Merge branch 'letsencrypt'

author: Ismaël Bouya <ismael.bouya@normalesup.org> 2018-02-20 11:32:40 +0100
committer: Ismaël Bouya <ismael.bouya@normalesup.org> 2018-02-20 11:32:40 +0100
commit: 73bca64c33744027a0e800ce6c98a549ec924c6e (patch)
tree: 42cc09c283a7b0f6fce4f7dde22cd9213408111f
parent: 428fcf14be3943fc01d234a5e622c7f8706bcb73 (diff)
parent: 5be7de41fe02fe60fbbac530e6729f74e206aea3 (diff)
download: Puppet-73bca64c33744027a0e800ce6c98a549ec924c6e.tar.gz
Puppet-73bca64c33744027a0e800ce6c98a549ec924c6e.tar.zst
Puppet-73bca64c33744027a0e800ce6c98a549ec924c6e.zip
15 files changed, 299 insertions, 7 deletions
diff --git a/.gitmodules b/.gitmodules
index e893f13..35df238 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -31,12 +31,18 @@
 [submodule "modules/postgresql"]
        path = modules/postgresql
        url = git://git.immae.eu/github/puppetlabs/puppetlabs-postgresql.git
-[submodule "modules/nginx"]
-        path = modules/nginx
-        url = git://git.immae.eu/github/voxpupuli/puppet-nginx.git
 [submodule "modules/archive"]
        path = modules/archive
        url = git://git.immae.eu/github/voxpupuli/puppet-archive.git
+[submodule "modules/apache"]
+        path = modules/apache
+        url = git://git.immae.eu/github/puppetlabs/puppetlabs-apache.git
+[submodule "modules/letsencrypt"]
+        path = modules/letsencrypt
+        url = git://git.immae.eu/github/voxpupuli/puppet-letsencrypt.git
 [submodule "python/ovh"]
        path = python/ovh
        url = git://git.immae.eu/github/ovh/python-ovh
+[submodule "modules/ssl"]
+        path = modules/ssl
+        url = git://git.immae.eu/github/fnerdwq/puppet-ssl
diff --git a/environments/production/data/types/vps-ovhssd-1.yaml b/environments/production/data/types/vps-ovhssd-1.yaml
index 968bf6b..9130ad1 100644
--- a/environments/production/data/types/vps-ovhssd-1.yaml
+++ b/environments/production/data/types/vps-ovhssd-1.yaml
@@ -3,5 +3,7 @@ classes:
  base_installation:
    stage: "setup"
+base_installation::real_hostname: "%{facts.ec2_metadata.hostname}.ovh.net"
 base_installation::grub_device: "/dev/sdb"
 base_installation::ldap_cert_path: "/etc/ssl/certs/ca-certificates.crt"
+ssl::try_letsencrypt_for_real_hostname: false
diff --git a/modules/apache b/modules/apache
new file mode 160000
+Subproject 42c1b5cae109630a53be89eda10c5c761c6d368
diff --git a/modules/letsencrypt b/modules/letsencrypt
new file mode 160000
+Subproject 55ac1e9c731b6dbfc380cd282c39f273223fcd5
diff --git a/modules/nginx b/modules/nginx
deleted file mode 160000
-Subproject a7f40a8893e394cc57695ff81ea53254bcf1ff3
diff --git a/modules/profile/files/apache/document_root.conf b/modules/profile/files/apache/document_root.conf
new file mode 100644
index 0000000..ed9a9ab
--- /dev/null
+++ b/modules/profile/files/apache/document_root.conf
@@ -0,0 +1,6 @@
+DocumentRoot "/srv/http"
+<Directory "/srv/http">
+    Options Indexes FollowSymLinks
+    AllowOverride None
+    Require all granted
+</Directory>
diff --git a/modules/profile/files/apache/googleb6d69446ff4ca3e5.html b/modules/profile/files/apache/googleb6d69446ff4ca3e5.html
new file mode 100644
index 0000000..f732bac
--- /dev/null
+++ b/modules/profile/files/apache/googleb6d69446ff4ca3e5.html
@@ -0,0 +1 @@
+google-site-verification: googleb6d69446ff4ca3e5.html
diff --git a/modules/profile/files/apache/immae.conf b/modules/profile/files/apache/immae.conf
new file mode 100644
index 0000000..5e0f3c4
--- /dev/null
+++ b/modules/profile/files/apache/immae.conf
@@ -0,0 +1,13 @@
+ErrorDocument 500 /maintenance_immae.html
+ErrorDocument 501 /maintenance_immae.html
+ErrorDocument 502 /maintenance_immae.html
+ErrorDocument 503 /maintenance_immae.html
+ErrorDocument 504 /maintenance_immae.html
+Alias /maintenance_immae.html /srv/http/maintenance_immae.html
+RedirectMatch ^/licen[cs]es?_et_tip(ping)?$   https://www.immae.eu/licences_et_tip.html
+RedirectMatch ^/licen[cs]es?_and_tip(ping)?$  https://www.immae.eu/licenses_and_tipping.html
+RedirectMatch ^/licen[cs]es?$                 https://www.immae.eu/licenses_and_tipping.html
+RedirectMatch ^/tip(ping)?$                   https://www.immae.eu/licenses_and_tipping.html
+AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" /srv/http/googleb6d69446ff4ca3e5.html
diff --git a/modules/profile/files/apache/index.html b/modules/profile/files/apache/index.html
new file mode 100644
index 0000000..0274251
--- /dev/null
+++ b/modules/profile/files/apache/index.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Hello World HTML</title>
+  </head>
+  <body>
+    <h1>It works!</h1>
+  </body>
+</html>
diff --git a/modules/profile/files/apache/letsencrypt.conf b/modules/profile/files/apache/letsencrypt.conf
new file mode 100644
index 0000000..b2eaae2
--- /dev/null
+++ b/modules/profile/files/apache/letsencrypt.conf
@@ -0,0 +1,6 @@
+Alias /.well-known/acme-challenge /srv/http/.well-known/acme-challenge
+<Directory /srv/http/.well-known/acme-challenge>
+  Require all granted
+  AllowOverride None
+  ErrorDocument 404 "Not Found"
+</Directory>
diff --git a/modules/profile/files/apache/maintenance_immae.html b/modules/profile/files/apache/maintenance_immae.html
new file mode 100644
index 0000000..90f265f
--- /dev/null
+++ b/modules/profile/files/apache/maintenance_immae.html
@@ -0,0 +1,58 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Maintenance</title>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <style>
+      body {
+        padding-left: 5px;
+        padding-right: 5px;
+        text-align: center;
+        margin: auto;
+        font: 20px Helvetica, sans-serif;
+        color: #333;
+      }
+      h1 {
+        margin: 0px;
+        font-size: 40px;
+      }
+      article {
+        display: block;
+        max-width: 650px;
+        margin: 0 auto;
+        padding-top: 30px;
+      }
+      article + article {
+        border-top: 1px solid lightgrey;
+      }
+      article div {
+        text-align: justify;
+      }
+      a {
+        color: #dc8100;
+        text-decoration: none;
+      }
+      a:hover {
+        color: #333;
+      }
+    </style>
+    <script type="text/javascript">
+      setTimeout(function () { location.reload(true); }, 5000);
+    </script>
+  </head>
+  <body>
+    <article>
+      <h1>Erreur serveur ou maintenance en cours&nbsp;!</h1>
+      <div>
+        <p>Une mise à jour ou une opération de maintenance est en cours sur le site. <a href="">Retentez</a> dans quelques instants ou patientez, la page se rechargera automatiquement.</p>
+      </div>
+    </article>
+    <article>
+      <h1>Server error or website in maintenance!</h1>
+      <div>
+        <p>An update or a maintenance is on track on the website. Please try <a href="">again</a> in a few seconds or wait, the page will reload automatically.</p>
+      </div>
+    </article>
+  </body>
+</html>
diff --git a/modules/profile/manifests/apache.pp b/modules/profile/manifests/apache.pp
new file mode 100644
index 0000000..605b701
--- /dev/null
+++ b/modules/profile/manifests/apache.pp
@@ -0,0 +1,173 @@
+class profile::apache {
+  class { 'apache':
+    root_directory_secured => true,
+    root_directory_options => ["All"],
+    default_mods           => false,
+    default_vhost          => false,
+    log_formats            => {
+      combined => '%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %p',
+      common   => '%h %l %u %t \"%r\" %>s %b',
+    }
+  }
+  ::apache::custom_config { 'log_config.conf':
+    content  => 'CustomLog "/var/log/httpd/access_log" combined',
+    filename => 'log_config.conf'
+  }
+  ::apache::custom_config { 'protocols.conf':
+    content  => 'Protocols h2 http/1.1',
+    filename => 'protocols.conf'
+  }
+  ::apache::custom_config { 'document_root.conf':
+    source   => "puppet:///modules/profile/apache/document_root.conf",
+    filename => "document_root.conf"
+  }
+  ::apache::custom_config { 'immae.conf':
+    source   => "puppet:///modules/profile/apache/immae.conf",
+    filename => 'immae.conf'
+  }
+  ::apache::custom_config { 'letsencrypt.conf':
+    source   => "puppet:///modules/profile/apache/letsencrypt.conf",
+    filename => 'letsencrypt.conf'
+  }
+  $apache_vhost_default = {
+    no_proxy_uris       => [
+      "/maintenance_immae.html",
+      "/googleb6d69446ff4ca3e5.html",
+      "/.well-known/acme-challenge"
+    ],
+    no_proxy_uris_match => [
+      '^/licen[cs]es?_et_tip(ping)?$',
+      '^/licen[cs]es?_and_tip(ping)?$',
+      '^/licen[cs]es?$',
+      '^/tip(ping)?$',
+    ]
+  }
+  $letsencrypt_certonly_default = {
+    plugin        => "webroot",
+    webroot_paths => ["/srv/http/"],
+    notify        => Class['Apache::Service'],
+    require       => [Apache::Vhost["redirect_no_ssl"],Apache::Custom_config["letsencrypt.conf"]],
+    manage_cron   => true,
+  }
+  class { '::letsencrypt':
+    install_method  => "package",
+    package_name    => "certbot",
+    package_command => "certbot",
+    # FIXME
+    email           => 'sites+letsencrypt@mail.immae.eu',
+  }
+  $real_hostname = lookup("base_installation::real_hostname") |$key| { {} }
+  unless empty($real_hostname) {
+    if (lookup("ssl::try_letsencrypt_for_real_hostname") |$key| { true }) {
+      letsencrypt::certonly { $real_hostname:
+        before => Apache::Vhost["default_ssl"];
+        default: * => $::profile::apache::letsencrypt_certonly_default;
+      }
+      $ssl_cert  = "/etc/letsencrypt/live/$real_hostname/cert.pem"
+      $ssl_key   = "/etc/letsencrypt/live/$real_hostname/privkey.pem"
+      $ssl_chain = "/etc/letsencrypt/live/$real_hostname/chain.pem"
+    } else {
+      ssl::self_signed_certificate { $real_hostname:
+        common_name  => $real_hostname,
+        country      => "FR",
+        days         => "3650",
+        organization => "Immae",
+        directory    => "/etc/httpd/conf/ssl",
+        before       => Apache::Vhost["default_ssl"],
+      }
+      $ssl_key   = "/etc/httpd/conf/ssl/$real_hostname.key"
+      $ssl_cert  = "/etc/httpd/conf/ssl/$real_hostname.crt"
+      $ssl_chain = undef
+    }
+    apache::vhost { "default_ssl":
+      port           => '443',
+      docroot        => '/srv/http',
+      servername     => $real_hostname,
+      directoryindex => 'index.htm index.html',
+      ssl            => true,
+      ssl_key        => $ssl_key,
+      ssl_cert       => $ssl_cert,
+      ssl_chain      => $ssl_chain,
+      priority       => 0;
+    default: * => $::profile::apache::apache_vhost_default;
+    }
+  }
+  apache::vhost { "redirect_no_ssl":
+    port          => '80',
+    error_log     => false,
+    log_level     => undef,
+    access_log    => false,
+    docroot       => false,
+    servername    => "",
+    serveraliases => "*",
+    priority      => 99,
+    rewrites      => [
+      {
+        rewrite_cond => '"%{REQUEST_URI}"   "!^/\.well-known"',
+        rewrite_rule => '^(.+)              https://%{HTTP_HOST}$1 [R=301]'
+      }
+    ]
+  }
+  class { 'apache::mod::ssl':
+    ssl_protocol               => [ 'all', '-SSLv3' ],
+    # Given by
+    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
+    ssl_cipher                 => "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS",
+    # FIXME: need SSLSessionTickets       off
+    ssl_stapling               => true,
+    ssl_stapling_return_errors => false,
+    # FIXME: SSLStaplingResponderTimeout 5
+    ssl_ca                     => '/etc/ssl/certs/ca-certificates.crt',
+  }
+  class { 'apache::mod::alias': }
+  class { 'apache::mod::autoindex': }
+  # Included by ssl
+  # class { 'apache::mod::mime': }
+  class { 'apache::mod::deflate': }
+  class { 'apache::mod::rewrite': }
+  class { 'apache::mod::dir':
+    indexes => ["index.html"]
+  }
+  file { [
+    "/srv/http",
+    "/srv/http/.well-known"]:
+      ensure => "directory",
+      mode   => "0755",
+      owner  => "root",
+      group  => "root",
+  }
+  file { "/srv/http/index.html":
+    mode   => "0644",
+    owner  => "root",
+    group  => "root",
+    source => "puppet:///modules/profile/apache/index.html",
+  }
+  file { "/srv/http/maintenance_immae.html":
+    mode   => "0644",
+    owner  => "root",
+    group  => "root",
+    source => "puppet:///modules/profile/apache/maintenance_immae.html",
+  }
+  file { "/srv/http/googleb6d69446ff4ca3e5.html":
+    mode   => "0644",
+    owner  => "root",
+    group  => "root",
+    source => "puppet:///modules/profile/apache/googleb6d69446ff4ca3e5.html",
+  }
+}
diff --git a/modules/profile/manifests/tools.pp b/modules/profile/manifests/tools.pp
new file mode 100644
index 0000000..52e3cea
--- /dev/null
+++ b/modules/profile/manifests/tools.pp
@@ -0,0 +1,3 @@
+class profile::tools {
+  ensure_packages(['vim', 'bash-completion'])
+}
diff --git a/modules/role/manifests/cryptoportfolio.pp b/modules/role/manifests/cryptoportfolio.pp
index 0f26527..d2323a4 100644
--- a/modules/role/manifests/cryptoportfolio.pp
+++ b/modules/role/manifests/cryptoportfolio.pp
@@ -1,7 +1,9 @@
 class role::cryptoportfolio {
  include "base_installation"
+  include "profile::tools"
  include "profile::postgresql"
+  include "profile::apache"
  $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} }
@@ -47,11 +49,24 @@ class role::cryptoportfolio {
    order       => "b0",
  }
-  class { 'nginx': }
+  letsencrypt::certonly { $cf_front_app_host: ;
+    default: * => $::profile::apache::letsencrypt_certonly_default;
+  }
-  nginx::resource::server { $cf_front_app_host:
+  class { 'apache::mod::headers': }
-    listen_port => 80,
+  apache::vhost { $cf_front_app_host:
-    proxy       => 'http://localhost:8000',
+    port                => '443',
+    docroot             => false,
+    manage_docroot      => false,
+    proxy_dest          => "http://localhost:8000",
+    request_headers     => 'set X-Forwarded-Proto "https"',
+    ssl                 => true,
+    ssl_cert            => "/etc/letsencrypt/live/$cf_front_app_host/cert.pem",
+    ssl_key             => "/etc/letsencrypt/live/$cf_front_app_host/privkey.pem",
+    ssl_chain           => "/etc/letsencrypt/live/$cf_front_app_host/chain.pem",
+    require             => Letsencrypt::Certonly[$cf_front_app_host],
+    proxy_preserve_host => true;
+    default: *          => $::profile::apache::apache_vhost_default;
  }
  user { $cf_user:
diff --git a/modules/ssl b/modules/ssl
new file mode 160000
+Subproject c1cef11d63da71c7599e905ff0598d21799ab8c
author	Ismaël Bouya <ismael.bouya@normalesup.org>	2018-02-20 11:32:40 +0100
committer	Ismaël Bouya <ismael.bouya@normalesup.org>	2018-02-20 11:32:40 +0100
commit	73bca64c33744027a0e800ce6c98a549ec924c6e (patch)
tree	42cc09c283a7b0f6fce4f7dde22cd9213408111f
parent	428fcf14be3943fc01d234a5e622c7f8706bcb73 (diff)
parent	5be7de41fe02fe60fbbac530e6729f74e206aea3 (diff)
download	Puppet-73bca64c33744027a0e800ce6c98a549ec924c6e.tar.gz Puppet-73bca64c33744027a0e800ce6c98a549ec924c6e.tar.zst Puppet-73bca64c33744027a0e800ce6c98a549ec924c6e.zip

diff --git a/.gitmodules b/.gitmodules index e893f13..35df238 100644 --- a/.gitmodules +++ b/.gitmodules
@@ -31,12 +31,18 @@
31	[submodule "modules/postgresql"]	31	[submodule "modules/postgresql"]
32	path = modules/postgresql	32	path = modules/postgresql
33	url = git://git.immae.eu/github/puppetlabs/puppetlabs-postgresql.git	33	url = git://git.immae.eu/github/puppetlabs/puppetlabs-postgresql.git
34	[submodule "modules/nginx"]
35	path = modules/nginx
36	url = git://git.immae.eu/github/voxpupuli/puppet-nginx.git
37	[submodule "modules/archive"]	34	[submodule "modules/archive"]
38	path = modules/archive	35	path = modules/archive
39	url = git://git.immae.eu/github/voxpupuli/puppet-archive.git	36	url = git://git.immae.eu/github/voxpupuli/puppet-archive.git
		37	[submodule "modules/apache"]
		38	path = modules/apache
		39	url = git://git.immae.eu/github/puppetlabs/puppetlabs-apache.git
		40	[submodule "modules/letsencrypt"]
		41	path = modules/letsencrypt
		42	url = git://git.immae.eu/github/voxpupuli/puppet-letsencrypt.git
40	[submodule "python/ovh"]	43	[submodule "python/ovh"]
41	path = python/ovh	44	path = python/ovh
42	url = git://git.immae.eu/github/ovh/python-ovh	45	url = git://git.immae.eu/github/ovh/python-ovh
		46	[submodule "modules/ssl"]
		47	path = modules/ssl
		48	url = git://git.immae.eu/github/fnerdwq/puppet-ssl


diff --git a/environments/production/data/types/vps-ovhssd-1.yaml b/environments/production/data/types/vps-ovhssd-1.yaml index 968bf6b..9130ad1 100644 --- a/environments/production/data/types/vps-ovhssd-1.yaml +++ b/environments/production/data/types/vps-ovhssd-1.yaml
@@ -3,5 +3,7 @@ classes:
3	base_installation:	3	base_installation:
4	stage: "setup"	4	stage: "setup"
5		5
		6	base_installation::real_hostname: "%{facts.ec2_metadata.hostname}.ovh.net"
6	base_installation::grub_device: "/dev/sdb"	7	base_installation::grub_device: "/dev/sdb"
7	base_installation::ldap_cert_path: "/etc/ssl/certs/ca-certificates.crt"	8	base_installation::ldap_cert_path: "/etc/ssl/certs/ca-certificates.crt"
		9	ssl::try_letsencrypt_for_real_hostname: false


diff --git a/modules/apache b/modules/apache new file mode 160000
			Subproject 42c1b5cae109630a53be89eda10c5c761c6d368


diff --git a/modules/letsencrypt b/modules/letsencrypt new file mode 160000
			Subproject 55ac1e9c731b6dbfc380cd282c39f273223fcd5


diff --git a/modules/nginx b/modules/nginx deleted file mode 160000
	Subproject a7f40a8893e394cc57695ff81ea53254bcf1ff3


diff --git a/modules/profile/files/apache/document_root.conf b/modules/profile/files/apache/document_root.conf new file mode 100644 index 0000000..ed9a9ab --- /dev/null +++ b/modules/profile/files/apache/document_root.conf
@@ -0,0 +1,6 @@
		1	DocumentRoot "/srv/http"
		2	<Directory "/srv/http">
		3	Options Indexes FollowSymLinks
		4	AllowOverride None
		5	Require all granted
		6	</Directory>


diff --git a/modules/profile/files/apache/googleb6d69446ff4ca3e5.html b/modules/profile/files/apache/googleb6d69446ff4ca3e5.html new file mode 100644 index 0000000..f732bac --- /dev/null +++ b/modules/profile/files/apache/googleb6d69446ff4ca3e5.html
@@ -0,0 +1 @@
			google-site-verification: googleb6d69446ff4ca3e5.html


diff --git a/modules/profile/files/apache/immae.conf b/modules/profile/files/apache/immae.conf new file mode 100644 index 0000000..5e0f3c4 --- /dev/null +++ b/modules/profile/files/apache/immae.conf
@@ -0,0 +1,13 @@
		1	ErrorDocument 500 /maintenance_immae.html
		2	ErrorDocument 501 /maintenance_immae.html
		3	ErrorDocument 502 /maintenance_immae.html
		4	ErrorDocument 503 /maintenance_immae.html
		5	ErrorDocument 504 /maintenance_immae.html
		6	Alias /maintenance_immae.html /srv/http/maintenance_immae.html
		7
		8	RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
		9	RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
		10	RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
		11	RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
		12
		13	AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" /srv/http/googleb6d69446ff4ca3e5.html


diff --git a/modules/profile/files/apache/index.html b/modules/profile/files/apache/index.html new file mode 100644 index 0000000..0274251 --- /dev/null +++ b/modules/profile/files/apache/index.html
@@ -0,0 +1,9 @@
		1	<!DOCTYPE html>
		2	<html>
		3	<head>
		4	<title>Hello World HTML</title>
		5	</head>
		6	<body>
		7	<h1>It works!</h1>
		8	</body>
		9	</html>


diff --git a/modules/profile/files/apache/letsencrypt.conf b/modules/profile/files/apache/letsencrypt.conf new file mode 100644 index 0000000..b2eaae2 --- /dev/null +++ b/modules/profile/files/apache/letsencrypt.conf
@@ -0,0 +1,6 @@
		1	Alias /.well-known/acme-challenge /srv/http/.well-known/acme-challenge
		2	<Directory /srv/http/.well-known/acme-challenge>
		3	Require all granted
		4	AllowOverride None
		5	ErrorDocument 404 "Not Found"
		6	</Directory>


diff --git a/modules/profile/files/apache/maintenance_immae.html b/modules/profile/files/apache/maintenance_immae.html new file mode 100644 index 0000000..90f265f --- /dev/null +++ b/modules/profile/files/apache/maintenance_immae.html
@@ -0,0 +1,58 @@
		1	<!doctype html>
		2	<html>
		3	<head>
		4	<title>Maintenance</title>
		5	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
		6	<style>
		7	body {
		8	padding-left: 5px;
		9	padding-right: 5px;
		10	text-align: center;
		11	margin: auto;
		12	font: 20px Helvetica, sans-serif;
		13	color: #333;
		14	}
		15	h1 {
		16	margin: 0px;
		17	font-size: 40px;
		18	}
		19	article {
		20	display: block;
		21	max-width: 650px;
		22	margin: 0 auto;
		23	padding-top: 30px;
		24	}
		25	article + article {
		26	border-top: 1px solid lightgrey;
		27	}
		28	article div {
		29	text-align: justify;
		30	}
		31	a {
		32	color: #dc8100;
		33	text-decoration: none;
		34	}
		35	a:hover {
		36	color: #333;
		37	}
		38	</style>
		39	<script type="text/javascript">
		40	setTimeout(function () { location.reload(true); }, 5000);
		41	</script>
		42	</head>
		43	<body>
		44	<article>
		45	<h1>Erreur serveur ou maintenance en cours !</h1>
		46	<div>
		47	<p>Une mise à jour ou une opération de maintenance est en cours sur le site. <a href="">Retentez</a> dans quelques instants ou patientez, la page se rechargera automatiquement.</p>
		48	</div>
		49	</article>
		50
		51	<article>
		52	<h1>Server error or website in maintenance!</h1>
		53	<div>
		54	<p>An update or a maintenance is on track on the website. Please try <a href="">again</a> in a few seconds or wait, the page will reload automatically.</p>
		55	</div>
		56	</article>
		57	</body>
		58	</html>


diff --git a/modules/profile/manifests/apache.pp b/modules/profile/manifests/apache.pp new file mode 100644 index 0000000..605b701 --- /dev/null +++ b/modules/profile/manifests/apache.pp
@@ -0,0 +1,173 @@
		1	class profile::apache {
		2	class { 'apache':
		3	root_directory_secured => true,
		4	root_directory_options => ["All"],
		5	default_mods => false,
		6	default_vhost => false,
		7	log_formats => {
		8	combined => '%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %p',
		9	common => '%h %l %u %t \"%r\" %>s %b',
		10	}
		11	}
		12
		13	::apache::custom_config { 'log_config.conf':
		14	content => 'CustomLog "/var/log/httpd/access_log" combined',
		15	filename => 'log_config.conf'
		16	}
		17
		18	::apache::custom_config { 'protocols.conf':
		19	content => 'Protocols h2 http/1.1',
		20	filename => 'protocols.conf'
		21	}
		22
		23	::apache::custom_config { 'document_root.conf':
		24	source => "puppet:///modules/profile/apache/document_root.conf",
		25	filename => "document_root.conf"
		26	}
		27
		28	::apache::custom_config { 'immae.conf':
		29	source => "puppet:///modules/profile/apache/immae.conf",
		30	filename => 'immae.conf'
		31	}
		32
		33	::apache::custom_config { 'letsencrypt.conf':
		34	source => "puppet:///modules/profile/apache/letsencrypt.conf",
		35	filename => 'letsencrypt.conf'
		36	}
		37
		38	$apache_vhost_default = {
		39	no_proxy_uris => [
		40	"/maintenance_immae.html",
		41	"/googleb6d69446ff4ca3e5.html",
		42	"/.well-known/acme-challenge"
		43	],
		44	no_proxy_uris_match => [
		45	'^/licen[cs]es?_et_tip(ping)?$',
		46	'^/licen[cs]es?_and_tip(ping)?$',
		47	'^/licen[cs]es?$',
		48	'^/tip(ping)?$',
		49	]
		50	}
		51
		52	$letsencrypt_certonly_default = {
		53	plugin => "webroot",
		54	webroot_paths => ["/srv/http/"],
		55	notify => Class['Apache::Service'],
		56	require => [Apache::Vhost["redirect_no_ssl"],Apache::Custom_config["letsencrypt.conf"]],
		57	manage_cron => true,
		58	}
		59
		60	class { '::letsencrypt':
		61	install_method => "package",
		62	package_name => "certbot",
		63	package_command => "certbot",
		64	# FIXME
		65	email => 'sites+letsencrypt@mail.immae.eu',
		66	}
		67
		68	$real_hostname = lookup("base_installation::real_hostname") \|$key\| { {} }
		69	unless empty($real_hostname) {
		70	if (lookup("ssl::try_letsencrypt_for_real_hostname") \|$key\| { true }) {
		71	letsencrypt::certonly { $real_hostname:
		72	before => Apache::Vhost["default_ssl"];
		73	default: * => $::profile::apache::letsencrypt_certonly_default;
		74	}
		75	$ssl_cert = "/etc/letsencrypt/live/$real_hostname/cert.pem"
		76	$ssl_key = "/etc/letsencrypt/live/$real_hostname/privkey.pem"
		77	$ssl_chain = "/etc/letsencrypt/live/$real_hostname/chain.pem"
		78	} else {
		79	ssl::self_signed_certificate { $real_hostname:
		80	common_name => $real_hostname,
		81	country => "FR",
		82	days => "3650",
		83	organization => "Immae",
		84	directory => "/etc/httpd/conf/ssl",
		85	before => Apache::Vhost["default_ssl"],
		86	}
		87
		88	$ssl_key = "/etc/httpd/conf/ssl/$real_hostname.key"
		89	$ssl_cert = "/etc/httpd/conf/ssl/$real_hostname.crt"
		90	$ssl_chain = undef
		91	}
		92
		93	apache::vhost { "default_ssl":
		94	port => '443',
		95	docroot => '/srv/http',
		96	servername => $real_hostname,
		97	directoryindex => 'index.htm index.html',
		98	ssl => true,
		99	ssl_key => $ssl_key,
		100	ssl_cert => $ssl_cert,
		101	ssl_chain => $ssl_chain,
		102	priority => 0;
		103	default: * => $::profile::apache::apache_vhost_default;
		104	}
		105	}
		106
		107	apache::vhost { "redirect_no_ssl":
		108	port => '80',
		109	error_log => false,
		110	log_level => undef,
		111	access_log => false,
		112	docroot => false,
		113	servername => "",
		114	serveraliases => "*",
		115	priority => 99,
		116	rewrites => [
		117	{
		118	rewrite_cond => '"%{REQUEST_URI}" "!^/\.well-known"',
		119	rewrite_rule => '^(.+) https://%{HTTP_HOST}$1 [R=301]'
		120	}
		121	]
		122	}
		123
		124	class { 'apache::mod::ssl':
		125	ssl_protocol => [ 'all', '-SSLv3' ],
		126	# Given by
		127	# https://mozilla.github.io/server-side-tls/ssl-config-generator/
		128	ssl_cipher => "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS",
		129	# FIXME: need SSLSessionTickets off
		130	ssl_stapling => true,
		131	ssl_stapling_return_errors => false,
		132	# FIXME: SSLStaplingResponderTimeout 5
		133	ssl_ca => '/etc/ssl/certs/ca-certificates.crt',
		134	}
		135	class { 'apache::mod::alias': }
		136	class { 'apache::mod::autoindex': }
		137	# Included by ssl
		138	# class { 'apache::mod::mime': }
		139	class { 'apache::mod::deflate': }
		140	class { 'apache::mod::rewrite': }
		141
		142	class { 'apache::mod::dir':
		143	indexes => ["index.html"]
		144	}
		145
		146	file { [
		147	"/srv/http",
		148	"/srv/http/.well-known"]:
		149	ensure => "directory",
		150	mode => "0755",
		151	owner => "root",
		152	group => "root",
		153	}
		154
		155	file { "/srv/http/index.html":
		156	mode => "0644",
		157	owner => "root",
		158	group => "root",
		159	source => "puppet:///modules/profile/apache/index.html",
		160	}
		161	file { "/srv/http/maintenance_immae.html":
		162	mode => "0644",
		163	owner => "root",
		164	group => "root",
		165	source => "puppet:///modules/profile/apache/maintenance_immae.html",
		166	}
		167	file { "/srv/http/googleb6d69446ff4ca3e5.html":
		168	mode => "0644",
		169	owner => "root",
		170	group => "root",
		171	source => "puppet:///modules/profile/apache/googleb6d69446ff4ca3e5.html",
		172	}
		173	}


diff --git a/modules/profile/manifests/tools.pp b/modules/profile/manifests/tools.pp new file mode 100644 index 0000000..52e3cea --- /dev/null +++ b/modules/profile/manifests/tools.pp
@@ -0,0 +1,3 @@
		1	class profile::tools {
		2	ensure_packages(['vim', 'bash-completion'])
		3	}


diff --git a/modules/role/manifests/cryptoportfolio.pp b/modules/role/manifests/cryptoportfolio.pp index 0f26527..d2323a4 100644 --- a/modules/role/manifests/cryptoportfolio.pp +++ b/modules/role/manifests/cryptoportfolio.pp
@@ -1,7 +1,9 @@
1	class role::cryptoportfolio {	1	class role::cryptoportfolio {
2	include "base_installation"	2	include "base_installation"
3		3
		4	include "profile::tools"
4	include "profile::postgresql"	5	include "profile::postgresql"
		6	include "profile::apache"
5		7
6	$password_seed = lookup("base_installation::puppet_pass_seed") \|$key\| { {} }	8	$password_seed = lookup("base_installation::puppet_pass_seed") \|$key\| { {} }
7		9
@@ -47,11 +49,24 @@ class role::cryptoportfolio {
47	order => "b0",	49	order => "b0",
48	}	50	}
49		51
50	class { 'nginx': }	52	letsencrypt::certonly { $cf_front_app_host: ;
		53	default: * => $::profile::apache::letsencrypt_certonly_default;
		54	}
51		55
52	nginx::resource::server { $cf_front_app_host:	56	class { 'apache::mod::headers': }
53	listen_port => 80,	57	apache::vhost { $cf_front_app_host:
54	proxy => 'http://localhost:8000',	58	port => '443',
		59	docroot => false,
		60	manage_docroot => false,
		61	proxy_dest => "http://localhost:8000",
		62	request_headers => 'set X-Forwarded-Proto "https"',
		63	ssl => true,
		64	ssl_cert => "/etc/letsencrypt/live/$cf_front_app_host/cert.pem",
		65	ssl_key => "/etc/letsencrypt/live/$cf_front_app_host/privkey.pem",
		66	ssl_chain => "/etc/letsencrypt/live/$cf_front_app_host/chain.pem",
		67	require => Letsencrypt::Certonly[$cf_front_app_host],
		68	proxy_preserve_host => true;
		69	default: * => $::profile::apache::apache_vhost_default;
55	}	70	}
56		71
57	user { $cf_user:	72	user { $cf_user:


diff --git a/modules/ssl b/modules/ssl new file mode 160000
			Subproject c1cef11d63da71c7599e905ff0598d21799ab8c