nickserver - added support for apache reverse proxy frontend to handle the TLS.

2 files changed, 41 insertions, 9 deletions

diff --git a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
new file mode 100644
index 00000000..67896cd3
--- /dev/null
+++ b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
@@ -0,0 +1,23 @@
+#
+# Apache reverse proxy configuration for the Nickserver
+#
+
+Listen 0.0.0.0:<%= @nickserver_port -%>
+
+<VirtualHost *:<%= @nickserver_port -%>>
+  ServerName <%= @nickserver_domain %>
+  ServerAlias <%= @address_domain %>
+
+  SSLEngine on
+  SSLProtocol -all +SSLv3 +TLSv1
+  SSLCipherSuite HIGH:MEDIUM:!aNULL:!SSLv2:!MD5:@STRENGTH
+  SSLHonorCipherOrder on
+
+  SSLCACertificatePath /etc/ssl/certs
+  SSLCertificateChainFile /etc/ssl/certs/nickserver.pem
+  SSLCertificateKeyFile /etc/x509/keys/nickserver.key
+  SSLCertificateFile /etc/x509/certs/nickserver.crt
+
+  ProxyPass / http://localhost:<%= @nickserver_local_port %>/
+  ProxyPreserveHost On  # preserve Host header in HTTP request
+</VirtualHost>
diff --git a/puppet/modules/site_nickserver/templates/nickserver.yml.erb b/puppet/modules/site_nickserver/templates/nickserver.yml.erb
index b6e0b3bf..7aab5605 100644
--- a/puppet/modules/site_nickserver/templates/nickserver.yml.erb
+++ b/puppet/modules/site_nickserver/templates/nickserver.yml.erb
@@ -1,10 +1,19 @@
-couch_host: <%= @couchdb_host %>
+#
+# configuration for nickserver.
+#
+
+domain: "<%= @address_domain %>"
+
+couch_host: "<%= @couchdb_host %>"
 couch_port: <%= @couchdb_port %>
-couch_database: 'users'
-couch_user: <%= @couchdb_user %>
-couch_password: <%= @couchdb_password %>
-hkp_url: 'https://hkps.pool.sks-keyservers.net:/pks/lookup'
-port: <%= @nickserver_port %>
-pid_file: '/var/run/nickserver'
-user: 'nickserver'
-log_file: '/var/log/nickserver.log'
+couch_database: "users"
+couch_user: "<%= @couchdb_user %>"
+couch_password: "<%= @couchdb_password %>"
+
+hkp_url: "https://hkps.pool.sks-keyservers.net:/pks/lookup"
+
+user: "nickserver"
+port: <%= @nickserver_local_port %>
+pid_file: "/var/run/nickserver"
+log_file: "/var/log/nickserver.log"
+