summaryrefslogtreecommitdiff
path: root/puppet/modules/site_static
diff options
context:
space:
mode:
authorMicah Anderson <micah@riseup.net>2016-11-04 10:54:28 -0400
committerMicah Anderson <micah@riseup.net>2016-11-04 10:54:28 -0400
commit34a381efa8f6295080c843f86bfa07d4e41056af (patch)
tree9282cf5d4c876688602705a7fa0002bc4a810bde /puppet/modules/site_static
parent0a72bc6fd292bf9367b314fcb0347c4d35042f16 (diff)
parent5821964ff7e16ca7aa9141bd09a77d355db492a9 (diff)
Merge branch 'develop'
Diffstat (limited to 'puppet/modules/site_static')
-rw-r--r--puppet/modules/site_static/manifests/domain.pp1
-rw-r--r--puppet/modules/site_static/manifests/hidden_service.pp37
-rw-r--r--puppet/modules/site_static/manifests/init.pp51
-rw-r--r--puppet/modules/site_static/templates/amber.erb8
-rw-r--r--puppet/modules/site_static/templates/apache.conf.erb123
-rw-r--r--puppet/modules/site_static/templates/rack.erb6
6 files changed, 177 insertions, 49 deletions
diff --git a/puppet/modules/site_static/manifests/domain.pp b/puppet/modules/site_static/manifests/domain.pp
index b26cc9e3..6cf2c653 100644
--- a/puppet/modules/site_static/manifests/domain.pp
+++ b/puppet/modules/site_static/manifests/domain.pp
@@ -4,6 +4,7 @@ define site_static::domain (
$key,
$cert,
$tls_only=true,
+ $use_hidden_service=false,
$locations=undef,
$aliases=undef,
$apache_config=undef) {
diff --git a/puppet/modules/site_static/manifests/hidden_service.pp b/puppet/modules/site_static/manifests/hidden_service.pp
new file mode 100644
index 00000000..f1f15f8e
--- /dev/null
+++ b/puppet/modules/site_static/manifests/hidden_service.pp
@@ -0,0 +1,37 @@
+# create hidden service for static sites
+class site_static::hidden_service {
+
+ include tor::daemon
+ tor::daemon::hidden_service { 'static': ports => [ '80 127.0.0.1:80'] }
+ file {
+ '/var/lib/tor/webapp/':
+ ensure => directory,
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '2700';
+
+ '/var/lib/tor/static/private_key':
+ ensure => present,
+ source => "/srv/leap/files/nodes/${::hostname}/tor.key",
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '0600',
+ notify => Service['tor'];
+
+ '/var/lib/tor/static/hostname':
+ ensure => present,
+ content => "${::site_static::tor_domain}\n",
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '0600',
+ notify => Service['tor'];
+ }
+
+ # it is necessary to zero out the config of the status module
+ # because we are configuring our own version that is unavailable
+ # over the hidden service (see: #7456 and #7776)
+ apache::module { 'status': ensure => present, conf_content => ' ' }
+
+ include site_shorewall::tor
+}
+
diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 4a722d62..dd3f912d 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -7,26 +7,40 @@ class site_static {
include site_config::x509::key
include site_config::x509::ca_bundle
- $static = hiera('static')
- $domains = $static['domains']
- $formats = $static['formats']
- $bootstrap = $static['bootstrap_files']
- $tor = hiera('tor', false)
+ $static = hiera('static')
+ $domains = $static['domains']
+ $formats = $static['formats']
+ $bootstrap = $static['bootstrap_files']
+ $tor = hiera('tor', false)
+
+ file {
+ '/srv/static/':
+ ensure => 'directory',
+ owner => 'root',
+ group => 'root',
+ mode => '0744';
+ '/srv/static/public':
+ ensure => 'directory',
+ owner => 'root',
+ group => 'root',
+ mode => '0744';
+ }
if $bootstrap['enabled'] {
$bootstrap_domain = $bootstrap['domain']
$bootstrap_client = $bootstrap['client_version']
- file { '/srv/leap/provider.json':
+ file { '/srv/static/public/provider.json':
content => $bootstrap['provider_json'],
owner => 'www-data',
group => 'www-data',
- mode => '0444';
+ mode => '0444',
+ notify => Service[apache];
}
# It is important to always touch provider.json: the client needs to check x-min-client-version header,
# but this is only sent when the file has been modified (otherwise 304 is sent by apache). The problem
# is that changing min client version won't alter the content of provider.json, so we must touch it.
- exec { '/bin/touch /srv/leap/provider.json':
- require => File['/srv/leap/provider.json'];
+ exec { '/bin/touch /srv/static/public/provider.json':
+ require => File['/srv/static/public/provider.json'];
}
}
@@ -42,8 +56,8 @@ class site_static {
if (member($formats, 'rack')) {
include site_apt::preferences::passenger
class { 'passenger':
- use_munin => false,
- require => Class['site_apt::preferences::passenger']
+ manage_munin => false,
+ require => Class['site_apt::preferences::passenger']
}
}
@@ -57,15 +71,24 @@ class site_static {
}
}
- create_resources(site_static::domain, $domains)
-
if $tor {
$hidden_service = $tor['hidden_service']
+ $tor_domain = "${hidden_service['address']}.onion"
if $hidden_service['active'] {
- include site_webapp::hidden_service
+ include site_static::hidden_service
+ }
+ # Currently, we only support a single hidden service address per server.
+ # So if there is more than one domain configured, then we need to make sure
+ # we don't enable the hidden service for every domain.
+ if size(keys($domains)) == 1 {
+ $always_use_hidden_service = true
+ } else {
+ $always_use_hidden_service = false
}
}
+ create_resources(site_static::domain, $domains)
+
include site_shorewall::defaults
include site_shorewall::service::http
include site_shorewall::service::https
diff --git a/puppet/modules/site_static/templates/amber.erb b/puppet/modules/site_static/templates/amber.erb
index 694f1136..b34458c3 100644
--- a/puppet/modules/site_static/templates/amber.erb
+++ b/puppet/modules/site_static/templates/amber.erb
@@ -4,10 +4,10 @@
<%- end -%>
<Directory "<%=@directory%>/">
AllowOverride FileInfo Indexes Options=All,MultiViews
-<% if scope.function_guess_apache_version([]) == '2.4' %>
+<%- if scope.function_guess_apache_version([]) == '2.4' -%>
Require all granted
-<% else %>
+<%- else -%>
Order deny,allow
Allow from all
-<% end %>
- </Directory>
+<%- end -%>
+ </Directory> \ No newline at end of file
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index 6b969d1c..dd04ca43 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -11,6 +11,9 @@
end
end
+ #
+ # document root
+ #
@document_root = begin
root = '/var/www'
@locations && @locations.each do |name, location|
@@ -19,22 +22,104 @@
root.gsub(%r{^/|/$}, '')
end
+ #
+ # provider.json
+ #
+ # if the domain is a bootstrap domain, we need to expose
+ # a /provider.json file.
+ #
bootstrap_domain = scope.lookupvar('site_static::bootstrap_domain')
bootstrap_client = scope.lookupvar('site_static::bootstrap_client')
+ if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain)
+ provider_json = \
+%(
+ Alias /provider.json /srv/static/public/provider.json
+ <Location /provider.json>
+ Header set X-Minimum-Client-Version #{bootstrap_client['min']}
+ </Location>
+)
+ else
+ provider_json = ""
+ end
+
+ #
+ # locations
+ #
+ locations = ""
+ @locations && @locations.each do |name, location|
+ location_path = location['path'].gsub(%r{^/|/$}, '')
+ directory = location_directory(name, location)
+ local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name}
+ template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb'
+ break unless File.exists?(template_path)
+ locations += \
+%(
+ #
+ # #{name} (#{location['format']})
+ #
+#{scope.function_templatewlv([template_path, local_vars])}
+)
+ end
+
+ #
+ # allow custom apache config
+ #
+ custom_apache_config = if @apache_config
+ @apache_config.gsub(':percent:','%')
+ end
+
-%>
+<Directory "/srv/static/public/">
+ Require all granted
+</Directory>
+
+<%- if @tor && (@always_use_hidden_service || @use_hidden_service) -%>
+##
+## Tor
+##
+<VirtualHost 127.0.0.1:80>
+ ServerName <%= @tor_domain %>
+ ServerAlias www.<%= @tor_domain %>
+
+ <IfModule mod_headers.c>
+ Header set X-Frame-Options "deny"
+ Header always unset X-Powered-By
+ Header always unset X-Runtime
+ </IfModule>
+
+ DocumentRoot "/<%= @document_root %>/"
+ AccessFileName .htaccess
+
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
+</VirtualHost>
+<%- end -%>
+
+##
+## HTTP
+##
<VirtualHost *:80>
ServerName <%= @domain %>
ServerAlias www.<%= @domain %>
<%- @aliases && @aliases.each do |domain_alias| -%>
ServerAlias <%= domain_alias %>
<%- end -%>
+
<%- if @tls_only -%>
RewriteEngine On
RewriteRule ^.*$ https://<%= @domain -%>%{REQUEST_URI} [R=permanent,L]
+<%- else -%>
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
<%- end -%>
</VirtualHost>
+##
+## HTTPS
+##
<VirtualHost *:443>
ServerName <%= @domain %>
ServerAlias www.<%= @domain %>
@@ -46,13 +131,15 @@
#RewriteLogLevel 3
Include include.d/ssl_common.inc
-
+
+ <IfModule mod_headers.c>
<%- if @tls_only -%>
- Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
+ Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
<%- end -%>
- Header set X-Frame-Options "deny"
- Header always unset X-Powered-By
- Header always unset X-Runtime
+ Header set X-Frame-Options "deny"
+ Header always unset X-Powered-By
+ Header always unset X-Runtime
+ </IfModule>
SSLCertificateKeyFile /etc/x509/keys/<%= @domain %>.key
SSLCertificateFile /etc/x509/certs/<%= @domain %>.crt
@@ -62,27 +149,7 @@
DocumentRoot "/<%= @document_root %>/"
AccessFileName .htaccess
-<%- if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) -%>
- Alias /provider.json /srv/leap/provider.json
- <Location /provider.json>
- Header set X-Minimum-Client-Version <%= bootstrap_client['min'] %>
- </Location>
-<%- end -%>
-
-<%- if @apache_config -%>
-<%= @apache_config.gsub(':percent:','%') %>
-<%- end -%>
-
-<%- @locations && @locations.each do |name, location| -%>
-<%- location_path = location['path'].gsub(%r{^/|/$}, '') -%>
-<%- directory = location_directory(name, location) -%>
-<%- local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name} -%>
-<%- template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb' -%>
-<%- break unless File.exists?(template_path) -%>
- ##
- ## <%= name %> (<%= location['format'] %>)
- ##
-<%= scope.function_templatewlv([template_path, local_vars]) %>
-<%- end -%>
-
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
</VirtualHost>
diff --git a/puppet/modules/site_static/templates/rack.erb b/puppet/modules/site_static/templates/rack.erb
index 431778bb..1cbf84d2 100644
--- a/puppet/modules/site_static/templates/rack.erb
+++ b/puppet/modules/site_static/templates/rack.erb
@@ -10,10 +10,10 @@
<%- end -%>
<Directory "<%=@directory%>">
Options -MultiViews
-<% if scope.function_guess_apache_version([]) == '2.4' %>
+<%- if scope.function_guess_apache_version([]) == '2.4' -%>
Require all granted
-<% else %>
+<%- else -%>
Order deny,allow
Allow from all
-<% end %>
+<%- end -%>
</Directory>