1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
|
#
# Copyright (C) 2014 eNovance SAS <licensing@enovance.com>
#
# Author: Emilien Macchi <emilien.macchi@enovance.com>
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# == Class: openstacklib::wsgi::apache
#
# Serve a service with apache mod_wsgi
# When using this class you should disable your service.
#
# == Parameters
#
# [*service_name*]
# (Optional) Name of the service to run.
# Example: nova-api
# Defaults to $name
#
# [*servername*]
# (Optional) The servername for the virtualhost
# Defaults to $facts['networking']['fqdn']
#
# [*bind_host*]
# (Optional) The host/ip address Apache will listen on.
# Defaults to undef (listen on all ip addresses)
#
# [*bind_port*]
# (Optional) The port to listen.
# Defaults to undef
#
# [*group*]
# (Optional) Group with permissions on the script.
# Defaults to undef
#
# [*path*]
# (Optional) The prefix for the endpoint.
# Defaults to '/'
#
# [*priority*]
# (Optional) The priority for the vhost.
# Defaults to 10
#
# [*setenv*]
# (Optional) Set environment variables for the vhost.
# Defaults to []
#
# [*ssl*]
# (Optional) Use SSL.
# Defaults to false
#
# [*ssl_cert*]
# (Optional) Path to SSL certificate.
# Default to apache::vhost 'ssl_*' defaults
#
# [*ssl_key*]
# (Optional) Path to SSL key.
# Default to apache::vhost 'ssl_*' defaults
#
# [*ssl_verify_client*]
# (Optional) Sets the SSLVerifyClient directive which sets the
# certificate verification level for client authentication.
# Default to apache::vhost 'ssl_*' defaults
#
# [*ssl_chain*]
# (Optional) SSL chain.
# Default to apache::vhost 'ssl_*' defaults
#
# [*ssl_ca*]
# (Optional) Path to SSL certificate authority.
# Default to apache::vhost 'ssl_*' defaults
#
# [*ssl_crl_path*]
# (Optional) Path to SSL certificate revocation list.
# Default to apache::vhost 'ssl_*' defaults
#
# [*ssl_crl*]
# (Optional) SSL certificate revocation list name.
# Default to apache::vhost 'ssl_*' defaults
#
# [*ssl_certs_dir*]
# (Optional) Path to SSL certificate directory
# Default to apache::vhost 'ssl_*' defaults
#
# [*threads*]
# (Optional) The number of threads for the vhost.
# Defaults to 1
#
# [*user*]
# (Optional) User with permissions on the script
# Defaults to undef
#
# [*workers*]
# (Optional) The number of workers for the vhost.
# Defaults to $facts['os_workers']
#
# [*wsgi_daemon_process*]
# (Optional) Name of the WSGI daemon process.
# Defaults to $name
#
# [*wsgi_process_display_name*]
# (Optional) Name of the WSGI process display-name.
# Defaults to $name
#
# [*wsgi_process_group*]
# (Optional) Name of the WSGI process group.
# Defaults to $name
#
# [*wsgi_script_dir*]
# (Optional) The directory path of the WSGI script.
# Defaults to undef
#
# [*wsgi_script_file*]
# (Optional) The file path of the WSGI script.
# Defaults to undef
#
# [*wsgi_script_source*]
# (Optional) The source of the WSGI script.
# Defaults to undef
#
# [*wsgi_application_group*]
# (Optional) The application group of the WSGI script.
# Defaults to '%{GLOBAL}'
#
# [*wsgi_pass_authorization*]
# (Optional) Whether HTTP authorisation headers are passed through to a WSGI
# script when the equivalent HTTP request headers are present.
# Defaults to undef
#
# [*wsgi_chunked_request*]
# (Optional) Makes the vhost allow chunked requests which is useful for
# handling TE (Transfer-Encoding), chunked or gzip. This sets the
# WSGIChunkedRequest option in the vhost.
# Defaults to undef
#
# [*set_wsgi_import_script*]
# (Optional) Enable WSGIImportScript.
# Defaults to false
#
# [*wsgi_import_script*]
# (Optional) WSGIImportScript path.
# Defaults to undef
# If not set and set_wsgi_import_script is true, defaults to the WSGI
# application module path
#
# [*wsgi_import_script_options*]
# (Optional) Sets WSGIImportScript options.
# Defaults to undef
# If not set and set_wsgi_import_script is true, push a dict as follow:
# {
# process-group => $wsgi_daemon_process,
# application-group => $wsgi_application_group,
# }
#
# [*headers*]
# (Optional) Headers for the vhost.
# Defaults to undef
#
# [*request_headers*]
# (Optional) Modifies collected request headers in various ways.
# Defaults to undef
#
# [*aliases*]
# (Optional) Aliases for the vhost.
# Defaults to undef
#
# [*custom_wsgi_process_options*]
# (Optional) gives you the oportunity to add custom process options or to
# overwrite the default options for the WSGI process.
# eg. to use a virtual python environment for the WSGI process
# you could set it to:
# { python-path => '/my/python/virtualenv' }
# Defaults to {}
#
# [*custom_wsgi_script_aliases*]
# (Optional) Pass a hash with any extra WSGI script aliases that you want
# to load for the same vhost, this is then combined with the default
# script alias built usin $path, $wsgi_script_dir and $wsgi_script_file.
# Defaults to undef
#
# [*vhost_custom_fragment*]
# (Optional) Passes a string of custom configuration
# directives to be placed at the end of the vhost configuration.
# Defaults to undef
#
# [*allow_encoded_slashes*]
# (Optional) If set, uses apache's AllowEncodedSlashes option in the vhost.
# This option is passed to puppetlabs-apache, which accepts only 4
# options: undef, "on", "off" or "nodecode". This is thus validated in the
# underlying vhost resource.
# Defaults to undef
#
# [*access_log_file*]
# (Optional) The log file name for the virtualhost.
# access_log_file and access_log_pipe is mutually exclusive.
# Defaults to undef
#
# [*access_log_pipe*]
# (Optional) Specifies a pipe where Apache sends access logs for the virtualhost.
# access_log_file and access_log_pipe is mutually exclusive.
# Defaults to undef
#
# [*access_log_syslog*]
# (Optional) Sends the virtualhost access log messages to syslog.
# Defaults to undef
#
# [*access_log_format*]
# (Optional) The log format for the virtualhost.
# Defaults to undef
#
# [*access_log_env_var*]
# (Optional) Specifies that only requests with particular environment
# variables be logged.
# Defaults to undef
#
# [*error_log_file*]
# (Optional) The error log file name for the virtualhost.
# error_log_file and error_log_pipe is mutually exclusive.
# Defaults to undef
#
# [*error_log_pipe*]
# (Optional) Specifies a pipe where Apache sends error logs for the virtualhost.
# error_log_file and error_log_pipe is mutually exclusive.
# Defaults to undef
#
# [*error_log_syslog*]
# (Optional) Sends the virtualhost error log messages to syslog.
# Defaults to undef
#
# [*log_level*]
# (Optional) Specifies LogLevel for Apache WSGI.
# Defaults to undef
#
define openstacklib::wsgi::apache (
$service_name = $name,
$servername = $facts['networking']['fqdn'],
$bind_host = undef,
$bind_port = undef,
$group = undef,
$path = '/',
$priority = 10,
$setenv = [],
$ssl = false,
$ssl_ca = undef,
$ssl_cert = undef,
$ssl_certs_dir = undef,
$ssl_chain = undef,
$ssl_crl = undef,
$ssl_crl_path = undef,
$ssl_key = undef,
$ssl_verify_client = undef,
$threads = 1,
$user = undef,
$workers = $facts['os_workers'],
$wsgi_daemon_process = $name,
$wsgi_process_display_name = $name,
$wsgi_process_group = $name,
$wsgi_script_dir = undef,
$wsgi_script_file = undef,
$wsgi_script_source = undef,
$wsgi_application_group = '%{GLOBAL}',
$wsgi_pass_authorization = undef,
$wsgi_chunked_request = undef,
$set_wsgi_import_script = false,
$wsgi_import_script = undef,
$wsgi_import_script_options = undef,
$headers = undef,
$request_headers = undef,
$aliases = undef,
$custom_wsgi_process_options = {},
$custom_wsgi_script_aliases = undef,
$vhost_custom_fragment = undef,
$allow_encoded_slashes = undef,
$access_log_file = undef,
$access_log_pipe = undef,
$access_log_syslog = undef,
$access_log_format = undef,
$access_log_env_var = undef,
$error_log_file = undef,
$error_log_pipe = undef,
$error_log_syslog = undef,
$log_level = undef,
) {
include apache
# Ensure there's no trailing '/' except if this is also the only character
$path_real = regsubst($path, '(^/.*)/$', '\1')
if !defined(File[$wsgi_script_dir]) {
file { $wsgi_script_dir:
ensure => directory,
owner => $user,
group => $group,
mode => '0755',
}
}
file { $service_name:
ensure => file,
links => follow,
path => "${wsgi_script_dir}/${wsgi_script_file}",
source => $wsgi_script_source,
owner => $user,
group => $group,
mode => '0644',
}
$wsgi_daemon_process_options = merge (
{
user => $user,
group => $group,
processes => $workers,
threads => $threads,
display-name => $wsgi_process_display_name,
},
$custom_wsgi_process_options,
)
$wsgi_script_aliases_default = Hash([$path_real,"${wsgi_script_dir}/${wsgi_script_file}"])
if $custom_wsgi_script_aliases {
$wsgi_script_aliases_real = merge($wsgi_script_aliases_default, $custom_wsgi_script_aliases)
} else {
$wsgi_script_aliases_real = $wsgi_script_aliases_default
}
# Sets WSGIImportScript related options
if $set_wsgi_import_script {
if $wsgi_import_script {
$wsgi_import_script_real = $wsgi_import_script
} else {
$wsgi_import_script_real = $wsgi_script_aliases_real[$path_real]
}
if $wsgi_import_script_options {
$wsgi_import_script_options_real = $wsgi_import_script_options
} else {
$wsgi_import_script_options_real = {
process-group => $wsgi_daemon_process,
application-group => $wsgi_application_group,
}
}
} else {
$wsgi_import_script_real = undef
$wsgi_import_script_options_real = undef
}
# End of WSGIImportScript related options
::apache::vhost { $service_name:
ensure => 'present',
servername => $servername,
ip => $bind_host,
port => $bind_port,
docroot => $wsgi_script_dir,
docroot_owner => $user,
docroot_group => $group,
priority => $priority,
setenv => $setenv,
setenvif => ['X-Forwarded-Proto https HTTPS=1'],
ssl => $ssl,
ssl_cert => $ssl_cert,
ssl_key => $ssl_key,
ssl_verify_client => $ssl_verify_client,
ssl_chain => $ssl_chain,
ssl_ca => $ssl_ca,
ssl_crl_path => $ssl_crl_path,
ssl_crl => $ssl_crl,
ssl_certs_dir => $ssl_certs_dir,
wsgi_daemon_process => Hash([$wsgi_daemon_process, $wsgi_daemon_process_options]),
wsgi_process_group => $wsgi_process_group,
wsgi_script_aliases => $wsgi_script_aliases_real,
wsgi_application_group => $wsgi_application_group,
wsgi_pass_authorization => $wsgi_pass_authorization,
wsgi_chunked_request => $wsgi_chunked_request,
wsgi_import_script => $wsgi_import_script_real,
wsgi_import_script_options => $wsgi_import_script_options_real,
headers => $headers,
request_headers => $request_headers,
aliases => $aliases,
custom_fragment => $vhost_custom_fragment,
allow_encoded_slashes => $allow_encoded_slashes,
access_log_file => $access_log_file,
access_log_pipe => $access_log_pipe,
access_log_syslog => $access_log_syslog,
access_log_format => $access_log_format,
access_log_env_var => $access_log_env_var,
error_log_file => $error_log_file,
error_log_pipe => $error_log_pipe,
error_log_syslog => $error_log_syslog,
log_level => $log_level,
options => ['-Indexes', '+FollowSymLinks'],
}
Package<| title == 'httpd' |>
~> File<| title == $wsgi_script_dir |>
~> File<| title == $service_name |>
~> Apache::Vhost<| title == $service_name |>
}
|
