+++ /dev/null
-# == Class: horizon::wsgi::apache
-#
-# Configures Apache WSGI for Horizon.
-#
-# === Parameters
-#
-# [*bind_address*]
-# (optional) Bind address in Apache for Horizon. (Defaults to '0.0.0.0')
-#
-# [*server_aliases*]
-# (optional) List of names which should be defined as ServerAlias directives
-# in vhost.conf.
-# Defaults to ::fqdn.
-#
-# [*listen_ssl*]
-# (optional) Enable SSL support in Apache. (Defaults to false)
-#
-# [*horizon_cert*]
-# (required with listen_ssl) Certificate to use for SSL support.
-#
-# [*horizon_key*]
-# (required with listen_ssl) Private key to use for SSL support.
-#
-# [*horizon_ca*]
-# (required with listen_ssl) CA certificate to use for SSL support.
-#
-# [*wsgi_processes*]
-# (optional) Number of Horizon processes to spawn
-# Defaults to '3'
-#
-# [*wsgi_threads*]
-# (optional) Number of thread to run in a Horizon process
-# Defaults to '10'
-#
-# [*priority*]
-# (optional) The apache vhost priority.
-# Defaults to '15'. To set Horizon as the primary vhost, change to '10'.
-#
-# [*extra_params*]
-# (optional) A hash of extra paramaters for apache::wsgi class.
-# Defaults to {}
-class horizon::wsgi::apache (
- $bind_address = undef,
- $fqdn = undef,
- $servername = $::fqdn,
- $server_aliases = $::fqdn,
- $listen_ssl = false,
- $ssl_redirect = true,
- $horizon_cert = undef,
- $horizon_key = undef,
- $horizon_ca = undef,
- $wsgi_processes = '3',
- $wsgi_threads = '10',
- $priority = '15',
- $vhost_conf_name = 'horizon_vhost',
- $vhost_ssl_conf_name = 'horizon_ssl_vhost',
- $extra_params = {},
-) {
-
- include ::horizon::params
- include ::apache
-
- if $fqdn {
- warning('Parameter fqdn is deprecated. Please use parameter server_aliases for setting ServerAlias directives in vhost.conf.')
- $final_server_aliases = $fqdn
- } else {
- $final_server_aliases = $server_aliases
- }
-
- include ::apache::mod::wsgi
-
- # We already use apache::vhost to generate our own
- # configuration file, let's clean the configuration
- # embedded within the package
- file { $::horizon::params::httpd_config_file:
- ensure => present,
- content => "#
-# This file has been cleaned by Puppet.
-#
-# OpenStack Horizon configuration has been moved to:
-# - ${priority}-${vhost_conf_name}.conf
-# - ${priority}-${vhost_ssl_conf_name}.conf
-#",
- require => Package[$::horizon::params::package_name]
- }
-
-
- if $listen_ssl {
- include ::apache::mod::ssl
- $ensure_ssl_vhost = 'present'
-
- if $horizon_ca == undef {
- fail('The horizon_ca parameter is required when listen_ssl is true')
- }
-
- if $horizon_cert == undef {
- fail('The horizon_cert parameter is required when listen_ssl is true')
- }
-
- if $horizon_key == undef {
- fail('The horizon_key parameter is required when listen_ssl is true')
- }
-
- if $ssl_redirect {
- $redirect_match = '(.*)'
- $redirect_url = "https://${servername}"
- }
-
- } else {
- $ensure_ssl_vhost = 'absent'
- $redirect_match = '^/$'
- $redirect_url = $::horizon::params::root_url
- }
-
- Package['horizon'] -> Package[$::horizon::params::http_service]
- File[$::horizon::params::config_file] ~> Service[$::horizon::params::http_service]
-
- $unix_user = $::osfamily ? {
- 'RedHat' => $::horizon::params::apache_user,
- default => $::horizon::params::wsgi_user
- }
- $unix_group = $::osfamily ? {
- 'RedHat' => $::horizon::params::apache_group,
- default => $::horizon::params::wsgi_group,
- }
-
- file { $::horizon::params::logdir:
- ensure => directory,
- owner => $unix_user,
- group => $unix_group,
- before => Service[$::horizon::params::http_service],
- mode => '0751',
- require => Package['horizon']
- }
-
- file { "${::horizon::params::logdir}/horizon.log":
- ensure => file,
- owner => $unix_user,
- group => $unix_group,
- before => Service[$::horizon::params::http_service],
- mode => '0640',
- require => [ File[$::horizon::params::logdir], Package['horizon'] ],
- }
-
- $default_vhost_conf_no_ip = {
- servername => $servername,
- serveraliases => os_any2array($final_server_aliases),
- docroot => '/var/www/',
- access_log_file => 'horizon_access.log',
- error_log_file => 'horizon_error.log',
- priority => $priority,
- aliases => [
- { alias => '/static', path => '/usr/share/openstack-dashboard/static' }
- ],
- port => 80,
- ssl_cert => $horizon_cert,
- ssl_key => $horizon_key,
- ssl_ca => $horizon_ca,
- wsgi_script_aliases => hash([$::horizon::params::root_url, $::horizon::params::django_wsgi]),
- wsgi_daemon_process => $::horizon::params::wsgi_group,
- wsgi_daemon_process_options => {
- processes => $wsgi_processes,
- threads => $wsgi_threads,
- user => $unix_user,
- group => $unix_group,
- },
- wsgi_import_script => $::horizon::params::django_wsgi,
- wsgi_process_group => $::horizon::params::wsgi_group,
- redirectmatch_status => 'permanent',
- }
-
- # Only add the 'ip' element to the $default_vhost_conf hash if it was explicitly
- # specified in the instantiation of the class. This is because ip => undef gets
- # changed to ip => '' via the Puppet function API when ensure_resource is called.
- # See https://bugs.launchpad.net/puppet-horizon/+bug/1371345
- if $bind_address {
- $default_vhost_conf = merge($default_vhost_conf_no_ip, { ip => $bind_address })
- } else {
- $default_vhost_conf = $default_vhost_conf_no_ip
- }
-
- ensure_resource('apache::vhost', $vhost_conf_name, merge ($default_vhost_conf, $extra_params, {
- redirectmatch_regexp => $redirect_match,
- redirectmatch_dest => $redirect_url,
- }))
- ensure_resource('apache::vhost', $vhost_ssl_conf_name, merge ($default_vhost_conf, $extra_params, {
- access_log_file => 'horizon_ssl_access.log',
- error_log_file => 'horizon_ssl_error.log',
- priority => $priority,
- ssl => true,
- port => 443,
- ensure => $ensure_ssl_vhost,
- wsgi_daemon_process => 'horizon-ssl',
- wsgi_process_group => 'horizon-ssl',
- redirectmatch_regexp => '^/$',
- redirectmatch_dest => $::horizon::params::root_url,
- }))
-
-}
projects / mirror / dsa-puppet.git / blobdiff