Set ProxyPreserveHost in ec2api TLS proxy
bp tls-via-certmonger-containers Change-Id: Iae8e61cb5be4faeea8861296629dd6a5f3ed4f01
This commit is contained in:
parent
88128ef20e
commit
26e053153b
manifests
@ -112,11 +112,12 @@ class tripleo::profile::base::nova::ec2api (
|
|||||||
$ec2_api_tls_keyfile = $certificates_specs["httpd-${ec2_api_network}"]['service_key']
|
$ec2_api_tls_keyfile = $certificates_specs["httpd-${ec2_api_network}"]['service_key']
|
||||||
|
|
||||||
::tripleo::tls_proxy { 'ec2-api':
|
::tripleo::tls_proxy { 'ec2-api':
|
||||||
servername => $ec2_api_tls_proxy_fqdn,
|
servername => $ec2_api_tls_proxy_fqdn,
|
||||||
ip => $ec2_api_tls_proxy_bind_ip,
|
ip => $ec2_api_tls_proxy_bind_ip,
|
||||||
port => $ec2_api_tls_proxy_port,
|
port => $ec2_api_tls_proxy_port,
|
||||||
tls_cert => $ec2_api_tls_certfile,
|
tls_cert => $ec2_api_tls_certfile,
|
||||||
tls_key => $ec2_api_tls_keyfile,
|
tls_key => $ec2_api_tls_keyfile,
|
||||||
|
preserve_host => true,
|
||||||
}
|
}
|
||||||
Tripleo::Tls_proxy['ec2-api'] ~> Anchor<| title == 'ec2api::service::begin' |>
|
Tripleo::Tls_proxy['ec2-api'] ~> Anchor<| title == 'ec2api::service::begin' |>
|
||||||
|
|
||||||
|
@ -33,26 +33,33 @@
|
|||||||
# [*tls_key*]
|
# [*tls_key*]
|
||||||
# The path to the key used for the specified certificate.
|
# The path to the key used for the specified certificate.
|
||||||
#
|
#
|
||||||
|
# [*preserve_host*]
|
||||||
|
# (Optional) Whether the Host header is perserved in proxied requests.
|
||||||
|
# See the Apache ProxyPreserveHost directive docs.
|
||||||
|
# Defaults to false
|
||||||
|
|
||||||
define tripleo::tls_proxy(
|
define tripleo::tls_proxy(
|
||||||
$ip,
|
$ip,
|
||||||
$port,
|
$port,
|
||||||
$servername,
|
$servername,
|
||||||
$tls_cert,
|
$tls_cert,
|
||||||
$tls_key,
|
$tls_key,
|
||||||
|
$preserve_host = false
|
||||||
) {
|
) {
|
||||||
include ::apache
|
include ::apache
|
||||||
::apache::vhost { "${title}-proxy":
|
::apache::vhost { "${title}-proxy":
|
||||||
ensure => 'present',
|
ensure => 'present',
|
||||||
docroot => false, # This is required by the manifest
|
docroot => false, # This is required by the manifest
|
||||||
manage_docroot => false,
|
manage_docroot => false,
|
||||||
servername => $servername,
|
servername => $servername,
|
||||||
ip => $ip,
|
ip => $ip,
|
||||||
port => $port,
|
port => $port,
|
||||||
ssl => true,
|
ssl => true,
|
||||||
ssl_cert => $tls_cert,
|
ssl_cert => $tls_cert,
|
||||||
ssl_key => $tls_key,
|
ssl_key => $tls_key,
|
||||||
request_headers => ['set X-Forwarded-Proto "https"'],
|
request_headers => ['set X-Forwarded-Proto "https"'],
|
||||||
proxy_pass => {
|
proxy_preserve_host => $preserve_host,
|
||||||
|
proxy_pass => {
|
||||||
path => '/',
|
path => '/',
|
||||||
url => "http://localhost:${port}/",
|
url => "http://localhost:${port}/",
|
||||||
params => {retry => '10'},
|
params => {retry => '10'},
|
||||||
|
Loading…
Reference in New Issue
Block a user