Commit ea5f2af7 authored by Cédric Le Ninivin's avatar Cédric Le Ninivin

Add Custom SSL posibility for default mode, fix various problems

parent 926f6371
...@@ -51,6 +51,26 @@ extra-context = ...@@ -51,6 +51,26 @@ extra-context =
raw error_log {{ error_log }} raw error_log {{ error_log }}
{{ '\n' }} {{ '\n' }}
# Set ssl certificates for each slave
{% for cert_name in ('ssl_key', 'ssl_crt', 'ssl_ca_crt', 'ssl_csr')-%}
{% if cert_name in slave_instance -%}
{% set cert_title = '%s-%s' % (slave_reference, cert_name.replace('ssl_', '')) -%}
{% set cert_file = '/'.join([custom_ssl_directory, cert_title.replace('-','.')]) -%}
{% do part_list.append(cert_title) -%}
{% do slave_instance.__setitem__('path_to_' ~ cert_name, cert_file) -%}
# Store certificates on fs
[{{ cert_title }}]
< = jinja2-template-base
template = {{ empty_template }}
rendered = {{ cert_file }}
extra-context =
key content {{ cert_title + '-config:value' }}
# Store certificate in config
[{{ cert_title + '-config' }}]
value = {{ dumps(slave_instance.get(cert_name)) }}
{% endif -%}
{% endfor -%}
# Set apache configuration for slave # Set apache configuration for slave
[{{ ('slave-instance-%s-configuration' % slave_reference) }}] [{{ ('slave-instance-%s-configuration' % slave_reference) }}]
{% for key, value in slave_instance.iteritems() -%} {% for key, value in slave_instance.iteritems() -%}
......
{% set TRUE_VALUES = ['y', 'yes', '1', 'true'] -%} {% set TRUE_VALUES = ['y', 'yes', '1', 'true'] -%}
<VirtualHost *:{{ http_port }}>
<VirtualHost *:{{ https_port }}>
ServerName {{ slave_parameter.get('domain') }} ServerName {{ slave_parameter.get('domain') }}
ServerAlias {{ slave_parameter.get('domain') }} ServerAlias {{ slave_parameter.get('domain') }}
SSLEngine on SSLEngine on
SSLProxyEngine on SSLProxyEngine on
# Rewrite part SSLProtocol -ALL +SSLv3 +TLSv1
ProxyVia On SSLHonorCipherOrder On
ProxyPreserveHost On SSLCipherSuite RC4-SHA:HIGH:!ADH
ProxyTimeout 600
RewriteEngine On {% set ssl_configuration_list = [('SSLCertificateFile', 'path_to_ssl_crt'),
('SSLCertificateKeyFile', 'path_to_ssl_key'),
('SSLCACertificateFile', 'path_to_ssl_ca_crt'),
('SSLCertificateChainFile', 'path_to_ssl_ca_crt')] -%}
{% for key, value in ssl_configuration_list -%}
{% if value in slave_parameter -%}
{{ ' %s' % key }} {{ slave_parameter.get(value) }}
{% endif -%}
{% endfor -%}
# One Slave two logs # One Slave two logs
ErrorLog "{{ error_log }}" ErrorLog "{{ error_log }}"
...@@ -16,30 +28,26 @@ ...@@ -16,30 +28,26 @@
LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
CustomLog "{{ access_log }}" combined CustomLog "{{ access_log }}" combined
# Next line is forbidden and people who copy it will be hanged short # Rewrite part
{% set https_only = ('' ~ slave_parameter.get('https-only', '')).lower() in TRUE_VALUES -%} ProxyVia On
{% if https_only in slave_parameter -%} ProxyPreserveHost On
# Not using HTTPS? Ask that guy over there. ProxyTimeout 600
# Dummy redirection to https. Note: will work only if https listens RewriteEngine On
# on standard port (443).
RewriteRule ^/(.*)$ https://%{DOMAIN}%{REQUEST_URI} {% if slave_parameter.get('type', '') == 'zope' -%}
{% elif slave_parameter.get('type', '') == 'zope' -%}
# First, we check if we have a zope backend server # First, we check if we have a zope backend server
# If so, let's use Virtual Host Daemon rewrite # If so, let's use Virtual Host Daemon rewrite
# We suppose that Apache listens to 80 (even indirectly thanks to things like iptables) # We suppose that Apache listens to 443 (even indirectly thanks to things like iptables)
RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/VirtualHostBase/http/{{ slave_parameter.get('domain', '') }}:80/{{ slave_parameter.get('path', '') }}/VirtualHostRoot/$1 [L,P] RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/VirtualHostBase/https/{{ slave_parameter.get('domain', '') }}:443/{{ slave_parameter.get('path', '') }}/VirtualHostRoot/$1 [L,P]
{% else -%} {% else -%}
RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/$1 [L,P] RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/$1 [L,P]
{% endif -%} {% endif -%}
# If nothing exist : put a nice error
# ErrorDocument 404 /notfound.html
# Dadiboom
</VirtualHost> </VirtualHost>
<VirtualHost *:{{ https_port }}> <VirtualHost *:{{ http_port }}>
ServerName {{ slave_parameter.get('domain') }} ServerName {{ slave_parameter.get('domain') }}
ServerAlias {{ slave_parameter.get('domain') }} ServerAlias {{ slave_parameter.get('domain') }}
SSLEngine on
SSLProxyEngine on SSLProxyEngine on
# Rewrite part # Rewrite part
ProxyVia On ProxyVia On
...@@ -56,12 +64,23 @@ ...@@ -56,12 +64,23 @@
# Remove "Secure" from cookies, as backend may be https # Remove "Secure" from cookies, as backend may be https
Header edit Set-Cookie "(?i)^(.+);secure$" "$1" Header edit Set-Cookie "(?i)^(.+);secure$" "$1"
{% if slave_parameter.get('type', '') == 'zope' -%} # Next line is forbidden and people who copy it will be hanged short
{% set https_only = ('' ~ slave_parameter.get('https-only', '')).lower() in TRUE_VALUES -%}
{% if https_only in slave_parameter -%}
# Not using HTTPS? Ask that guy over there.
# Dummy redirection to https. Note: will work only if https listens
# on standard port (443).
RewriteRule ^/(.*)$ https://%{DOMAIN}%{REQUEST_URI}
{% elif slave_parameter.get('type', '') == 'zope' -%}
# First, we check if we have a zope backend server # First, we check if we have a zope backend server
# If so, let's use Virtual Host Daemon rewrite # If so, let's use Virtual Host Daemon rewrite
# We suppose that Apache listens to 443 (even indirectly thanks to things like iptables) # We suppose that Apache listens to 80 (even indirectly thanks to things like iptables)
RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/VirtualHostBase/https/{{ slave_parameter.get('domain', '') }}:443/{{ slave_parameter.get('path', '') }}/VirtualHostRoot/$1 [L,P] RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/VirtualHostBase/http/{{ slave_parameter.get('domain', '') }}:80/{{ slave_parameter.get('path', '') }}/VirtualHostRoot/$1 [L,P]
{% else -%} {% else -%}
RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/$1 [L,P] RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/$1 [L,P]
{% endif -%} {% endif -%}
# If nothing exist : put a nice error
# ErrorDocument 404 /notfound.html
# Dadiboom
</VirtualHost> </VirtualHost>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment