Skip to content

slapos
slapos
Commit c695d8da authored by Łukasz Nowak's avatar Łukasz Nowak
Browse files
Options

Partially revert "software/slapos-master: follow up changes on ERP5 stack." 

This partially reverts commit 20fb7c58.

Unfortunately having trustable X-Forwarded for in case of SlapOS Master
is not so simple, and not needed for now, as the approach is a bit different
on that apache, thus let's revert for now.

The update of AddOutputFilterByType is kept.
parent 4f13734c
Pipeline #11556 failed with stage
    Hide whitespace changes
    Inline Side-by-side
    Showing with 35 additions and 113 deletions
    software/slapos-master/apache-backend.conf.in
    View file @ c695d8da
    ......@@ -23,14 +23,14 @@
    # # The path given to "SSLSessionCache shmcb:<folder_path>(512000)"
    # "ssl-session-cache": "<folder_path>",
    #
    # # The path given to "SSLCACertificatePath" (can be empty)
    # # The path given to "SSLCACertificateFile" (can be empty)
    # # If this value is not empty, it enables client certificate check.
    # # (Enabling "SSLVerifyClient require")
    # "ca-cert-dir": "<directory_path>",
    # "ca-cert": "<file_path>",
    #
    # # The path given to "SSLCARevocationPath" (used if ca-cert-dir is not
    # # The path given to "SSLCARevocationFile" (used if ca-cert is not
    # # empty)
    # "crl-dir": "<directory_path>",
    # "crl": "<file_path>",
    #
    # # The path given to "ErrorLog"
    # "error-log": "<file_path>",
    ......@@ -69,7 +69,7 @@
    # From to `backend-list`:
    # - 0.0.0.0:8000 redirecting internaly to http://10.0.0.10:8001 and
    # - [::1]:8000 redirecting internaly to http://10.0.0.10:8001
    # only accepting requests from clients who provide a valid SSL certificate trusted in `ca-cert-dir`.
    # only accepting requests from clients who provide a valid SSL certificate trusted in `ca-cert`.
    # - 0.0.0.0:8002 redirecting internaly to http://10.0.0.10:8003
    # - [::1]:8002 redirecting internaly to http://10.0.0.10:8003
    # accepting requests from any client.
    ......@@ -83,8 +83,6 @@
    # For more details, refer to
    # https://docs.zope.org/zope2/zope2book/VirtualHosting.html#using-virtualhostroot-and-virtualhostbase-together
    -#}
    {% set ca_cert_dir = parameter_dict.get('ca-cert-dir') -%}
    {% set crl_dir = parameter_dict.get('crl-dir') -%}
    LoadModule unixd_module modules/mod_unixd.so
    LoadModule access_compat_module modules/mod_access_compat.so
    LoadModule authz_core_module modules/mod_authz_core.so
    ......@@ -135,16 +133,17 @@ SSLProxyEngine On
    # As backend is trusting Remote-User header unset it always
    RequestHeader unset Remote-User
    {% if ca_cert_dir -%}
    {% if parameter_dict['ca-cert'] -%}
    SSLVerifyClient optional
    RequestHeader set Remote-User %{SSL_CLIENT_S_DN_CN}s
    RequestHeader unset X-Forwarded-For "expr=%{SSL_CLIENT_VERIFY} != 'SUCCESS'"
    SSLCACertificatePath {{ ca_cert_dir }}
    {% if crl_dir -%}
    SSLCACertificateFile {{ parameter_dict['ca-cert'] }}
    {% if not parameter_dict['shared-ca-cert'] %}
    {% if parameter_dict['crl'] -%}
    SSLCARevocationCheck chain
    SSLCARevocationPath {{ crl_dir }}
    {% endif -%}
    {% endif -%}
    SSLCARevocationFile {{ parameter_dict['crl'] }}
    {%- endif %}
    {%- endif %}
    {%- endif %}
    ErrorLog "{{ parameter_dict['error-log'] }}"
    # Default apache log format with request time in microsecond at the end
    ......@@ -164,8 +163,12 @@ Listen {{ ip }}:{{ port }}
    {% endfor -%}
    <VirtualHost *:{{ port }}>
    SSLEngine on
    {% if enable_authentication and ca_cert_dir -%}
    {% if enable_authentication and parameter_dict['shared-ca-cert'] and parameter_dict['shared-crl'] -%}
    SSLVerifyClient require
    # Custom block we use for now different parameters.
    RequestHeader set Remote-User %{SSL_CLIENT_S_DN_CN}s
    SSLCACertificateFile {{ parameter_dict['shared-ca-cert'] }}
    SSLCARevocationPath {{ parameter_dict['shared-crl'] }}
    LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
    ......@@ -183,8 +186,11 @@ Listen {{ ip }}:{{ port }}
    <VirtualHost {{ ip }}:{{ port }}>
    SSLEngine on
    Timeout 3600
    {% if enable_authentication and ca_cert_dir -%}
    {% if enable_authentication and parameter_dict['ca-cert'] and parameter_dict['crl'] -%}
    SSLVerifyClient require
    SSLCACertificateFile {{ parameter_dict['ca-cert'] }}
    SSLCARevocationCheck chain
    SSLCARevocationFile {{ parameter_dict['crl'] }}
    LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
    ......
    software/slapos-master/buildout.hash.cfg
    View file @ c695d8da
    ......@@ -18,8 +18,8 @@ md5sum = 2ef0ddc206c6b0982a37cfc21f23e423
    [template-balancer]
    filename = instance-balancer.cfg.in
    md5sum = d10a5ddfffa67b8ca01b3e38315bae2f
    md5sum = ef86e09e44ac67a9b15939df0ab4a466
    [template-apache-backend-conf]
    filename = apache-backend.conf.in
    md5sum = ba8f878083b79535c6a2d10de496d90f
    md5sum = 9d7104ce18f79a7a84988efc11f5ed23
    software/slapos-master/instance-balancer.cfg.in
    View file @ c695d8da
    ......@@ -2,7 +2,6 @@
    {% set part_list = [] -%}
    {% macro section(name) %}{% do part_list.append(name) %}{{ name }}{% endmacro -%}
    {% set ssl_parameter_dict = slapparameter_dict['ssl'] -%}
    {% set frontend_caucase_url_list = ssl_parameter_dict.get('frontend_caucase_url_list', []) -%}
    {% set shared_ca_path = slapparameter_dict.get('shared-certificate-authority-path') -%}
    {#
    XXX: This template only supports exactly one IPv4 and (if ipv6 is used) one IPv6
    ......@@ -29,8 +28,8 @@ mode = 644
    url=ssl_parameter_dict['caucase-url'],
    data_dir='${directory:srv}/caucase-updater',
    crt_path='${apache-conf-ssl:caucase-cert}',
    ca_path='${directory:srv}/caucase-updater/ca.crt',
    crl_path='${directory:srv}/caucase-updater/crl.pem',
    ca_path='${apache-conf-ssl:ca-cert}',
    crl_path='${apache-conf-ssl:crl}',
    key_path='${apache-conf-ssl:caucase-key}',
    on_renew='${apache-graceful:output}',
    max_sleep=ssl_parameter_dict.get('max-crl-update-delay', 1.0),
    ......@@ -38,69 +37,6 @@ mode = 644
    openssl=parameter_dict['openssl'] ~ '/bin/openssl',
    )}}
    {% do section('caucase-updater') -%}
    {% do section('caucase-updater-promise') -%}
    {% set frontend_caucase_url_hash_list = [] -%}
    {% for frontend_caucase_url in frontend_caucase_url_list -%}
    {% set hash = hashlib.md5(frontend_caucase_url).hexdigest() -%}
    {% do frontend_caucase_url_hash_list.append(hash) -%}
    {% set data_dir = '${directory:srv}/client-cert-ca/%s' % hash -%}
    {{ caucase.updater(
    prefix='caucase-updater-%s' % hash,
    buildout_bin_directory=parameter_dict['bin-directory'],
    updater_path='${directory:services-on-watch}/caucase-updater-%s' % hash,
    url=frontend_caucase_url,
    data_dir=data_dir,
    ca_path='%s/ca.crt' % data_dir,
    crl_path='%s/crl.pem' % data_dir,
    on_renew='${caucase-updater-housekeeper:output}; ${apache-graceful:output}',
    max_sleep=ssl_parameter_dict.get('max-crl-update-delay', 1.0),
    openssl=parameter_dict['openssl'] ~ '/bin/openssl',
    )}}
    {% do section('caucase-updater-%s' % hash) -%}
    {% endfor -%}
    {% if frontend_caucase_url_hash_list -%}
    [caucase-updater-housekeeper]
    recipe = collective.recipe.template
    output = ${directory:bin}/caucase-updater-housekeeper
    mode = 700
    input =
    inline:
    #!${buildout:executable}
    import glob
    import os
    import subprocess
    hash_list = {{ repr(frontend_caucase_url_hash_list) }}
    crt_list = ['%s.crt' % e for e in hash_list]
    crl_list = ['%s.crl' % e for e in hash_list]
    {% if shared_ca_path -%}
    crt_list.append('{{ shared_ca_path }}/cacert.pem')
    crl_list.append('{{ shared_ca_path }}/crl')
    {% endif -%}
    for path in glob.glob('${apache-conf-ssl:ca-cert-dir}/*.crt'):
    if os.path.basename(path) not in crt_list:
    os.unlink(path)
    for path in glob.glob('${apache-conf-ssl:crl-dir}/*.crl'):
    if os.path.basename(path) not in crl_list:
    os.unlink(path)
    for hash in hash_list:
    crt = '${directory:srv}/client-cert-ca/%s/ca.crt' % hash
    crt_link = '${apache-conf-ssl:ca-cert-dir}/%s.crt' % hash
    crl = '${directory:srv}/client-cert-ca/%s/crl.pem' % hash
    crl_link = '${apache-conf-ssl:crl-dir}/%s.crl' % hash
    if os.path.isfile(crt) and not os.path.islink(crt_link):
    os.symlink(crt, crt_link)
    if os.path.isfile(crl) and not os.path.islink(crl_link):
    os.symlink(crl, crl_link)
    subprocess.check_call(['{{ parameter_dict["openssl"] }}/bin/c_rehash', '${apache-conf-ssl:ca-cert-dir}'])
    subprocess.check_call(['{{ parameter_dict["openssl"] }}/bin/c_rehash', '${apache-conf-ssl:crl-dir}'])
    [caucase-updater-housekeeper-run]
    recipe = plone.recipe.command
    command = ${caucase-updater-housekeeper:output}
    update-command = ${:command}
    {% endif -%}
    {% set haproxy_dict = {} -%}
    {% set apache_dict = {} -%}
    ......@@ -187,27 +123,8 @@ key = ${directory:apache-conf}/apache.pem
    # XXX caucase certificate is not supported by caddy for now
    caucase-cert = ${directory:apache-conf}/apache-caucase.crt
    caucase-key = ${directory:apache-conf}/apache-caucase.pem
    {% if frontend_caucase_url_list -%}
    depends = ${caucase-updater-housekeeper-run:recipe}
    ca-cert-dir = ${directory:apache-ca-cert-dir}
    crl-dir = ${directory:apache-crl-dir}
    {%- endif %}
    [simplefile]
    < = jinja2-template-base
    template = inline:{{ '{{ content }}' }}
    {% macro simplefile(section_name, file_path, content, mode='') -%}
    {% set content_section_name = section_name ~ '-content' -%}
    [{{ content_section_name }}]
    content = {{ dumps(content) }}
    [{{ section(section_name) }}]
    < = simplefile
    rendered = {{ file_path }}
    context = key content {{content_section_name}}:content
    mode = {{ mode }}
    {%- endmacro %}
    ca-cert = ${directory:apache-conf}/ca.crt
    crl = ${directory:apache-conf}/crl.pem
    [apache-ssl]
    {% if ssl_parameter_dict.get('key') -%}
    ......@@ -237,10 +154,13 @@ cert = ${apache-ssl:cert}
    key = ${apache-ssl:key}
    cipher =
    ssl-session-cache = ${directory:log}/apache-ssl-session-cache
    {% if frontend_caucase_url_list -%}
    # Client x509 auth
    ca-cert-dir = ${apache-conf-ssl:ca-cert-dir}
    crl-dir = ${apache-conf-ssl:crl-dir}
    ca-cert = ${apache-conf-ssl:ca-cert}
    crl = ${apache-conf-ssl:crl}
    {% if shared_ca_path -%}
    shared-ca-cert = {{ shared_ca_path }}/cacert.pem
    shared-crl = {{ shared_ca_path }}/crl
    {%- endif %}
    [apache-conf]
    ......@@ -266,8 +186,8 @@ input = inline:
    kill -USR1 "$(cat '${apache-conf-parameter-dict:pid-file}')"
    [{{ section('apache-promise') }}]
    <= monitor-promise-base
    # Check any apache port in ipv4, expect other ports and ipv6 to behave consistently
    <= monitor-promise-base
    module = check_port_listening
    name = apache.py
    config-hostname = {{ ipv4 }}
    ......@@ -308,10 +228,6 @@ post = test ! -s ${apache-conf-parameter-dict:pid-file} || {{ parameter_dict['bi
    [directory]
    recipe = slapos.cookbook:mkdirectory
    apache-conf = ${:etc}/apache
    {% if frontend_caucase_url_list -%}
    apache-ca-cert-dir = ${:apache-conf}/ssl.crt
    apache-crl-dir = ${:apache-conf}/ssl.crl
    {% endif -%}
    bin = ${buildout:directory}/bin
    etc = ${buildout:directory}/etc
    services = ${:etc}/run
    ......
    Markdown is supported
    0% or
    You are about to add 0 people to the discussion. Proceed with caution.
    Finish editing this message first!
    Please register or to comment
    GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7