openstack/kolla-ansible
Code Issues Proposed changes

Fix enforced horizon redirect to https

Browse Source 
Also fixes similar issues introduced by the same recent change.
Added FIXME note about possible TLS malfunction regarding horizon.

Change-Id: I5f46a9306139eb550d3849757c8bdf0767537c78
Closes-Bug: #1844016
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
This commit is contained in:
Radosław Piliszek 2019-09-14 22:00:56 +02:00
parent d659c4dd15
commit b4ef4638a6
4 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/roles/haproxy/templates/haproxy_main.cfg.j2
View File

@ -13,7 +13,7 @@ global
{% endfor %}
{% endif %}
stats socket /var/lib/kolla/haproxy/haproxy.sock group kolla mode 660
{% if kolla_enable_tls_external or kolla_enable_tls_internal | bool %}
{% if kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool %}
ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
tune.ssl.default-dh-param 4096

3
ansible/roles/horizon/templates/horizon.conf.j2
View File

@ -33,7 +33,8 @@ TraceEnable off
</Location>
</VirtualHost>
{% if kolla_enable_tls_external or kolla_enable_tls_internal| bool %}
{# FIXME(yoctozepto): enabling of either tls will break the other if not enabled too #}
{% if kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool %}
Header edit Location ^http://(.*)$ https://$1
{% endif %}

2
ansible/roles/horizon/templates/local_settings.j2
View File

@ -55,7 +55,7 @@ DATABASES = {
#CSRF_COOKIE_SECURE = True
#SESSION_COOKIE_SECURE = True
{% if kolla_enable_tls_external or kolla_enable_tls_internal | bool %}
{% if kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool %}
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True

2
ansible/roles/nova/templates/nova.conf.j2
View File

@ -229,7 +229,7 @@ debug = {{ nova_logging_debug }}
[wsgi]
api_paste_config = /etc/nova/api-paste.ini
{% if kolla_enable_tls_external or kolla_enable_tls_internal | bool %}
{% if kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool %}
secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO
{% endif %}