1ff51a9bf3
Apache2's default value for KeepAliveTimeout is 5 seconds, which is okay for general web-page serving use cases. However, sessions and connection pools created by keystoneauth1.session.Session can be terminated unnecessarily during multiple API calls in a session due to the short KeepAliveTimeout. Let's ease KeepAliveTimeout to 75 seconds, which is fairly standard for API services behind a reverse proxy since it's the default value of nginx. Closes-Bug: #1947010 Change-Id: I752a836676d895ef783362810ed6764980e8574b
36 lines
1.3 KiB
Plaintext
36 lines
1.3 KiB
Plaintext
{% if options.endpoints -%}
|
|
{% for ext_port in options.ext_ports -%}
|
|
Listen {{ ext_port }}
|
|
{% endfor -%}
|
|
{% for address, endpoint, ext, int in options.endpoints -%}
|
|
<VirtualHost {{ address }}:{{ ext }}>
|
|
ServerName {{ endpoint }}
|
|
SSLEngine on
|
|
|
|
# This section is based on Mozilla's recommendation
|
|
# as the "intermediate" profile as of July 7th, 2020.
|
|
# https://wiki.mozilla.org/Security/Server_Side_TLS
|
|
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
|
|
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
|
SSLHonorCipherOrder off
|
|
|
|
SSLCertificateFile /etc/apache2/ssl/{{ options.service_name }}/cert_{{ endpoint }}
|
|
SSLCertificateKeyFile /etc/apache2/ssl/{{ options.service_name }}/key_{{ endpoint }}
|
|
ProxyPass / http://localhost:{{ int }}/
|
|
ProxyPassReverse / http://localhost:{{ int }}/
|
|
ProxyPreserveHost on
|
|
RequestHeader set X-Forwarded-Proto "https"
|
|
KeepAliveTimeout 75
|
|
MaxKeepAliveRequests 1000
|
|
</VirtualHost>
|
|
{% endfor -%}
|
|
<Proxy *>
|
|
Order deny,allow
|
|
Allow from all
|
|
</Proxy>
|
|
<Location />
|
|
Order allow,deny
|
|
Allow from all
|
|
</Location>
|
|
{% endif -%}
|