aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitmodules6
-rw-r--r--environments/production/data/types/vps-ovhssd-1.yaml1
m---------modules/apache0
-rw-r--r--modules/profile/files/apache/document_root.conf6
-rw-r--r--modules/profile/files/apache/googleb6d69446ff4ca3e5.html1
-rw-r--r--modules/profile/files/apache/immae.conf13
-rw-r--r--modules/profile/files/apache/letsencrypt.conf6
-rw-r--r--modules/profile/files/apache/maintenance_immae.html58
-rw-r--r--modules/profile/manifests/apache.pp125
-rw-r--r--modules/role/manifests/cryptoportfolio.pp23
10 files changed, 231 insertions, 8 deletions
diff --git a/.gitmodules b/.gitmodules
index e893f13..2b29861 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -31,12 +31,12 @@
31[submodule "modules/postgresql"] 31[submodule "modules/postgresql"]
32 path = modules/postgresql 32 path = modules/postgresql
33 url = git://git.immae.eu/github/puppetlabs/puppetlabs-postgresql.git 33 url = git://git.immae.eu/github/puppetlabs/puppetlabs-postgresql.git
34[submodule "modules/nginx"]
35 path = modules/nginx
36 url = git://git.immae.eu/github/voxpupuli/puppet-nginx.git
37[submodule "modules/archive"] 34[submodule "modules/archive"]
38 path = modules/archive 35 path = modules/archive
39 url = git://git.immae.eu/github/voxpupuli/puppet-archive.git 36 url = git://git.immae.eu/github/voxpupuli/puppet-archive.git
37[submodule "modules/apache"]
38 path = modules/apache
39 url = git://git.immae.eu/github/puppetlabs/puppetlabs-apache.git
40[submodule "python/ovh"] 40[submodule "python/ovh"]
41 path = python/ovh 41 path = python/ovh
42 url = git://git.immae.eu/github/ovh/python-ovh 42 url = git://git.immae.eu/github/ovh/python-ovh
diff --git a/environments/production/data/types/vps-ovhssd-1.yaml b/environments/production/data/types/vps-ovhssd-1.yaml
index 968bf6b..4647a25 100644
--- a/environments/production/data/types/vps-ovhssd-1.yaml
+++ b/environments/production/data/types/vps-ovhssd-1.yaml
@@ -3,5 +3,6 @@ classes:
3 base_installation: 3 base_installation:
4 stage: "setup" 4 stage: "setup"
5 5
6base_installation::real_hostname: "%{facts.ec2_metadata.hostname}.ovh.net"
6base_installation::grub_device: "/dev/sdb" 7base_installation::grub_device: "/dev/sdb"
7base_installation::ldap_cert_path: "/etc/ssl/certs/ca-certificates.crt" 8base_installation::ldap_cert_path: "/etc/ssl/certs/ca-certificates.crt"
diff --git a/modules/apache b/modules/apache
new file mode 160000
Subproject 42c1b5cae109630a53be89eda10c5c761c6d368
diff --git a/modules/profile/files/apache/document_root.conf b/modules/profile/files/apache/document_root.conf
new file mode 100644
index 0000000..ed9a9ab
--- /dev/null
+++ b/modules/profile/files/apache/document_root.conf
@@ -0,0 +1,6 @@
1DocumentRoot "/srv/http"
2<Directory "/srv/http">
3 Options Indexes FollowSymLinks
4 AllowOverride None
5 Require all granted
6</Directory>
diff --git a/modules/profile/files/apache/googleb6d69446ff4ca3e5.html b/modules/profile/files/apache/googleb6d69446ff4ca3e5.html
new file mode 100644
index 0000000..f732bac
--- /dev/null
+++ b/modules/profile/files/apache/googleb6d69446ff4ca3e5.html
@@ -0,0 +1 @@
google-site-verification: googleb6d69446ff4ca3e5.html
diff --git a/modules/profile/files/apache/immae.conf b/modules/profile/files/apache/immae.conf
new file mode 100644
index 0000000..5e0f3c4
--- /dev/null
+++ b/modules/profile/files/apache/immae.conf
@@ -0,0 +1,13 @@
1ErrorDocument 500 /maintenance_immae.html
2ErrorDocument 501 /maintenance_immae.html
3ErrorDocument 502 /maintenance_immae.html
4ErrorDocument 503 /maintenance_immae.html
5ErrorDocument 504 /maintenance_immae.html
6Alias /maintenance_immae.html /srv/http/maintenance_immae.html
7
8RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
9RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
10RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
11RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
12
13AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" /srv/http/googleb6d69446ff4ca3e5.html
diff --git a/modules/profile/files/apache/letsencrypt.conf b/modules/profile/files/apache/letsencrypt.conf
new file mode 100644
index 0000000..b2eaae2
--- /dev/null
+++ b/modules/profile/files/apache/letsencrypt.conf
@@ -0,0 +1,6 @@
1Alias /.well-known/acme-challenge /srv/http/.well-known/acme-challenge
2<Directory /srv/http/.well-known/acme-challenge>
3 Require all granted
4 AllowOverride None
5 ErrorDocument 404 "Not Found"
6</Directory>
diff --git a/modules/profile/files/apache/maintenance_immae.html b/modules/profile/files/apache/maintenance_immae.html
new file mode 100644
index 0000000..90f265f
--- /dev/null
+++ b/modules/profile/files/apache/maintenance_immae.html
@@ -0,0 +1,58 @@
1<!doctype html>
2<html>
3 <head>
4 <title>Maintenance</title>
5 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
6 <style>
7 body {
8 padding-left: 5px;
9 padding-right: 5px;
10 text-align: center;
11 margin: auto;
12 font: 20px Helvetica, sans-serif;
13 color: #333;
14 }
15 h1 {
16 margin: 0px;
17 font-size: 40px;
18 }
19 article {
20 display: block;
21 max-width: 650px;
22 margin: 0 auto;
23 padding-top: 30px;
24 }
25 article + article {
26 border-top: 1px solid lightgrey;
27 }
28 article div {
29 text-align: justify;
30 }
31 a {
32 color: #dc8100;
33 text-decoration: none;
34 }
35 a:hover {
36 color: #333;
37 }
38 </style>
39 <script type="text/javascript">
40 setTimeout(function () { location.reload(true); }, 5000);
41 </script>
42 </head>
43 <body>
44 <article>
45 <h1>Erreur serveur ou maintenance en cours&nbsp;!</h1>
46 <div>
47 <p>Une mise à jour ou une opération de maintenance est en cours sur le site. <a href="">Retentez</a> dans quelques instants ou patientez, la page se rechargera automatiquement.</p>
48 </div>
49 </article>
50
51 <article>
52 <h1>Server error or website in maintenance!</h1>
53 <div>
54 <p>An update or a maintenance is on track on the website. Please try <a href="">again</a> in a few seconds or wait, the page will reload automatically.</p>
55 </div>
56 </article>
57 </body>
58</html>
diff --git a/modules/profile/manifests/apache.pp b/modules/profile/manifests/apache.pp
new file mode 100644
index 0000000..b965944
--- /dev/null
+++ b/modules/profile/manifests/apache.pp
@@ -0,0 +1,125 @@
1class profile::apache {
2 class { 'apache':
3 root_directory_secured => true,
4 root_directory_options => ["All"],
5 default_mods => false,
6 default_vhost => false,
7 log_formats => {
8 combined => '%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %p',
9 common => '%h %l %u %t \"%r\" %>s %b',
10 }
11 }
12
13 ::apache::custom_config { 'log_config.conf':
14 content => 'CustomLog "/var/log/httpd/access_log" combined',
15 filename => 'log_config.conf'
16 }
17
18 ::apache::custom_config { 'protocols.conf':
19 content => 'Protocols h2 http/1.1',
20 filename => 'protocols.conf'
21 }
22
23 ::apache::custom_config { 'document_root.conf':
24 source => "puppet:///modules/profile/apache/document_root.conf",
25 filename => "document_root.conf"
26 }
27
28 ::apache::custom_config { 'immae.conf':
29 source => "puppet:///modules/profile/apache/immae.conf",
30 filename => 'immae.conf'
31 }
32
33 ::apache::custom_config { 'letsencrypt.conf':
34 source => "puppet:///modules/profile/apache/letsencrypt.conf",
35 filename => 'letsencrypt.conf'
36 }
37
38 # FIXME: default values ignored?
39 Apache::Vhost {
40 no_proxy_uris => [
41 "/maintenance_immae.html",
42 "/googleb6d69446ff4ca3e5.html",
43 "/.well-known/acme-challenge"
44 ],
45 no_proxy_uris_match => [
46 '^/licen[cs]es?_et_tip(ping)?$',
47 '^/licen[cs]es?_and_tip(ping)?$',
48 '^/licen[cs]es?$',
49 '^/tip(ping)?$',
50 ]
51 }
52
53 $real_hostname = lookup("base_installation::real_hostname") |$key| { {} }
54 unless empty($real_hostname) {
55 apache::vhost { "default_ssl":
56 port => '443',
57 docroot => '/srv/http',
58 servername => $real_hostname,
59 directoryindex => 'index.htm index.html',
60 priority => 0,
61 }
62 }
63
64 apache::vhost { "redirect_no_ssl":
65 port => '80',
66 error_log => false,
67 log_level => undef,
68 access_log => false,
69 docroot => false,
70 servername => "",
71 serveraliases => "*",
72 priority => 99,
73 rewrites => [
74 {
75 rewrite_cond => '"%{REQUEST_URI}" "!^/\.well-known"',
76 rewrite_rule => '^(.+) https://%{HTTP_HOST}$1 [R=301]'
77 }
78 ]
79 }
80
81 class { 'apache::mod::ssl':
82 ssl_protocol => [ 'all', '-SSLv3' ],
83 # Given by
84 # https://mozilla.github.io/server-side-tls/ssl-config-generator/
85 ssl_cipher => "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS",
86 # FIXME: need SSLSessionTickets off
87 ssl_stapling => true,
88 ssl_stapling_return_errors => false,
89 # FIXME: SSLStaplingResponderTimeout 5
90 ssl_ca => '/etc/ssl/certs/ca-certificates.crt',
91 }
92 class { 'apache::mod::alias': }
93 class { 'apache::mod::autoindex': }
94 # Included by ssl
95 # class { 'apache::mod::mime': }
96 class { 'apache::mod::deflate': }
97 class { 'apache::mod::rewrite': }
98
99 class { 'apache::mod::dir':
100 indexes => ["index.html"]
101 }
102
103 file { [
104 "/srv/http",
105 "/srv/http/.well-known",
106 "/srv/http/.well-known/acme-challenge"]:
107 ensure => "directory",
108 mode => "0755",
109 owner => "root",
110 group => "root",
111 }
112
113 file { "/srv/http/maintenance_immae.html":
114 mode => "0644",
115 owner => "root",
116 group => "root",
117 source => "puppet:///modules/profile/apache/maintenance_immae.html",
118 }
119 file { "/srv/http/googleb6d69446ff4ca3e5.html":
120 mode => "0644",
121 owner => "root",
122 group => "root",
123 source => "puppet:///modules/profile/apache/googleb6d69446ff4ca3e5.html",
124 }
125}
diff --git a/modules/role/manifests/cryptoportfolio.pp b/modules/role/manifests/cryptoportfolio.pp
index 0f26527..084419e 100644
--- a/modules/role/manifests/cryptoportfolio.pp
+++ b/modules/role/manifests/cryptoportfolio.pp
@@ -2,6 +2,7 @@ class role::cryptoportfolio {
2 include "base_installation" 2 include "base_installation"
3 3
4 include "profile::postgresql" 4 include "profile::postgresql"
5 include "profile::apache"
5 6
6 $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} } 7 $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} }
7 8
@@ -47,11 +48,23 @@ class role::cryptoportfolio {
47 order => "b0", 48 order => "b0",
48 } 49 }
49 50
50 class { 'nginx': } 51 apache::vhost { $cf_front_app_host:
51 52 port => '80',
52 nginx::resource::server { $cf_front_app_host: 53 docroot => false,
53 listen_port => 80, 54 manage_docroot => false,
54 proxy => 'http://localhost:8000', 55 proxy_dest => "http://localhost:8000",
56 proxy_preserve_host => true,
57 no_proxy_uris => [
58 "/maintenance_immae.html",
59 "/googleb6d69446ff4ca3e5.html",
60 "/.well-known/acme-challenge"
61 ],
62 no_proxy_uris_match => [
63 '^/licen[cs]es?_et_tip(ping)?$',
64 '^/licen[cs]es?_and_tip(ping)?$',
65 '^/licen[cs]es?$',
66 '^/tip(ping)?$',
67 ]
55 } 68 }
56 69
57 user { $cf_user: 70 user { $cf_user:
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 17:23:04 +0000