Changeset - d26fe0368a4b
Parent rev.
Child rev.
[Not reviewed]
0 5 0
Branko Majic (branko) - 9 years ago 2015-05-29 19:09:58
branko@majic.rs
MAR-5: Updated php and wsgi website roles to include set-up website-specific TLS configuration for Nginx (including separate TLS key/certificate if necessary).
5 files changed with 67 insertions and 7 deletions:
docs/rolereference.rst
24
3
roles/php_website/tasks/main.yml
12
roles/php_website/templates/nginx_site.j2
9
1
roles/wsgi_website/tasks/main.yml
12
roles/wsgi_website/templates/nginx_site.j2
10
3
0 comments (0 inline, 0 general)
docs/rolereference.rst
➞
Show inline comments
 
@@ -913,12 +913,13 @@ The role implements the following:
 
* Creates a base directory where the website-specific code and data should be
 
  stored at.
 
* Adds nginx to website's group, so nginx could read the necessary files.
 
* Adds website administrator to website's group, so administrator could manage
 
  the code and data.
 
* Installs additional packages required for running the role (as configured).
 
* Deploys the HTTPS TLS private key and certificate (for website vhost).
 
* Configures PHP FPM and nginx to serve the website.
 

			




	
	
	
		
 
The role is implemented with the following layout/logic in mind:

			




	
	
	
		
 

			




	
	
	
		
 
* Website users are named after the ``FQDN`` (fully qualified domain name) of

			




	
	
	
		
 
  website, in format of ``web-ESCAPEDFQDN``, where ``ESCAPEDFQDN`` is equal to

			




	
	
		
 
@@ -962,12 +963,20 @@ Parameters

			




	
	
	
		
 
**index** (string, optional)

			




	
	
	
		
 
  Space-separated list of files which should be treated as index files by the

			




	
	
	
		
 
  web server. The web server will attempt opening these index files, in

			




	
	
	
		
 
  succession, until the first match, or until it runs out of matches, when a

			




	
	
	
		
 
  client requests an URI pointing to directory. Default is ``index.php``.

			




	
	
	
		
 

			




	
	
	
		
 
**https_tls_certificate** (string, mandatory)

			




	
	
	
		
 
  Path to file on Ansible host that contains the X.509 certificate used for TLS

			




	
	
	
		
 
  for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.

			




	
	
	
		
 

			




	
	
	
		
 
**https_tls_key** (string, mandatory)

			




	
	
	
		
 
  Path to file on Ansible host that contains the private key used for TLS for

			




	
	
	
		
 
  HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.

			




	
	
	
		
 

			




	
	
	
		
 
**php_file_regex** (string, optional)

			




	
	
	
		
 
  Regular expression used for determining which file should be interepted via

			




	
	
	
		
 
  PHP. Default is ``\.php$``.

			




	
	
	
		
 

			




	
	
	
		
 
**php_rewrite_urls** (list, optional)

			




	
	
	
		
 
  A list of rewrite rules that are applied to incoming requests. These rewrite

			




	
	
		
 
@@ -1017,21 +1026,24 @@ running *ownCloud* and *The Bug Genie* applications):

			




	
	
	
		
 
      packages:

			




	
	
	
		
 
        # For ownCloud

			




	
	
	
		
 
        - php5-gd

			




	
	
	
		
 
        - php5-json

			




	
	
	
		
 
        - php5-mysql

			




	
	
	
		
 
        - php5-curl

			




	
	
	
		
 
      https_tls_key: "{{ inventory_dir }}/tls/cloud.example.com_https.key"

			




	
	
	
		
 
      https_tls_certificate: "{{ inventory_dir }}/tls/cloud.example.com_https.pem"

			




	
	
	
		
 
    - role: php_website

			




	
	
	
		
 
      admin: admin

			




	
	
	
		
 
      deny_files_regex:

			




	
	
	
		
 
        - ^\..*

			




	
	
	
		
 
      php_rewrite_urls:

			




	
	
	
		
 
        - ^(.*) /index.php?url=$1

			




	
	
	
		
 
      fqdn: tbg.example.com

			




	
	
	
		
 
      uid: 2007

			




	
	
	
		
 

			




	
	
	
		
 
      https_tls_key: "{{ inventory_dir }}/tls/tbg.example.com_https.key"

			




	
	
	
		
 
      https_tls_certificate: "{{ inventory_dir }}/tls/tbg.example.com_https.pem"

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
WSGI Website

			




	
	
	
		
 
------------

			




	
	
	
		
 

			




	
	
	
		
 
The ``wsgi_website`` role can be used for setting-up a website powered by Python

			




	
	
		
 
@@ -1055,12 +1067,13 @@ The role implements the following:

			




	
	
	
		
 
* Installs additional packages required for running the role (as configured).

			




	
	
	
		
 
* Sets-up a dedicated Python virtual environment for website.

			




	
	
	
		
 
* Install Gunicorn in Python virtual environment.

			




	
	
	
		
 
* Installs additional packages required for running the role in Python virtual

			




	
	
	
		
 
  environment (as configured).

			




	
	
	
		
 
* Configures systemd to run the website code (using Gunicorn)

			




	
	
	
		
 
* Deploys the HTTPS TLS private key and certificate (for website vhost).

			




	
	
	
		
 
* Configures nginx to serve the website (static files served directly, requests

			




	
	
	
		
 
  passed on to Gunicorn).

			




	
	
	
		
 

			




	
	
	
		
 
The role is implemented with the following layout/logic in mind:

			




	
	
	
		
 

			




	
	
	
		
 
* Website users are named after the ``FQDN`` (fully qualified domain name) of

			




	
	
		
 
@@ -1100,12 +1113,20 @@ Parameters

			




	
	
	
		
 

			




	
	
	
		
 
**fqdn** (string, mandatory)

			




	
	
	
		
 
  Fully-qualified domain name where the website is reachable. This value is used

			




	
	
	
		
 
  for calculating the user/group name for dedicated website user, as well as

			




	
	
	
		
 
  home directory of the website user (where data/code should be stored at).

			




	
	
	
		
 

			




	
	
	
		
 
**https_tls_certificate** (string, mandatory)

			




	
	
	
		
 
  Path to file on Ansible host that contains the X.509 certificate used for TLS

			




	
	
	
		
 
  for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.

			




	
	
	
		
 

			




	
	
	
		
 
**https_tls_key** (string, mandatory)

			




	
	
	
		
 
  Path to file on Ansible host that contains the private key used for TLS for

			




	
	
	
		
 
  HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.

			




	
	
	
		
 

			




	
	
	
		
 
**packages** (list, optional)

			




	
	
	
		
 
  A list of additional packages to install for this particular WSGI

			




	
	
	
		
 
  website. This is usually going to be development libraries for building Python

			




	
	
	
		
 
  packages.

			




	
	
	
		
 

			




	
	
	
		
 
**rewrites** (list, optional)

			




	
	
		
 
@@ -1144,18 +1165,18 @@ Examples

			




	
	
	
		
 

			




	
	
	
		
 
Here is an example configuration for setting-up a (base) WSGI website (for

			




	
	
	
		
 
running a bare Django project):

			




	
	
	
		
 

			




	
	
	
		
 
.. code-block:: yaml

			




	
	
	
		
 

			




	
	
	
		
 
    ---

			




	
	
	
		
 

			




	
	
	
		
 
    - role: wsgi_website

			




	
	
	
		
 
      admin: admin

			




	
	
	
		
 
      fqdn: django.example.com

			




	
	
	
		
 
      static_locations:

			




	
	
	
		
 
        - /static

			




	
	
	
		
 
        - /media

			




	
	
	
		
 
      uid: 2004

			




	
	
	
		
 
      virtualenv_packages:

			




	
	
	
		
 
        - django

			




	
	
	
		
 
      wsgi_application: django_example_com.wsgi:application

			




	
	
	
		
 
      https_tls_key: "{{ inventory_dir }}/tls/wsgi.example.com_https.key"

			




	
	
	
		
 
      https_tls_certificate: "{{ inventory_dir }}/tls/wsgi.example.com_https.pem"

			




        

    


    
    

    

        

                

                    roles/php_website/tasks/main.yml
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -29,12 +29,24 @@

			




	
	
	
		
 

			




	
	
	
		
 
- name: Deploy PHP FPM configuration file for website

			




	
	
	
		
 
  template: src="fpm_site.conf.j2" dest="/etc/php5/fpm/pool.d/{{ fqdn }}.conf" validate="php5-fpm -t -y %s"

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart php5-fpm

			




	
	
	
		
 

			




	
	
	
		
 
- name: Deploy nginx TLS private key for website

			




	
	
	
		
 
  copy: dest="/etc/ssl/private/{{ https_tls_key | basename }}" src="{{ https_tls_key }}"

			




	
	
	
		
 
        mode=640 owner=root group=root

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart nginx

			




	
	
	
		
 

			




	
	
	
		
 
- name: Deploy nginx TLS certificate for website

			




	
	
	
		
 
  copy: dest="/etc/ssl/certs/{{ https_tls_certificate | basename }}" src="{{ https_tls_certificate }}"

			




	
	
	
		
 
        mode=644 owner=root group=root

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart nginx

			




	
	
	
		
 

			




	
	
	
		
 
- name: Deploy nginx configuration file for website

			




	
	
	
		
 
  template: src="nginx_site.j2" dest="/etc/nginx/sites-available/{{ fqdn }}"

			




	
	
	
		
 
            owner=root group=root mode=640 validate="/usr/local/bin/nginx_verify_site.sh -n '{{ fqdn }}' %s"

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart nginx

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    roles/php_website/templates/nginx_site.j2
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
server {

			




	
	
	
		
 
    # Base settings.

			




	
	
	
		
 
    listen 80;

			




	
	
	
		
 
    root {{ home }}/htdocs/;

			




	
	
	
		
 
    index {{ index }};

			




	
	
	
		
 
    server_name {{ fqdn }};

			




	
	
	
		
 

			




	
	
	
		
 
    # HTTP (plaintext) configuration.

			




	
	
	
		
 
    listen 80;

			




	
	
	
		
 

			




	
	
	
		
 
    # HTTPS (TLS) configuration.

			




	
	
	
		
 
    listen 443 ssl;

			




	
	
	
		
 
    listen [::]:443 ssl;

			




	
	
	
		
 
    ssl_certificate_key /etc/ssl/private/{{ https_tls_key | basename }};

			




	
	
	
		
 
    ssl_certificate /etc/ssl/certs/{{ https_tls_certificate | basename }};

			




	
	
	
		
 

			




	
	
	
		
 
    {% if rewrites -%}

			




	
	
	
		
 
    # Generic URL rewrites.

			




	
	
	
		
 
    {% for rewrite in rewrites -%}

			




	
	
	
		
 
    rewrite {{ rewrite }};

			




	
	
	
		
 
    {% endfor -%}

			




	
	
	
		
 
    {% endif %}

			




        

    


    
    

    

        

                

                    roles/wsgi_website/tasks/main.yml
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -78,12 +78,24 @@

			




	
	
	
		
 
  service: name="{{ fqdn }}" enabled=yes state=started

			




	
	
	
		
 

			




	
	
	
		
 
- name: Create directory where static files can be served from

			




	
	
	
		
 
  file: path="{{ home }}/htdocs/" state=directory

			




	
	
	
		
 
        owner="{{ admin }}" group="{{ user }}" mode="2750"

			




	
	
	
		
 

			




	
	
	
		
 
- name: Deploy nginx TLS private key for website

			




	
	
	
		
 
  copy: dest="/etc/ssl/private/{{ https_tls_key | basename }}" src="{{ https_tls_key }}"

			




	
	
	
		
 
        mode=640 owner=root group=root

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart nginx

			




	
	
	
		
 

			




	
	
	
		
 
- name: Deploy nginx TLS certificate for website

			




	
	
	
		
 
  copy: dest="/etc/ssl/certs/{{ https_tls_certificate | basename }}" src="{{ https_tls_certificate }}"

			




	
	
	
		
 
        mode=644 owner=root group=root

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart nginx

			




	
	
	
		
 

			




	
	
	
		
 
- name: Deploy nginx configuration file for website

			




	
	
	
		
 
  template: src="nginx_site.j2" dest="/etc/nginx/sites-available/{{ fqdn }}"

			




	
	
	
		
 
            owner=root group=root mode=640 validate="/usr/local/bin/nginx_verify_site.sh -n '{{ fqdn }}' %s"

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart nginx

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    roles/wsgi_website/templates/nginx_site.j2
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
server {

			




	
	
	
		
 
    listen 80;

			




	
	
	
		
 

			




	
	
	
		
 
    # Base settings.

			




	
	
	
		
 
    root {{ home }}/htdocs/;

			




	
	
	
		
 

			




	
	
	
		
 
    server_name {{ fqdn }};

			




	
	
	
		
 

			




	
	
	
		
 
    # HTTP (plaintext) configuration.

			




	
	
	
		
 
    listen 80;

			




	
	
	
		
 

			




	
	
	
		
 
    # HTTPS (TLS) configuration.

			




	
	
	
		
 
    listen 443 ssl;

			




	
	
	
		
 
    listen [::]:443 ssl;

			




	
	
	
		
 
    ssl_certificate_key /etc/ssl/private/{{ https_tls_key | basename }};

			




	
	
	
		
 
    ssl_certificate /etc/ssl/certs/{{ https_tls_certificate | basename }};

			




	
	
	
		
 

			




	
	
	
		
 
    {% if rewrites -%}

			




	
	
	
		
 
    # Site rewrites.

			




	
	
	
		
 
    {% for rewrite in rewrites -%}

			




	
	
	
		
 
    rewrite {{ rewrite }};

			




	
	
	
		
 
    {% endfor -%}

			




	
	
	
		
 
    {% endif %}

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2023 by various authors & licensed under GPLv3.