8 Commits

Author SHA1 Message Date
Damian Dabrowski
e9445504f4 Add support for TLS backends
This patch allows haproxy to communicate with service backends over TLS.

It's disabled by default and each service role needs to have TLS backend
support implemented to get it working.

For example, TLS support for glance was added in [1]

[1] https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/821011

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/880872

Change-Id: I5fc507f4031dcf63ed95dae307c30d9f436ef3da
2023-04-25 15:24:24 +02:00
Andrew Bonney
e9989ed74b tls1.2: update ciphers to latest recommendations
Based upon usual recommendations from:
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/

Change-Id: Ia17660eb19cb2ad15f8d511cad2fce95f39b706b
2022-08-05 10:44:00 +01:00
Dmitriy Rabotyagov
b2e13a5128 Fix behaviour of OSA_CONFIG_DIR
OSA_CONFIG_DIR environemntal variable allows to manage several
deployments from same deploy host. That is handy feature
which was broken for several roles and usecases. It should be
respected and handled properly.

Change-Id: Ie6210a71f7b9890b74d9006de86050c822002c69
2022-02-11 20:31:11 +02:00
Andrew Bonney
0d74b74bfc Add defaults for TLS 1.3 and rename TLS <= 1.2 variable
TLS v1.3 uses different (incompatible) cipher suite names, so
a new variable is added to set these in roles which require them.

TLS v1.2 and below is still required, but the variable name is
changed to avoid confusion, whilst using the old name as a default
if set by a user deployment.

Change-Id: I9312daa7ca75e484f8aa3857fe43565c89e3f09a
2022-01-10 13:46:51 +00:00
Andrew Bonney
b018162d37 Fix definition of ssl_protocol
The syntax for TLS 1.0 is incorrect for Apache servers
which appear to be the only users of this variable.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/823971
Change-Id: I4a66a5b24f03eadc0fe758065749a7ae15a013d8
2022-01-10 13:46:51 +00:00
Jonathan Rosser
e2b42b91bd Add PKI role to integrated repo
Change-Id: I9d53aaf21272dd56045b16985a3516ef192ec715
2021-06-04 15:16:19 +00:00
Matthew Thode
05d9f6a032
Force force-tlsv12 only
Secure by default

Change-Id: I507a25114481ff0c6b229eeea980785a45dad460
2018-12-17 09:57:03 -06:00
Jimmy McCrory
c5551f2c8c Move inventory files to folder in root of repo
Move the playbooks/inventory folder, group_vars, and host_vars to
inventory/ in the root of the OpenStack-Ansible repo. This helps better
organize the repo structure since playbooks/ will now only contain
playbooks, shared task files, and included repo package var files.

group_vars and host_vars are moved alongside the inventory since that's
the default place that Ansible expects those folders and to help better
prepare for Ansible 2.4 where multiple inventories can be loaded,
automatically including relative group and host var files.

Effected docs, scripts, and variables have been updated with the new
paths.

Change-Id: If50e2412c3fd6575d7041deb8ecc9480b04184cc
2017-12-16 02:34:33 -08:00