work in progress: ssl configuration for Tendrl [blocked]

roles/tendrl-server/README.md

@@ -53,6 +53,14 @@ Role Variables
     config file (as shipped in rpm package) will be used. *If you are not sure*
     if you need to reconfigure this, *leave this variable undefined*.
 
+ *  When `httpd_ip_address` variable is undefined,
+
+    TODO:
+
+ *  When `httpd_server_name` variable is undefined,
+
+    TODO:
+
  *  When `etcd_authentication` variable is undefined or set to `False` (which
     is the default value), ansible would just skip all etcd authentication
     tasks (icluding both etcd auth setup and tendrl configuration),
@@ -124,6 +132,26 @@ Role Variables
     For more details about email configuration of tendrl-notifier, see the
     Tendrl documentation.
 
+ *  When `tendrl_ssl_enabled` variable is undefined or set to `False` (which
+    is the default value), ansible would not configure tendrl to provide
+    web interface including REST API over SSL encripted connection.
+
+    When `tendrl_ssl_enabled` variable is set to `True`, SSL will be enabled
+    for Tendrl web interface including API.
+
+ *  When one or both of variables `httpd_ssl_certificate_file` and
+    `httpd_ssl_certificate_key_file` is undefined (which is
+    the default state for both variables), the self signed local SSL key
+    created during installation of `mod_ssl` package will be used.
+
+    Value of `http_ssl_certificate_file` variable is used as
+    `SSLCertificateFile`, and `httpd_ssl_certificate_key_file` as
+    `SSLCertificateKeyFile`.
+
+    To use different SSL certificate, you need to create it and place it on the
+    tendrl server yourself, and then use it's absolute file path on tendrl
+    server as value for both variables.
+
 License
 -------
 

roles/tendrl-server/defaults/main.yml

@@ -2,3 +2,4 @@
 # defaults file for tendrl-server
 etcd_authentication: False
 tendrl_notifier_email_smtp_port: 25
+tendrl_ssl_enabled: False

roles/tendrl-server/tasks/httpd-ssl.yml

@@ -0,0 +1,111 @@
+---
+# Tasks file for Apache SSL setup for Tendrl.
+# Based on description in https://github.com/Tendrl/api/pull/264
+
+# Note: at this point, httpd package should be already installed (httpd is a
+# dependency of tendrl-api-httpd, installed along with tendrl-ui).
+
+- name: Install mod_ssl package
+  yum:
+    name=mod_ssl
+    state=latest
+
+#
+# https support over a specific IP
+#
+
+- name: Initialize new tendrl-ssl.conf file based on sample conf file
+  copy:
+    src: /etc/httpd/conf.d/tendrl-ssl.conf.sample
+    dest: /etc/httpd/conf.d/tendrl-ssl.conf
+    remote_src: True
+    # This is here to prevent overriding changes over and over again, and
+    # also to allow additional manual tweaks.
+    # If you need to start from scratch or make sure that the latest sample
+    # conf file is used, just delete the tendrl-ssl.conf file.
+    force: no
+
+- name: Configure VirtualHost ip address in tendrl-ssl.conf
+  lineinfile:
+    path: /etc/httpd/conf.d/tendrl-ssl.conf
+    regexp: '^<VirtualHost .*:443>'
+    line: "<VirtualHost {{ httpd_ip_address }}:443>"
+  notify:
+    - restart httpd
+
+- name: Configure VirtualHost ServerName in tendrl-ssl.conf
+  lineinfile:
+    path: /etc/httpd/conf.d/tendrl-ssl.conf
+    insertafter: '<VirtualHost .*:443>'
+    regexp: '^ *ServerName .*'
+    line: "  ServerName {{ httpd_server_name }}"
+    state: present
+  notify:
+    - restart httpd
+
+#
+# Specify different cert files if needed
+#
+
+- name: Configure SSL certificate files
+  lineinfile:
+    path: /etc/httpd/conf.d/tendrl-ssl.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - regexp: '^ *SSLCertificateFile .*'
+      line: '  SSLCertificateFile {{ httpd_ssl_certificate_file }}'
+    - regexp: '^ *SSLCertificateKeyFile .*'
+      line: '  SSLCertificateKeyFile {{ httpd_ssl_certificate_key_file }}'
+  when: httpd_ssl_certificate_key_file is defined and httpd_ssl_certificate_file is defined
+  notify:
+    - restart httpd
+
+- name: Run apachectl configtest to validate new configuration
+  command: apachectl -t
+  changed_when: False
+  register: apachectl_configtest
+
+- name: Recheck result of config validation (based on previous task)
+  assert:
+    that:
+      - apachectl_configtest.stderr == 'Syntax OK'
+      - apachectl_configtest.stdout == ''
+
+#
+# Automatic redirect of all http urls to https
+#
+
+- name: Comment out DocumentRoot, ProxyPass and ProxyPassReverse in tendrl.conf
+  lineinfile:
+    path: /etc/httpd/conf.d/tendrl.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - regexp: '  *#?DocumentRoot /var/www/tendrl'
+      line: '  #DocumentRoot /var/www/tendrl'
+    - regexp: '  *#?ProxyPass "/api" http://127.0.0.1:9292/'
+      line: '  #ProxyPass "/api" http://127.0.0.1:9292/'
+    - regexp: '  *#?ProxyPassReverse "/api" http://127.0.0.1:9292/'
+      line: '  #ProxyPassReverse "/api" http://127.0.0.1:9292/'
+  notify:
+    - restart httpd
+
+- name: Configure SSL redirect in tendrl.conf
+  lineinfile:
+    path: /etc/httpd/conf.d/tendrl.conf
+    regexp: ' *#? *Redirect permanent / https://.*/'
+    line: "  Redirect permanent / https://{{ httpd_server_name }}/"
+  notify:
+    - restart httpd
+
+- name: Run apachectl configtest to validate new configuration
+  command: apachectl -t
+  changed_when: False
+  register: apachectl_configtest
+
+- name: Recheck result of config validation (based on previous task)
+  assert:
+    that:
+      - apachectl_configtest.stderr == 'Syntax OK'
+      - apachectl_configtest.stdout == ''

roles/tendrl-server/tasks/main.yml

@@ -11,17 +11,31 @@
     graphite_ip_address: '{{ ansible_default_ipv4.address }}'
   when: graphite_ip_address is undefined
 
+- name: Use ip address of default ipv4 network interface for apache
+  set_fact:
+    httpd_ip_address: '{{ ansible_default_ipv4.address }}'
+  when: httpd_ip_address is undefined
+
+- name: Use ansible detected fqdn as apache ServerName
+  set_fact:
+    httpd_server_name: '{{ ansible_fqdn }}'
+  when: httpd_server_name is undefined
+
 - debug:
     msg:
       - "Using {{ etcd_ip_address }} as etcd ip address."
       - "Using {{ graphite_ip_address }} as graphite ip address."
+      - "Using {{ httpd_ip_address }} as apache ip address."
+      - "Using {{ httpd_server_name }} as apache ServerName."
 
 - include: etcd.yml
 - include: tendrl-node-agent.yml
 - include: tendrl-api.yml
 - include: tendrl-ui.yml
 - include: tendrl-monitoring-integration.yml
 - include: tendrl-notifier.yml
+- include: httpd-ssl.yml
+  when: tendrl_ssl_enabled == True
 
 - name: Enable httpd service
   service: