Puppet Class: foreman::config::apache

Defined in:

manifests/config/apache.pp

Summary

Configure the foreman service using Apache

Overview

Parameters:

• app_root (Stdlib::Absolutepath) (defaults to: '/usr/share/foreman') —

  Root of the application.

• passenger_ruby (Optional[String]) (defaults to: undef) —

  Path to Ruby interpreter

• priority (String) (defaults to: '05') —

  Apache vhost priority

• servername (Stdlib::Fqdn) (defaults to: $facts['networking']['fqdn']) —

  Servername for the vhost.

• serveraliases (Array[Stdlib::Fqdn]) (defaults to: []) —

  Serveraliases for the vhost.

• server_port (Stdlib::Port) (defaults to: 80) —

  Port for Apache to listen on HTTP requests

• server_ssl_port (Stdlib::Port) (defaults to: 443) —

  Port for Apache to listen on HTTPS requests

• ssl (Boolean) (defaults to: false) —

  Whether to enable SSL.

• ssl_cert (Optional[Stdlib::Absolutepath]) (defaults to: undef) —

  Location of the SSL certificate file.

• ssl_certs_dir (Variant[Undef, Enum[''], Stdlib::Absolutepath]) (defaults to: undef) —

  Location of additional certificates for SSL client authentication.

• ssl_key (Optional[Stdlib::Absolutepath]) (defaults to: undef) —

  Location of the SSL key file.

• ssl_ca (Optional[Stdlib::Absolutepath]) (defaults to: undef) —

  Location of the SSL CA file

• ssl_chain (Optional[Stdlib::Absolutepath]) (defaults to: undef) —

  Location of the SSL chain file

• ssl_crl (Variant[Undef, Enum[''], Stdlib::Absolutepath]) (defaults to: undef) —

  Location of the SSL certificate revocation list file

• ssl_protocol (Optional[String]) (defaults to: undef) —

  SSLProtocol configuration to use

• ssl_verify_client (Enum['none','optional','require','optional_no_ca']) (defaults to: 'optional') —

  The level of SSL client verification to apply

• user (Optional[String]) (defaults to: undef) —

  The user under which the application runs.

• passenger (Boolean) (defaults to: false) —

  Whether to use passenger as an application server. If false, the reverse proxy setup is used.

• passenger_prestart (Boolean) (defaults to: false) —

  Pre-start the first passenger worker instance process during httpd start.

• passenger_min_instances (Integer[0]) (defaults to: 1) —

  Minimum passenger worker instances to keep when application is idle.

• passenger_start_timeout (Integer[0]) (defaults to: 90) —

  Amount of seconds to wait for Ruby application boot.

• proxy_backend (Pattern['^(https?|unix)://']) (defaults to: 'unix:///run/foreman.sock') —

  The backend service to proxy to. Only used when passenger is false

• proxy_params (Hash) (defaults to: {'retry' => '0'}) —

  The proxy parameters to use when proxying. Only used when passenger is false

• proxy_no_proxy_uris (Array[String]) (defaults to: ['/pulp', '/pulp2', '/streamer', '/pub', '/icons']) —

  URIs not to proxy. Only used when passenger is false

• foreman_url (Optional[Stdlib::HTTPUrl]) (defaults to: undef) —

  The URL Foreman should be reachable under. Used for loading the application on startup rather than on demand.

• access_log_format (Optional[String]) (defaults to: undef) —

  Apache log format to use

• ipa_authentication (Boolean) (defaults to: false) —

  Whether to install support for IPA authentication

• http_vhost_options (Hash[String, Any]) (defaults to: {}) —

  Direct options to apache::vhost for the http vhost

• https_vhost_options (Hash[String, Any]) (defaults to: {}) —

  Direct options to apache::vhost for the https vhost

• keycloak (Boolean) (defaults to: false) —

  Whether to enable keycloak support

• keycloak_app_name (String[1]) (defaults to: 'foreman-openidc') —

  The app name as passed to keycloak-httpd-client-install

• keycloak_realm (String[1]) (defaults to: 'ssl-realm') —

  The realm as passed to keycloak-httpd-client-install

# File 'manifests/config/apache.pp', line 101

class foreman::config::apache(
  Stdlib::Absolutepath $app_root = '/usr/share/foreman',
  String $priority = '05',
  Stdlib::Fqdn $servername = $facts['networking']['fqdn'],
  Array[Stdlib::Fqdn] $serveraliases = [],
  Stdlib::Port $server_port = 80,
  Stdlib::Port $server_ssl_port = 443,
  Pattern['^(https?|unix)://'] $proxy_backend = 'unix:///run/foreman.sock',
  Hash $proxy_params = {'retry' => '0'},
  Array[String] $proxy_no_proxy_uris = ['/pulp', '/pulp2', '/streamer', '/pub', '/icons'],
  Boolean $ssl = false,
  Optional[Stdlib::Absolutepath] $ssl_ca = undef,
  Optional[Stdlib::Absolutepath] $ssl_chain = undef,
  Optional[Stdlib::Absolutepath] $ssl_cert = undef,
  Variant[Undef, Enum[''], Stdlib::Absolutepath] $ssl_certs_dir = undef,
  Optional[Stdlib::Absolutepath] $ssl_key = undef,
  Variant[Undef, Enum[''], Stdlib::Absolutepath] $ssl_crl = undef,
  Optional[String] $ssl_protocol = undef,
  Enum['none','optional','require','optional_no_ca'] $ssl_verify_client = 'optional',
  Optional[String] $user = undef,
  Boolean $passenger = false,
  Optional[String] $passenger_ruby = undef,
  Boolean $passenger_prestart = false,
  Integer[0] $passenger_min_instances = 1,
  Integer[0] $passenger_start_timeout = 90,
  Optional[Stdlib::HTTPUrl] $foreman_url = undef,
  Optional[String] $access_log_format = undef,
  Boolean $ipa_authentication = false,
  Hash[String, Any] $http_vhost_options = {},
  Hash[String, Any] $https_vhost_options = {},
  Boolean $keycloak = false,
  String[1] $keycloak_app_name = 'foreman-openidc',
  String[1] $keycloak_realm = 'ssl-realm',
) {
  $docroot = "${app_root}/public"

  if $proxy_backend =~ 'unix://' {
    $_proxy_backend = "${proxy_backend}|http://foreman/"
  } else {
    $_proxy_backend = regsubst($proxy_backend, 'tcp://', 'http://')
  }

  if $foreman_url {
    $suburi_parts = split($foreman_url, '/')
    $suburi_parts_count = size($suburi_parts) - 1
    if $suburi_parts_count >= 3 {
      $suburi_without_slash = join(values_at($suburi_parts, ["3-${suburi_parts_count}"]), '/')
      if $suburi_without_slash {
        $suburi = "/${suburi_without_slash}"
      } else {
        $suburi = undef
      }
    } else {
      $suburi = undef
    }
  } else {
    $suburi = undef
  }

  if $passenger {
    if $suburi {
      $custom_fragment = template('foreman/_suburi.conf.erb')
    } else {
      $custom_fragment = file('foreman/_assets.conf.erb')
    }

    $passenger_options = {
      'passenger_app_root' => $app_root,
      'passenger_min_instances' => $passenger_min_instances,
      'passenger_start_timeout' => $passenger_start_timeout,
      'passenger_ruby' => $passenger_ruby,
    }

    if $passenger_prestart {
      $vhost_http_internal_options = $passenger_options + {'passenger_pre_start' => "http://${servername}:${server_port}"}
      $vhost_https_internal_options = $passenger_options + {'passenger_pre_start' => "https://${servername}:${server_ssl_port}"}
    } else {
      $vhost_http_internal_options = $passenger_options
      $vhost_https_internal_options = $passenger_options
    }

    if $app_root and $user {
      file { ["${app_root}/config.ru", "${app_root}/config/environment.rb"]:
        owner => $user,
      }
    }
  } else {
    if $suburi {
      $custom_fragment = undef
    } else {
      $custom_fragment = file('foreman/_assets.conf.erb')
    }

    include apache::mod::proxy_wstunnel
    $websockets_backend = regsubst($_proxy_backend, 'http://', 'ws://')

    $vhost_http_internal_options = {
      'proxy_preserve_host' => true,
      'proxy_add_headers'   => true,
      'request_headers'     => [
        'set X_FORWARDED_PROTO "http"',
        'set SSL_CLIENT_S_DN ""',
        'set SSL_CLIENT_CERT ""',
        'set SSL_CLIENT_VERIFY ""',
        'unset REMOTE_USER',
        'unset REMOTE_USER_EMAIL',
        'unset REMOTE_USER_FIRSTNAME',
        'unset REMOTE_USER_LASTNAME',
        'unset REMOTE_USER_GROUPS',
      ],
      'proxy_pass'          => {
        'no_proxy_uris' => $proxy_no_proxy_uris,
        'path'          => pick($suburi, '/'),
        'url'           => $_proxy_backend,
        'params'        => $proxy_params,
      },
      'rewrites'            => [
        {
          'comment'      => 'Upgrade Websocket connections',
          'rewrite_cond' => '%{HTTP:Upgrade} =websocket [NC]',
          'rewrite_rule' => "/(.*) ${websockets_backend}\$1 [P,L]",
        },
      ],
    }

    $vhost_https_internal_options = $vhost_http_internal_options + {
      'ssl_proxyengine' => true,
      'request_headers' => [
        'set X_FORWARDED_PROTO "https"',
        'set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"',
        'set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"',
        'set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"',
        'unset REMOTE_USER',
        'unset REMOTE_USER_EMAIL',
        'unset REMOTE_USER_FIRSTNAME',
        'unset REMOTE_USER_LASTNAME',
        'unset REMOTE_USER_GROUPS',
      ],
    }

    if $facts['os']['selinux']['enabled'] {
      selboolean { 'httpd_can_network_connect':
        persistent => true,
        value      => 'on',
      }
    }
  }

  include apache
  include apache::mod::headers

  if $ipa_authentication {
    include apache::mod::authnz_pam
    include apache::mod::intercept_form_submit
    include apache::mod::lookup_identity
    include apache::mod::auth_kerb
  } elsif $keycloak {
    include apache::mod::auth_openidc

    # This file is generated by keycloak-httpd-client-install and that manages
    # the content. The command would be:
    #
    # keycloak-httpd-client-install --app-name ${keycloak_app_name} --keycloak-server-url $KEYCLOAK_URL --keycloak-admin-username $KEYCLOAK_USER --keycloak-realm ${keycloak_realm} --keycloak-admin-realm master --keycloak-auth-role root-admin --client-type openidc --client-hostname ${servername} --protected-locations /users/extlogin
    #
    # If $suburi is used, --location-root should also be passed in
    #
    # By defining it here we avoid purging it and also tighten the
    # permissions so the world can't read its secrets.
    # This is functionally equivalent to apache::custom_config without content/source
    file { "${apache::confd_dir}/${keycloak_app_name}_oidc_keycloak_${keycloak_realm}.conf":
      ensure => file,
      owner  => 'root',
      group  => 'root',
      mode   => '0640',
    }
  }

  file { "${apache::confd_dir}/${priority}-foreman.d":
    ensure  => 'directory',
    owner   => 'root',
    group   => 'root',
    mode    => '0644',
    purge   => true,
    recurse => true,
  }

  apache::vhost { 'foreman':
    add_default_charset   => 'UTF-8',
    docroot               => $docroot,
    manage_docroot        => false,
    options               => ['SymLinksIfOwnerMatch'],
    port                  => $server_port,
    priority              => $priority,
    servername            => $servername,
    serveraliases         => $serveraliases,
    access_log_format     => $access_log_format,
    additional_includes   => ["${::apache::confd_dir}/${priority}-foreman.d/*.conf"],
    use_optional_includes => true,
    custom_fragment       => $custom_fragment,
    *                     => $vhost_http_internal_options + $http_vhost_options,
  }

  if $ssl {
    if $ssl_crl and $ssl_crl != '' {
      $ssl_crl_real = $ssl_crl
      $ssl_crl_check = 'chain'
    } else {
      $ssl_crl_real = undef
      $ssl_crl_check = undef
    }

    file { "${apache::confd_dir}/${priority}-foreman-ssl.d":
      ensure  => 'directory',
      owner   => 'root',
      group   => 'root',
      mode    => '0644',
      purge   => true,
      recurse => true,
    }

    apache::vhost { 'foreman-ssl':
      add_default_charset   => 'UTF-8',
      docroot               => $docroot,
      manage_docroot        => false,
      options               => ['SymLinksIfOwnerMatch'],
      port                  => $server_ssl_port,
      priority              => $priority,
      servername            => $servername,
      serveraliases         => $serveraliases,
      ssl                   => true,
      ssl_cert              => $ssl_cert,
      ssl_certs_dir         => $ssl_certs_dir,
      ssl_key               => $ssl_key,
      ssl_chain             => $ssl_chain,
      ssl_ca                => $ssl_ca,
      ssl_crl               => $ssl_crl_real,
      ssl_crl_check         => $ssl_crl_check,
      ssl_protocol          => $ssl_protocol,
      ssl_verify_client     => $ssl_verify_client,
      ssl_options           => '+StdEnvVars +ExportCertData',
      ssl_verify_depth      => '3',
      access_log_format     => $access_log_format,
      additional_includes   => ["${::apache::confd_dir}/${priority}-foreman-ssl.d/*.conf"],
      use_optional_includes => true,
      custom_fragment       => $custom_fragment,
      *                     => $vhost_https_internal_options + $https_vhost_options,
    }
  }
}