Skip to content

Commit a60df53

Browse files
ekohlehelms
ekohl
authored and
ehelms
committed
Add HTTP / HTTPS vhost management
The goal of this is that the module can either manage the vhost itself or attach fragments to another vhost to embed the application. This allows composition.
1 parent 1c16585 commit a60df53

File tree

16 files changed

+715
-65
lines changed

16 files changed

+715
-65
lines changed

‎manifests/apache.pp‎

Lines changed: 145 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,155 @@
11
# Configure an Apache vhost
22
# @api private
3-
class pulpcore::apache {
3+
class pulpcore::apache (
4+
Boolean $manage_selinux_boolean = true,
5+
Stdlib::Port $http_port = 80,
6+
Stdlib::Port $https_port = 443,
7+
Hash[String, Any] $http_vhost_options = {},
8+
Hash[String, Any] $https_vhost_options = {},
9+
Enum['none', 'optional', 'require', 'optional_no_ca'] $ssl_verify_client = 'optional',
10+
) {
11+
$vhost_priority = $pulpcore::apache_vhost_priority
412
$api_path = '/pulp/api/v3'
5-
$api_url = "http://${pulpcore::api_host}:${pulpcore::api_port}${api_path}"
13+
$api_base_url = "http://${pulpcore::api_host}:${pulpcore::api_port}"
14+
$api_url = "${api_base_url}${api_path}"
615
$content_path = '/pulp/content'
7-
$content_url = "http://${pulpcore::content_host}:${pulpcore::content_port}${content_path}"
8-
9-
if $pulpcore::manage_apache {
10-
include apache
11-
apache::vhost { 'pulpcore':
12-
servername => $pulpcore::servername,
13-
port => 80,
14-
priority => '10',
15-
docroot => $pulpcore::apache_docroot,
16-
docroot_owner => $pulpcore::user,
17-
docroot_group => $pulpcore::group,
18-
docroot_mode => '0755',
19-
manage_docroot => true,
20-
proxy_pass => [
21-
{
22-
'path' => $api_path,
23-
'url' => $api_url,
24-
'reverse_urls' => [$api_url],
25-
},
26-
{
27-
'path' => $content_path,
28-
'url' => $content_url,
29-
'reverse_urls' => [$content_url],
30-
},
31-
],
16+
$content_base_url = "http://${pulpcore::content_host}:${pulpcore::content_port}"
17+
$content_url = "${content_base_url}${content_path}"
18+
19+
$docroot_directory = {
20+
'provider' => 'Directory',
21+
'path' => $pulpcore::apache_docroot,
22+
'options' => ['-Indexes', '-FollowSymLinks'],
23+
'allow_override' => ['None'],
24+
}
25+
$content_directory = {
26+
'path' => $content_path,
27+
'provider' => 'location',
28+
'proxy_pass' => [
29+
{
30+
'url' => $content_url,
31+
},
32+
],
33+
'request_headers' => [
34+
'unset X-CLIENT-CERT',
35+
'set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT',
36+
],
37+
}
38+
39+
# Pulp has a default for remote header. Here it's ensured that the end user
40+
# can't send that header to spoof users.
41+
$remote_user_environ_header = $pulpcore::remote_user_environ_name.regsubst(/^HTTP_/, '')
42+
$api_directory = {
43+
'path' => $api_path,
44+
'provider' => 'location',
45+
'proxy_pass' => [
46+
{
47+
'url' => $api_url,
48+
},
49+
],
50+
'request_headers' => [
51+
"unset ${remote_user_environ_header}",
52+
"set ${remote_user_environ_header} \"%{SSL_CLIENT_S_DN_CN}s\" env=SSL_CLIENT_S_DN_CN",
53+
],
54+
}
55+
56+
# Static content is served by the whitenoise application. SELinux prevents
57+
# Apache from serving it directly
58+
$proxy_pass_static = {
59+
'path' => $pulpcore::static_url,
60+
'url' => "${api_base_url}${pulpcore::static_url}",
61+
}
62+
63+
case $pulpcore::apache_http_vhost {
64+
true: {
65+
$http_vhost_name = 'pulpcore'
66+
$http_fragment = undef
67+
68+
include apache
69+
include apache::mod::headers
70+
apache::vhost { $http_vhost_name:
71+
servername => $pulpcore::servername,
72+
port => $http_port,
73+
priority => $vhost_priority,
74+
docroot => $pulpcore::apache_docroot,
75+
manage_docroot => false,
76+
directories => [$docroot_directory, $content_directory],
77+
* => $http_vhost_options,
78+
}
79+
}
80+
false: {
81+
$http_vhost_name = undef
82+
$http_fragment = undef
83+
}
84+
default: {
85+
$http_vhost_name = $pulpcore::apache_http_vhost
86+
$http_fragment = epp('pulpcore/apache-fragment.epp', {
87+
'directories' => [$content_directory],
88+
})
89+
}
90+
}
91+
92+
case $pulpcore::apache_https_vhost {
93+
true: {
94+
$https_vhost_name = 'pulpcore-https'
95+
$https_fragment = undef
96+
97+
include apache
98+
include apache::mod::headers
99+
apache::vhost { $https_vhost_name:
100+
servername => $pulpcore::servername,
101+
port => $https_port,
102+
ssl => true,
103+
priority => $vhost_priority,
104+
docroot => $pulpcore::apache_docroot,
105+
manage_docroot => false,
106+
directories => [$docroot_directory, $content_directory, $api_directory],
107+
proxy_pass => [$proxy_pass_static],
108+
ssl_cert => $pulpcore::apache_https_cert,
109+
ssl_key => $pulpcore::apache_https_key,
110+
ssl_chain => $pulpcore::apache_https_chain,
111+
ssl_ca => $pulpcore::apache_https_ca,
112+
ssl_verify_client => $ssl_verify_client,
113+
* => $https_vhost_options,
114+
}
115+
}
116+
false: {
117+
$https_vhost_name = undef
118+
$https_fragment = undef
119+
}
120+
default: {
121+
$https_vhost_name = $pulpcore::apache_https_vhost
122+
$https_fragment = epp('pulpcore/apache-fragment.epp', {
123+
'directories' => [$content_directory, $api_directory],
124+
'proxy_pass' => [$proxy_pass_static],
125+
})
126+
}
127+
}
128+
129+
if $pulpcore::apache_http_vhost == true or $pulpcore::apache_https_vhost == true {
130+
file { $pulpcore::apache_docroot:
131+
ensure => directory,
132+
owner => $pulpcore::user,
133+
group => $pulpcore::group,
134+
mode => '0755',
135+
}
136+
}
137+
138+
if $http_fragment or $https_fragment {
139+
pulpcore::apache::fragment { 'pulpcore':
140+
http_content => $http_fragment,
141+
https_content => $https_fragment,
32142
}
143+
}
33144

145+
if $manage_selinux_boolean and ($pulpcore::apache_http_vhost or $pulpcore::apache_https_vhost) {
146+
# Doesn't use selinux::boolean since that doesn't use ensure_resource which
147+
# then conflict with the foreman module which doesn't use the selinux module.
34148
if $facts['os']['selinux']['enabled'] {
35-
selinux::boolean { 'httpd_can_network_connect': }
149+
ensure_resource('selboolean', 'httpd_can_network_connect', {
150+
value => 'on',
151+
persistent => true,
152+
})
36153
}
37154
}
38155
}

‎manifests/apache/fragment.pp‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# @summary Deploy an Apache fragment. Only intended to be used within the module
2+
# @param order
3+
# This determines the order. See apache::vhost for more details.
4+
# 165 is chosen because it's just before the Proxy setup. In Foreman a
5+
# ProxyPass /pulp ! is generated and by placing all content before that, a
6+
# broken setup is avoided.
7+
# @api private
8+
define pulpcore::apache::fragment (
9+
Optional[String] $http_content = undef,
10+
Optional[String] $https_content = undef,
11+
Integer[0] $order = 165,
12+
) {
13+
include pulpcore::apache
14+
15+
if $pulpcore::apache::http_vhost_name and $http_content {
16+
apache::vhost::fragment { "pulpcore-http-${title}":
17+
vhost => $pulpcore::apache::http_vhost_name,
18+
priority => $pulpcore::apache::vhost_priority,
19+
content => $http_content,
20+
order => $order,
21+
}
22+
}
23+
24+
if $pulpcore::apache::https_vhost_name and $https_content {
25+
apache::vhost::fragment { "pulpcore-https-${title}":
26+
vhost => $pulpcore::apache::https_vhost_name,
27+
priority => $pulpcore::apache::vhost_priority,
28+
content => $https_content,
29+
order => $order,
30+
}
31+
}
32+
}

‎manifests/init.pp‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,38 @@
99
# @param user_home
1010
# Pulp user home directory
1111
#
12-
# @param manage_apache
13-
# Deploy a separate apache vhost for pulp3
12+
# @param apache_http_vhost
13+
# When true, deploy a separate apache vhost for pulp3 listening on HTTP.
14+
# When a name is given, fragments are attached to the specified vhost.
15+
# When false, no Apache HTTP vhost is touched.
16+
#
17+
# @param apache_https_vhost
18+
# When true, deploy a separate apache vhost for pulp3 listening on HTTPS.
19+
# When a name is given, fragments are attached to the specified vhost.
20+
# When false, no Apache HTTPS vhost is touched.
21+
#
22+
# @param apache_https_cert
23+
# The certificate file to use in the HTTPS vhost. Only used when
24+
# apache_https_vhost is true.
25+
#
26+
# @param apache_https_key
27+
# The key file to use in the HTTPS vhost. Only used when apache_https_vhost
28+
# is true.
29+
#
30+
# @param apache_https_ca
31+
# The ca file to use in the HTTPS vhost. Only used when apache_https_vhost is
32+
# true. The ca file should contain the certificates allowed to sign client
33+
# certificates. This can be a different CA than the chain.
34+
#
35+
# @param apache_https_chain
36+
# The chain file to use in the HTTPS vhost. Only used when apache_https_vhost
37+
# is true. The chain file should contain the CA certificate an any
38+
# intermediate certificates that signed the certificate.
39+
#
40+
# @param apache_vhost_priority
41+
# The Apache vhost priority. When a name is passed to apache_http_vhost or
42+
# apache_https_vhost, this will be used when attaching fragments to those
43+
# vhosts. Note that this implies both vhosts need to have the same priority.
1444
#
1545
# @param api_host
1646
# API service host
@@ -119,9 +149,15 @@
119149
Stdlib::Absolutepath $chunked_upload_dir = '/var/lib/pulp/upload',
120150
Stdlib::Absolutepath $media_root = '/var/lib/pulp/media',
121151
Stdlib::Absolutepath $static_root = '/var/lib/pulp/assets',
122-
String[1] $static_url = '/assets/',
152+
Pattern['^/.+/$'] $static_url = '/assets/',
123153
Stdlib::Absolutepath $apache_docroot = '/var/lib/pulp/docroot',
124-
Boolean $manage_apache = true,
154+
Variant[Boolean, String[1]] $apache_http_vhost = true,
155+
Variant[Boolean, String[1]] $apache_https_vhost = true,
156+
Optional[Stdlib::Absolutepath] $apache_https_cert = undef,
157+
Optional[Stdlib::Absolutepath] $apache_https_key = undef,
158+
Optional[Stdlib::Absolutepath] $apache_https_ca = undef,
159+
Optional[Stdlib::Absolutepath] $apache_https_chain = undef,
160+
String[1] $apache_vhost_priority = '10',
125161
Stdlib::Host $api_host = '127.0.0.1',
126162
Stdlib::Port $api_port = 24817,
127163
Stdlib::Host $content_host = '127.0.0.1',

‎manifests/plugin.pp‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,17 @@
55
#
66
# @param config
77
# An optional config in the Pulp settings file
8+
#
9+
# @param http_content
10+
# Optional fragment for the Apache HTTP vhost
11+
#
12+
# @param https_content
13+
# Optional fragment for the Apache HTTPS vhost
814
define pulpcore::plugin(
915
String $package_name = "python3-pulp-${title}",
1016
Optional[String] $config = undef,
17+
Optional[String] $http_content = undef,
18+
Optional[String] $https_content = undef,
1119
) {
1220
package { $package_name:
1321
ensure => present,
@@ -20,4 +28,11 @@
2028
order => '10',
2129
}
2230
}
31+
32+
if $http_content or $https_content {
33+
pulpcore::apache::fragment { "plugin-${title}":
34+
http_content => $http_content,
35+
https_content => $https_content,
36+
}
37+
}
2338
}

‎manifests/plugin/container.pp‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,40 @@
11
# @summary Pulp Container plugin
2-
class pulpcore::plugin::container {
2+
# @param location_prefix
3+
# In the Apache configuration a location with this prefix is exposed. The
4+
# version (currently v2) will be appended.
5+
# @param registry_version_path
6+
# The path beneath the location prefix to forward. This is also appended to
7+
# the content base url.
8+
class pulpcore::plugin::container (
9+
String $location_prefix = '/pulpcore_registry',
10+
String $registry_version_path = '/v2/',
11+
) {
12+
$context = {
13+
'directories' => [
14+
{
15+
'provider' => 'location',
16+
'path' => "${location_prefix}${registry_version_path}",
17+
'proxy_pass' => [
18+
{
19+
'url' => "${pulpcore::apache::api_base_url}${registry_version_path}",
20+
},
21+
],
22+
'request_headers' => [
23+
"unset ${pulpcore::apache::remote_user_environ_header}",
24+
"set ${pulpcore::apache::remote_user_environ_header} \"%{SSL_CLIENT_S_DN_CN}s\" env=SSL_CLIENT_S_DN_CN",
25+
],
26+
},
27+
],
28+
'proxy_pass' => [
29+
{
30+
'path' => '/pulp/container/',
31+
'url' => "${pulpcore::apache::content_base_url}/pulp/container/",
32+
},
33+
],
34+
}
35+
336
pulpcore::plugin { 'container':
4-
config => 'TOKEN_AUTH_DISABLED=True',
37+
config => 'TOKEN_AUTH_DISABLED=True',
38+
https_content => epp('pulpcore/apache-fragment.epp', $context),
539
}
640
}

‎manifests/plugin/file.pp‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,34 @@
11
# @summary Pulp File plugin
2-
class pulpcore::plugin::file {
2+
# @param use_pulp2_content_route
3+
# Whether to redirect the legacy (Pulp 2) URLs to the content server
4+
class pulpcore::plugin::file (
5+
Boolean $use_pulp2_content_route = false,
6+
) {
7+
if $use_pulp2_content_route {
8+
$context = {
9+
'directories' => [
10+
{
11+
'provider' => 'location',
12+
'path' => '/pulp/isos',
13+
'proxy_pass' => [
14+
{
15+
'url' => $pulpcore::apache::content_url,
16+
},
17+
],
18+
'request_headers' => [
19+
'unset X-CLIENT-CERT',
20+
'set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT',
21+
],
22+
},
23+
],
24+
}
25+
$content = epp('pulpcore/apache-fragment.epp', $context)
26+
} else {
27+
$content = undef
28+
}
29+
330
pulpcore::plugin { 'file':
31+
http_content => $content,
32+
https_content => $content,
433
}
534
}

0 commit comments

Comments
 (0)