0d83dd3ea0
Some of our testing makes use of secure communication between testing nodes; e.g. testing a load-balancer pass-through. Other parts "loop-back" but require flags like "curl --insecure" because the self-signed certificates aren't trusted. To make testing more realistic, create a CA that is distributed and trusted by all testing nodes early in the Zuul playbook. This then allows us to sign local certificates created by the letsencrypt playbooks with this trusted CA and have realistic peer-to-peer secure communications. The other thing this does is reworks the letsencrypt self-signed cert path to correctly setup SAN records for the host. This also improves the "realism" of our testing environment. This is so realistic that it requires fixing the gitea playbook :). The Apache service proxying gitea currently has to override in testing to "localhost" because that is all the old certificate covered; we can now just proxy to the hostname directly for testing and production. Change-Id: I3d49a7b683462a076263127018ec6a0f16735c94
46 lines
1.3 KiB
Django/Jinja
46 lines
1.3 KiB
Django/Jinja
Listen 3081
|
|
|
|
<VirtualHost *:3081>
|
|
ServerName {{ inventory_hostname }}
|
|
ServerAdmin infra-root@opendev.org
|
|
DocumentRoot /var/www/opendev.org
|
|
|
|
<Directory /var/www/opendev.org/>
|
|
Require all granted
|
|
Order allow,deny
|
|
Allow from all
|
|
</Directory>
|
|
|
|
AllowEncodedSlashes On
|
|
|
|
ErrorLog ${APACHE_LOG_DIR}/gitea-ssl-error.log
|
|
|
|
LogLevel warn
|
|
|
|
LogFormat "%h:%{remote}p %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combinedport
|
|
CustomLog ${APACHE_LOG_DIR}/gitea-ssl-access.log combinedport
|
|
|
|
SSLEngine on
|
|
SSLProtocol All -SSLv2 -SSLv3
|
|
# Note: this list should ensure ciphers that provide forward secrecy
|
|
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
|
|
SSLHonorCipherOrder on
|
|
|
|
SSLCertificateFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.cer
|
|
SSLCertificateKeyFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
|
|
SSLCertificateChainFile /etc/letsencrypt-certs/{{ inventory_hostname }}/ca.cer
|
|
|
|
SSLProxyEngine on
|
|
|
|
<Location /.well-known/matrix/client>
|
|
Header set Access-Control-Allow-Origin "*"
|
|
</Location>
|
|
|
|
Use UserAgentFilter
|
|
ProxyPass /.well-known/ !
|
|
ProxyPass / https://{{ inventory_hostname }}:3000/ retry=0
|
|
ProxyPassReverse / https://{{ inventory_hostname }}:3000/
|
|
|
|
|
|
</VirtualHost>
|