Merge branch 'develop'

6 files changed, 177 insertions, 49 deletions

diff --git a/puppet/modules/site_static/manifests/domain.pp b/puppet/modules/site_static/manifests/domain.pp
index b26cc9e3..6cf2c653 100644
--- a/puppet/modules/site_static/manifests/domain.pp
+++ b/puppet/modules/site_static/manifests/domain.pp
@@ -4,6 +4,7 @@ define site_static::domain (
   $key,
   $cert,
   $tls_only=true,
+  $use_hidden_service=false,
   $locations=undef,
   $aliases=undef,
   $apache_config=undef) {
diff --git a/puppet/modules/site_static/manifests/hidden_service.pp b/puppet/modules/site_static/manifests/hidden_service.pp
new file mode 100644
index 00000000..f1f15f8e
--- /dev/null
+++ b/puppet/modules/site_static/manifests/hidden_service.pp
@@ -0,0 +1,37 @@
+# create hidden service for static sites
+class site_static::hidden_service {
+
+  include tor::daemon
+  tor::daemon::hidden_service { 'static': ports => [ '80 127.0.0.1:80'] }
+  file {
+    '/var/lib/tor/webapp/':
+      ensure  => directory,
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '2700';
+
+    '/var/lib/tor/static/private_key':
+      ensure  => present,
+      source  => "/srv/leap/files/nodes/${::hostname}/tor.key",
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '0600',
+      notify  => Service['tor'];
+
+    '/var/lib/tor/static/hostname':
+      ensure  => present,
+      content => "${::site_static::tor_domain}\n",
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '0600',
+      notify  => Service['tor'];
+  }
+
+  # it is necessary to zero out the config of the status module
+  # because we are configuring our own version that is unavailable
+  # over the hidden service (see: #7456 and #7776)
+  apache::module { 'status': ensure => present, conf_content => ' ' }
+
+  include site_shorewall::tor
+}
+
diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 4a722d62..dd3f912d 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -7,26 +7,40 @@ class site_static {
   include site_config::x509::key
   include site_config::x509::ca_bundle
 
-  $static        = hiera('static')
-  $domains       = $static['domains']
-  $formats       = $static['formats']
-  $bootstrap     = $static['bootstrap_files']
-  $tor           = hiera('tor', false)
+  $static         = hiera('static')
+  $domains        = $static['domains']
+  $formats        = $static['formats']
+  $bootstrap      = $static['bootstrap_files']
+  $tor            = hiera('tor', false)
+
+  file {
+    '/srv/static/':
+      ensure => 'directory',
+      owner  => 'root',
+      group  => 'root',
+      mode   => '0744';
+    '/srv/static/public':
+      ensure => 'directory',
+      owner  => 'root',
+      group  => 'root',
+      mode   => '0744';
+  }
 
   if $bootstrap['enabled'] {
     $bootstrap_domain  = $bootstrap['domain']
     $bootstrap_client  = $bootstrap['client_version']
-    file { '/srv/leap/provider.json':
+    file { '/srv/static/public/provider.json':
       content => $bootstrap['provider_json'],
       owner   => 'www-data',
       group   => 'www-data',
-      mode    => '0444';
+      mode    => '0444',
+      notify  => Service[apache];
     }
     # It is important to always touch provider.json: the client needs to check x-min-client-version header,
     # but this is only sent when the file has been modified (otherwise 304 is sent by apache). The problem
     # is that changing min client version won't alter the content of provider.json, so we must touch it.
-    exec { '/bin/touch /srv/leap/provider.json':
-      require => File['/srv/leap/provider.json'];
+    exec { '/bin/touch /srv/static/public/provider.json':
+      require => File['/srv/static/public/provider.json'];
     }
   }
 
@@ -42,8 +56,8 @@ class site_static {
   if (member($formats, 'rack')) {
     include site_apt::preferences::passenger
     class { 'passenger':
-      use_munin => false,
-      require   => Class['site_apt::preferences::passenger']
+      manage_munin => false,
+      require      => Class['site_apt::preferences::passenger']
     }
   }
 
@@ -57,15 +71,24 @@ class site_static {
     }
   }
 
-  create_resources(site_static::domain, $domains)
-
   if $tor {
     $hidden_service = $tor['hidden_service']
+    $tor_domain     = "${hidden_service['address']}.onion"
     if $hidden_service['active'] {
-      include site_webapp::hidden_service
+      include site_static::hidden_service
+    }
+    # Currently, we only support a single hidden service address per server.
+    # So if there is more than one domain configured, then we need to make sure
+    # we don't enable the hidden service for every domain.
+    if size(keys($domains)) == 1 {
+      $always_use_hidden_service = true
+    } else {
+      $always_use_hidden_service = false
     }
   }
 
+  create_resources(site_static::domain, $domains)
+
   include site_shorewall::defaults
   include site_shorewall::service::http
   include site_shorewall::service::https
diff --git a/puppet/modules/site_static/templates/amber.erb b/puppet/modules/site_static/templates/amber.erb
index 694f1136..b34458c3 100644
--- a/puppet/modules/site_static/templates/amber.erb
+++ b/puppet/modules/site_static/templates/amber.erb
@@ -4,10 +4,10 @@
 <%- end -%>
   <Directory "<%=@directory%>/">
     AllowOverride FileInfo Indexes Options=All,MultiViews
-<% if scope.function_guess_apache_version([]) == '2.4' %>
+<%- if scope.function_guess_apache_version([]) == '2.4' -%>
     Require all granted
-<% else %>
+<%- else -%>
     Order deny,allow
     Allow from all
-<% end %>
-  </Directory>
+<%- end -%>
+  </Directory>
\ No newline at end of file
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index 6b969d1c..dd04ca43 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -11,6 +11,9 @@
     end
   end
 
+  #
+  # document root
+  #
   @document_root = begin
     root = '/var/www'
     @locations && @locations.each do |name, location|
@@ -19,22 +22,104 @@
     root.gsub(%r{^/|/$}, '')
   end
 
+  #
+  # provider.json
+  #
+  # if the domain is a bootstrap domain, we need to expose
+  # a /provider.json file.
+  #
   bootstrap_domain = scope.lookupvar('site_static::bootstrap_domain')
   bootstrap_client = scope.lookupvar('site_static::bootstrap_client')
+  if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain)
+    provider_json = \
+%(
+  Alias /provider.json /srv/static/public/provider.json
+  <Location /provider.json>
+    Header set X-Minimum-Client-Version #{bootstrap_client['min']}
+  </Location>
+)
+  else
+    provider_json = ""
+  end
+
+  #
+  # locations
+  #
+  locations = ""
+  @locations && @locations.each do |name, location|
+    location_path = location['path'].gsub(%r{^/|/$}, '')
+    directory = location_directory(name, location)
+    local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name}
+    template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb'
+    break unless File.exists?(template_path)
+    locations += \
+%(
+  #
+  # #{name} (#{location['format']})
+  #
+#{scope.function_templatewlv([template_path, local_vars])}
+)
+  end
+
+  #
+  # allow custom apache config
+  #
+  custom_apache_config = if @apache_config
+    @apache_config.gsub(':percent:','%')
+  end
+
 -%>
 
+<Directory "/srv/static/public/">
+  Require all granted
+</Directory>
+
+<%- if @tor && (@always_use_hidden_service || @use_hidden_service) -%>
+##
+## Tor
+##
+<VirtualHost 127.0.0.1:80>
+  ServerName <%= @tor_domain %>
+  ServerAlias www.<%= @tor_domain %>
+
+  <IfModule mod_headers.c>
+    Header set X-Frame-Options "deny"
+    Header always unset X-Powered-By
+    Header always unset X-Runtime
+  </IfModule>
+
+  DocumentRoot "/<%= @document_root %>/"
+  AccessFileName .htaccess
+
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
+</VirtualHost>
+<%- end -%>
+
+##
+## HTTP
+##
 <VirtualHost *:80>
   ServerName <%= @domain %>
   ServerAlias www.<%= @domain %>
 <%- @aliases && @aliases.each do |domain_alias| -%>
   ServerAlias <%= domain_alias %>
 <%- end -%>
+
 <%- if @tls_only -%>
   RewriteEngine On
   RewriteRule ^.*$ https://<%= @domain -%>%{REQUEST_URI} [R=permanent,L]
+<%- else -%>
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
 <%- end -%>
 </VirtualHost>
 
+##
+## HTTPS
+##
 <VirtualHost *:443>
   ServerName <%= @domain %>
   ServerAlias www.<%= @domain %>
@@ -46,13 +131,15 @@
   #RewriteLogLevel 3
 
   Include include.d/ssl_common.inc
-  
+
+  <IfModule mod_headers.c>
 <%- if @tls_only -%>
-  Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
+    Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
 <%- end -%>
-  Header set X-Frame-Options "deny"
-  Header always unset X-Powered-By
-  Header always unset X-Runtime
+    Header set X-Frame-Options "deny"
+    Header always unset X-Powered-By
+    Header always unset X-Runtime
+  </IfModule>
 
   SSLCertificateKeyFile    /etc/x509/keys/<%= @domain %>.key
   SSLCertificateFile       /etc/x509/certs/<%= @domain %>.crt
@@ -62,27 +149,7 @@
   DocumentRoot "/<%= @document_root %>/"
   AccessFileName .htaccess
 
-<%- if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) -%>
-  Alias /provider.json /srv/leap/provider.json
-  <Location /provider.json>
-    Header set X-Minimum-Client-Version <%= bootstrap_client['min'] %>
-  </Location>
-<%- end -%>
-
-<%- if @apache_config -%>
-<%=   @apache_config.gsub(':percent:','%') %>
-<%- end -%>
-
-<%- @locations && @locations.each do |name, location| -%>
-<%-   location_path = location['path'].gsub(%r{^/|/$}, '') -%>
-<%-   directory = location_directory(name, location) -%>
-<%-   local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name} -%>
-<%-   template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb' -%>
-<%-   break unless File.exists?(template_path) -%>
-  ##
-  ## <%= name %> (<%= location['format'] %>)
-  ##
-<%=   scope.function_templatewlv([template_path, local_vars]) %>
-<%- end -%>
-
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
 </VirtualHost>
diff --git a/puppet/modules/site_static/templates/rack.erb b/puppet/modules/site_static/templates/rack.erb
index 431778bb..1cbf84d2 100644
--- a/puppet/modules/site_static/templates/rack.erb
+++ b/puppet/modules/site_static/templates/rack.erb
@@ -10,10 +10,10 @@
 <%- end -%>
   <Directory "<%=@directory%>">
     Options -MultiViews
-<% if scope.function_guess_apache_version([]) == '2.4' %>
+<%- if scope.function_guess_apache_version([]) == '2.4' -%>
     Require all granted
-<% else %>
+<%- else -%>
     Order deny,allow
     Allow from all
-<% end %>
+<%- end -%>
   </Directory>