Add a HTTPS-->HTTP reverse proxy in front of redfish-emulator
This patch introduces a reverse proxy that terminates an HTTPS connection and forwards it to the redfish emulator behind that is running HTTP. Also the reverse proxy presents a self-signed certificate. Closes: #136 Relates-To: #136 Change-Id: If6ee705247ae8866d2674bff1ff034277f9c9177
This commit is contained in:
parent
bc949f259f
commit
5bf96b27d6
@ -19,6 +19,10 @@ airship_gate_ipam:
|
||||
bridge_ip: "10.23.24.1"
|
||||
|
||||
airship_gate_redfish:
|
||||
hostname: "redfish-emulator"
|
||||
username: "username"
|
||||
password: "password"
|
||||
secure_port: 443
|
||||
port: 8000
|
||||
bind_address: "127.0.0.1"
|
||||
|
||||
@ -79,4 +83,4 @@ airship_gate_libvirt_networks:
|
||||
delay: '0'
|
||||
ip:
|
||||
address: "{{ airship_gate_ipam.provision_network.bridge_ip }}"
|
||||
netmask: "255.255.255.0"
|
||||
netmask: "255.255.255.0"
|
||||
|
@ -94,6 +94,19 @@
|
||||
- network: "{{ airship_gate_names.nat_network }}"
|
||||
- network: "{{ airship_gate_names.provision_network }}"
|
||||
|
||||
- name: install apache2 reverse proxy
|
||||
include_role:
|
||||
name: reverse-proxy
|
||||
vars:
|
||||
reverse_proxy_action: "install"
|
||||
reverse_proxy_hostname: "{{ airship_gate_redfish.hostname }}"
|
||||
reverse_proxy_username: "{{ airship_gate_redfish.username }}"
|
||||
reverse_proxy_password: "{{ airship_gate_redfish.password }}"
|
||||
reverse_proxy_frontend_ip: "{{ airship_gate_redfish.bind_address }}"
|
||||
reverse_proxy_frontend_port: "{{ airship_gate_redfish.secure_port }}"
|
||||
reverse_proxy_backend_ip: "{{ airship_gate_redfish.bind_address }}"
|
||||
reverse_proxy_backend_port: "{{ airship_gate_redfish.port }}"
|
||||
|
||||
- name: install and start redfish emulator
|
||||
include_role:
|
||||
name: redfish-emulator
|
||||
|
@ -9,9 +9,12 @@
|
||||
gate_flavor: small
|
||||
gate_action: build-infra
|
||||
|
||||
- name: query redfish to make sure it has runnig domains
|
||||
- name: query redfish to make sure it has running domains using HTTPS
|
||||
uri:
|
||||
url: http://{{ airship_gate_redfish.bind_address }}:{{ airship_gate_redfish.port }}/redfish/v1/Systems?format=json
|
||||
url: "https://{{ airship_gate_redfish.bind_address }}:{{ airship_gate_redfish.secure_port }}/redfish/v1/Systems?format=json"
|
||||
url_username: "{{ airship_gate_redfish.username }}"
|
||||
url_password: "{{ airship_gate_redfish.password }}"
|
||||
validate_certs: false
|
||||
method: GET
|
||||
return_content: yes
|
||||
register: redfish_response
|
||||
@ -22,7 +25,10 @@
|
||||
|
||||
- name: save ids to list
|
||||
uri:
|
||||
url: "http://{{ airship_gate_redfish.bind_address }}:{{ airship_gate_redfish.port }}{{ item.value }}?format=json"
|
||||
url: "https://{{ airship_gate_redfish.bind_address }}:{{ airship_gate_redfish.secure_port }}{{ item.value }}?format=json"
|
||||
url_username: "{{ airship_gate_redfish.username }}"
|
||||
url_password: "{{ airship_gate_redfish.password }}"
|
||||
validate_certs: false
|
||||
method: GET
|
||||
return_content: yes
|
||||
with_dict: "{{ redfish_response.json.Members }}"
|
||||
@ -38,4 +44,4 @@
|
||||
assert:
|
||||
that:
|
||||
- ephemeral_domain_id is defined
|
||||
- (ephemeral_domain_id | length) > 1
|
||||
- (ephemeral_domain_id | length) > 1
|
||||
|
@ -1,4 +1,8 @@
|
||||
airship_gate_redfish:
|
||||
hostname: "redfish-emulator"
|
||||
username: "username"
|
||||
password: "password"
|
||||
secure_port: 443
|
||||
port: 8000
|
||||
bind_address: "127.0.0.1"
|
||||
|
||||
@ -12,4 +16,4 @@ airship_gate_names:
|
||||
target_separator: "-"
|
||||
target_volume_prefix: "vol_target"
|
||||
ephemeral_volume: "vol_ephemeral"
|
||||
pool: airship
|
||||
pool: airship
|
||||
|
9
roles/reverse-proxy/defaults/main.yaml
Normal file
9
roles/reverse-proxy/defaults/main.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
reverse_proxy_action: install
|
||||
|
||||
reverse_proxy_hostname: "redfish-emulator"
|
||||
reverse_proxy_username: "username"
|
||||
reverse_proxy_password: "password"
|
||||
reverse_proxy_frontend_ip: "127.0.0.1"
|
||||
reverse_proxy_frontend_port: 443
|
||||
reverse_proxy_backend_ip: "127.0.0.1"
|
||||
reverse_proxy_backend_port: 8000
|
24
roles/reverse-proxy/tasks/dependencies.yaml
Normal file
24
roles/reverse-proxy/tasks/dependencies.yaml
Normal file
@ -0,0 +1,24 @@
|
||||
- block:
|
||||
- name: Ensuring python3-pip and support packages are present
|
||||
when: ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux'
|
||||
fail:
|
||||
msg: "CentoOS or RHEL is not currently supported"
|
||||
|
||||
- name: Ensuring python3-pip and support packages are present
|
||||
become: true
|
||||
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
|
||||
apt:
|
||||
name:
|
||||
- python3-pip
|
||||
- python3-libvirt
|
||||
- python-libvirt
|
||||
state: present
|
||||
|
||||
- name: Install required pip packages
|
||||
pip:
|
||||
name: "{{ item }}"
|
||||
executable: pip3
|
||||
with_items:
|
||||
- pyOpenSSL
|
||||
- passlib
|
||||
become: true
|
103
roles/reverse-proxy/tasks/install.yaml
Normal file
103
roles/reverse-proxy/tasks/install.yaml
Normal file
@ -0,0 +1,103 @@
|
||||
- name: Install dependencies
|
||||
include_tasks: dependencies.yaml
|
||||
|
||||
- name: Install apache2 package
|
||||
apt:
|
||||
name: apache2
|
||||
state: present
|
||||
become: true
|
||||
|
||||
- name: Disable default virtualhost
|
||||
file:
|
||||
path: /etc/apache2/sites-enabled/000-default.conf
|
||||
state: absent
|
||||
become: true
|
||||
|
||||
- name: Enable proxy related modules
|
||||
apache2_module:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items:
|
||||
- headers
|
||||
- proxy
|
||||
- proxy_http
|
||||
- rewrite
|
||||
- ssl
|
||||
become: true
|
||||
|
||||
- name: Generate private key for "{{ reverse_proxy_hostname }}"
|
||||
openssl_privatekey:
|
||||
path: /etc/ssl/private/{{ reverse_proxy_hostname }}-privkey.pem
|
||||
become: true
|
||||
|
||||
- name: Generate CSR for "{{ reverse_proxy_hostname }}"
|
||||
openssl_csr:
|
||||
path: /tmp/{{ reverse_proxy_hostname }}.csr
|
||||
privatekey_path: /etc/ssl/private/{{ reverse_proxy_hostname }}-privkey.pem
|
||||
common_name: "{{ reverse_proxy_hostname }}"
|
||||
subject_alt_name: "IP:{{ reverse_proxy_frontend_ip }}"
|
||||
become: true
|
||||
|
||||
- name: Generate the self signed certificate for "{{ reverse_proxy_hostname }}"
|
||||
openssl_certificate:
|
||||
path: /etc/ssl/certs/{{ reverse_proxy_hostname }}-cert.pem
|
||||
privatekey_path: /etc/ssl/private/{{ reverse_proxy_hostname }}-privkey.pem
|
||||
csr_path: /tmp/{{ reverse_proxy_hostname }}.csr
|
||||
provider: selfsigned
|
||||
become: true
|
||||
|
||||
# TODO: Using dhparam can be good to have for HTTPS virtual host
|
||||
# But it takes too much time to generate for each run.
|
||||
# It can be enabled if necessary at a later point.
|
||||
#- name: Generate Diffie-Hellman parameters with the default size (4096 bits)
|
||||
# openssl_dhparam:
|
||||
# path: /etc/ssl/certs/{{ reverse_proxy_hostname }}-dhparams.pem
|
||||
|
||||
- name: Remove older htpasswd file
|
||||
file:
|
||||
path: /etc/apache2/{{ reverse_proxy_hostname }}-passwd
|
||||
state: absent
|
||||
become: true
|
||||
|
||||
- name: Create username and password for basic authentication
|
||||
htpasswd:
|
||||
path: /etc/apache2/{{ reverse_proxy_hostname }}-passwd
|
||||
name: "{{ reverse_proxy_username }}"
|
||||
password: "{{ reverse_proxy_password }}"
|
||||
become: true
|
||||
|
||||
- name: Add default virtual host
|
||||
template:
|
||||
src: etc/apache2/sites-available/000-default.conf.j2
|
||||
dest: /etc/apache2/sites-available/000-default.conf
|
||||
become: true
|
||||
|
||||
- name: Add ssl virtual host
|
||||
template:
|
||||
src: etc/apache2/sites-available/default-ssl.conf.j2
|
||||
dest: /etc/apache2/sites-available/default-ssl.conf
|
||||
become: true
|
||||
|
||||
- name: Add ssl configuration
|
||||
template:
|
||||
src: etc/apache2/conf-available/ssl-params.conf.j2
|
||||
dest: /etc/apache2/conf-available/ssl-params.conf
|
||||
become: true
|
||||
|
||||
- name: Enable default virtual host
|
||||
command: a2ensite 000-default
|
||||
become: true
|
||||
|
||||
- name: Enable ssl virtual host
|
||||
command: a2ensite default-ssl
|
||||
become: true
|
||||
|
||||
- name: Enable ssl configuration
|
||||
command: a2enconf ssl-params
|
||||
become: true
|
||||
|
||||
- name: Reload apache2 service
|
||||
service:
|
||||
name: apache2
|
||||
state: reloaded
|
||||
become: true
|
1
roles/reverse-proxy/tasks/main.yaml
Normal file
1
roles/reverse-proxy/tasks/main.yaml
Normal file
@ -0,0 +1 @@
|
||||
- include_tasks: "{{ reverse_proxy_action }}.yaml"
|
@ -0,0 +1,17 @@
|
||||
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
|
||||
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
|
||||
|
||||
SSLHonorCipherOrder On
|
||||
# Disable preloading HSTS for now. You can use the commented out header line that includes
|
||||
# the "preload" directive if you understand the implications.
|
||||
#Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
|
||||
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
|
||||
Header always set X-Frame-Options DENY
|
||||
Header always set X-Content-Type-Options nosniff
|
||||
# Requires Apache >= 2.4
|
||||
SSLCompression off
|
||||
SSLSessionTickets Off
|
||||
SSLUseStapling on
|
||||
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
|
||||
|
||||
#SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/{{ reverse_proxy_hostname }}-dhparam.pem"
|
@ -0,0 +1,3 @@
|
||||
<VirtualHost *:80>
|
||||
Redirect permanent "/" "https://{{ reverse_proxy_frontend_ip }}:{{ reverse_proxy_frontend_port }}/"
|
||||
</VirtualHost>
|
@ -0,0 +1,148 @@
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost {{ reverse_proxy_frontend_ip }}:{{ reverse_proxy_frontend_port }}>
|
||||
ServerAdmin webmaster@localhost
|
||||
ServerName {{ reverse_proxy_hostname }}
|
||||
|
||||
DocumentRoot /var/www/html
|
||||
|
||||
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
|
||||
# error, crit, alert, emerg.
|
||||
# It is also possible to configure the loglevel for particular
|
||||
# modules, e.g.
|
||||
#LogLevel info ssl:warn
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
||||
|
||||
# For most configuration files from conf-available/, which are
|
||||
# enabled or disabled at a global level, it is possible to
|
||||
# include a line for only one particular virtual host. For example the
|
||||
# following line enables the CGI configuration for this host only
|
||||
# after it has been globally disabled with "a2disconf".
|
||||
#Include conf-available/serve-cgi-bin.conf
|
||||
|
||||
# SSL Engine Switch:
|
||||
# Enable/Disable SSL for this virtual host.
|
||||
SSLEngine on
|
||||
|
||||
# A self-signed (snakeoil) certificate can be created by installing
|
||||
# the ssl-cert package. See
|
||||
# /usr/share/doc/apache2/README.Debian.gz for more info.
|
||||
# If both key and certificate are stored in the same file, only the
|
||||
# SSLCertificateFile directive is needed.
|
||||
SSLCertificateFile /etc/ssl/certs/{{ reverse_proxy_hostname }}-cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/private/{{ reverse_proxy_hostname }}-privkey.pem
|
||||
|
||||
# Server Certificate Chain:
|
||||
# Point SSLCertificateChainFile at a file containing the
|
||||
# concatenation of PEM encoded CA certificates which form the
|
||||
# certificate chain for the server certificate. Alternatively
|
||||
# the referenced file can be the same as SSLCertificateFile
|
||||
# when the CA certificates are directly appended to the server
|
||||
# certificate for convinience.
|
||||
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
|
||||
|
||||
# Certificate Authority (CA):
|
||||
# Set the CA certificate verification path where to find CA
|
||||
# certificates for client authentication or alternatively one
|
||||
# huge file containing all of them (file must be PEM encoded)
|
||||
# Note: Inside SSLCACertificatePath you need hash symlinks
|
||||
# to point to the certificate files. Use the provided
|
||||
# Makefile to update the hash symlinks after changes.
|
||||
#SSLCACertificatePath /etc/ssl/certs/
|
||||
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
|
||||
|
||||
# Certificate Revocation Lists (CRL):
|
||||
# Set the CA revocation path where to find CA CRLs for client
|
||||
# authentication or alternatively one huge file containing all
|
||||
# of them (file must be PEM encoded)
|
||||
# Note: Inside SSLCARevocationPath you need hash symlinks
|
||||
# to point to the certificate files. Use the provided
|
||||
# Makefile to update the hash symlinks after changes.
|
||||
#SSLCARevocationPath /etc/apache2/ssl.crl/
|
||||
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
|
||||
|
||||
# Client Authentication (Type):
|
||||
# Client certificate verification type and depth. Types are
|
||||
# none, optional, require and optional_no_ca. Depth is a
|
||||
# number which specifies how deeply to verify the certificate
|
||||
# issuer chain before deciding the certificate is not valid.
|
||||
#SSLVerifyClient require
|
||||
#SSLVerifyDepth 10
|
||||
|
||||
# SSL Engine Options:
|
||||
# Set various options for the SSL engine.
|
||||
# o FakeBasicAuth:
|
||||
# Translate the client X.509 into a Basic Authorisation. This means that
|
||||
# the standard Auth/DBMAuth methods can be used for access control. The
|
||||
# user name is the `one line' version of the client's X.509 certificate.
|
||||
# Note that no password is obtained from the user. Every entry in the user
|
||||
# file needs this password: `xxj31ZMTZzkVA'.
|
||||
# o ExportCertData:
|
||||
# This exports two additional environment variables: SSL_CLIENT_CERT and
|
||||
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
|
||||
# server (always existing) and the client (only existing when client
|
||||
# authentication is used). This can be used to import the certificates
|
||||
# into CGI scripts.
|
||||
# o StdEnvVars:
|
||||
# This exports the standard SSL/TLS related `SSL_*' environment variables.
|
||||
# Per default this exportation is switched off for performance reasons,
|
||||
# because the extraction step is an expensive operation and is usually
|
||||
# useless for serving static content. So one usually enables the
|
||||
# exportation for CGI and SSI requests only.
|
||||
# o OptRenegotiate:
|
||||
# This enables optimized SSL connection renegotiation handling when SSL
|
||||
# directives are used in per-directory context.
|
||||
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
|
||||
<FilesMatch "\.(cgi|shtml|phtml|php)$">
|
||||
SSLOptions +StdEnvVars
|
||||
</FilesMatch>
|
||||
<Directory /usr/lib/cgi-bin>
|
||||
SSLOptions +StdEnvVars
|
||||
</Directory>
|
||||
|
||||
# SSL Protocol Adjustments:
|
||||
# The safe and default but still SSL/TLS standard compliant shutdown
|
||||
# approach is that mod_ssl sends the close notify alert but doesn't wait for
|
||||
# the close notify alert from client. When you need a different shutdown
|
||||
# approach you can use one of the following variables:
|
||||
# o ssl-unclean-shutdown:
|
||||
# This forces an unclean shutdown when the connection is closed, i.e. no
|
||||
# SSL close notify alert is send or allowed to received. This violates
|
||||
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
|
||||
# this when you receive I/O errors because of the standard approach where
|
||||
# mod_ssl sends the close notify alert.
|
||||
# o ssl-accurate-shutdown:
|
||||
# This forces an accurate shutdown when the connection is closed, i.e. a
|
||||
# SSL close notify alert is send and mod_ssl waits for the close notify
|
||||
# alert of the client. This is 100% SSL/TLS standard compliant, but in
|
||||
# practice often causes hanging connections with brain-dead browsers. Use
|
||||
# this only for browsers where you know that their SSL implementation
|
||||
# works correctly.
|
||||
# Notice: Most problems of broken clients are also related to the HTTP
|
||||
# keep-alive facility, so you usually additionally want to disable
|
||||
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
|
||||
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
|
||||
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
|
||||
# "force-response-1.0" for this.
|
||||
# BrowserMatch "MSIE [2-6]" \
|
||||
# nokeepalive ssl-unclean-shutdown \
|
||||
# downgrade-1.0 force-response-1.0
|
||||
|
||||
<Proxy *>
|
||||
Order deny,allow
|
||||
Allow from all
|
||||
Authtype Basic
|
||||
Authname "Password based authentication"
|
||||
AuthUserFile /etc/apache2/{{ reverse_proxy_hostname }}-passwd
|
||||
Require valid-user
|
||||
</Proxy>
|
||||
|
||||
ProxyPreserveHost On
|
||||
|
||||
ProxyPass / http://{{ reverse_proxy_backend_ip }}:{{ reverse_proxy_backend_port }}/
|
||||
ProxyPassReverse / http://{{ reverse_proxy_backend_ip }}:{{ reverse_proxy_backend_port }}/
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
|
Loading…
Reference in New Issue
Block a user