From debbfbbf8fe8702fd3202f75e049496ee9bb3ddf Mon Sep 17 00:00:00 2001
From: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Date: Mon, 26 Sep 2016 15:34:10 +0000
Subject: Generate internal TLS hieradata for apache services

This adds an environment file that can be used to enable TLS in
the internal endpoints via certmonger if used. This will include
a nested stack that will create the hash that will be used to
create the certmonger certificates.

When setting up a service over apache via puppet, we used to disable
explicitly ssl (which sets modd_ssl-related fields for that vhost).
We now make this depend on the EnableInternalTLS flag. This has only
been done for keystone, but more services will be added as the
puppet code lands

bp tls-via-certmonger

Depends-On: I303f6cf47859284785c0cdc65284a7eb89a4e039
Change-Id: I12e794f2d4076be9505dabfe456c1ca6cfbd359c
---
 puppet/services/apache.yaml | 46 +++++++++++++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 16 deletions(-)

(limited to 'puppet/services/apache.yaml')

diff --git a/puppet/services/apache.yaml b/puppet/services/apache.yaml
index c9792019..382e0ff9 100644
--- a/puppet/services/apache.yaml
+++ b/puppet/services/apache.yaml
@@ -27,6 +27,17 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  EnableInternalTLS:
+    type: boolean
+    default: false
+
+
+resources:
+
+  ApacheTLS:
+    type: OS::TripleO::Services::ApacheTLS
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
 
 outputs:
   role_data:
@@ -34,19 +45,22 @@ outputs:
     value:
       service_name: apache
       config_settings:
-        # for the given network; replacement examples (eg. for internal_api):
-        # internal_api -> IP
-        # internal_api_uri -> [IP]
-        # internal_api_subnet - > IP/CIDR
-        apache::ip: {get_param: [ServiceNetMap, ApacheNetwork]}
-        apache::server_signature: 'Off'
-        apache::server_tokens: 'Prod'
-        apache_remote_proxy_ips_network:
-          str_replace:
-            template: "NETWORK_subnet"
-            params:
-              NETWORK: {get_param: [ServiceNetMap, ApacheNetwork]}
-        apache::mod::prefork::maxclients: { get_param: ApacheMaxRequestWorkers }
-        apache::mod::prefork::serverlimit: { get_param: ApacheServerLimit }
-        apache::mod::remoteip::proxy_ips:
-          - "%{hiera('apache_remote_proxy_ips_network')}"
+        map_merge:
+          - get_attr: [ApacheTLS, role_data, config_settings]
+          -
+            # for the given network; replacement examples (eg. for internal_api):
+            # internal_api -> IP
+            # internal_api_uri -> [IP]
+            # internal_api_subnet - > IP/CIDR
+            apache::ip: {get_param: [ServiceNetMap, ApacheNetwork]}
+            apache::server_signature: 'Off'
+            apache::server_tokens: 'Prod'
+            apache_remote_proxy_ips_network:
+              str_replace:
+                template: "NETWORK_subnet"
+                params:
+                  NETWORK: {get_param: [ServiceNetMap, ApacheNetwork]}
+            apache::mod::prefork::maxclients: { get_param: ApacheMaxRequestWorkers }
+            apache::mod::prefork::serverlimit: { get_param: ApacheServerLimit }
+            apache::mod::remoteip::proxy_ips:
+              - "%{hiera('apache_remote_proxy_ips_network')}"
-- 
cgit 1.2.3-korg