diff --git a/docs/releasenotes.rst b/docs/releasenotes.rst index da0bd1af4f28f5efbc7411f39968e174cdc3289e..c0ede1e2255362c91922d014ceb33b0ea5725e82 100644 --- a/docs/releasenotes.rst +++ b/docs/releasenotes.rst @@ -80,6 +80,12 @@ Debian 12 Bookworm. Some minor improvements and fixes. ``/etc/pip_check_requirements_upgrades`` path, in accordance to changes made in this release to the ``common`` role. + * Dropped the ``proxy_headers`` parameter, and replaced it with the + ``http_header_overrides`` parameter. The new parameter has similar + function, but the values should no longer include double + quotes. Main goal is ease of use and consistency between the PHP + and WSGI website roles. + **New features/improvements** * ``php_website`` role diff --git a/docs/rolereference.rst b/docs/rolereference.rst index 61519d65b941d09cd98a71c1db53f524b579ad73..a77cdc1a8e526e3c29f82e4e36a5d6a44322db85 100644 --- a/docs/rolereference.rst +++ b/docs/rolereference.rst @@ -1937,12 +1937,24 @@ Parameters website. This is usually going to be development libraries for building Python packages. -**proxy_headers** (dictionary, optional, ``{}``) - Additional headers to set when proxying request to Gunicorn. Keys are header - names, values are header values. Both should be compatible with Nginx - ``proxy_set_header``. If you need to provide an empty value, use quotes (don't - forget to surround them by another set of quotes for YAML syntax, for example - ``"\"\""`` or ``'""'``). +**http_header_overrides** (dict, optional, ``{}``) + HTTP headers to set/override on the incoming request before passing + it on to the WSGI application. Keys are HTTP header names, values are + header values. + + Double quotes in the value must be escaped with a backslash. Make + sure to take into account the YAML escaping as well. For example, to + set the value to ``this is quote - "``, YAML should look like one of + the following: + + - ``this is double quote - "`` + - ``'this is double quote - \"'`` + - ``"this is double quote - \\\"'`` + + To clear a header value, simply set its value to an empty + string. Nginx variables can be used as well, however keep in mind + that the dollar sign (``$``) *cannot* be used/escaped due to Nginx + configuration file syntax limitations. **rewrites** (list, optional, ``[]``) A list of rewrite rules that are applied to incoming requests. Each element of @@ -2056,8 +2068,8 @@ running a bare Django project): background_colour: "green" text_colour: "black" text: "TEST ENVIRONMENT" - proxy_headers: - Accept-Encoding: '""' + http_header_overrides: + Accept-Encoding: "" # Use wsgi_requirements to deploy Gunicorn. - role: wsgi_website diff --git a/docs/usage.rst b/docs/usage.rst index df465c4fb60bba6f82edafa034793326fcb5ee17..ee504e37cbe914abe0810c154284db027027163e 100644 --- a/docs/usage.rst +++ b/docs/usage.rst @@ -1814,8 +1814,10 @@ on the safe side: * If you ever need to set some environment variables, this can easily be done via the ``environment_variables`` role parameter. This particular example does not set any, though. -* You can also specify headers to be passed on via Nginx ``proxy_set_header`` - directive to Gunicorn running the application. +* You can also specify headers to be modified in incoming client + request before it gets passed on to the WSGI application using the + ``http_header_overrides`` parameter. directive to Gunicorn running + the application. * Mails deliverd to local admin/application users are forwarded to ``root`` account instead (this can be configured via ``website_mail_recipients`` role parameter. diff --git a/roles/wsgi_website/defaults/main.yml b/roles/wsgi_website/defaults/main.yml index 6fa318619d571ba26b39c5b5cab4f14d5b4a7f6c..acbf809d68295492cb1eb50e6529f12e9cd543c2 100644 --- a/roles/wsgi_website/defaults/main.yml +++ b/roles/wsgi_website/defaults/main.yml @@ -9,7 +9,7 @@ virtualenv_packages: [] environment_variables: {} website_mail_recipients: "root" environment_indicator: null -proxy_headers: {} +http_header_overrides: {} wsgi_requirements: - gunicorn==21.2.0 - packaging==23.2 diff --git a/roles/wsgi_website/molecule/default/playbook.yml b/roles/wsgi_website/molecule/default/playbook.yml index f5ee1ab714e4acdb70dd9093678a0ee5a254a436..6d6f16968493609523642b0d85b098b13bd1a6a0 100644 --- a/roles/wsgi_website/molecule/default/playbook.yml +++ b/roles/wsgi_website/molecule/default/playbook.yml @@ -36,8 +36,8 @@ packages: - atftp - global - proxy_headers: - Accept-Encoding: '""' + http_header_overrides: + Accept-Encoding: "" rewrites: - '^/rewrite1/(.*) /rewritten1/ last' - '^/rewrite2/(.*) /rewritten2/$1 last' diff --git a/roles/wsgi_website/molecule/default/tests/test_parameters_optional.py b/roles/wsgi_website/molecule/default/tests/test_parameters_optional.py index 74f4c44c596a55ccbfa417c1878f6c611fa0e84d..5a1b85f89e860993f9e4e7b34213d20fb5a71347 100644 --- a/roles/wsgi_website/molecule/default/tests/test_parameters_optional.py +++ b/roles/wsgi_website/molecule/default/tests/test_parameters_optional.py @@ -22,7 +22,7 @@ def test_index_page(host): - Basic WSGI application operation. - Handling of environment variables. - - Handling of proxy headers. + - Handling of HTTP header overrides. """ page = host.run('curl -H "Accept-Encoding: plain" https://parameters-optional.local/') diff --git a/roles/wsgi_website/templates/nginx_site.j2 b/roles/wsgi_website/templates/nginx_site.j2 index b9e49761c5a2f1a79570df7be8db9bf6b7292e47..5b31634bf46d3a4bb8c255aeec078fa0a1669161 100644 --- a/roles/wsgi_website/templates/nginx_site.j2 +++ b/roles/wsgi_website/templates/nginx_site.j2 @@ -50,8 +50,8 @@ server { proxy_set_header Host $http_host; proxy_redirect off; - {% for header, value in proxy_headers | dictsort -%} - proxy_set_header {{ header }} {{ value }}; + {% for header, value in http_header_overrides | dictsort -%} + proxy_set_header {{ header }} "{{ value }}"; {% endfor -%} proxy_pass http://unix:/run/wsgi/{{ fqdn }}.sock; diff --git a/testsite/group_vars/web.yml b/testsite/group_vars/web.yml index e03b359aef569c97c4e490e903b66ed219df8f6b..e19cfc1039aef634c3c3701e2fcb2c66135087a2 100644 --- a/testsite/group_vars/web.yml +++ b/testsite/group_vars/web.yml @@ -20,8 +20,8 @@ environment_indicator: text_colour: "white" text: "Majic Ansible Roles Test Site" -proxy_headers: - Accept-Encoding: '"gzip"' +http_header_overrides: + Accept-Encoding: "gzip" web_server_tls_protocols: - TLSv1.2