add httpd

playbooks/deploy.yaml

@@ -23,6 +23,10 @@
     foreman_client_key: "{{ certificates_ca_directory }}/private/{{ certificates_server }}-client.key"
     foreman_client_certificate: "{{ certificates_ca_directory }}/certs/{{ certificates_server }}-client.crt"
     foreman_db_password: "CHANGEME"
+    httpd_server_ca_certificate: "{{ certificates_ca_directory }}/certs/ca.crt"
+    httpd_client_ca_certificate: "{{ certificates_ca_directory }}/certs/ca.crt"
+    httpd_server_certificate: "{{ certificates_ca_directory }}/certs/{{ certificates_server }}.crt"
+    httpd_server_key: "{{ certificates_ca_directory }}/private/{{ certificates_server }}.key"
     postgresql_databases:
     - name: candlepin
       owner: candlepin
@@ -48,3 +52,4 @@
     - foreman-proxy
     - redis
     - foreman
+    - httpd

playbooks/setup.yaml

@@ -16,6 +16,7 @@
       name:
       - podman
       - python3-cryptography
+      - python3-libsemanage
       - python3-requests
       - bash-completion
       - nmap

roles/httpd/defaults/main.yml

@@ -0,0 +1,4 @@
+httpd_ssl_dir: /etc/pki/httpd
+httpd_pulp_api_backend: http://localhost:8080
+httpd_pulp_content_backend: http://localhost:8080
+httpd_foreman_backend: http://localhost:3000

roles/httpd/tasks/main.yml

@@ -0,0 +1,52 @@
+---
+- name: Install Apache httpd
+  ansible.builtin.package:
+    name:
+      - httpd
+      - mod_ssl
+    state: present
+
+- name: Set httpd_can_network_connect so Apache can connect to Puma and Gunicorn
+  ansible.posix.seboolean:
+    name: httpd_can_network_connect
+    state: true
+    persistent: true
+
+- name: Disable welcome page
+  ansible.builtin.file:
+    path: /etc/httpd/conf.d/welcome.conf
+    state: absent
+
+- name: Create cert directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - "{{ httpd_ssl_dir }}/certs"
+    - "{{ httpd_ssl_dir }}/private"
+
+- name: Deploy certificates
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ httpd_ssl_dir }}/{{ item.dest }}"
+    remote_src: true
+  loop:
+    - src: "{{ httpd_server_ca_certificate }}"
+      dest: "certs/katello-server-ca.crt"
+    - src: "{{ httpd_client_ca_certificate }}"
+      dest: "certs/katello-default-ca.crt"
+    - src: "{{ httpd_server_certificate }}"
+      dest: "certs/katello-apache.crt"
+    - src: "{{ httpd_server_key }}"
+      dest: "private/katello-apache.key"
+
+- name: Configure foreman-ssl vhost
+  ansible.builtin.template:
+    src: foreman-ssl-vhost.conf.j2
+    dest: /etc/httpd/conf.d/foreman-ssl.conf
+
+- name: Start Apache httpd
+  ansible.builtin.service:
+    name: httpd
+    state: started
+    enabled: true

roles/httpd/templates/foreman-ssl-vhost.conf.j2

@@ -0,0 +1,77 @@
+<VirtualHost *:443>
+  ServerName {{ ansible_fqdn }}
+
+  ## Load additional static includes
+  IncludeOptional "/etc/httpd/conf.d/05-foreman-ssl.d/*.conf"
+
+  ## Logging
+  ErrorLog "/var/log/httpd/foreman-ssl_error_ssl.log"
+  ServerSignature Off
+  CustomLog "/var/log/httpd/foreman-ssl_access_ssl.log" combined
+
+  ## Request header rules
+  ## as per http://httpd.apache.org/docs/2.4/mod/mod_headers.html#requestheader
+  RequestHeader set X_FORWARDED_PROTO "https"
+  RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
+  RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
+  RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"
+  RequestHeader unset REMOTE_USER
+  RequestHeader unset REMOTE-USER
+
+  ## SSL directives
+  SSLEngine on
+  SSLCertificateFile      "{{ httpd_ssl_dir }}/certs/katello-apache.crt"
+  SSLCertificateKeyFile   "{{ httpd_ssl_dir }}/private/katello-apache.key"
+  SSLCertificateChainFile "{{ httpd_ssl_dir }}/certs/katello-server-ca.crt"
+  SSLVerifyClient         optional
+  SSLVerifyDepth          3
+  SSLCACertificateFile    "{{ httpd_ssl_dir }}/certs/katello-default-ca.crt"
+  SSLOptions +StdEnvVars +ExportCertData
+
+  # SSL Proxy directives
+  SSLProxyEngine On
+
+  ProxyPass /pulp_ansible/galaxy/ {{ httpd_pulp_api_backend }}/pulp_ansible/galaxy/
+  ProxyPassReverse /pulp_ansible/galaxy/ {{ httpd_pulp_api_backend }}/pulp_ansible/galaxy/
+
+  <Location "/pulpcore_registry/v2/">
+    RequestHeader unset REMOTE_USER
+    RequestHeader unset REMOTE-USER
+    RequestHeader set REMOTE-USER "admin" "expr=%{SSL_CLIENT_S_DN_CN} == '{{ ansible_fqdn }}'"
+    ProxyPass {{ httpd_pulp_api_backend }}/v2/
+    ProxyPassReverse {{ httpd_pulp_api_backend }}/v2/
+  </Location>
+
+  ProxyPass /pulp/container/ {{ httpd_pulp_content_backend }}/pulp/container/
+  ProxyPassReverse /pulp/container/ {{ httpd_pulp_content_backend }}/pulp/container/
+
+  <Location "/pulp/content">
+    RequestHeader unset X-CLIENT-CERT
+    RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
+    ProxyPass {{ httpd_pulp_content_backend }}/pulp/content disablereuse=on timeout=600
+    ProxyPassReverse {{ httpd_pulp_content_backend }}/pulp/content
+  </Location>
+
+  <Location "/pulp/api/v3">
+    RequestHeader unset REMOTE_USER
+    RequestHeader unset REMOTE-USER
+    RequestHeader set REMOTE-USER "admin" "expr=%{SSL_CLIENT_S_DN_CN} == '{{ ansible_fqdn }}'"
+    ProxyPass {{ httpd_pulp_api_backend }}/pulp/api/v3 timeout=600
+    ProxyPassReverse {{ httpd_pulp_api_backend }}/pulp/api/v3
+  </Location>
+
+  ProxyPass /pulp/assets/ {{ httpd_pulp_api_backend }}/pulp/assets/
+  ProxyPassReverse /pulp/assets/ {{ httpd_pulp_api_backend }}/pulp/assets/
+
+  ## Proxy rules
+  ProxyRequests Off
+  ProxyPreserveHost On
+  ProxyAddHeaders On
+  ProxyPass /pulp !
+  ProxyPass /icons !
+  ProxyPass /server-status !
+  ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900
+  ProxyPassReverse / {{ httpd_foreman_backend }}/
+
+  AddDefaultCharset UTF-8
+</VirtualHost>

tests/httpd_test.py

@@ -0,0 +1,37 @@
+HTTP_HOST = 'localhost'
+HTTP_PORT = 80
+HTTPS_PORT = 443
+
+
+def test_httpd_service(host):
+    httpd = host.service("httpd")
+    assert httpd.is_running
+    assert httpd.is_enabled
+
+
+def test_http_port(host):
+    httpd = host.addr(HTTP_HOST)
+    assert httpd.port(HTTP_PORT).is_reachable
+
+
+def test_https_port(host):
+    httpd = host.addr(HTTP_HOST)
+    assert httpd.port(HTTPS_PORT).is_reachable
+
+
+def test_https_foreman_ping(host):
+    cmd = host.run('curl --cacert /root/certificates/certs/ca.crt --silent --output /dev/null --write-out \'%{http_code}\' https://quadlet.example.com/api/v2/ping')
+    assert cmd.succeeded
+    assert cmd.stdout == '200'
+
+
+def test_https_pulp_status(host):
+    cmd = host.run('curl --cacert /root/certificates/certs/ca.crt --silent --output /dev/null --write-out \'%{http_code}\' https://quadlet.example.com/pulp/api/v3/status/')
+    assert cmd.succeeded
+    assert cmd.stdout == '200'
+
+
+def test_https_pulp_content(host):
+    cmd = host.run('curl --cacert /root/certificates/certs/ca.crt --silent --output /dev/null --write-out \'%{http_code}\' https://quadlet.example.com/pulp/content/')
+    assert cmd.succeeded
+    assert cmd.stdout == '200'