roles/apache: Role to deploy Apache HTTPD

The *apache* role installs and configures the Apache HTTPD server and
its *mod_ssl* module. It currently only works on Fedora/RHEL-based
distributions.

roles/apache/defaults/main.yml

@@ -0,0 +1,48 @@
+apache_mpm: prefork
+apache_keep_num_logs: 4
+apache_max_log_size: 256M
+apache_ssl_protocol:
+- all
+- '-SSLv2'
+- '-SSLv3'
+apache_ssl_ciphersuite:
+- ECDHE-RSA-AES128-GCM-SHA256
+- ECDHE-ECDSA-AES128-GCM-SHA256
+- ECDHE-RSA-AES256-GCM-SHA384
+- ECDHE-ECDSA-AES256-GCM-SHA384
+- DHE-RSA-AES128-GCM-SHA256
+- DHE-DSS-AES128-GCM-SHA256
+- kEDH+AESGCM
+- ECDHE-RSA-AES128-SHA256
+- ECDHE-ECDSA-AES128-SHA256
+- ECDHE-RSA-AES128-SHA
+- ECDHE-ECDSA-AES128-SHA
+- ECDHE-RSA-AES256-SHA384
+- ECDHE-ECDSA-AES256-SHA384
+- ECDHE-RSA-AES256-SHA
+- ECDHE-ECDSA-AES256-SHA
+- DHE-RSA-AES128-SHA256
+- DHE-RSA-AES128-SHA
+- DHE-DSS-AES128-SHA256
+- DHE-RSA-AES256-SHA256
+- DHE-DSS-AES256-SHA
+- DHE-RSA-AES256-SHA
+- AES128-GCM-SHA256
+- AES256-GCM-SHA384
+- AES128
+- AES256
+- HIGH
+- '!RC4'
+- '!aNULL'
+- '!eNULL'
+- '!EXPORT'
+- '!DES'
+- '!3DES'
+- '!MD5'
+apache_ssl_certificate: /etc/pki/tls/certs/localhost.crt
+apache_ssl_certificate_key: /etc/pki/tls/private/localhost.key
+apache_default_ssl_vhost: true
+apache_ssl_listen_port: 443
+web_ports:
+- '{{ apache_ssl_listen_port if apache_ssl_listen_port != 443 else "https" }}'
+- http

roles/apache/files/.gitignore

@@ -0,0 +1,5 @@
+*.cer
+*.crt
+*.key
+*.pem
+*.keytab

roles/apache/handlers/main.yml

@@ -0,0 +1,11 @@
+- name: restart httpd
+  service:
+    name=httpd
+    state=restarted
+- name: reload httpd
+  service:
+    name=httpd
+    state=reloaded
+- name: save firewalld configuration
+  command:
+    firewall-cmd --runtime-to-permanent

roles/apache/tasks/main.yml

@@ -0,0 +1,100 @@
+- name: ensure apache httpd is installed
+  package:
+    name=httpd,mod_ssl
+    state=present
+  tags:
+  - install
+
+- name: ensure http service keytab is in place
+  copy:
+    src={{ item }}
+    dest=/etc/httpd/krb5.keytab
+    mode=0440
+    owner=root
+    group=apache
+  with_fileglob:
+  - '{{ inventory_hostname }}.keytab'
+
+- name: ensure tls private key exists
+  copy:
+    src={{ item }}
+    dest={{ apache_ssl_certificate_key }}
+    mode=0400
+    setype=cert_t
+  with_fileglob:
+  - '{{ inventory_hostname }}.key'
+  notify: reload httpd
+- name: ensure tls certificate exists
+  copy:
+   src={{ item }}
+   dest={{ apache_ssl_certificate }}
+   mode=0644
+   setype=cert_t
+  with_fileglob:
+  - '{{ inventory_hostname }}.cer'
+  notify: reload httpd
+- name: ensure tls ca certificate exists
+  copy:
+    src={{ item }}
+    dest={{ apache_ssl_ca_certificate }}
+    mode=0644
+    setype=cert_t
+  when: apache_ssl_ca_certificate is defined
+  with_fileglob:
+  - '{{ inventory_hostname }}-ca.crt'
+  notify: reload httpd
+- name: ensure ssl.include is populated
+  template:
+    src=ssl.include.j2
+    dest=/etc/httpd/conf.d/ssl.include
+    mode=0644
+  notify: reload httpd
+- name: ensure mod_ssl is configured
+  template:
+    src=ssl.conf.j2
+    dest=/etc/httpd/conf.d/ssl.conf
+    mode=0644
+    setype=httpd_config_t
+  notify: reload httpd
+
+- name: ensure apache mpm module is configured
+  template:
+    src=mpm.httpd.conf.j2
+    dest=/etc/httpd/conf.d/00-mpm.conf
+    mode=0644
+    setype=httpd_config_t
+  notify: reload httpd
+- name: ensure apache server name is set
+  template:
+    src=servername.httpd.conf.j2
+    dest=/etc/httpd/conf.d/00-servername.conf
+    mode=0644
+    setype=httpd_config_t
+  notify: reload httpd
+
+- name: ensure httpd service starts at boot
+  service:
+    name=httpd
+    enabled=yes
+
+- name: ensure web ports are open in firewall
+  firewalld: >-
+    port={{ item if '/' in item else omit }}
+    service={{ item if '/' not in item else omit }}
+    permanent=no
+    immediate=yes
+    state=enabled
+  with_items: '{{ web_ports }}'
+  notify: save firewalld configuration
+
+- meta: flush_handlers
+- name: ensure httpd service is running
+  service:
+    name=httpd
+    state=started
+
+- name: ensure old apache logs are rotated
+  template:
+    src=httpd.logrotate.j2
+    dest=/etc/logrotate.d/httpd
+    mode=0644

roles/apache/templates/httpd.logrotate.j2

@@ -0,0 +1,18 @@
+/var/log/httpd/*log {
+    missingok
+    notifempty
+    rotate {{ apache_keep_num_logs }}
+    maxsize {{ apache_max_log_size }}
+    sharedscripts
+    compress
+    compresscmd /usr/bin/xz
+    compressext .xz
+    delaycompress
+    postrotate
+{% if ansible_distribution_major_version|int < 7 %}
+        /sbin/service httpd reload > /dev/null 2>/dev/null || true
+{% else %}
+        /bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true
+{% endif %}
+    endscript
+}

roles/apache/templates/mpm.httpd.conf.j2

@@ -0,0 +1,23 @@
+# Select the MPM module which should be used by uncommenting exactly
+# one of the following LoadModule lines.  See the httpd.service(8) man
+# page for more information on changing the MPM.
+
+# prefork MPM: Implements a non-threaded, pre-forking web server
+# See: http://httpd.apache.org/docs/2.4/mod/prefork.html
+#
+# NOTE: If enabling prefork, the httpd_graceful_shutdown SELinux
+# boolean should be enabled, to allow graceful stop/shutdown.
+#
+{% if apache_mpm != 'prefork' %}#{% endif %}LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
+
+# worker MPM: Multi-Processing Module implementing a hybrid
+# multi-threaded multi-process web server
+# See: http://httpd.apache.org/docs/2.4/mod/worker.html
+#
+{% if apache_mpm != 'worker' %}#{% endif %}LoadModule mpm_worker_module modules/mod_mpm_worker.so
+
+# event MPM: A variant of the worker MPM with the goal of consuming
+# threads only for connections with active processing
+# See: http://httpd.apache.org/docs/2.4/mod/event.html
+#
+{% if apache_mpm != 'event' %}#{% endif %}LoadModule mpm_event_module modules/mod_mpm_event.so

roles/apache/templates/servername.httpd.conf.j2

@@ -0,0 +1,12 @@
+#
+# ServerName gives the name and port that the server uses to identify itself.
+# This can often be determined automatically, but we recommend you specify
+# it explicitly to prevent problems during startup.
+#
+# If your host doesn't have a registered DNS name, enter its IP address here.
+#
+{% if apache_server_name is defined %}
+ServerName {{ apache_server_name }}
+{% else %}
+#ServerName www.example.com:80
+{% endif %}

roles/apache/templates/ssl.conf.j2

@@ -0,0 +1,161 @@
+#
+# When we also provide SSL we have to listen to the 
+# the HTTPS port in addition.
+#
+Listen {{ apache_ssl_listen_port }} https
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is a internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First the mechanism 
+#   to use and second the expiring timeout (in seconds).
+SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
+SSLSessionCacheTimeout  300
+
+#   Pseudo Random Number Generator (PRNG):
+#   Configure one or more sources to seed the PRNG of the 
+#   SSL library. The seed data should be of good random quality.
+#   WARNING! On some platforms /dev/random blocks if not enough entropy
+#   is available. This means you then cannot use the /dev/random device
+#   because it would lead to very long connection times (as long as
+#   it requires to make more entropy available). But usually those
+#   platforms additionally provide a /dev/urandom device which doesn't
+#   block. So, if available, use this one instead. Read the mod_ssl User
+#   Manual for more details.
+SSLRandomSeed startup file:/dev/urandom  256
+SSLRandomSeed connect builtin
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+
+#
+# Use "SSLCryptoDevice" to enable any supported hardware
+# accelerators. Use "openssl engine -v" to list supported
+# engine names.  NOTE: If you enable an accelerator and the
+# server does not start, consult the error logs and ensure
+# your accelerator is functioning properly. 
+#
+SSLCryptoDevice builtin
+#SSLCryptoDevice ubsec
+
+##
+## SSL Virtual Host Context
+##
+
+{% if apache_default_ssl_vhost|bool %}
+<VirtualHost _default_:{{ apache_ssl_listen_port }}>
+
+# General setup for the virtual host, inherited from global configuration
+#DocumentRoot "/var/www/html"
+#ServerName www.example.com:443
+
+Include conf.d/ssl.include
+
+#   Server Certificate:
+# Point SSLCertificateFile at a PEM encoded certificate.  If
+# the certificate is encrypted, then you will be prompted for a
+# pass phrase.  Note that a kill -HUP will prompt again.  A new
+# certificate can be generated using the genkey(1) command.
+SSLCertificateFile {{ apache_ssl_certificate }}
+
+#   Server Private Key:
+#   If the key is not combined with the certificate, use this
+#   directive to point at the key file.  Keep in mind that if
+#   you've both a RSA and a DSA private key you can configure
+#   both in parallel (to also allow the use of DSA ciphers, etc.)
+SSLCertificateKeyFile {{ apache_ssl_certificate_key }}
+
+#   Server Certificate Chain:
+#   Point SSLCertificateChainFile at a file containing the
+#   concatenation of PEM encoded CA certificates which form the
+#   certificate chain for the server certificate. Alternatively
+#   the referenced file can be the same as SSLCertificateFile
+#   when the CA certificates are directly appended to the server
+#   certificate for convinience.
+SSLCertificateChainFile {{ apache_ssl_certificate }}
+
+#   Certificate Authority (CA):
+#   Set the CA certificate verification path where to find CA
+#   certificates for client authentication or alternatively one
+#   huge file containing all of them (file must be PEM encoded)
+{% if apache_ssl_ca_certificate is defined %}
+SSLCACertificateFile {{ apache_ssl_ca_certificate }}
+{% else %}
+#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
+{% endif %}
+
+#   Client Authentication (Type):
+#   Client certificate verification type and depth.  Types are
+#   none, optional, require and optional_no_ca.  Depth is a
+#   number which specifies how deeply to verify the certificate
+#   issuer chain before deciding the certificate is not valid.
+#SSLVerifyClient require
+#SSLVerifyDepth  10
+
+#   Access Control:
+#   With SSLRequire you can do per-directory access control based
+#   on arbitrary complex boolean expressions containing server
+#   variable checks and other lookup directives.  The syntax is a
+#   mixture between C and Perl.  See the mod_ssl documentation
+#   for more details.
+#<Location />
+#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
+#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
+#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+#</Location>
+
+#   SSL Engine Options:
+#   Set various options for the SSL engine.
+#   o FakeBasicAuth:
+#     Translate the client X.509 into a Basic Authorisation.  This means that
+#     the standard Auth/DBMAuth methods can be used for access control.  The
+#     user name is the `one line' version of the client's X.509 certificate.
+#     Note that no password is obtained from the user. Every entry in the user
+#     file needs this password: `xxj31ZMTZzkVA'.
+#   o ExportCertData:
+#     This exports two additional environment variables: SSL_CLIENT_CERT and
+#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+#     server (always existing) and the client (only existing when client
+#     authentication is used). This can be used to import the certificates
+#     into CGI scripts.
+#   o StdEnvVars:
+#     This exports the standard SSL/TLS related `SSL_*' environment variables.
+#     Per default this exportation is switched off for performance reasons,
+#     because the extraction step is an expensive operation and is usually
+#     useless for serving static content. So one usually enables the
+#     exportation for CGI and SSI requests only.
+#   o StrictRequire:
+#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
+#     under a "Satisfy any" situation, i.e. when it applies access is denied
+#     and no other module can change it.
+#   o OptRenegotiate:
+#     This enables optimized SSL connection renegotiation handling when SSL
+#     directives are used in per-directory context. 
+#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+<Files ~ "\.(cgi|shtml|phtml|php3?)$">
+    SSLOptions +StdEnvVars
+</Files>
+<Directory "/var/www/cgi-bin">
+    SSLOptions +StdEnvVars
+</Directory>
+
+</VirtualHost>                                  
+
+{% else %}
+# The default SSL virtual host is not used on this system. Another
+# configuration file likely defines a VirtualHost container.
+{% endif %}

roles/apache/templates/ssl.include.j2

@@ -0,0 +1,67 @@
+# Use separate log files for the SSL virtual host; note that LogLevel
+# is not inherited from httpd.conf.
+ErrorLog logs/ssl_error_log
+TransferLog logs/ssl_access_log
+LogLevel warn
+
+#   SSL Engine Switch:
+#   Enable/Disable SSL for this virtual host.
+SSLEngine on
+
+#   SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect.  Disable SSLv2 access by default:
+SSLProtocol {{ apache_ssl_protocol|join(' ') }}
+
+#   SSL Cipher Suite:
+#   List the ciphers that the client is permitted to negotiate.
+#   See the mod_ssl documentation for a complete list.
+SSLCipherSuite  {{ apache_ssl_ciphersuite|join(':') }}
+SSLHonorCipherOrder on
+
+#   Speed-optimized SSL Cipher configuration:
+#   If speed is your main concern (on busy HTTPS servers e.g.),
+#   you might want to force clients to specific, performance
+#   optimized ciphers. In this case, prepend those ciphers
+#   to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
+#   Caveat: by giving precedence to RC4-SHA and AES128-SHA
+#   (as in the example below), most connections will no longer
+#   have perfect forward secrecy - if the server's key is
+#   compromised, captures of past or future traffic must be
+#   considered compromised, too.
+#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
+#SSLHonorCipherOrder on 
+
+#   SSL Protocol Adjustments:
+#   The safe and default but still SSL/TLS standard compliant shutdown
+#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+#   the close notify alert from client. When you need a different shutdown
+#   approach you can use one of the following variables:
+#   o ssl-unclean-shutdown:
+#     This forces an unclean shutdown when the connection is closed, i.e. no
+#     SSL close notify alert is send or allowed to received.  This violates
+#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
+#     this when you receive I/O errors because of the standard approach where
+#     mod_ssl sends the close notify alert.
+#   o ssl-accurate-shutdown:
+#     This forces an accurate shutdown when the connection is closed, i.e. a
+#     SSL close notify alert is send and mod_ssl waits for the close notify
+#     alert of the client. This is 100% SSL/TLS standard compliant, but in
+#     practice often causes hanging connections with brain-dead browsers. Use
+#     this only for browsers where you know that their SSL implementation
+#     works correctly. 
+#   Notice: Most problems of broken clients are also related to the HTTP
+#   keep-alive facility, so you usually additionally want to disable
+#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+#   "force-response-1.0" for this.
+BrowserMatch "MSIE [2-5]" \
+         nokeepalive ssl-unclean-shutdown \
+         downgrade-1.0 force-response-1.0
+
+#   Per-Server Logging:
+#   The home of a custom SSL log file. Use this when you want a
+#   compact non-error SSL logfile on a virtual host basis.
+CustomLog logs/ssl_request_log \
+          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"