Rudder

DocumentRoot /var/www

<FilesMatch "\.(cgi|shtml|phtml|php)$">

SSLOptions +StdEnvVars

</FilesMatch>

<Directory /usr/lib/cgi-bin>

SSLOptions +StdEnvVars

</Directory>

# Expose the server UUID through http

Alias /uuid /opt/rudder/etc/uuid.hive

<Directory /opt/rudder/etc>

<IfVersion < 2.4>

Order deny,allow

Allow From all

</IfVersion>

<IfVersion >= 2.4>

Require all granted

</IfVersion>

</Directory>

# WebDAV share to receive inventories

Alias /inventories /var/rudder/inventories/incoming

<Directory /var/rudder/inventories/incoming>

DAV on

AuthName "WebDAV Storage"

AuthType Basic

AuthUserFile /opt/rudder/etc/htpasswd-webdav-initial

Require valid-user

# rudder-networks.conf / rudder-networks-24.conf is automatically

# generated according to the hosts allowed by rudder.

<IfVersion < 2.4>

Order allow,deny

Include /opt/rudder/etc/rudder-networks.conf

</IfVersion>

<IfVersion >= 2.4>

Include /opt/rudder/etc/rudder-networks-24.conf

</IfVersion>

<LimitExcept PUT>

<IfVersion < 2.4>

Order deny,allow

Deny from all

</IfVersion>

<IfVersion >= 2.4>

Require all denied

</IfVersion>

</LimitExcept>

</Directory>

# WebDAV share to receive inventories

Alias /inventory-updates /var/rudder/inventories/accepted-nodes-updates

<Directory /var/rudder/inventories/accepted-nodes-updates>

DAV on

AuthName "WebDAV Storage"

AuthType Basic

AuthUserFile /opt/rudder/etc/htpasswd-webdav

Require valid-user

# rudder-networks.conf / rudder-networks-24.conf is automatically

# generated according to the hosts allowed by rudder.

<IfVersion < 2.4>

Order allow,deny

Include /opt/rudder/etc/rudder-networks.conf

</IfVersion>

<IfVersion >= 2.4>

Include /opt/rudder/etc/rudder-networks-24.conf

</IfVersion>

<LimitExcept PUT>

<IfVersion < 2.4>

Order deny,allow

Deny from all

</IfVersion>

<IfVersion >= 2.4>

Require all denied

</IfVersion>

</LimitExcept>

</Directory>

<VirtualHost *:80>

ServerAdmin webmaster@localhost

# Logs

LogLevel warn

CustomLog /var/log/rudder/apache2/access.log combined

ErrorLog /var/log/rudder/apache2/error.log

# Include Rudder common vhost definitions

Include /opt/rudder/etc/rudder-apache-*-common.conf

Include /opt/rudder/etc/rudder-apache-*-nossl.conf

</VirtualHost>

<VirtualHost *:443>

ServerAdmin webmaster@localhost

# Logs

LogLevel warn

CustomLog /var/log/rudder/apache2/access.log combined

ErrorLog /var/log/rudder/apache2/error.log

# SSL Engine Switch:

# Enable/Disable SSL for this virtual host.

SSLEngine on

SSLCertificateFile /opt/rudder/etc/ssl/rudder.crt

SSLCertificateKeyFile /opt/rudder/etc/ssl/rudder.key

# Include Rudder common vhost definitions

Include /opt/rudder/etc/rudder-apache-*-common.conf

Include /opt/rudder/etc/rudder-apache-*-ssl.conf

</VirtualHost>

Source1: rudder-vhost.conf

Source5: rudder-apache-relay-common.conf

Requires: rudder-agent >= %{real_epoch}:%{real_version}, rsyslog, openssl, %{apache}, %{apache_tools}, python

install -m 644 %{SOURCE1} %{buildroot}/etc/%{apache_vhost_dir}/rudder.conf

install -m 644 %{SOURCE5} %{buildroot}%{rudderdir}/etc/rudder-apache-relay-common.conf

/bin/systemctl stop %{apache}.service && echo " Done"

# Add required includes in the apache2 configuration

echo -e '# This sources the modules/defines needed by Rudder\n. /etc/sysconfig/rudder-relay-apache' >> /etc/sysconfig/apache2

# Remove old includes in the SLES apache2 configuration

if [ -f /etc/sysconfig/apache2 ]; then

if grep -qE "^. /etc/sysconfig/rudder-apache$" /etc/sysconfig/apache2; then

sed -i "/. \/etc\/sysconfig\/rudder-apache/d" /etc/sysconfig/apache2

fi

fi

# On SLES, change the Apache DocumentRoot to the OS default

sed -i "s%^DocumentRoot /var/www$%DocumentRoot /srv/www%" %{buildroot}%{rudderdir}/etc/rudder-apache-relay-common.conf

%endif

# Migrate existing certificates

if [ ! -f /opt/rudder/etc/ssl/rudder.crt ] || [ ! -f /opt/rudder/etc/ssl/rudder.key ]; then

for source in relay webapp; do

if [ -f /opt/rudder/etc/ssl/rudder-${source}.crt ] && [ -f /opt/rudder/etc/ssl/rudder-${source}.key ]; then

echo -n "INFO: Importing existing ${source} certificates..."

mv /opt/rudder/etc/ssl/rudder-${source}.crt /opt/rudder/etc/ssl/rudder.crt

mv /opt/rudder/etc/ssl/rudder-${source}.key /opt/rudder/etc/ssl/rudder.key

echo " Done"

fi

done

fi

# Generate certificates if needed

if [ ! -f /opt/rudder/etc/ssl/rudder.crt ] || [ ! -f /opt/rudder/etc/ssl/rudder.key ]; then

openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$(hostname --fqdn)/" -keyout /opt/rudder/etc/ssl/rudder.key -out /opt/rudder/etc/ssl/rudder.crt -days 1460 -nodes -sha256 >/dev/null 2>&1

chgrp %{apache_group} /opt/rudder/etc/ssl/rudder.key && chmod 640 /opt/rudder/etc/ssl/rudder.key

# Move old virtual hosts out of the way

for OLD_VHOST in rudder-default rudder-default-ssl rudder-default.conf rudder-default-ssl.conf rudder-vhost.conf rudder-vhost-ssl.conf rudder-relay-vhost.conf rudder-relay-vhost-ssl.conf; do

if [ -f /etc/%{apache_vhost_dir}/${OLD_VHOST} ]; then

echo -n "INFO: An old rudder virtual host file has been detected (${OLD_VHOST}), it will be moved to /var/backups."

mkdir -p /var/backups

mv /etc/%{apache_vhost_dir}/${OLD_VHOST} /var/backups/${OLD_VHOST}-$(date +%s)

echo " Done"

fi

done

echo "INFO: * If you are installing a root server, configuration is automatically done "

echo "INFO: * If you are installing a simple relay, run: "

echo "INFO: '/opt/rudder/bin/rudder-node-to-relay $(cat /opt/rudder/etc/uuid.hive)' "

echo "INFO: on your root server to complete this node transition to a relay server. "

echo "INFO: Please look at the documentation for details (Section 'Relay servers') "

%config(noreplace) /etc/%{apache_vhost_dir}/rudder-vhost.conf

%config(noreplace) %{rudderdir}/etc/rudder-relay-apache-relay-common.conf

/etc/apache2/sites-available/rudder.conf

/opt/rudder/etc/rudder-apache-relay-common.conf

Depends: ${shlibs:Depends}, ${misc:Depends}, python, rudder-agent (>= ${binary:Version}), apache2, apache2-utils, rsyslog, openssl, libapache2-mod-wsgi

This package is required to setup a Rudder policy server.

SITES_TO_DISABLE="default 000-default default-ssl rudder-vhost rudder-vhost-ssl rudder-relay-vhost rudder-relay-vhost-ssl"

SITES_TO_ENABLE="rudder"

# Migrate existing certificates

if [ ! -f /opt/rudder/etc/ssl/rudder.crt ] || [ ! -f /opt/rudder/etc/ssl/rudder.key ]; then

for source in relay webapp; do

if [ -f /opt/rudder/etc/ssl/rudder-${source}.crt ] && [ -f /opt/rudder/etc/ssl/rudder-${source}.key ]; then

echo -n "INFO: Importing existing ${source} certificates..."

mv /opt/rudder/etc/ssl/rudder-${source}.crt /opt/rudder/etc/ssl/rudder.crt

mv /opt/rudder/etc/ssl/rudder-${source}.key /opt/rudder/etc/ssl/rudder.key

echo " Done"

fi

done

fi

# Generate certificates if needed

if [ ! -f /opt/rudder/etc/ssl/rudder.crt ] || [ ! -f /opt/rudder/etc/ssl/rudder.key ]; then

openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$(hostname --fqdn)/" -keyout /opt/rudder/etc/ssl/rudder.key -out /opt/rudder/etc/ssl/rudder.crt -days 1460 -nodes -sha256 >/dev/null 2>&1

chgrp www-data /opt/rudder/etc/ssl/rudder.key && chmod 640 /opt/rudder/etc/ssl/rudder.key

# Move old virtual hosts out of the way

for OLD_VHOST in rudder-default rudder-default-ssl rudder-vhost.conf rudder-vhost-ssl.conf rudder-relay-vhost.conf rudder-relay-vhost-ssl.conf; do

if [ -f /etc/apache2/sites-available/${OLD_VHOST} ]; then

echo -n "INFO: An old rudder virtual host file has been detected (${OLD_VHOST}), it will be moved to /var/backups."

mkdir -p /var/backups

mv /etc/apache2/sites-available/${OLD_VHOST} /var/backups/${OLD_VHOST}-$(date +%s)

echo " Done"

fi

done

echo "INFO: * If you are installing a root server, configuration is automatically done "

echo "INFO: * If you are installing a simple relay, run: "

echo "INFO: '/opt/rudder/bin/rudder-node-to-relay $(cat /opt/rudder/etc/uuid.hive)' "

echo "INFO: on your root server to complete this node transition to a relay server. "

echo "INFO: Please look at the documentation for details (Section 'Relay servers') "

cp $(CURDIR)/SOURCES/rudder-relay-vhost.conf $(CURDIR)/BUILD/rudder

dh_install --SOURCEDIR=$(CURDIR)/BUILD/ rudder /etc/apache2/sites-available/rudder

dh_install --SOURCEDIR=$(CURDIR)/SOURCES/ rudder-apache-relay-common.conf /opt/rudder/etc/

# Prevent Chrome loop detection to block the page after too many

# page reloads.

<LocationMatch "/rudder">

Header add X-Chrome-Exponential-Throttling "disable"

</LocationMatch>

# MSIE 7 and newer should be able to use keepalive

BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

# Prevent the apache logs from beeing cluttered by 404 errors

# due to a missing robots.txt file.

Alias /robots.txt /opt/rudder/share/load-page/robots.txt

# Nice loading page if the Java server is not ready

Alias /images /opt/rudder/share/load-page/images

Alias /files /opt/rudder/share/load-page/files

Alias /rudder-loading.html /opt/rudder/share/load-page/rudder-loading.html

Alias /rudder-not-loaded.html /opt/rudder/share/load-page/rudder-not-loaded.html

ErrorDocument 503 /rudder-loading.html

ErrorDocument 404 /rudder-not-loaded.html

ProxyErrorOverride On

<IfVersion >= 2.4>

<Location /rudder/api>

ProxyErrorOverride Off

</Location>

<Location /rudder/secure/api>

ProxyErrorOverride Off

</Location>

<Location /rudder/relay-api>

ProxyErrorOverride Off

</Location>

<Location /inventories>

ProxyErrorOverride Off

</Location>

<Location /inventory-updates>

ProxyErrorOverride Off

</Location>

<Location /uuid>

ProxyErrorOverride Off

</Location>

</IfVersion>

# Enforce permissive access to the load page directory

<Directory /opt/rudder/share/load-page>

<IfVersion < 2.4>

Order deny,allow

Allow From all

</IfVersion>

<IfVersion >= 2.4>

Require all granted

</IfVersion>

</Directory>

# Deny the use of legacy API if using X-API-Version which is not '1'

SetEnvIf X-API-Version "[^1]" api_deny

# NO access to the status and archiving API unless you are localhost

<LocationMatch "^/rudder/api/(status|archives)$">

<IfVersion < 2.4>

Order allow,deny

Allow from localhost

Deny from env=api_deny

</IfVersion>

<IfVersion >= 2.4>

<RequireAll>

Require local

Require not env api_deny

</RequireAll>

</IfVersion>

</LocationMatch>

# NO access to the reloading API either unless you are localhost

<LocationMatch "^/rudder/api/(techniqueLibrary|dyngroup|deploy)/reload$">

<IfVersion < 2.4>

Order allow,deny

Allow from localhost

Deny from env=api_deny

</IfVersion>

<IfVersion >= 2.4>

<RequireAll>

Require local

Require not env api_deny

</RequireAll>

</IfVersion>

</LocationMatch>

# Note: The preceding statements are here for compatibility purpose and will

# be removed in a future version of Rudder, which will enforce authenticated

# calls to every API part.

# Link to Rudder documentation

Alias /rudder-doc /usr/share/doc/rudder/html

<Directory /usr/share/doc/rudder/html>

<IfVersion < 2.4>

Order deny,allow

Allow From all

</IfVersion>

<IfVersion >= 2.4>

Require all granted

</IfVersion>

</Directory>

# Rudder webapp

RewriteEngine on

# Rule 1 - If hitting the server root, redirect to Rudder

RewriteRule ^/$ /rudder [R]

# Rule 2 - If we are not currently connected via HTTP/S

RewriteCond %{HTTPS} !=on

# Rule 2 - Don't use HTTP/S for these URLs to avoid breaking the compatibility for cURL

# clients (especially in Techniques)

RewriteCond %{REQUEST_URI} !^/rudder-(not-loaded|loading).html

RewriteCond %{REQUEST_URI} !^/uuid

RewriteCond %{REQUEST_URI} !^/inventories/?

RewriteCond %{REQUEST_URI} !^/inventory-updates/?

RewriteCond %{REQUEST_URI} !^/api/?

# Rule 2 - Restrict redirection to Rudder webapp

RewriteCond %{REQUEST_URI} ^/rudder/?

# Rule 2 - Redirect to HTTP/S

RewriteRule ^/(.*)$ https://%{SERVER_NAME}/$1 [R]

# Rudder webapp

RewriteEngine on

RewriteRule ^/$ /rudder [R]

ProxyPass "/rudder" "http://localhost:8080/rudder" retry=0

ProxyPassReverse "/rudder" "http://localhost:8080/rudder"

ProxyRequests Off

# Local reverse proxy authorization override

# Most unix distribution deny proxy by default (ie /etc/apache2/mods-enabled/proxy.conf in Ubuntu)

<Proxy http://localhost:8080/rudder*>

<IfVersion < 2.4>

Order deny,allow

Allow From all

</IfVersion>

<IfVersion >= 2.4>

Require all granted

</IfVersion>

</Proxy>

# Apache modules

APACHE_MODULES="${APACHE_MODULES} rewrite dav dav_fs proxy proxy_http headers ssl version"

# Apache configuration flags

APACHE_SERVER_FLAGS="${APACHE_SERVER_FLAGS} SSL"

Source24: rudder-webapp-apache

Requires: rudder-techniques = %{real_epoch}:%{real_version}, rudder-server-relay = %{real_epoch}:%{real_version}, ncf, ncf-api-virtualenv, %{apache}, %{apache_tools}, git-core, rsync, openssl, %{ldap_clients}

cp %{_sourcedir}/rudder-sources/rudder/rudder-web/src/main/resources/rudder-apache-webapp-common.conf %{buildroot}%{rudderdir}/etc/rudder-apache-webapp-common.conf

cp %{_sourcedir}/rudder-sources/rudder/rudder-web/src/main/resources/rudder-apache-webapp-ssl.conf %{buildroot}%{rudderdir}/etc/rudder-apache-webapp-ssl.conf

cp %{_sourcedir}/rudder-sources/rudder/rudder-web/src/main/resources/rudder-apache-webapp-nossl.conf %{buildroot}%{rudderdir}/etc/rudder-apache-webapp-no-ssl.conf

cp %{SOURCE24} %{buildroot}/etc/sysconfig/rudder-webapp-apache

if ! grep -qE "^. /etc/sysconfig/rudder-webapp-apache$" /etc/sysconfig/apache2

echo -e '# This sources the modules/defines needed by Rudder\n. /etc/sysconfig/rudder-webapp-apache' >> /etc/sysconfig/apache2

echo "INFO: Upgrading the /etc/sysconfig/apache2 file, Rudder needed modules for Apache are now listed in /etc/sysconfig/rudder-relay-apache"

sed -i 's%APACHE_MODULES="${APACHE_MODULES} rewrite dav dav_fs proxy proxy_http.*%# This sources the Rudder needed by Rudder\n. /etc/sysconfig/rudder-relay-apache%' /etc/sysconfig/apache2

# Add perms on tools and inventories

sed -i "/. \/etc\/sysconfig\/rudder-webapp-apache/d" /etc/sysconfig/apache2

%config %{rudderdir}/etc/rudder-apache-webapp.conf

%config(noreplace) /etc/sysconfig/rudder-webapp-apache

/opt/rudder/etc/rudder-apache-webapp-common.conf

Depends: ${shlibs:Depends}, ${misc:Depends}, rudder-jetty | jetty | jetty8, rudder-techniques (= ${binary:Version}), rudder-server-relay (= ${binary:Version}), apache2, apache2-utils, ncf, git-core, rsync, lsb-release, openssl, ldap-utils, postgresql-client (>=8.4), ncf-api-virtualenv

MODULES_TO_ENABLE="rewrite proxy_http headers ssl"

# Add perms on tools and inventories

dh_install --SOURCEDIR=$(CURDIR)/SOURCES/rudder-sources/rudder/rudder-web/src/main/resources/ rudder-apache-webapp-common.conf /opt/rudder/etc/

dh_install --SOURCEDIR=$(CURDIR)/SOURCES/rudder-sources/rudder/rudder-web/src/main/resources/ rudder-apache-webapp-ssl.conf /opt/rudder/etc/

dh_install --SOURCEDIR=$(CURDIR)/SOURCES/rudder-sources/rudder/rudder-web/src/main/resources/ rudder-apache-webapp-nossl.conf /opt/rudder/etc/