Skip to content
This repository was archived by the owner on Jan 10, 2023. It is now read-only.

add the abbility to disable ssl #22

Open
ramonskie wants to merge 4 commits into
base: master
Choose a base branch
from
Open

add the abbility to disable ssl #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b3026c4
add ssl attribute default to true
Jan 3, 2014
dd8ba51
add options to enable or disable ssl
Jan 3, 2014
3ab71e8
Update web-tomcat7.xml.erb
Jan 3, 2014
a34d15d
add proxy preserve host
Jan 3, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions attributes/default.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,8 @@
default['stash']['ssh']['hostname'] = node['fqdn']
default['stash']['ssh']['port'] = '7999'

default['stash']['ssl'] = true

default['stash']['tomcat']['keyAlias'] = 'tomcat'
default['stash']['tomcat']['keystoreFile'] = "#{node['stash']['home_path']}/.keystore"
default['stash']['tomcat']['keystorePass'] = 'changeit'
Expand Down
4 changes: 2 additions & 2 deletions templates/default/server-tomcat7.xml.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@
useBodyEncodingForURI="true"
compression="on"
compressableMimeType="text/html,text/xml,text/plain,text/css,application/json,application/javascript,application/x-javascript"
<% if node['stash']['apache2'] -%>
<% if node['stash']['ssl'] == true -%>
Copy link
Copy Markdown
Owner

@bflad bflad Jan 3, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

== true is redundant and can be removed. Doesn't this still have redirectPort to the Tomcat HTTPS port below here in the else?

Copy link
Copy Markdown
Owner

@bflad bflad Jan 3, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any changes here should also be done in server.xml.erb (for completeness).

Copy link
Copy Markdown
Owner

@bflad bflad Jan 3, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nevermind about redirectPort, that's only used for Tomcat security constraints, which would be turned off. Although don't we want apache2 to still be the check here for Apache vs non-Apache config? I think all we really need to do is mess with the security constraint in web(-tomcat7).xml.erb

Copy link
Copy Markdown
Contributor Author

@ramonskie ramonskie Jan 6, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think you are right will need to test this

Copy link
Copy Markdown
Contributor Author

@ramonskie ramonskie Jan 13, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just tested it and this option is needed.
and apache is default configured for stash for non-ssl

redirectPort="<%= node['stash']['apache2']['ssl']['port'] %>"
secure="true"
scheme="https"
Expand Down Expand Up @@ -193,4 +193,4 @@
</Host>
</Engine>
</Service>
</Server>
</Server>
5 changes: 4 additions & 1 deletion templates/default/web-tomcat7.xml.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4280,6 +4280,8 @@
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>

<!-- Require HTTPS for login -->
<% if node['stash']['ssl'] == true -%>
Copy link
Copy Markdown
Owner

@bflad bflad Jan 3, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

== true is redundant and can be removed

Copy link
Copy Markdown
Owner

@bflad bflad Jan 3, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any changes here should also be done in web.xml.erb (for completeness).

<!-- Require HTTPS for login -->
<security-constraint>
<web-resource-collection>
Expand All @@ -4290,4 +4292,5 @@
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
</web-app>
<% end -%>
</web-app>
6 changes: 5 additions & 1 deletion templates/default/web_app.conf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@
CustomLog <%= node['stash']['apache2']['access_log'].empty? ? node['apache']['log_dir']+"/stash-access.log" : node['stash']['apache2']['access_log'] %> combined
ErrorLog <%= node['stash']['apache2']['error_log'].empty? ? node['apache']['log_dir']+"/stash-error.log" : node['stash']['apache2']['error_log'] %>
LogLevel warn
ProxyRequests Off
Copy link
Copy Markdown
Owner

@bflad bflad Jan 3, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you maybe have tabs instead of spaces? I think these changes are reasonable here.

Copy link
Copy Markdown
Contributor Author

@ramonskie ramonskie Jan 6, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i always use spaces.
will change it if you require it

ProxyPreserveHost On

<Proxy *>
Order Deny,Allow
Expand All @@ -41,6 +43,8 @@
CustomLog <%= node['stash']['apache2']['ssl']['access_log'].empty? ? node['apache']['log_dir']+"/stash-ssl-access.log" : node['stash']['apache2']['ssl']['access_log'] %> combined
ErrorLog <%= node['stash']['apache2']['ssl']['error_log'].empty? ? node['apache']['log_dir']+"/stash-ssl-error.log" : node['stash']['apache2']['ssl']['error_log'] %>
LogLevel warn
ProxyRequests Off
ProxyPreserveHost On

<Proxy *>
Order Deny,Allow
Expand All @@ -55,4 +59,4 @@
<% unless node['stash']['apache2']['ssl']['chain_file'].empty? -%>
SSLCertificateChainFile <%= node['stash']['apache2']['ssl']['chain_file'] %>
<% end -%>
</VirtualHost>
</VirtualHost>
⚡