summaryrefslogtreecommitdiff
path: root/puppet/modules
diff options
context:
space:
mode:
authorMicah <micah@leap.se>2016-06-23 12:08:54 -0400
committerMicah <micah@leap.se>2016-06-28 13:11:37 -0400
commit29d6b7dbbc3b9d8b11f0b215cad894fcfca9989c (patch)
tree1f9619db78c6bb2a0410535c6f45f3f6e03bbcc6 /puppet/modules
parent4cf9b7d34fce1c37d3b4bb16e62f078df642263b (diff)
Make static tor hidden services work (#8212).
When tor hidden services were enabled for static sites, only a very basic configuration was setup and it didn't take into account the different location configurations that can be configured for a static site. This commit resolves that by making a site_static::hidden_service class similar to the site_webapp::hidden_service class, and fixes up the apache vhost template to properly create the location blocks for the hidden service vhost. Change-Id: Ice3586f4173bd2d1bd3defca29d21c7403d5a03a
Diffstat (limited to 'puppet/modules')
-rw-r--r--puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb15
-rw-r--r--puppet/modules/site_static/manifests/hidden_service.pp37
-rw-r--r--puppet/modules/site_static/manifests/init.pp20
-rw-r--r--puppet/modules/site_static/templates/apache.conf.erb45
4 files changed, 91 insertions, 26 deletions
diff --git a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
index b34bd189..1d19094e 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
@@ -37,19 +37,4 @@
</Location>
<% end -%>
-<% if (defined? @services) and (@services.include? 'static') -%>
- DocumentRoot "/srv/static/root/public"
- <% if scope.function_guess_apache_version([]) == '2.4' %>
- <Directory /srv/static/root/public>
- AllowOverride FileInfo Indexes Options=All,MultiViews
- Require all granted
- </Directory>
- <% end %>
- AccessFileName .htaccess
-
- Alias /provider.json /srv/static/public/provider.json
- <Location /provider.json>
- Header set X-Minimum-Client-Version 0.5
- </Location>
-<% end -%>
</VirtualHost>
diff --git a/puppet/modules/site_static/manifests/hidden_service.pp b/puppet/modules/site_static/manifests/hidden_service.pp
new file mode 100644
index 00000000..f1f15f8e
--- /dev/null
+++ b/puppet/modules/site_static/manifests/hidden_service.pp
@@ -0,0 +1,37 @@
+# create hidden service for static sites
+class site_static::hidden_service {
+
+ include tor::daemon
+ tor::daemon::hidden_service { 'static': ports => [ '80 127.0.0.1:80'] }
+ file {
+ '/var/lib/tor/webapp/':
+ ensure => directory,
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '2700';
+
+ '/var/lib/tor/static/private_key':
+ ensure => present,
+ source => "/srv/leap/files/nodes/${::hostname}/tor.key",
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '0600',
+ notify => Service['tor'];
+
+ '/var/lib/tor/static/hostname':
+ ensure => present,
+ content => "${::site_static::tor_domain}\n",
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '0600',
+ notify => Service['tor'];
+ }
+
+ # it is necessary to zero out the config of the status module
+ # because we are configuring our own version that is unavailable
+ # over the hidden service (see: #7456 and #7776)
+ apache::module { 'status': ensure => present, conf_content => ' ' }
+
+ include site_shorewall::tor
+}
+
diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 8063d432..4912fbab 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -7,11 +7,14 @@ class site_static {
include site_config::x509::key
include site_config::x509::ca_bundle
- $static = hiera('static')
- $domains = $static['domains']
- $formats = $static['formats']
- $bootstrap = $static['bootstrap_files']
- $tor = hiera('tor', false)
+ $static = hiera('static')
+ $domains = $static['domains']
+ $formats = $static['formats']
+ $bootstrap = $static['bootstrap_files']
+
+ $tor = hiera('tor', false)
+ $hidden_service = $tor['hidden_service']
+ $tor_domain = "${hidden_service['address']}.onion"
file {
'/srv/static/':
@@ -71,15 +74,14 @@ class site_static {
}
}
- create_resources(site_static::domain, $domains)
-
if $tor {
- $hidden_service = $tor['hidden_service']
if $hidden_service['active'] {
- include site_webapp::hidden_service
+ include site_static::hidden_service
}
}
+ create_resources(site_static::domain, $domains)
+
include site_shorewall::defaults
include site_shorewall::service::http
include site_shorewall::service::https
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index b3e5fc09..2013e5ee 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -27,12 +27,52 @@
Require all granted
</Directory>
+<%- if @tor -%>
+<VirtualHost 127.0.0.1:80>
+ ServerName <%= @tor_domain %>
+ ServerAlias www.<%= @tor_domain %>
+
+ <IfModule mod_headers.c>
+ Header set X-Frame-Options "deny"
+ Header always unset X-Powered-By
+ Header always unset X-Runtime
+ </IfModule>
+
+ DocumentRoot "/<%= @document_root %>/"
+ AccessFileName .htaccess
+
+<%- if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) -%>
+ Alias /provider.json /srv/leap/provider.json
+ <Location /provider.json>
+ Header set X-Minimum-Client-Version <%= bootstrap_client['min'] %>
+ </Location>
+<%- end -%>
+
+<%- if @apache_config -%>
+<%= @apache_config.gsub(':percent:','%') %>
+<%- end -%>
+
+<%- @locations && @locations.each do |name, location| -%>
+<%- location_path = location['path'].gsub(%r{^/|/$}, '') -%>
+<%- directory = location_directory(name, location) -%>
+<%- local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name} -%>
+<%- template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb' -%>
+<%- break unless File.exists?(template_path) -%>
+ ##
+ ## <%= name %> (<%= location['format'] %>)
+ ##
+<%= scope.function_templatewlv([template_path, local_vars]) %>
+<%- end -%>
+<%- end -%>
+</VirtualHost>
+
<VirtualHost *:80>
ServerName <%= @domain %>
ServerAlias www.<%= @domain %>
<%- @aliases && @aliases.each do |domain_alias| -%>
ServerAlias <%= domain_alias %>
<%- end -%>
+
<%- if @tls_only -%>
RewriteEngine On
RewriteRule ^.*$ https://<%= @domain -%>%{REQUEST_URI} [R=permanent,L]
@@ -50,13 +90,15 @@
#RewriteLogLevel 3
Include include.d/ssl_common.inc
-
+
+ <IfModule mod_headers.c>
<%- if @tls_only -%>
Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
<%- end -%>
Header set X-Frame-Options "deny"
Header always unset X-Powered-By
Header always unset X-Runtime
+ </IfModule>
SSLCertificateKeyFile /etc/x509/keys/<%= @domain %>.key
SSLCertificateFile /etc/x509/certs/<%= @domain %>.crt
@@ -88,5 +130,4 @@
##
<%= scope.function_templatewlv([template_path, local_vars]) %>
<%- end -%>
-
</VirtualHost>