openstack
/
puppet-tripleo
Code Issues Proposed changes

Horizon: Support Strict-Transport-Security header 

This allows operators to enable HTTP Strict-Transport-Security (HSTS)
for Horizon endpoint, to enforce usage of SSL.

Change-Id: I20c2aee6af03af96a4a2022681eabba75a6acf00
This commit is contained in:
Takashi Kajinami 2022-05-10 11:33:04 +09:00
parent 040b0c9d59
commit 837abea1f3
1 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
manifests/haproxy/horizon_endpoint.pp
View File

@ -71,6 +71,11 @@
# fetching the certificate for that specific network. # fetching the certificate for that specific network.
# Defaults to undef # Defaults to undef
# #
# [*hsts_header_value*]
# (optional) Adds the HTTP Strict Transport Securiy (HSTS) header to
# response. This takes effect only when public_certificate is set.
# Defaults to undef
#
class tripleo::haproxy::horizon_endpoint ( class tripleo::haproxy::horizon_endpoint (
$internal_ip, $internal_ip,
$ip_addresses, $ip_addresses,
@ -83,6 +88,7 @@ class tripleo::haproxy::horizon_endpoint (
$use_internal_certificates = false, $use_internal_certificates = false,
$internal_certificates_specs = {}, $internal_certificates_specs = {},
$service_network = undef, $service_network = undef,
$hsts_header_value = undef,
) { ) {
# Let users override the options on a per-service basis # Let users override the options on a per-service basis
$custom_options = hiera('tripleo::haproxy::horizon::options', undef) $custom_options = hiera('tripleo::haproxy::horizon::options', undef)
@ -122,8 +128,18 @@ class tripleo::haproxy::horizon_endpoint (
"${public_virtual_ip}:80" => union($haproxy_listen_bind_param, $custom_bind_options_public), "${public_virtual_ip}:80" => union($haproxy_listen_bind_param, $custom_bind_options_public),
"${public_virtual_ip}:443" => union($haproxy_listen_bind_param, ['ssl', 'crt', $public_certificate], $custom_bind_options_public), "${public_virtual_ip}:443" => union($haproxy_listen_bind_param, ['ssl', 'crt', $public_certificate], $custom_bind_options_public),
} }
if $hsts_header_value != undef {
$hsts_header_value_real = join(any2array($hsts_header_value), '; ')
$hsts_response = "set-header Strict-Transport-Security \"${hsts_header_value_real};\""
} else {
$hsts_response = undef
}
$horizon_frontend_options = { $horizon_frontend_options = {
'http-response' => 'replace-header Location http://(.*) https://\\1', 'http-response' => delete_undef_values([
'replace-header Location http://(.*) https://\\1',
$hsts_response]),
# NOTE(jaosorior): We always redirect to https for the public_virtual_ip. # NOTE(jaosorior): We always redirect to https for the public_virtual_ip.
'redirect' => 'scheme https code 301 if !{ ssl_fc }', 'redirect' => 'scheme https code 301 if !{ ssl_fc }',
'option' => [ 'forwardfor' ], 'option' => [ 'forwardfor' ],