https_port = 443,
7+
) {
48
$api_path = '/pulp/api/v3'
59
$api_url = "http://${pulpcore::api_host}:${pulpcore::api_port}${api_path}"
610
$content_path = '/pulp/content'
711
$content_base_url = "http://${pulpcore::content_host}:${pulpcore::content_port}"
812
$content_url = "${content_base_url}${content_path}"
913

10-
if $pulpcore::manage_apache {
11-
$base_directories = [
12-
{
13-
provider => 'directory',
14-
path => $pulpcore::webserver_static_dir,
15-
options => ['Indexes','FollowSymLinks'],
16-
allow_override => ['None'],
17-
},
14+
$base_directories = [
15+
{
16+
provider => 'directory',
17+
path => $pulpcore::webserver_static_dir,
18+
options => ['Indexes','FollowSymLinks'],
19+
allow_override => ['None'],
20+
},
21+
{
22+
'path' => $content_path,
23+
'provider' => 'location',
24+
'request_headers' => [
25+
'unset X-CLIENT-CERT',
26+
'set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT',
27+
],
28+
},
29+
]
30+
31+
if $pulpcore::remote_user_environ_name {
32+
$remote_user_environ_header = $pulpcore::remote_user_environ_name.regsubst(/^HTTP_/, '')
33+
$api_directories = [
1834
{
19-
'path' => $content_path,
35+
'path' => $api_path,
2036
'provider' => 'location',
2137
'request_headers' => [
22-
'unset X-CLIENT-CERT',
23-
'set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT',
38+
"unset ${remote_user_environ_header}",
39+
"set ${remote_user_environ_header} \"%{SSL_CLIENT_S_DN_CN}s\" env=SSL_CLIENT_S_DN_CN",
2440
],
2541
},
2642
]
43+
} else {
44+
$api_directories = []
45+
}
2746

28-
if $pulpcore::remote_user_environ_name {
29-
$remote_user_environ_header = $pulpcore::remote_user_environ_name.regsubst(/^HTTP_/, '')
30-
$api_directories = [
31-
{
32-
'path' => $api_path,
33-
'provider' => 'location',
34-
'request_headers' => [
35-
"unset ${remote_user_environ_header}",
36-
"set ${remote_user_environ_header} \"%{SSL_CLIENT_S_DN_CN}s\" env=SSL_CLIENT_S_DN_CN",
37-
],
38-
},
39-
]
40-
} else {
41-
$api_directories = []
42-
}
47+
case $pulpcore::apache_http_vhost {
48+
true: {
49+
$http_vhost_name = 'pulpcore'
4350

44-
include apache
45-
apache::vhost { 'pulpcore':
46-
servername => $pulpcore::servername,
47-
port => 80,
48-
priority => '10',
49-
docroot => $pulpcore::webserver_static_dir,
50-
directories => $base_directories + $api_directories,
51-
proxy_pass => [
52-
{
53-
'path' => $api_path,
54-
'url' => $api_url,
55-
'reverse_urls' => [$api_url],
56-
},
57-
{
58-
'path' => $content_path,
59-
'url' => $content_url,
60-
'reverse_urls' => [$content_url],
61-
},
62-
],
51+
include apache
52+
apache::vhost { $http_vhost_name:
53+
servername => $pulpcore::servername,
54+
port => $http_port,
55+
priority => $vhost_priority,
56+
docroot => $pulpcore::webserver_static_dir,
57+
directories => $base_directories,
58+
proxy_pass => [
59+
{
60+
'path' => $content_path,
61+
'url' => $content_url,
62+
'reverse_urls' => [$content_url],
63+
},
64+
],
65+
}
66+
67+
}
68+
false: {
69+
$http_vhost_name = undef
6370
}
71+
default: {
72+
$http_vhost_name = $pulpcore::apache_http_vhost
73+
}
74+
}
75+
76+
case $pulpcore::apache_https_vhost {
77+
true: {
78+
$https_vhost_name = 'pulpcore'
79+
80+
include apache
81+
apache::vhost { $https_vhost_name:
82+
servername => $pulpcore::servername,
83+
port => $https_port,
84+
ssl => true,
85+
priority => $vhost_priority,
86+
docroot => $pulpcore::webserver_static_dir,
87+
directories => $base_directories + $api_directories,
88+
proxy_pass => [
89+
{
90+
'path' => $api_path,
91+
'url' => $api_url,
92+
'reverse_urls' => [$api_url],
93+
},
94+
{
95+
'path' => $content_path,
96+
'url' => $content_url,
97+
'reverse_urls' => [$content_url],
98+
},
99+
],
100+
}
64101

65-
if $facts['os']['selinux']['enabled'] {
66-
selinux::boolean { 'httpd_can_network_connect': }
67102
}
103+
false: {
104+
$https_vhost_name = undef
105+
}
106+
default: {
107+
$https_vhost_name = $pulpcore::apache_https_vhost
108+
}
109+
}
110+
111+
# TODO: should this be in the selinux policy?
112+
if $pulpcore::apache_http_vhost or $pulpcore::apache_https_vhost {
113+
selinux::boolean { 'httpd_can_network_connect': }
68114
}
69115
}

‎manifests/apache/fragment.pp‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,26 @@
11
# @summary Deploy an Apache fragment. Only intended to be used within the module
22
# @api private
33
define pulpcore::apache::fragment (
4-
Optional[String] $content = undef,
4+
Optional[String] $http_content = undef,
5+
Optional[String] $https_content = undef,
56
Optional[Integer[0]] $order = undef,
67
) {
7-
if $pulpcore::manage_apache {
8-
apache::vhost::fragment { "pulpcore-${title}":
9-
vhost => 'pulpcore',
10-
priority => '10',
11-
content => $content,
8+
include pulpcore::apache
9+
10+
if $pulpcore::apache::http_vhost_name {
11+
apache::vhost::fragment { "pulpcore-http-${title}":
12+
vhost => $pulpcore::apache::http_vhost_name,
13+
priority => $pulpcore::apache::vhost_priority,
14+
content => $http_content,
15+
order => $order,
16+
}
17+
}
18+
19+
if $pulpcore::apache::https_vhost_name {
20+
apache::vhost::fragment { "pulpcore-https-${title}":
21+
vhost => $pulpcore::apache::https_vhost_name,
22+
priority => $pulpcore::apache::vhost_priority,
23+
content => $https_content,
1224
order => $order,
1325
}
1426
}

‎manifests/init.pp‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,15 @@
1515
# @param user_home
1616
# Pulp user home directory
1717
#
18-
# @param manage_apache
19-
# Deploy a separate apache vhost for pulp3
18+
# @param apache_http_vhost
19+
# When true, deploy a separate apache vhost for pulp3 listening on HTTP.
20+
# When a name is given, fragments are attached to the specified vhost.
21+
# When false, no Apache HTTP vhost is touched.
22+
#
23+
# @param apache_https_vhost
24+
# When true, deploy a separate apache vhost for pulp3 listening on HTTPS.
25+
# When a name is given, fragments are attached to the specified vhost.
26+
# When false, no Apache HTTPS vhost is touched.
2027
#
2128
# @param api_host
2229
# API service host
@@ -92,7 +99,8 @@
9299
String $user = 'pulp',
93100
String $group = 'pulp',
94101
Stdlib::Absolutepath $user_home = '/var/lib/pulp',
95-
Boolean $manage_apache = true,
102+
Variant[Boolean, String[1]] $apache_http_vhost = true,
103+
Variant[Boolean, String[1]] $apache_https_vhost = false,
96104
Stdlib::Host $api_host = '127.0.0.1',
97105
Stdlib::Port $api_port = 24817,
98106
Stdlib::Host $content_host = '127.0.0.1',

‎manifests/plugin/container.pp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,6 @@
1313
$url = "${pulpcore::apache::content_base_url}/v2/"
1414

1515
pulpcore::apache::fragment { 'container':
16-
content => template('pulpcore/plugin/container-apache.erb'),
16+
https_content => template('pulpcore/plugin/container-apache.erb'),
1717
}
1818
}

0 commit comments

Comments
 (0)