tmakinen/puppet
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

apache: Add support for HTTP Strict Transport Security

Browse source
This commit is contained in:
Ossi Salmi 2013-08-14 14:31:23 +03:00
parent a3b970ab8e
commit e6d7688bdc
4 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apache/manifests/debian.pp
View file

@ -186,7 +186,7 @@ class apache::debian::sslserver inherits apache::debian::common {
} }
define apache::debian::sslsite($first, $ipaddr, $root, define apache::debian::sslsite($first, $hsts, $ipaddr, $root,
$ssl_cert, $ssl_key, $ssl_chain) { $ssl_cert, $ssl_key, $ssl_chain) {
if $name == "default" { if $name == "default" {

12
apache/manifests/init.pp
View file

@ -266,6 +266,9 @@ class apache::sslserver::listen {
# $first: # $first:
# Bool for whether this is the first (default) vhost # Bool for whether this is the first (default) vhost
# when using NameVirtualHost. Defaults to false. # when using NameVirtualHost. Defaults to false.
# $hsts:
# Bool for whether to enable HTTP Strict Transport Security for this
# virtual host. Defaults to false.
# $ipaddr: # $ipaddr:
# IP address of virtual host. Defaults to _default_. # IP address of virtual host. Defaults to _default_.
# $root: # $root:
@ -285,15 +288,21 @@ class apache::sslserver::listen {
# ssl_key => "puppet:///path/to/www.example.com.key", # ssl_key => "puppet:///path/to/www.example.com.key",
# } # }
# #
define apache::sslsite($first=false, $ipaddr="_default_", $root="", $ssl_cert="", $ssl_key="", $ssl_chain="") { define apache::sslsite($first=false, $hsts=false, $ipaddr="_default_", $root="",
$ssl_cert="", $ssl_key="", $ssl_chain="") {
include apache::sslserver::listen include apache::sslserver::listen
if $hsts == true {
include apache::mod::headers
}
case $::operatingsystem { case $::operatingsystem {
"debian","ubuntu": { "debian","ubuntu": {
$apache_ssldir = "/etc/ssl" $apache_ssldir = "/etc/ssl"
apache::debian::sslsite { $name: apache::debian::sslsite { $name:
first => $first, first => $first,
hsts => $hsts,
ipaddr => $ipaddr, ipaddr => $ipaddr,
root => $root, root => $root,
ssl_cert => $ssl_cert, ssl_cert => $ssl_cert,
@ -306,6 +315,7 @@ define apache::sslsite($first=false, $ipaddr="_default_", $root="", $ssl_cert=""
$apache_ssldir = "/etc/pki/tls" $apache_ssldir = "/etc/pki/tls"
apache::redhat::sslsite { $name: apache::redhat::sslsite { $name:
first => $first, first => $first,
hsts => $hsts,
ipaddr => $ipaddr, ipaddr => $ipaddr,
root => $root, root => $root,
ssl_cert => $ssl_cert, ssl_cert => $ssl_cert,

2
apache/manifests/redhat.pp
View file

@ -225,7 +225,7 @@ class apache::redhat::sslserver {
} }
define apache::redhat::sslsite($first, $ipaddr, $root, define apache::redhat::sslsite($first, $hsts, $ipaddr, $root,
$ssl_cert, $ssl_key, $ssl_chain) { $ssl_cert, $ssl_key, $ssl_chain) {
if $name == "default" { if $name == "default" {

7
apache/templates/site.https.conf.erb
View file

@ -148,6 +148,13 @@ BrowserMatch "MSIE [2-5]" \
# compact non-error SSL logfile on a virtual host basis. # compact non-error SSL logfile on a virtual host basis.
#CustomLog logs/ssl_request_log \ #CustomLog logs/ssl_request_log \
# "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" # "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
<% if @hsts == true -%>
# Enable HTTP Strict Transport Security
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=15768000"
</IfModule>
<% end -%>
Include <%= @site_confdir %>/*.conf Include <%= @site_confdir %>/*.conf