BBlack has uploaded a new change for review.
https://gerrit.wikimedia.org/r/284518
Change subject: ssl_ciphersuite: autodetect apache, too
......................................................................
ssl_ciphersuite: autodetect apache, too
This worked for nginx, do it for apache versioning too and
refactor things around that. This way we don't forget to update
the ssl_ciphersuite() server during jessie upgrades and such.
Change-Id: I851580f72a9d38b5fed92a5f706151d04912e745
---
M manifests/role/icinga.pp
M manifests/role/requesttracker.pp
M manifests/role/servermon.pp
M manifests/role/tendril.pp
M modules/ganglia/manifests/web.pp
M modules/gerrit/manifests/proxy.pp
M modules/librenms/manifests/web.pp
M modules/mailman/manifests/webui.pp
M modules/puppetmaster/manifests/passenger.pp
M modules/role/manifests/labs/openstack/nova.pp
M modules/statistics/manifests/web.pp
M modules/toolserver_legacy/manifests/init.pp
M modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
13 files changed, 33 insertions(+), 40 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/18/284518/1
diff --git a/manifests/role/icinga.pp b/manifests/role/icinga.pp
index 84cf8b1..8e9f88a 100644
--- a/manifests/role/icinga.pp
+++ b/manifests/role/icinga.pp
@@ -41,7 +41,7 @@
include icinga::ircbot
}
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat', '365')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat', '365')
sslcert::certificate { 'icinga.wikimedia.org': }
monitoring::service { 'https':
diff --git a/manifests/role/requesttracker.pp b/manifests/role/requesttracker.pp
index b863f41..c096757 100644
--- a/manifests/role/requesttracker.pp
+++ b/manifests/role/requesttracker.pp
@@ -7,7 +7,7 @@
sslcert::certificate { 'rt.wikimedia.org': }
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat', '365')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat', '365')
class { '::requesttracker':
apache_site => 'rt.wikimedia.org',
diff --git a/manifests/role/servermon.pp b/manifests/role/servermon.pp
index fee7108..8ed5cb0 100644
--- a/manifests/role/servermon.pp
+++ b/manifests/role/servermon.pp
@@ -31,7 +31,7 @@
include passwords::ldap::wmf_cluster
$proxypass = $passwords::ldap::wmf_cluster::proxypass
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat')
class { '::servermon':
ensure => 'present',
diff --git a/manifests/role/tendril.pp b/manifests/role/tendril.pp
index 6e7038c..e2b8861 100644
--- a/manifests/role/tendril.pp
+++ b/manifests/role/tendril.pp
@@ -6,7 +6,7 @@
system::role { 'role::tendril': description => 'tendril server' }
sslcert::certificate { 'tendril.wikimedia.org': }
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat', '365')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat', '365')
monitoring::service { 'https-tendril':
description => 'HTTPS-tendril',
diff --git a/modules/ganglia/manifests/web.pp b/modules/ganglia/manifests/web.pp
index e29a6d4..66d7bd8 100644
--- a/modules/ganglia/manifests/web.pp
+++ b/modules/ganglia/manifests/web.pp
@@ -15,7 +15,7 @@
$ganglia_ssl_cert = '/etc/ssl/localcerts/ganglia.wikimedia.org.crt'
$ganglia_ssl_chain = '/etc/ssl/localcerts/ganglia.wikimedia.org.chain.crt'
$ganglia_ssl_key = '/etc/ssl/private/ganglia.wikimedia.org.key'
- $ssl_settings = ssl_ciphersuite('apache-2.4', 'compat', '365')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat', '365')
# Apache's docroot. Used for populating robots.txt
$doc_root = '/var/www'
diff --git a/modules/gerrit/manifests/proxy.pp
b/modules/gerrit/manifests/proxy.pp
index 79930bd..65621b8 100644
--- a/modules/gerrit/manifests/proxy.pp
+++ b/modules/gerrit/manifests/proxy.pp
@@ -2,7 +2,7 @@
$ssl_cert = '',
$ssl_cert_key= '') {
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat', '365')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat', '365')
apache::site { 'gerrit.wikimedia.org':
content => template('gerrit/gerrit.wikimedia.org.erb'),
diff --git a/modules/librenms/manifests/web.pp
b/modules/librenms/manifests/web.pp
index 3bc5197..4599d07 100644
--- a/modules/librenms/manifests/web.pp
+++ b/modules/librenms/manifests/web.pp
@@ -7,11 +7,7 @@
include ::apache::mod::ssl
- if os_version('debian >= jessie || ubuntu >= trusty') {
- $ssl_settings = ssl_ciphersuite('apache-2.4', 'compat', '365')
- } else {
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat', '365')
- }
+ $ssl_settings = ssl_ciphersuite('apache', 'compat', '365')
apache::site { $sitename:
content => template('librenms/apache.conf.erb'),
diff --git a/modules/mailman/manifests/webui.pp
b/modules/mailman/manifests/webui.pp
index 4a3ff3e..cabbe72 100644
--- a/modules/mailman/manifests/webui.pp
+++ b/modules/mailman/manifests/webui.pp
@@ -11,11 +11,7 @@
$lists_servername = hiera('mailman::lists_servername')
- if os_version ( 'debian >= jessie') {
- $ssl_settings = ssl_ciphersuite('apache-2.4', 'mid', '365')
- } else {
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat', '365')
- }
+ $ssl_settings = ssl_ciphersuite('apache', 'mid', '365')
apache::site { 'lists.wikimedia.org':
content => template('mailman/lists.wikimedia.org.erb'),
diff --git a/modules/puppetmaster/manifests/passenger.pp
b/modules/puppetmaster/manifests/passenger.pp
index d1ea396..c5a3869 100644
--- a/modules/puppetmaster/manifests/passenger.pp
+++ b/modules/puppetmaster/manifests/passenger.pp
@@ -25,7 +25,7 @@
ensure => present,
}
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat')
apache::site { 'puppetmaster.wikimedia.org':
content => template('puppetmaster/puppetmaster.erb'),
diff --git a/modules/role/manifests/labs/openstack/nova.pp
b/modules/role/manifests/labs/openstack/nova.pp
index acc50d3..880b71c 100644
--- a/modules/role/manifests/labs/openstack/nova.pp
+++ b/modules/role/manifests/labs/openstack/nova.pp
@@ -66,7 +66,7 @@
check_command => "check_ssl_http!${certificate}",
}
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat', '365')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat', '365')
ferm::service { 'wikitech_http':
proto => 'tcp',
diff --git a/modules/statistics/manifests/web.pp
b/modules/statistics/manifests/web.pp
index 1633da5..60870aa 100644
--- a/modules/statistics/manifests/web.pp
+++ b/modules/statistics/manifests/web.pp
@@ -5,7 +5,7 @@
class statistics::web {
Class['::statistics'] -> Class['::statistics::web']
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat', '365')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat', '365')
# make sure /var/log/apache2 is readable by wikidevs for debugging.
# This won't make the actual log files readable, only the directory.
diff --git a/modules/toolserver_legacy/manifests/init.pp
b/modules/toolserver_legacy/manifests/init.pp
index 8f259e2..06e4b3f 100644
--- a/modules/toolserver_legacy/manifests/init.pp
+++ b/modules/toolserver_legacy/manifests/init.pp
@@ -9,7 +9,7 @@
include ::apache
include ::apache::mod::rewrite
- $ssl_settings = ssl_ciphersuite('apache-2.2', 'compat')
+ $ssl_settings = ssl_ciphersuite('apache', 'compat')
system::role { 'toolserver_legacy': description => 'Toolserver legacy
server' }
diff --git a/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
b/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
index 2d8b603..1da16cc 100644
--- a/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
+++ b/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
@@ -1,4 +1,4 @@
-# == Function: ssl_ciphersuite( string $servercode, string $encryption_type,
int $hsts_days )
+# == Function: ssl_ciphersuite( string $server, string $encryption_type, int
$hsts_days )
#
# Outputs the ssl configuration directives for use with either Nginx
# or Apache using our selection of ciphers and SSL options.
@@ -7,9 +7,7 @@
#
# Takes three arguments:
#
-# - The servercode, or which browser-version combination to
-# support. At the moment only 'apache-2.2', 'apache-2.4' and 'nginx'
-# are supported.
+# - The server to configure for: 'apache' or 'nginx'
# - The compatibility mode, trades security vs compatibility.
# Note that due to POODLE, SSLv3 is universally disabled and none of these
# options are compatible with SSLv3-only clients such as IE6/XP.
@@ -41,7 +39,7 @@
#
# == Examples
#
-# ssl_ciphersuite('apache-2.4', 'compat')
+# ssl_ciphersuite('apache', 'compat')
# ssl_ciphersuite('nginx', 'strong')
#
# == License
@@ -135,15 +133,15 @@
:doc => <<-END
Outputs the ssl configuration part of the webserver config.
Function parameters are:
- servercode - either nginx, apache-2.2 or apache-2.4
+ server - either nginx or apache
encryption_type - strong, mid, or compat
hsts_days - how many days should the STS header live. If not expressed, HSTS
will
be disabled
Examples:
- ssl_ciphersuite('apache-2.4', 'compat') # Compatible config for apache 2.4
- ssl_ciphersuite('apache-2.4', 'mid') # PFS-only for apache2.4
+ ssl_ciphersuite('apache', 'compat') # Compatible config for apache
+ ssl_ciphersuite('apache', 'mid') # PFS-only for apache
ssl_ciphersuite('nginx', 'strong', '365') # PFS-only, AEAD-only,
TLSv1.2-only
END
) do |args|
@@ -154,19 +152,22 @@
fail(ArgumentError, 'ssl_ciphersuite() requires at least 2 arguments')
end
- servercode = args.shift
- case servercode
- when 'apache-2.4' then
- server = 'apache'
- server_version = 24
- when 'apache-2.2' then
- server = 'apache'
- server_version = 22
+ server = args.shift
+ case server
+ when 'apache' then
+ if function_os_version(['debian >= jessie || ubuntu >= trusty'])
+ server_version = 24
+ else
+ server_version = 22
+ end
when 'nginx' then
- server = 'nginx'
- server_version = nil
+ if function_os_version(['debian >= jessie'])
+ server_version = 19
+ else
+ server_version = 11
+ end
else
- fail(ArgumentError, "ssl_ciphersuite(): unknown server string
'#{servercode}'")
+ fail(ArgumentError, "ssl_ciphersuite(): unknown server string
'#{server}'")
end
ciphersuite = args.shift
@@ -230,7 +231,7 @@
end
unless hsts_days.nil?
hsts_seconds = hsts_days * 86400
- if function_os_version(['debian >= jessie'])
+ if server_version >= 18
output.push("add_header Strict-Transport-Security
\"max-age=#{hsts_seconds}\" always;")
else
output.push("add_header Strict-Transport-Security
\"max-age=#{hsts_seconds}\";")
--
To view, visit https://gerrit.wikimedia.org/r/284518
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I851580f72a9d38b5fed92a5f706151d04912e745
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: BBlack <bbl...@wikimedia.org>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
