Skip to content

Commit 8d9a6f1

Browse files
ekohlekohl
committed
Factor out Apache to its own class
Prior to this, when the Apache config was modified a full database refresh was triggered. There's no need for that and this makes applying those changes faster.
1 parent 0d06d2e commit 8d9a6f1

File tree

5 files changed

+105
-115
lines changed

5 files changed

+105
-115
lines changed

‎manifests/apache.pp‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# @summary The apache configuration for Foreman
2+
# @api private
3+
class foreman::apache {
4+
class { 'foreman::config::apache':
5+
app_root => $foreman::app_root,
6+
priority => $foreman::vhost_priority,
7+
servername => $foreman::servername,
8+
serveraliases => $foreman::serveraliases,
9+
server_port => $foreman::server_port,
10+
server_ssl_port => $foreman::server_ssl_port,
11+
proxy_backend => "unix://${foreman::listen_socket}",
12+
ssl => $foreman::ssl,
13+
ssl_ca => $foreman::server_ssl_ca,
14+
ssl_chain => $foreman::server_ssl_chain,
15+
ssl_cert => $foreman::server_ssl_cert,
16+
ssl_certs_dir => $foreman::server_ssl_certs_dir,
17+
ssl_key => $foreman::server_ssl_key,
18+
ssl_crl => $foreman::server_ssl_crl,
19+
ssl_protocol => $foreman::server_ssl_protocol,
20+
ssl_verify_client => $foreman::server_ssl_verify_client,
21+
user => $foreman::user,
22+
foreman_url => $foreman::foreman_url,
23+
ipa_authentication => $foreman::ipa_authentication,
24+
keycloak => $foreman::keycloak,
25+
keycloak_app_name => $foreman::keycloak_app_name,
26+
keycloak_realm => $foreman::keycloak_realm,
27+
}
28+
29+
contain foreman::config::apache
30+
31+
if $foreman::ipa_authentication {
32+
if $facts['os']['selinux']['enabled'] {
33+
selboolean { ['allow_httpd_mod_auth_pam', 'httpd_dbus_sssd']:
34+
persistent => true,
35+
value => 'on',
36+
}
37+
}
38+
39+
if $foreman::ipa_manage_sssd {
40+
service { 'sssd':
41+
ensure => running,
42+
enable => true,
43+
require => Package['sssd-dbus'],
44+
}
45+
}
46+
47+
file { "/etc/pam.d/${foreman::pam_service}":
48+
ensure => file,
49+
owner => root,
50+
group => root,
51+
mode => '0644',
52+
content => template('foreman/pam_service.erb'),
53+
}
54+
55+
$http_keytab = pick($foreman::http_keytab, "${apache::conf_dir}/http.keytab")
56+
57+
exec { 'ipa-getkeytab':
58+
command => "/bin/echo Get keytab \
59+
&& KRB5CCNAME=KEYRING:session:get-http-service-keytab kinit -k \
60+
&& KRB5CCNAME=KEYRING:session:get-http-service-keytab /usr/sbin/ipa-getkeytab -k ${http_keytab} -p HTTP/${facts['networking']['fqdn']} \
61+
&& kdestroy -c KEYRING:session:get-http-service-keytab",
62+
creates => $http_keytab,
63+
}
64+
-> file { $http_keytab:
65+
ensure => file,
66+
owner => $apache::user,
67+
mode => '0600',
68+
}
69+
70+
foreman::config::apache::fragment { 'intercept_form_submit':
71+
ssl_content => template('foreman/intercept_form_submit.conf.erb'),
72+
}
73+
74+
foreman::config::apache::fragment { 'lookup_identity':
75+
ssl_content => template('foreman/lookup_identity.conf.erb'),
76+
}
77+
78+
foreman::config::apache::fragment { 'auth_gssapi':
79+
ssl_content => template('foreman/auth_gssapi.conf.erb'),
80+
}
81+
}
82+
}

‎manifests/config.pp‎

Lines changed: 1 addition & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -94,110 +94,10 @@
9494
}
9595

9696
if $foreman::apache {
97-
$listen_socket = '/run/foreman.sock'
98-
99-
class { 'foreman::config::apache':
100-
app_root => $foreman::app_root,
101-
priority => $foreman::vhost_priority,
102-
servername => $foreman::servername,
103-
serveraliases => $foreman::serveraliases,
104-
server_port => $foreman::server_port,
105-
server_ssl_port => $foreman::server_ssl_port,
106-
proxy_backend => "unix://${listen_socket}",
107-
ssl => $foreman::ssl,
108-
ssl_ca => $foreman::server_ssl_ca,
109-
ssl_chain => $foreman::server_ssl_chain,
110-
ssl_cert => $foreman::server_ssl_cert,
111-
ssl_certs_dir => $foreman::server_ssl_certs_dir,
112-
ssl_key => $foreman::server_ssl_key,
113-
ssl_crl => $foreman::server_ssl_crl,
114-
ssl_protocol => $foreman::server_ssl_protocol,
115-
ssl_verify_client => $foreman::server_ssl_verify_client,
116-
user => $foreman::user,
117-
foreman_url => $foreman::foreman_url,
118-
ipa_authentication => $foreman::ipa_authentication,
119-
keycloak => $foreman::keycloak,
120-
keycloak_app_name => $foreman::keycloak_app_name,
121-
keycloak_realm => $foreman::keycloak_realm,
122-
}
123-
124-
contain foreman::config::apache
125-
12697
$foreman_socket_override = template('foreman/foreman.socket-overrides.erb')
12798

12899
if $foreman::ipa_authentication {
129-
if $facts['os']['selinux']['enabled'] {
130-
selboolean { ['allow_httpd_mod_auth_pam', 'httpd_dbus_sssd']:
131-
persistent => true,
132-
value => 'on',
133-
}
134-
}
135-
136-
if $foreman::ipa_manage_sssd {
137-
service { 'sssd':
138-
ensure => running,
139-
enable => true,
140-
require => Package['sssd-dbus'],
141-
}
142-
}
143-
144-
file { "/etc/pam.d/${foreman::pam_service}":
145-
ensure => file,
146-
owner => root,
147-
group => root,
148-
mode => '0644',
149-
content => template('foreman/pam_service.erb'),
150-
}
151-
152-
$http_keytab = pick($foreman::http_keytab, "${apache::conf_dir}/http.keytab")
153-
154-
exec { 'ipa-getkeytab':
155-
command => "/bin/echo Get keytab \
156-
&& KRB5CCNAME=KEYRING:session:get-http-service-keytab kinit -k \
157-
&& KRB5CCNAME=KEYRING:session:get-http-service-keytab /usr/sbin/ipa-getkeytab -k ${http_keytab} -p HTTP/${facts['networking']['fqdn']} \
158-
&& kdestroy -c KEYRING:session:get-http-service-keytab",
159-
creates => $http_keytab,
160-
}
161-
-> file { $http_keytab:
162-
ensure => file,
163-
owner => $apache::user,
164-
mode => '0600',
165-
}
166-
167-
foreman::config::apache::fragment { 'intercept_form_submit':
168-
ssl_content => template('foreman/intercept_form_submit.conf.erb'),
169-
}
170-
171-
foreman::config::apache::fragment { 'lookup_identity':
172-
ssl_content => template('foreman/lookup_identity.conf.erb'),
173-
}
174-
175-
foreman::config::apache::fragment { 'auth_gssapi':
176-
ssl_content => template('foreman/auth_gssapi.conf.erb'),
177-
}
178-
179-
180-
if $foreman::ipa_manage_sssd {
181-
$sssd = pick(fact('foreman_sssd'), {})
182-
$sssd_services = join(unique(pick($sssd['services'], []) + ['ifp']), ', ')
183-
$sssd_ldap_user_extra_attrs = join(unique(pick($sssd['ldap_user_extra_attrs'], []) + ['email:mail', 'lastname:sn', 'firstname:givenname']), ', ')
184-
$sssd_allowed_uids = join(unique(pick($sssd['allowed_uids'], []) + [$apache::user, 'root']), ', ')
185-
$sssd_user_attributes = join(unique(pick($sssd['user_attributes'], []) + ['+email', '+firstname', '+lastname']), ', ')
186-
187-
augeas { 'sssd-ifp-extra-attributes':
188-
context => '/files/etc/sssd/sssd.conf',
189-
changes => [
190-
"set target[.=~regexp('domain/.*')]/ldap_user_extra_attrs '${sssd_ldap_user_extra_attrs}'",
191-
"set target[.='sssd']/services '${sssd_services}'",
192-
'set target[.=\'ifp\'] \'ifp\'',
193-
"set target[.='ifp']/allowed_uids '${sssd_allowed_uids}'",
194-
"set target[.='ifp']/user_attributes '${sssd_user_attributes}'",
195-
],
196-
notify => Service['sssd'],
197-
}
198-
}
199-
200-
concat::fragment {'foreman_settings+02-authorize_login_delegation.yaml':
100+
concat::fragment { 'foreman_settings+02-authorize_login_delegation.yaml':
201101
target => '/etc/foreman/settings.yaml',
202102
content => template('foreman/settings-external-auth.yaml.erb'),
203103
order => '02',

‎manifests/init.pp‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -312,19 +312,28 @@
312312
timeout => 0,
313313
}
314314

315+
$listen_socket = '/run/foreman.sock'
316+
315317
include foreman::install
316318
include foreman::config
317319
include foreman::database
318-
contain foreman::service
320+
include foreman::service
321+
322+
anchor { 'foreman::running': # lint:ignore:anchor_resource
323+
}
319324

320325
Anchor <| title == 'foreman::repo' |> ~> Class['foreman::install']
321326
Class['foreman::install'] ~> Class['foreman::config', 'foreman::service']
322327
Class['foreman::config'] ~> Class['foreman::database', 'foreman::service']
323328
Class['foreman::database'] ~> Class['foreman::service']
324-
Class['foreman::service'] -> Foreman_smartproxy <| base_url == $foreman_url |>
329+
Class['foreman::service'] -> Anchor['foreman::running']
330+
Anchor['foreman::running'] -> Foreman_smartproxy <| base_url == $foreman_url |>
325331

326332
if $apache {
327-
Class['foreman::database'] -> Class['apache::service']
333+
include foreman::apache
334+
335+
Class['foreman::config', 'foreman::database'] -> Class['foreman::apache']
336+
Class['foreman::apache', 'apache::service'] -> Anchor['foreman::running']
328337
if $ipa_authentication and $keycloak {
329338
fail("${facts['networking']['hostname']}: External authentication via IPA and Keycloak are mutually exclusive.")
330339
}
@@ -334,6 +343,15 @@
334343
fail("${facts['networking']['hostname']}: External authentication via Keycloak can only be enabled when Apache is used.")
335344
}
336345

346+
# Ensure SSL certs from the puppetmaster are available
347+
# Relationship is duplicated there as defined() is parse-order dependent
348+
if $ssl and defined(Class['puppet::server::config']) {
349+
Class['puppet::server::config'] -> Class['foreman::service']
350+
if $apache {
351+
Class['puppet::server::config'] -> Class['foreman::apache']
352+
}
353+
}
354+
337355
# Anchor these separately so as not to break
338356
# the notify between main classes
339357
Class['foreman::install']

‎manifests/service.pp‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,6 @@
2525
}
2626
}
2727

28-
if $apache {
29-
Class['apache::service'] -> Class['foreman::service']
30-
31-
# Ensure SSL certs from the puppetmaster are available
32-
# Relationship is duplicated there as defined() is parse-order dependent
33-
if $ssl and defined(Class['puppet::server::config']) {
34-
Class['puppet::server::config'] -> Class['foreman::service']
35-
}
36-
}
37-
3828
service { "${foreman_service}.socket":
3929
ensure => $foreman_service_ensure,
4030
enable => $foreman_service_enable,

‎templates/foreman.socket-overrides.erb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[Socket]
22
ListenStream=
3-
ListenStream=<%= @listen_socket %>
3+
ListenStream=<%= scope['foreman::listen_socket'] %>
44
SocketUser=<%= scope['apache::user'] %>
55
SocketMode=0600

0 commit comments

Comments
 (0)