puppet/services/apache.yaml

   1 heat_template_version: ocata
   2
   3 description: >
   4   Apache service configured with Puppet. Note this is typically included
   5   automatically via other services which run via Apache.
   6
   7 parameters:
   8   ApacheMaxRequestWorkers:
   9     default: 256
  10     description: Maximum number of simultaneously processed requests.
  11     type: number
  12   ApacheServerLimit:
  13     default: 256
  14     description: Maximum number of Apache processes.
  15     type: number
  16   ServiceNetMap:
  17     default: {}
  18     description: Mapping of service_name -> network name. Typically set
  19                  via parameter_defaults in the resource registry.  This
  20                  mapping overrides those in ServiceNetMapDefaults.
  21     type: json
  22   DefaultPasswords:
  23     default: {}
  24     type: json
  25   EndpointMap:
  26     default: {}
  27     description: Mapping of service endpoint -> protocol. Typically set
  28                  via parameter_defaults in the resource registry.
  29     type: json
  30   EnableInternalTLS:
  31     type: boolean
  32     default: false
  33
  34 conditions:
  35
  36   internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
  37
  38 resources:
  39
  40   ApacheNetworks:
  41     type: OS::Heat::Value
  42     properties:
  43       value:
  44         # NOTE(jaosorior) Get unique network names to create
  45         # certificates for those. We skip the tenant network since
  46         # we don't need a certificate for that, and the external
  47         # is for HAProxy so it isn't used for apache either.
  48         yaql:
  49           expression: list($.data.map.items().map($1[1])).distinct().where($ != external and $ != tenant)
  50           data:
  51             map:
  52               get_param: ServiceNetMap
  53
  54 outputs:
  55   role_data:
  56     description: Role data for the Apache role.
  57     value:
  58       service_name: apache
  59       config_settings:
  60         map_merge:
  61           -
  62             # for the given network; replacement examples (eg. for internal_api):
  63             # internal_api -> IP
  64             # internal_api_uri -> [IP]
  65             # internal_api_subnet - > IP/CIDR
  66             apache::ip: {get_param: [ServiceNetMap, ApacheNetwork]}
  67             apache::default_vhost: false
  68             apache::server_signature: 'Off'
  69             apache::server_tokens: 'Prod'
  70             apache_remote_proxy_ips_network:
  71               str_replace:
  72                 template: "NETWORK_subnet"
  73                 params:
  74                   NETWORK: {get_param: [ServiceNetMap, ApacheNetwork]}
  75             apache::mod::prefork::maxclients: { get_param: ApacheMaxRequestWorkers }
  76             apache::mod::prefork::serverlimit: { get_param: ApacheServerLimit }
  77             apache::mod::remoteip::proxy_ips:
  78               - "%{hiera('apache_remote_proxy_ips_network')}"
  79           -
  80             generate_service_certificates: true
  81             tripleo::certmonger::apache_dirs::certificate_dir: '/etc/pki/tls/certs/httpd'
  82             tripleo::certmonger::apache_dirs::key_dir: '/etc/pki/tls/private/httpd'
  83             apache_certificates_specs:
  84               map_merge:
  85                 repeat:
  86                   template:
  87                     httpd-NETWORK:
  88                       service_certificate: '/etc/pki/tls/certs/httpd/httpd-NETWORK.crt'
  89                       service_key: '/etc/pki/tls/private/httpd/httpd-NETWORK.key'
  90                       hostname: "%{hiera('fqdn_NETWORK')}"
  91                       principal: "HTTP/%{hiera('fqdn_NETWORK')}"
  92                   for_each:
  93                     NETWORK: {get_attr: [ApacheNetworks, value]}
  94       metadata_settings:
  95         if:
  96           - internal_tls_enabled
  97           -
  98             repeat:
  99               template:
 100                 - service: HTTP
 101                   network: $NETWORK
 102                   type: node
 103               for_each:
 104                 $NETWORK: {get_attr: [ApacheNetworks, value]}
 105           - null
 106       upgrade_tasks:
 107         - name: Check if httpd is deployed
 108           command: systemctl is-enabled httpd
 109           tags: common
 110           ignore_errors: True
 111           register: httpd_enabled
 112         - name: "PreUpgrade step0,validation: Check service httpd is running"
 113           shell: /usr/bin/systemctl show 'httpd' --property ActiveState | grep '\bactive\b'
 114           when: httpd_enabled.rc == 0
 115           tags: step0,validation
 116         - name: Ensure mod_ssl package is installed
 117           tags: step3
 118           yum: name=mod_ssl state=latest