diff options
Diffstat (limited to 'puppet/modules/site_static')
| -rw-r--r-- | puppet/modules/site_static/manifests/domain.pp | 1 | ||||
| -rw-r--r-- | puppet/modules/site_static/manifests/hidden_service.pp | 37 | ||||
| -rw-r--r-- | puppet/modules/site_static/manifests/init.pp | 51 | ||||
| -rw-r--r-- | puppet/modules/site_static/templates/amber.erb | 8 | ||||
| -rw-r--r-- | puppet/modules/site_static/templates/apache.conf.erb | 123 | ||||
| -rw-r--r-- | puppet/modules/site_static/templates/rack.erb | 6 |
6 files changed, 177 insertions, 49 deletions
diff --git a/puppet/modules/site_static/manifests/domain.pp b/puppet/modules/site_static/manifests/domain.pp index b26cc9e3..6cf2c653 100644 --- a/puppet/modules/site_static/manifests/domain.pp +++ b/puppet/modules/site_static/manifests/domain.pp @@ -4,6 +4,7 @@ define site_static::domain ( $key, $cert, $tls_only=true, + $use_hidden_service=false, $locations=undef, $aliases=undef, $apache_config=undef) { diff --git a/puppet/modules/site_static/manifests/hidden_service.pp b/puppet/modules/site_static/manifests/hidden_service.pp new file mode 100644 index 00000000..f1f15f8e --- /dev/null +++ b/puppet/modules/site_static/manifests/hidden_service.pp @@ -0,0 +1,37 @@ +# create hidden service for static sites +class site_static::hidden_service { + + include tor::daemon + tor::daemon::hidden_service { 'static': ports => [ '80 127.0.0.1:80'] } + file { + '/var/lib/tor/webapp/': + ensure => directory, + owner => 'debian-tor', + group => 'debian-tor', + mode => '2700'; + + '/var/lib/tor/static/private_key': + ensure => present, + source => "/srv/leap/files/nodes/${::hostname}/tor.key", + owner => 'debian-tor', + group => 'debian-tor', + mode => '0600', + notify => Service['tor']; + + '/var/lib/tor/static/hostname': + ensure => present, + content => "${::site_static::tor_domain}\n", + owner => 'debian-tor', + group => 'debian-tor', + mode => '0600', + notify => Service['tor']; + } + + # it is necessary to zero out the config of the status module + # because we are configuring our own version that is unavailable + # over the hidden service (see: #7456 and #7776) + apache::module { 'status': ensure => present, conf_content => ' ' } + + include site_shorewall::tor +} + diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp index 4a722d62..dd3f912d 100644 --- a/puppet/modules/site_static/manifests/init.pp +++ b/puppet/modules/site_static/manifests/init.pp @@ -7,26 +7,40 @@ class site_static { include site_config::x509::key include site_config::x509::ca_bundle - $static = hiera('static') - $domains = $static['domains'] - $formats = $static['formats'] - $bootstrap = $static['bootstrap_files'] - $tor = hiera('tor', false) + $static = hiera('static') + $domains = $static['domains'] + $formats = $static['formats'] + $bootstrap = $static['bootstrap_files'] + $tor = hiera('tor', false) + + file { + '/srv/static/': + ensure => 'directory', + owner => 'root', + group => 'root', + mode => '0744'; + '/srv/static/public': + ensure => 'directory', + owner => 'root', + group => 'root', + mode => '0744'; + } if $bootstrap['enabled'] { $bootstrap_domain = $bootstrap['domain'] $bootstrap_client = $bootstrap['client_version'] - file { '/srv/leap/provider.json': + file { '/srv/static/public/provider.json': content => $bootstrap['provider_json'], owner => 'www-data', group => 'www-data', - mode => '0444'; + mode => '0444', + notify => Service[apache]; } # It is important to always touch provider.json: the client needs to check x-min-client-version header, # but this is only sent when the file has been modified (otherwise 304 is sent by apache). The problem # is that changing min client version won't alter the content of provider.json, so we must touch it. - exec { '/bin/touch /srv/leap/provider.json': - require => File['/srv/leap/provider.json']; + exec { '/bin/touch /srv/static/public/provider.json': + require => File['/srv/static/public/provider.json']; } } @@ -42,8 +56,8 @@ class site_static { if (member($formats, 'rack')) { include site_apt::preferences::passenger class { 'passenger': - use_munin => false, - require => Class['site_apt::preferences::passenger'] + manage_munin => false, + require => Class['site_apt::preferences::passenger'] } } @@ -57,15 +71,24 @@ class site_static { } } - create_resources(site_static::domain, $domains) - if $tor { $hidden_service = $tor['hidden_service'] + $tor_domain = "${hidden_service['address']}.onion" if $hidden_service['active'] { - include site_webapp::hidden_service + include site_static::hidden_service + } + # Currently, we only support a single hidden service address per server. + # So if there is more than one domain configured, then we need to make sure + # we don't enable the hidden service for every domain. + if size(keys($domains)) == 1 { + $always_use_hidden_service = true + } else { + $always_use_hidden_service = false } } + create_resources(site_static::domain, $domains) + include site_shorewall::defaults include site_shorewall::service::http include site_shorewall::service::https diff --git a/puppet/modules/site_static/templates/amber.erb b/puppet/modules/site_static/templates/amber.erb index 694f1136..b34458c3 100644 --- a/puppet/modules/site_static/templates/amber.erb +++ b/puppet/modules/site_static/templates/amber.erb @@ -4,10 +4,10 @@ <%- end -%> <Directory "<%=@directory%>/"> AllowOverride FileInfo Indexes Options=All,MultiViews -<% if scope.function_guess_apache_version([]) == '2.4' %> +<%- if scope.function_guess_apache_version([]) == '2.4' -%> Require all granted -<% else %> +<%- else -%> Order deny,allow Allow from all -<% end %> - </Directory> +<%- end -%> + </Directory>
\ No newline at end of file diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb index 6b969d1c..dd04ca43 100644 --- a/puppet/modules/site_static/templates/apache.conf.erb +++ b/puppet/modules/site_static/templates/apache.conf.erb @@ -11,6 +11,9 @@ end end + # + # document root + # @document_root = begin root = '/var/www' @locations && @locations.each do |name, location| @@ -19,22 +22,104 @@ root.gsub(%r{^/|/$}, '') end + # + # provider.json + # + # if the domain is a bootstrap domain, we need to expose + # a /provider.json file. + # bootstrap_domain = scope.lookupvar('site_static::bootstrap_domain') bootstrap_client = scope.lookupvar('site_static::bootstrap_client') + if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) + provider_json = \ +%( + Alias /provider.json /srv/static/public/provider.json + <Location /provider.json> + Header set X-Minimum-Client-Version #{bootstrap_client['min']} + </Location> +) + else + provider_json = "" + end + + # + # locations + # + locations = "" + @locations && @locations.each do |name, location| + location_path = location['path'].gsub(%r{^/|/$}, '') + directory = location_directory(name, location) + local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name} + template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb' + break unless File.exists?(template_path) + locations += \ +%( + # + # #{name} (#{location['format']}) + # +#{scope.function_templatewlv([template_path, local_vars])} +) + end + + # + # allow custom apache config + # + custom_apache_config = if @apache_config + @apache_config.gsub(':percent:','%') + end + -%> +<Directory "/srv/static/public/"> + Require all granted +</Directory> + +<%- if @tor && (@always_use_hidden_service || @use_hidden_service) -%> +## +## Tor +## +<VirtualHost 127.0.0.1:80> + ServerName <%= @tor_domain %> + ServerAlias www.<%= @tor_domain %> + + <IfModule mod_headers.c> + Header set X-Frame-Options "deny" + Header always unset X-Powered-By + Header always unset X-Runtime + </IfModule> + + DocumentRoot "/<%= @document_root %>/" + AccessFileName .htaccess + +<%= provider_json %> +<%= custom_apache_config %> +<%= locations %> +</VirtualHost> +<%- end -%> + +## +## HTTP +## <VirtualHost *:80> ServerName <%= @domain %> ServerAlias www.<%= @domain %> <%- @aliases && @aliases.each do |domain_alias| -%> ServerAlias <%= domain_alias %> <%- end -%> + <%- if @tls_only -%> RewriteEngine On RewriteRule ^.*$ https://<%= @domain -%>%{REQUEST_URI} [R=permanent,L] +<%- else -%> +<%= provider_json %> +<%= custom_apache_config %> +<%= locations %> <%- end -%> </VirtualHost> +## +## HTTPS +## <VirtualHost *:443> ServerName <%= @domain %> ServerAlias www.<%= @domain %> @@ -46,13 +131,15 @@ #RewriteLogLevel 3 Include include.d/ssl_common.inc - + + <IfModule mod_headers.c> <%- if @tls_only -%> - Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains" + Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains" <%- end -%> - Header set X-Frame-Options "deny" - Header always unset X-Powered-By - Header always unset X-Runtime + Header set X-Frame-Options "deny" + Header always unset X-Powered-By + Header always unset X-Runtime + </IfModule> SSLCertificateKeyFile /etc/x509/keys/<%= @domain %>.key SSLCertificateFile /etc/x509/certs/<%= @domain %>.crt @@ -62,27 +149,7 @@ DocumentRoot "/<%= @document_root %>/" AccessFileName .htaccess -<%- if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) -%> - Alias /provider.json /srv/leap/provider.json - <Location /provider.json> - Header set X-Minimum-Client-Version <%= bootstrap_client['min'] %> - </Location> -<%- end -%> - -<%- if @apache_config -%> -<%= @apache_config.gsub(':percent:','%') %> -<%- end -%> - -<%- @locations && @locations.each do |name, location| -%> -<%- location_path = location['path'].gsub(%r{^/|/$}, '') -%> -<%- directory = location_directory(name, location) -%> -<%- local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name} -%> -<%- template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb' -%> -<%- break unless File.exists?(template_path) -%> - ## - ## <%= name %> (<%= location['format'] %>) - ## -<%= scope.function_templatewlv([template_path, local_vars]) %> -<%- end -%> - +<%= provider_json %> +<%= custom_apache_config %> +<%= locations %> </VirtualHost> diff --git a/puppet/modules/site_static/templates/rack.erb b/puppet/modules/site_static/templates/rack.erb index 431778bb..1cbf84d2 100644 --- a/puppet/modules/site_static/templates/rack.erb +++ b/puppet/modules/site_static/templates/rack.erb @@ -10,10 +10,10 @@ <%- end -%> <Directory "<%=@directory%>"> Options -MultiViews -<% if scope.function_guess_apache_version([]) == '2.4' %> +<%- if scope.function_guess_apache_version([]) == '2.4' -%> Require all granted -<% else %> +<%- else -%> Order deny,allow Allow from all -<% end %> +<%- end -%> </Directory> |