Dzahn has submitted this change and it was merged.
Change subject: stats.wikimedia.org - enable SSL, replace
webserver::apache::site and its inline Apache config with apache_site and
template in ./sites/apache
......................................................................
stats.wikimedia.org - enable SSL, replace webserver::apache::site
and its inline Apache config with apache_site and template in ./sites/apache
To: - make it more uniform to the setup of most other misc apache
sites, especially metrics.wm on the same host, instead of being a one-off
- make it easier to read Apache config in one place
- and enable HTTPS for RT #4749 without running into conflicts
between the different site setups on one host
- don't have to edit puppet class to change inline Apache config
RT #4749
Change-Id: I241e1964e127633084644de601bdb30fffd30a63
---
M manifests/misc/statistics.pp
A templates/apache/sites/stats.wikimedia.org.erb
2 files changed, 96 insertions(+), 49 deletions(-)
Approvals:
jenkins-bot: Verified
Dzahn: Looks good to me, approved
diff --git a/manifests/misc/statistics.pp b/manifests/misc/statistics.pp
index fa0678e..73e11a6 100644
--- a/manifests/misc/statistics.pp
+++ b/manifests/misc/statistics.pp
@@ -1,3 +1,5 @@
+# this file is for stat[0-9] statistics servers (per ezachte - RT 2162)
+
class misc::statistics::iptables-purges {
require "iptables::tables"
@@ -36,8 +38,6 @@
# Labs has security groups, and as such, doesn't need firewall rules
}
-
-# this file is for stat[0-9]/(ex-bayes) statistics servers (per ezachte - RT
2162)
class misc::statistics::user {
$username = "stats"
@@ -159,7 +159,7 @@
}
# wikistats configuration for generating
-# stat.wikimedia.org data.
+# stats.wikimedia.org data.
#
# TODO: puppetize clone of wikistats?
class misc::statistics::wikistats {
@@ -216,7 +216,7 @@
mode => 0750,
require => Class['webserver::apache'],
}
-
+
webserver::apache::module { ['rewrite', 'proxy', 'proxy_http']:
require => Class['webserver::apache']
}
@@ -260,54 +260,19 @@
source => "puppet:///private/apache/htpasswd.stats",
}
- webserver::apache::site { $site_name:
- require => [Class["webserver::apache"],
Webserver::Apache::Module["rewrite"], File["/etc/apache2/htpasswd.stats"]],
- docroot => $docroot,
- ssl => true,
- certfile => '/etc/ssl/certs/stats.wikimedia.org.chained.pem',
- certkey => '/etc/ssl/private/stats.wikimedia.org.key',
- aliases => ["stats.wikipedia.org"],
- custom => [
- "Alias /extended $docroot/reportcard/extended",
- "Alias /staff $docroot/reportcard/staff \n",
- "RewriteEngine On",
+ install_certificate{ $site_name: }
- # redirect stats.wikipedia.org to stats.wikimedia.org
- "RewriteCond %{HTTP_HOST} stats.wikipedia.org
- RewriteRule ^(.*)$ http://$site_name\$1 [R=301,L]\n",
-
- # Set up htpasswd authorization for some sensitive stuff
- "<Directory \"$docroot/reportcard/staff\">
- AllowOverride None
- Order allow,deny
- Allow from all
- AuthName \"Password protected area\"
- AuthType Basic
- AuthUserFile /etc/apache2/htpasswd.stats
- Require user wmf
- </Directory>",
- "<Directory \"$docroot/reportcard/extended\">
- AllowOverride None
- Order allow,deny
- Allow from all
- AuthName \"Password protected area\"
- AuthType Basic
- AuthUserFile /etc/apache2/htpasswd.stats
- Require user internal
- </Directory>",
- "<Directory \"$docroot/reportcard/pediapress\">
- AllowOverride None
- Order allow,deny
- Allow from all
- AuthName \"Password protected area\"
- AuthType Basic
- AuthUserFile /etc/apache2/htpasswd.stats
- Require user pediapress
- </Directory>",
- ],
+ file {
+ "/etc/apache2/sites-available/stats.wikimedia.org":
+ ensure => present,
+ mode => '0444',
+ owner => root,
+ group => root,
+ content => template('apache/sites/stats.wikimedia.org.erb');
}
- install_certificate{ $site_name: }
+ apache_site { statswikimedia: name => 'stats.wikimedia.org' }
+
}
# community-analytics.wikimedia.org
diff --git a/templates/apache/sites/stats.wikimedia.org.erb
b/templates/apache/sites/stats.wikimedia.org.erb
new file mode 100644
index 0000000..134057b
--- /dev/null
+++ b/templates/apache/sites/stats.wikimedia.org.erb
@@ -0,0 +1,82 @@
+# Note: This file is managed by Puppet.
+<%
+# Most of the VirtualHost configs are common to both the
+# http and https site. DRY up the VirtualHosts with this
+# variable.
+common_config = <<END
+ ServerName stats.wikimedia.org
+ ServerAlias stats.wikipedia.org
+ ServerAdmin [email protected]
+
+ DocumentRoot /srv/stats.wikimedia.org/htdocs
+ <Directory /srv/stats.wikimedia.org/htdocs>
+ Options Indexes FollowSymLinks MultiViews
+ AllowOverride None
+ Order allow,deny
+ allow from all
+ </Directory>
+
+ ErrorLog /var/log/apache2/error.log
+ # Possible values include: debug, info, notice, warn, error, crit,
+ # alert, emerg.
+ LogLevel warn
+
+ CustomLog /var/log/apache2/access.log combined
+ ServerSignature On
+
+ Alias /extended /srv/stats.wikimedia.org/htdocs/reportcard/extended
+ Alias /staff /srv/stats.wikimedia.org/htdocs/reportcard/staff
+
+ <Directory "/srv/stats.wikimedia.org/htdocs/reportcard/staff">
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+ AuthName "Password protected area"
+ AuthType Basic
+ AuthUserFile /etc/apache2/htpasswd.stats
+ Require user wmf
+ </Directory>
+ <Directory "/srv/stats.wikimedia.org/htdocs/reportcard/extended">
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+ AuthName "Password protected area"
+ AuthType Basic
+ AuthUserFile /etc/apache2/htpasswd.stats
+ Require user internal
+ </Directory>
+ <Directory "/srv/stats.wikimedia.org/htdocs/reportcard/pediapress">
+ AllowOverride Nonesta
+ Order allow,deny
+ Allow from all
+ AuthName "Password protected area"
+ AuthType Basic
+ AuthUserFile /etc/apache2/htpasswd.stats
+ Require user pediapress
+ </Directory>
+END
+-%>
+
+<VirtualHost *:80>
+<%= common_config %>
+ RewriteEngine On
+ RewriteCond %{HTTP_HOST} stats.wikipedia.org
+ RewriteRule ^(.*)$ http://stats.wikimedia.org$1 [R=301,L]
+</VirtualHost>
+
+<VirtualHost *:443>
+<%= common_config %>
+ RewriteEngine On
+ RewriteCond %{HTTP_HOST} stats.wikipedia.org
+ RewriteRule ^(.*)$ https://stats.wikimedia.org$1 [R=301,L]
+
+ SSLEngine on
+ SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
+ SSLHonorCipherOrder on
+ SSLCertificateFile /etc/ssl/certs/stats.wikimedia.org.pem
+ SSLCertificateKeyFile /etc/ssl/private/stats.wikimedia.org.key
+ SSLCertificateChainFile /etc/ssl/certs/stats.wikimedia.org.chained.pem
+</VirtualHost>
+
+# vim: filetype=apache
--
To view, visit https://gerrit.wikimedia.org/r/85971
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I241e1964e127633084644de601bdb30fffd30a63
Gerrit-PatchSet: 5
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Dzahn <[email protected]>
Gerrit-Reviewer: Dzahn <[email protected]>
Gerrit-Reviewer: Krinkle <[email protected]>
Gerrit-Reviewer: Ottomata <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
