3e96c062f5
for "Defining container networking" and "Enabling security.txt" https://docs.openstack.org/openstack-ansible/latest/user/prod/haproxy_in_lxc.html https://docs.openstack.org/openstack-ansible/latest/user/security/index.html#security-txt Current displayed order of steps: 1. 1. 2. Change-Id: I28c664e898ae0311f2ea6d0546352dca4db91f0e
1.6 KiB
security.txt
security.txt is a proposed IETF
standard to allow independent security researchers to easily report
vulnerabilities. The standard defines that a text file called
security.txt should be found at
"/.well-known/security.txt". For legacy compatibility reasons the file
might also be placed at "/security.txt".
In OpenStack-Ansible, security.txt is implemented in
HAProxy as all public endpoints reside behind it. It defaults to
directing any request paths that end with /security.txt to
the text file using an ACL rule in HAProxy.
Enabling security.txt
Use the following process to add a security.txt file to
your deployment using OpenStack-Ansible:
Write the contents of the
security.txtfile in accordance with the standard.Define the contents of
security.txtin the variablehaproxy_security_txt_contentin the/etc/openstack_deploy/user_variables.ymlfile:haproxy_security_txt_content: | # This is my example security.txt file # Please see https://securitytxt.org/ for details of the specification of this fileUpdate HAProxy
# openstack-ansible haproxy-install.yml
Advanced security.txt ACL
In some cases you may need to change the HAProxy ACL used to redirect
requests to the security.txt file, such as adding extra
domains.
The HAProxy ACL is updated by overriding the variable
haproxy_map_entries inside
haproxy_security_txt_service.