diff --git a/manifests/site.pp b/manifests/site.pp index 9224d3b090..ae245fb3cf 100644 --- a/manifests/site.pp +++ b/manifests/site.pp @@ -35,36 +35,41 @@ node /^review\d*\.open.*\.org$/ { class { 'openstack_project::server': } class { 'openstack_project::review': - project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', - github_oauth_token => hiera('gerrit_github_token'), - github_project_username => hiera('github_project_username', 'username'), - github_project_password => hiera('github_project_password'), - mysql_host => hiera('gerrit_mysql_host', 'localhost'), - mysql_password => hiera('gerrit_mysql_password'), - email_private_key => hiera('gerrit_email_private_key'), - token_private_key => hiera('gerrit_rest_token_private_key'), - gerritbot_password => hiera('gerrit_gerritbot_password'), - gerritbot_ssh_rsa_key_contents => hiera('gerritbot_ssh_rsa_key_contents'), - gerritbot_ssh_rsa_pubkey_contents => hiera('gerritbot_ssh_rsa_pubkey_contents'), - ssl_cert_file_contents => hiera('gerrit_ssl_cert_file_contents'), - ssl_key_file_contents => hiera('gerrit_ssl_key_file_contents'), - ssl_chain_file_contents => hiera('gerrit_ssl_chain_file_contents'), - ssh_dsa_key_contents => hiera('gerrit_ssh_dsa_key_contents'), - ssh_dsa_pubkey_contents => hiera('gerrit_ssh_dsa_pubkey_contents'), - ssh_rsa_key_contents => hiera('gerrit_ssh_rsa_key_contents'), - ssh_rsa_pubkey_contents => hiera('gerrit_ssh_rsa_pubkey_contents'), - ssh_project_rsa_key_contents => hiera('gerrit_project_ssh_rsa_key_contents'), - ssh_project_rsa_pubkey_contents => hiera('gerrit_project_ssh_rsa_pubkey_contents'), - ssh_welcome_rsa_key_contents => hiera('welcome_message_gerrit_ssh_private_key'), - ssh_welcome_rsa_pubkey_contents => hiera('welcome_message_gerrit_ssh_public_key'), - ssh_replication_rsa_key_contents => hiera('gerrit_replication_ssh_rsa_key_contents'), - ssh_replication_rsa_pubkey_contents => hiera('gerrit_replication_ssh_rsa_pubkey_contents'), - lp_access_token => hiera('gerrit_lp_access_token'), - lp_access_secret => hiera('gerrit_lp_access_secret'), - lp_consumer_key => hiera('gerrit_lp_consumer_key'), - swift_username => hiera('swift_store_user', 'username'), - swift_password => hiera('swift_store_key'), - storyboard_password => hiera('gerrit_storyboard_token'), + project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', + github_oauth_token => hiera('gerrit_github_token'), + github_project_username => hiera('github_project_username', 'username'), + github_project_password => hiera('github_project_password'), + mysql_host => hiera('gerrit_mysql_host', 'localhost'), + mysql_password => hiera('gerrit_mysql_password'), + email_private_key => hiera('gerrit_email_private_key'), + token_private_key => hiera('gerrit_rest_token_private_key'), + gerritbot_password => hiera('gerrit_gerritbot_password'), + gerritbot_ssh_rsa_key_contents => hiera('gerritbot_ssh_rsa_key_contents'), + gerritbot_ssh_rsa_pubkey_contents => hiera('gerritbot_ssh_rsa_pubkey_contents'), + ssl_cert_file_contents => hiera('review_opendev_cert_file_contents'), + ssl_key_file_contents => hiera('review_opendev_key_file_contents'), + ssl_chain_file_contents => hiera('review_opendev_chain_file_contents'), + ssh_dsa_key_contents => hiera('gerrit_ssh_dsa_key_contents'), + ssh_dsa_pubkey_contents => hiera('gerrit_ssh_dsa_pubkey_contents'), + ssh_rsa_key_contents => hiera('gerrit_ssh_rsa_key_contents'), + ssh_rsa_pubkey_contents => hiera('gerrit_ssh_rsa_pubkey_contents'), + ssh_project_rsa_key_contents => hiera('gerrit_project_ssh_rsa_key_contents'), + ssh_project_rsa_pubkey_contents => hiera('gerrit_project_ssh_rsa_pubkey_contents'), + ssh_welcome_rsa_key_contents => hiera('welcome_message_gerrit_ssh_private_key'), + ssh_welcome_rsa_pubkey_contents => hiera('welcome_message_gerrit_ssh_public_key'), + ssh_replication_rsa_key_contents => hiera('gerrit_replication_ssh_rsa_key_contents'), + ssh_replication_rsa_pubkey_contents => hiera('gerrit_replication_ssh_rsa_pubkey_contents'), + lp_access_token => hiera('gerrit_lp_access_token'), + lp_access_secret => hiera('gerrit_lp_access_secret'), + lp_consumer_key => hiera('gerrit_lp_consumer_key'), + swift_username => hiera('swift_store_user', 'username'), + swift_password => hiera('swift_store_key'), + storyboard_password => hiera('gerrit_storyboard_token'), + # Compatibility layer vars for the old domain name below here. + # TODO rename the hiera keys to reduce confusion + review_openstack_cert_file_contents => hiera('gerrit_ssl_cert_file_contents'), + review_openstack_key_file_contents => hiera('gerrit_ssl_key_file_contents'), + review_openstack_chain_file_contents => hiera('gerrit_ssl_chain_file_contents'), } } diff --git a/modules/openstack_project/files/opendev.svg b/modules/openstack_project/files/opendev.svg new file mode 100644 index 0000000000..2e2c47f714 --- /dev/null +++ b/modules/openstack_project/files/opendev.svg @@ -0,0 +1,86 @@ + +image/svg+xml \ No newline at end of file diff --git a/modules/openstack_project/manifests/gerrit.pp b/modules/openstack_project/manifests/gerrit.pp index 92fdb12ff3..15b0c80c44 100644 --- a/modules/openstack_project/manifests/gerrit.pp +++ b/modules/openstack_project/manifests/gerrit.pp @@ -262,7 +262,7 @@ class openstack_project::gerrit ( file { '/home/gerrit2/review_site/static/title.svg': ensure => present, - source => 'puppet:///modules/openstack_project/openstack.svg', + source => 'puppet:///modules/openstack_project/opendev.svg', require => Class['::gerrit'], notify => Exec['reload_gerrit_header'], } diff --git a/modules/openstack_project/manifests/review.pp b/modules/openstack_project/manifests/review.pp index 36729c261c..1678267df3 100644 --- a/modules/openstack_project/manifests/review.pp +++ b/modules/openstack_project/manifests/review.pp @@ -81,6 +81,10 @@ class openstack_project::review ( $project_config_repo = '', $projects_config = 'openstack_project/review.projects.ini.erb', $gerrit_configure = true, + # Compatibility for old domain name vars below here. + $review_openstack_cert_file_contents = '', + $review_openstack_key_file_contents = '', + $review_openstack_chain_file_contents = '', ) { class { 'project_config': @@ -90,9 +94,9 @@ class openstack_project::review ( if ($gerrit_configure) { $accountpatchreviewdb_url = "jdbc:mysql://${mysql_host}:3306/accountPatchReviewDb?characterSetResults=utf8&characterEncoding=utf8&connectionCollation=utf8_bin&useUnicode=yes&user=gerrit2&password=${mysql_password}" class { 'openstack_project::gerrit': - vhost_name => 'review.openstack.org', - canonicalweburl => 'https://review.openstack.org/', - git_http_url => 'https://git.openstack.org/', + vhost_name => 'review.opendev.org', + canonicalweburl => 'https://review.opendev.org/', + git_http_url => 'https://opendev.org/', ssl_cert_file => $ssl_cert_file, ssl_key_file => $ssl_key_file, ssl_chain_file => $ssl_chain_file, @@ -481,4 +485,42 @@ class openstack_project::review ( backup_user => 'bup-review', backup_server => 'backup01.ord.rax.ci.openstack.org', } + + # Compatibility layer for old domain name below here + include ::httpd + + if ! defined(Httpd::Mod['alias']) { + httpd::mod { 'alias': + ensure => present, + before => Service['httpd'], + } + } + + file { '/etc/ssl/certs/review-redirect.openstack.org.pem': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', + content => $review_openstack_cert_file_contents, + } + file { '/etc/ssl/private/review-redirect.openstack.org.key': + ensure => present, + owner => 'root', + group => 'root', + mode => '0600', + content => $review_openstack_key_file_contents, + } + file { '/etc/ssl/certs/review-redirect.openstack.org_intermediate.pem': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', + content => $review_openstack_chain_file_contents, + } + ::httpd::vhost { 'review.openstack.org': + port => 443, # Is required despite not being used. + docroot => 'MEANINGLESS_ARGUMENT', + priority => '50', + template => 'openstack_project/review-openstack-redirect.vhost.erb', + } } diff --git a/modules/openstack_project/templates/review-openstack-redirect.vhost.erb b/modules/openstack_project/templates/review-openstack-redirect.vhost.erb new file mode 100644 index 0000000000..acb4f73ee6 --- /dev/null +++ b/modules/openstack_project/templates/review-openstack-redirect.vhost.erb @@ -0,0 +1,38 @@ +# ************************************ +# Managed by Puppet +# ************************************ + + + ServerName <%= @srvname %> + + LogLevel warn + ErrorLog /var/log/apache2/<%= @srvname %>_error.log + CustomLog /var/log/apache2/<%= @srvname %>_access.log combined + ServerSignature Off + + Redirect / https://review.opendev.org/ + + + + + ServerName <%= @srvname %> + + SSLEngine on + SSLProtocol All -SSLv2 -SSLv3 + # Once the machine is using something to terminate TLS that supports ECDHE + # then this should be edited to remove the RSA+AESGCM:RSA+AES so that PFS + # only is guarenteed. + SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP + SSLHonorCipherOrder on + SSLCertificateFile /etc/ssl/certs/review-redirect.openstack.org.pem + SSLCertificateKeyFile /etc/ssl/private/review-redirect.openstack.org.key + SSLCertificateChainFile /etc/ssl/certs/review-redirect.openstack.org_intermediate.pem + + LogLevel warn + ErrorLog /var/log/apache2/<%= @srvname %>_error.log + CustomLog /var/log/apache2/<%= @srvname %>_access.log combined + ServerSignature Off + + Redirect / https://review.opendev.org/ + +