Skip to content

Commit a849298

Browse files
ekohlekohl
committed
Add HTTP / HTTPS vhost management
The goal of this is that the module can either manage the vhost itself or attach fragments to another vhost to embed the application. This allows composition.
1 parent 7010bd3 commit a849298

16 files changed

Lines changed: 349 additions & 56 deletions

‎manifests/apache.pp‎

Lines changed: 111 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,122 @@
11
# Configure an Apache vhost
22
# @api private
3-
class pulpcore::apache {
3+
class pulpcore::apache (
4+
String[1] $vhost_priority = '10',
5+
Stdlib::Port $http_port = 80,
6+
Stdlib::Port $https_port = 443,
7+
) {
48
$api_path = '/pulp/api/v3'
59
$api_url = "http://${pulpcore::api_host}:${pulpcore::api_port}${api_path}"
610
$content_path = '/pulp/content'
7-
$content_url = "http://${pulpcore::content_host}:${pulpcore::content_port}${content_path}"
8-
9-
if $pulpcore::manage_apache {
10-
include apache
11-
apache::vhost { 'pulpcore':
12-
servername => $pulpcore::servername,
13-
port => 80,
14-
priority => '10',
15-
docroot => $pulpcore::webserver_static_dir,
16-
proxy_pass => [
17-
{
18-
'path' => $api_path,
19-
'url' => $api_url,
20-
'reverse_urls' => [$api_url],
21-
},
22-
{
23-
'path' => $content_path,
24-
'url' => $content_url,
25-
'reverse_urls' => [$content_url],
26-
},
11+
$content_base_url = "http://${pulpcore::content_host}:${pulpcore::content_port}"
12+
$content_url = "${content_base_url}${content_path}"
13+
14+
$base_directories = [
15+
{
16+
provider => 'directory',
17+
path => $pulpcore::webserver_static_dir,
18+
options => ['Indexes','FollowSymLinks'],
19+
allow_override => ['None'],
20+
},
21+
{
22+
'path' => $content_path,
23+
'provider' => 'location',
24+
'request_headers' => [
25+
'unset X-CLIENT-CERT',
26+
'set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT',
2727
],
28+
},
29+
]
30+
31+
if $pulpcore::remote_user_environ_name {
32+
$remote_user_environ_header = $pulpcore::remote_user_environ_name.regsubst(/^HTTP_/, '')
33+
$api_directories = [
34+
{
35+
'path' => $api_path,
36+
'provider' => 'location',
37+
'request_headers' => [
38+
"unset ${remote_user_environ_header}",
39+
"set ${remote_user_environ_header} \"%{SSL_CLIENT_S_DN_CN}s\" env=SSL_CLIENT_S_DN_CN",
40+
],
41+
},
42+
]
43+
} else {
44+
$api_directories = []
45+
}
46+
47+
$proxy_pass_content = {
48+
'path' => $content_path,
49+
'url' => $content_url,
50+
}
51+
52+
$proxy_pass_api = {
53+
'path' => $api_path,
54+
'url' => $api_url,
55+
}
56+
57+
case $pulpcore::apache_http_vhost {
58+
true: {
59+
$http_vhost_name = 'pulpcore'
60+
$http_fragment = undef
61+
62+
include apache
63+
include apache::mod::headers
64+
apache::vhost { $http_vhost_name:
65+
servername => $pulpcore::servername,
66+
port => $http_port,
67+
priority => $vhost_priority,
68+
docroot => $pulpcore::webserver_static_dir,
69+
directories => $base_directories,
70+
proxy_pass => [$proxy_pass_content],
71+
}
2872
}
73+
false: {
74+
$http_vhost_name = undef
75+
$http_fragment = undef
76+
}
77+
default: {
78+
$http_vhost_name = $pulpcore::apache_http_vhost
79+
$http_fragment = epp('pulpcore/apache-fragment.epp', {'proxy_pass' => [$proxy_pass_content]})
2980

30-
if $facts['os']['selinux']['enabled'] {
31-
selinux::boolean { 'httpd_can_network_connect': }
3281
}
3382
}
83+
84+
case $pulpcore::apache_https_vhost {
85+
true: {
86+
$https_vhost_name = 'pulpcore-https'
87+
$https_fragment = undef
88+
89+
include apache
90+
include apache::mod::headers
91+
apache::vhost { $https_vhost_name:
92+
servername => $pulpcore::servername,
93+
port => $https_port,
94+
ssl => true,
95+
priority => $vhost_priority,
96+
docroot => $pulpcore::webserver_static_dir,
97+
directories => $base_directories + $api_directories,
98+
proxy_pass => [$proxy_pass_api, $proxy_pass_content],
99+
}
100+
}
101+
false: {
102+
$https_vhost_name = undef
103+
$https_fragment = undef
104+
}
105+
default: {
106+
$https_vhost_name = $pulpcore::apache_https_vhost
107+
$https_fragment = epp('pulpcore/apache-fragment.epp', {'proxy_pass' => [$proxy_pass_api, $proxy_pass_content]})
108+
}
109+
}
110+
111+
if $http_fragment or $https_fragment {
112+
pulpcore::apache::fragment { 'pulpcore':
113+
http_content => $http_fragment,
114+
https_content => $https_fragment,
115+
}
116+
}
117+
118+
# TODO: should this be in the selinux policy?
119+
if $pulpcore::apache_http_vhost or $pulpcore::apache_https_vhost {
120+
selinux::boolean { 'httpd_can_network_connect': }
121+
}
34122
}

‎manifests/apache/fragment.pp‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# @summary Deploy an Apache fragment. Only intended to be used within the module
2+
# @api private
3+
define pulpcore::apache::fragment (
4+
Optional[String] $http_content = undef,
5+
Optional[String] $https_content = undef,
6+
Optional[Integer[0]] $order = undef,
7+
) {
8+
include pulpcore::apache
9+
10+
if $pulpcore::apache::http_vhost_name and $http_content {
11+
apache::vhost::fragment { "pulpcore-http-${title}":
12+
vhost => $pulpcore::apache::http_vhost_name,
13+
priority => $pulpcore::apache::vhost_priority,
14+
content => $http_content,
15+
order => $order,
16+
}
17+
}
18+
19+
if $pulpcore::apache::https_vhost_name and $https_content {
20+
apache::vhost::fragment { "pulpcore-https-${title}":
21+
vhost => $pulpcore::apache::https_vhost_name,
22+
priority => $pulpcore::apache::vhost_priority,
23+
content => $https_content,
24+
order => $order,
25+
}
26+
}
27+
}

‎manifests/init.pp‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,15 @@
1515
# @param user_home
1616
# Pulp user home directory
1717
#
18-
# @param manage_apache
19-
# Deploy a separate apache vhost for pulp3
18+
# @param apache_http_vhost
19+
# When true, deploy a separate apache vhost for pulp3 listening on HTTP.
20+
# When a name is given, fragments are attached to the specified vhost.
21+
# When false, no Apache HTTP vhost is touched.
22+
#
23+
# @param apache_https_vhost
24+
# When true, deploy a separate apache vhost for pulp3 listening on HTTPS.
25+
# When a name is given, fragments are attached to the specified vhost.
26+
# When false, no Apache HTTPS vhost is touched.
2027
#
2128
# @param api_host
2229
# API service host
@@ -97,7 +104,8 @@
97104
String $user = 'pulp',
98105
String $group = 'pulp',
99106
Stdlib::Absolutepath $user_home = '/var/lib/pulp',
100-
Boolean $manage_apache = true,
107+
Variant[Boolean, String[1]] $apache_http_vhost = true,
108+
Variant[Boolean, String[1]] $apache_https_vhost = true,
101109
Stdlib::Host $api_host = '127.0.0.1',
102110
Stdlib::Port $api_port = 24817,
103111
Stdlib::Host $content_host = '127.0.0.1',

‎manifests/plugin.pp‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,17 @@
55
#
66
# @param config
77
# An optional config in the Pulp settings file
8+
#
9+
# @param http_content
10+
# Optional fragment for the Apache HTTP vhost
11+
#
12+
# @param https_content
13+
# Optional fragment for the Apache HTTPS vhost
814
define pulpcore::plugin(
915
String $package_name = "python3-pulp-${title}",
1016
Optional[String] $config = undef,
17+
Optional[String] $http_content = undef,
18+
Optional[String] $https_content = undef,
1119
) {
1220
package { $package_name:
1321
ensure => present,
@@ -20,4 +28,12 @@
2028
order => '10',
2129
}
2230
}
31+
32+
if $http_content or $https_content {
33+
# TODO: prio below main
34+
pulpcore::apache::fragment { "plugin-${title}":
35+
http_content => $http_content,
36+
https_content => $https_content,
37+
}
38+
}
2339
}

‎manifests/plugin/container.pp‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,17 @@
11
# @summary Pulp Container plugin
2-
class pulpcore::plugin::container {
2+
# @param location_prefix
3+
# In the Apache configuration a location with this prefix is exposed. The
4+
# version (currently v2) will be appended.
5+
class pulpcore::plugin::container(
6+
String $location_prefix = '/pulpcore_registry',
7+
) {
8+
$context = {
9+
'path' => "${location_prefix}/v2/",
10+
'url' => "${pulpcore::apache::content_base_url}/v2/",
11+
}
12+
313
pulpcore::plugin { 'container':
4-
config => 'TOKEN_AUTH_DISABLED=True',
14+
config => 'TOKEN_AUTH_DISABLED=True',
15+
https_content => epp('pulpcore/plugin-container-apache-fragment.epp', $context),
516
}
617
}

‎manifests/plugin/file.pp‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,22 @@
11
# @summary Pulp File plugin
2-
class pulpcore::plugin::file {
2+
# @param use_pulp2_content_route
3+
# Whether to redirect the legacy (Pulp 2) URLs to the content server
4+
class pulpcore::plugin::file (
5+
Boolean $use_pulp2_content_route = false,
6+
) {
7+
if $use_pulp2_content_route {
8+
$context = {
9+
'path' => '/pulp/isos',
10+
'url' => $pulpcore::apache::content_url,
11+
}
12+
$content = epp('pulpcore/plugin-pulp2-content-routing.epp', $context)
13+
} else {
14+
$content = undef
15+
}
16+
317
pulpcore::plugin { 'file':
18+
http_content => $content,
19+
https_content => $content,
420
}
21+
522
}

‎manifests/plugin/rpm.pp‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,21 @@
11
# @summary Pulp RPM plugin
2-
class pulpcore::plugin::rpm {
2+
# @param use_pulp2_content_route
3+
# Whether to redirect the legacy (Pulp 2) URLs to the content server
4+
class pulpcore::plugin::rpm (
5+
Boolean $use_pulp2_content_route = false,
6+
) {
7+
if $use_pulp2_content_route {
8+
$context = {
9+
'path' => '/pulp/repos',
10+
'url' => $pulpcore::apache::content_url,
11+
}
12+
$content = epp('pulpcore/plugin-pulp2-content-routing.epp', $context)
13+
} else {
14+
$content = undef
15+
}
16+
317
pulpcore::plugin { 'rpm':
18+
http_content => $content,
19+
https_content => $content,
420
}
521
}

‎metadata.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
},
2121
{
2222
"name": "puppetlabs/apache",
23-
"version_requirement": ">= 5.0.0 < 6.0.0"
23+
"version_requirement": ">= 5.4.0 < 6.0.0"
2424
},
2525
{
2626
"name": "puppetlabs/postgresql",

‎spec/acceptance/basic_spec.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ class { 'pulpcore':
6161
it { is_expected.to be_listening }
6262
end
6363

64-
describe command("curl -s http://#{host_inventory['fqdn']}/pulp/api/v3/status/ -w '%{response_code}' -o /dev/null") do
64+
describe command("curl -sk https://#{host_inventory['fqdn']}/pulp/api/v3/status/ -w '%{response_code}' -o /dev/null") do
6565
its(:stdout) { is_expected.to eq("200") }
6666
its(:exit_status) { is_expected.to eq 0 }
6767
end

‎spec/acceptance/plugins_spec.rb‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,14 @@ class { 'redis::globals':
2020
}
2121
2222
include pulpcore
23-
include pulpcore::plugin::file
23+
class { 'pulpcore::plugin::file':
24+
redirect_legacy => true,
25+
}
2426
include pulpcore::plugin::container
2527
include pulpcore::plugin::migration
26-
include pulpcore::plugin::rpm
28+
class { 'pulpcore::plugin::rpm':
29+
redirect_legacy => true,
30+
}
2731
include pulpcore::plugin::certguard
2832
PUPPET
2933
}
@@ -59,7 +63,7 @@ class { 'redis::globals':
5963
it { is_expected.to be_listening }
6064
end
6165

62-
describe command("curl -s http://#{host_inventory['fqdn']}/pulp/api/v3/status/ -w '%{response_code}' -o /dev/null") do
66+
describe command("curl -sk https://#{host_inventory['fqdn']}/pulp/api/v3/status/ -w '%{response_code}' -o /dev/null") do
6367
its(:stdout) { is_expected.to eq("200") }
6468
its(:exit_status) { is_expected.to eq 0 }
6569
end

0 commit comments

Comments
 (0)