Changeset - 3352797ee517
Parent rev.
Child rev.
[Not reviewed]
0 5 0
Branko Majic (branko) - 9 years ago 2016-11-22 22:25:09
branko@majic.rs
MAR-68: When enforcing TLS in web_server, wsgi_website, or php_website roles, send connecting clients proper HSTS policy via Strict-Transport-Security header.
5 files changed with 33 insertions and 3 deletions:
docs/rolereference.rst
9
3
docs/usage.rst
6
roles/php_website/templates/nginx_site.j2
6
roles/web_server/templates/nginx-default.j2
6
roles/wsgi_website/templates/nginx_site.j2
6
0 comments (0 inline, 0 general)
docs/rolereference.rst
➞
Show inline comments
 
@@ -1131,13 +1131,15 @@ Depends on the following roles:
 

			




	
	
	
		
 
Parameters

			




	
	
	
		
 
~~~~~~~~~~

			




	
	
	
		
 

			




	
	
	
		
 
**default_enforce_https** (boolean, optional, ``True``)

			




	
	
	
		
 
  Specify if HTTPS should be enforced for the default virtual host or not. If

			




	
	
	
		
 
  enforced, clients connecting via plaintext will be redirected to HTTPS.

			




	
	
	
		
 
  enforced, clients connecting via plaintext will be redirected to HTTPS, and

			




	
	
	
		
 
  clients will be served with ``Strict-Transport-Security`` header with value of

			




	
	
	
		
 
  ``max-age=31536000; includeSubDomains``.

			




	
	
	
		
 

			




	
	
	
		
 
**default_https_tls_certificate** (string, optional, ``{{ lookup('file', tls_certificate_dir + '/' + ansible_fqdn + '_https.pem') }}``)

			




	
	
	
		
 
  X.509 certificate used for TLS for HTTPS service. The file will be stored in

			




	
	
	
		
 
  directory ``/etc/ssl/certs/`` under name ``{{ ansible_fqdn }}_https.pem``.

			




	
	
	
		
 

			




	
	
	
		
 
**default_https_tls_key** (string, optional, ``{{ lookup('file', tls_private_key_dir + '/' + ansible_fqdn + '_https.key') }}``)

			




	
	
		
 
@@ -1256,13 +1258,15 @@ Parameters

			




	
	
	
		
 
  files that should not be served directly by the web server. The format must be

			




	
	
	
		
 
  compatible with regular expressions used by ``nginx`` for ``location ~``

			




	
	
	
		
 
  syntax.

			




	
	
	
		
 

			




	
	
	
		
 
**enforce_https** (boolean, optional, ``True``)

			




	
	
	
		
 
  Specify if HTTPS should be enforced for the website or not. If enforced,

			




	
	
	
		
 
  clients connecting via plaintext will be redirected to HTTPS.

			




	
	
	
		
 
  clients connecting via plaintext will be redirected to HTTPS, and clients will

			




	
	
	
		
 
  be served with ``Strict-Transport-Security`` header with value of

			




	
	
	
		
 
  ``max-age=31536000; includeSubDomains``.

			




	
	
	
		
 

			




	
	
	
		
 
**fqdn** (string, mandatory)

			




	
	
	
		
 
  Fully-qualified domain name where the website is reachable. This value is used

			




	
	
	
		
 
  for calculating the user/group name for dedicated website user, as well as

			




	
	
	
		
 
  home directory of the website user (where data/code should be stored at).

			




	
	
	
		
 

			




	
	
		
 
@@ -1449,13 +1453,15 @@ Parameters

			




	
	
	
		
 
**admin_uid** (integer, optional, ``whatever OS picks``)

			




	
	
	
		
 
  UID of the dedicated website administrator user. The user will be member of

			




	
	
	
		
 
  website group.

			




	
	
	
		
 

			




	
	
	
		
 
**enforce_https** (boolean, optional, ``True``)

			




	
	
	
		
 
  Specify if HTTPS should be enforced for the website or not. If enforced,

			




	
	
	
		
 
  clients connecting via plaintext will be redirected to HTTPS.

			




	
	
	
		
 
  clients connecting via plaintext will be redirected to HTTPS, and clients will

			




	
	
	
		
 
  be served with ``Strict-Transport-Security`` header with value of

			




	
	
	
		
 
  ``max-age=31536000; includeSubDomains``.

			




	
	
	
		
 

			




	
	
	
		
 
**fqdn** (string, mandatory)

			




	
	
	
		
 
  Fully-qualified domain name where the website is reachable. This value is used

			




	
	
	
		
 
  for calculating the user/group name for dedicated website user, as well as

			




	
	
	
		
 
  home directory of the website user (where data/code should be stored at).

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    docs/usage.rst
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -1069,12 +1069,18 @@ Let us first define what we want to deploy on the web server. Here is the plan:

			




	
	
	
		
 

			




	
	
	
		
 
It should be noted that the web application deployment roles are a bit more

			




	
	
	
		
 
complex - namely they are not meant to be used directly, but instead as a

			




	
	
	
		
 
dependency for a custom role. They do come with decent amount of batteries

			




	
	
	
		
 
included, and also play nice with the web server role.

			




	
	
	
		
 

			




	
	
	
		
 
As mentioned before, all roles will enforce TLS by default. The web server roles

			




	
	
	
		
 
will additionaly implement HSTS policy by sending connecting clients

			




	
	
	
		
 
``Strict-Transport-Security`` header with value set to ``max-age=31536000;

			




	
	
	
		
 
includeSubDomains`` (if you disable enforcement of TLS, the header will not be

			




	
	
	
		
 
sent).

			




	
	
	
		
 

			




	
	
	
		
 
With all the above noted, let us finally move on to the next step.

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
Setting-up the web server

			




	
	
	
		
 
-------------------------

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    roles/php_website/templates/nginx_site.j2
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -23,12 +23,18 @@ server {

			




	
	
	
		
 
    # HTTPS (TLS) configuration.

			




	
	
	
		
 
    listen 443 ssl;

			




	
	
	
		
 
    listen [::]:443 ssl;

			




	
	
	
		
 
    ssl_certificate_key /etc/ssl/private/{{ fqdn }}_https.key;

			




	
	
	
		
 
    ssl_certificate /etc/ssl/certs/{{ fqdn }}_https.pem;

			




	
	
	
		
 

			




	
	
	
		
 
{% if default_enforce_https -%}

			




	
	
	
		
 
    # Set-up HSTS header for preventing downgrades for users that visited the

			




	
	
	
		
 
    # site via HTTPS at least once.

			




	
	
	
		
 
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

			




	
	
	
		
 
{% endif -%}

			




	
	
	
		
 

			




	
	
	
		
 
    {% for config in additional_nginx_config -%}

			




	
	
	
		
 
    # {{ config.comment }}

			




	
	
	
		
 
    {{ config.value }}

			




	
	
	
		
 
    {% endfor -%}

			




	
	
	
		
 

			




	
	
	
		
 
    {% if rewrites -%}

			




        

    


    
    

    

        

                

                    roles/web_server/templates/nginx-default.j2
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -25,12 +25,18 @@ server {

			




	
	
	
		
 
    # HTTPS (TLS) configuration.

			




	
	
	
		
 
    listen 443 ssl default_server;

			




	
	
	
		
 
    listen [::]:443 ssl default_server;

			




	
	
	
		
 
    ssl_certificate_key /etc/ssl/private/{{ ansible_fqdn }}_https.key;

			




	
	
	
		
 
    ssl_certificate /etc/ssl/certs/{{ ansible_fqdn }}_https.pem;

			




	
	
	
		
 

			




	
	
	
		
 
{% if default_enforce_https %}

			




	
	
	
		
 
    # Set-up HSTS header for preventing downgrades for users that visited the

			




	
	
	
		
 
    # site via HTTPS at least once.

			




	
	
	
		
 
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

			




	
	
	
		
 
{% endif %}

			




	
	
	
		
 

			




	
	
	
		
 
    # Set-up the serving of default page.

			




	
	
	
		
 
    root /var/www/default/;

			




	
	
	
		
 
    index index.html;

			




	
	
	
		
 

			




	
	
	
		
 
    # Set server_name to something that won't be matched (for default server).

			




	
	
	
		
 
    server_name _;

			




        

    


    
    

    

        

                

                    roles/wsgi_website/templates/nginx_site.j2
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -22,12 +22,18 @@ server {

			




	
	
	
		
 
    # HTTPS (TLS) configuration.

			




	
	
	
		
 
    listen 443 ssl;

			




	
	
	
		
 
    listen [::]:443 ssl;

			




	
	
	
		
 
    ssl_certificate_key /etc/ssl/private/{{ fqdn }}_https.key;

			




	
	
	
		
 
    ssl_certificate /etc/ssl/certs/{{ fqdn }}_https.pem;

			




	
	
	
		
 

			




	
	
	
		
 
{% if default_enforce_https -%}

			




	
	
	
		
 
    # Set-up HSTS header for preventing downgrades for users that visited the

			




	
	
	
		
 
    # site via HTTPS at least once.

			




	
	
	
		
 
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

			




	
	
	
		
 
{% endif -%}

			




	
	
	
		
 

			




	
	
	
		
 
    {% for config in additional_nginx_config -%}

			




	
	
	
		
 
    # {{ config.comment }}

			




	
	
	
		
 
    {{ config.value }}

			




	
	
	
		
 
    {% endfor -%}

			




	
	
	
		
 

			




	
	
	
		
 
    {% if rewrites -%}

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.