vars fix

README.md

@@ -9,11 +9,18 @@ See also [ansible-infra-playbooks](https://github.com/CentOS/ansible-infra-playb
 See [defaults variables and explanations](defaults/main.yml)
 
 ```
-mbs_import_default_modules: boolean flag to import modules from mbs_default_modules_dir
+mbs_env: mbs environment, it will try to inherit the value from "centos_infra_env", valud choices: dev, stg and prod.
+mbs_import_default_modules: boolean flag to import modules from a local dir
 mbs_upgrade_db: boolean flag which defines if `mbs-manager upgrade db` should run during instllation
 mbs_num_workers: number of mbs workers added as systemd service
 mbs_celery_max_worker_tasks: max of tasks that can be executed per worker
 mbs_default_modules_dir: local module dir to import modules from (yaml files)
+# postgresql
+mbs_postgres_local: boolean flag to determine if mbs role needs to install psql using centos postgresql role
+mbs_postgres_hostname: postgresql hostname
+mbs_postgres_username: postgresql username
+mbs_postgres_password: postgresql password
+mbs_postgres_database: potsgresql database
 # rabbitmq
 rabbitmq_local: boolean flag that wll install a local rabbitmq instance if set to true 
 rabbitmq_vhost: rabbitmq vhost to use or create
@@ -27,16 +34,15 @@ kojihub_kerberos_rdns: bool flag to enable/disable koji kerberos rdns
 #mbs config.py
 mbs_config_broker_url: celery broker url to use, defaults to local rabbitmq instance
 mbs_config_debug: bool flag that enables/disables mbs debug mode
-mbs_config_env: "{{ mbs_config_type }}" #
-mbs_config_secret_key: a1b2c3d4 #
-mbs_config_database_url: mbs database url
+mbs_config_secret_key: random string to be used by mbs frontend
+mbs_config_database_url: mbs postgresql url, it is formed by psql vars: "postgresql://{{ mbs_postgres_username }}:{{ mbs_postgres_password }}@{{ mbs_postgres_hostname }}/{{ mbs_postgres_database }}"
 mbs_config_system: mbs build system, defaults to "koji"
 mbs_config_messaging: mbs messaging backend type, defaults to "fedmsg"
 mbs_config_messaging_topic_prefix: 'org.centos.mbs' #
 mbs_config_koji_file: path to the mbs koji conf file, defaulta to  /etc/module-build-service/koji.conf
 mbs_config_koji_profile: mbs koji profile to use, defaults to "koji"
 mbs_config_arches: a list of supported archs by this mbs instance
-mbs_config_koji_proxy_user: true #
+mbs_config_koji_proxy_user: boolean flag to tell if mbs needs to proxy mbs username to koji
 mbs_config_koji_repository_url: koji repos url
 mbs_config_scm_urls: a list of allowed git urls for mbs to pull modules from
 mbs_config_polling_interval: mbs polling interval for mbs-poller

defaults/main.yml

@@ -1,32 +1,37 @@
 ---
 # defaults file for mbs
-
-# Do we want to deploy frontend, backend
-mbs_frontend: False
-mbs_backend: False
-
-
+mbs_buildtools_repo_gpgkey: "{{ kojid_buildtools_repo_gpgkey | default('') }}"
+mbs_env: "{{ centos_infra_env | default('prod') }}"
+mbs_frontend: True
+mbs_backend: True
 mbs_cert_prefix: mbs
 mbs_import_default_modules: true
 mbs_upgrade_db: true
 mbs_num_workers: 3
 mbs_celery_max_worker_tasks: 10
 mbs_default_modules_dir: default-modules
+mbs_pki_store: "{{ pkistore | default('./') }}"
+# psql
+mbs_postgres_local: True
+mbs_postgres_hostname: localhost
+mbs_postgres_username: mbs
+mbs_postgres_password: mbs
+mbs_postgres_database: mbs
 # rabbitmq
-rabbitmq_local: True
-rabbitmq_vhost: mbs
-rabbitmq_username: mbs
-rabbitmq_password: mbs
+mbs_rabbitmq_local: True
+mbs_rabbitmq_vhost: mbs
+mbs_rabbitmq_username: mbs
+mbs_rabbitmq_password: mbs
 # kojihub
-kojihub_top_url: https://cbs.centos.org
-kojihub_use_fast_upload: true
-kojihub_auth_type: kerberos
-kojihub_kerberos_rdns: false
+mbs_kojihub_top_url: https://cbs.centos.org
+mbs_kojihub_use_fast_upload: true
+mbs_kojihub_auth_type: kerberos
+mbs_kojihub_kerberos_rdns: false
 #mbs config.py
-mbs_config_broker_url: 'amqp://{{ rabbitmq_username }}@{{ rabbitmq_password }}:localhost:5627/{{ rabbitmq_vhost }}'
+mbs_config_broker_url: 'amqp://{{ mbs_rabbitmq_username }}@{{ mbs_rabbitmq_password }}:localhost:5627/{{ mbs_rabbitmq_vhost }}'
 mbs_config_debug: false
 mbs_config_secret_key: a1b2c3d4
-mbs_config_database_url: postgresql://mbs:mbs@localhost/mbs
+mbs_config_database_url: postgresql://{{ mbs_postgres_username }}:{{ mbs_postgres_password }}@{{ mbs_postgres_hostname }}/{{ mbs_postgres_database }}
 mbs_config_system: koji
 mbs_config_messaging: fedmsg
 mbs_config_messaging_topic_prefix: ['org.centos.prod']
@@ -48,7 +53,7 @@ mbs_config_log_backend: file
 mbs_config_log_file: /var/log/mbs/module_build_service.log
 mbs_config_log_level: info
 mbs_config_logs_build_dir: /var/tmp
-mbs_config_krb_keytab: /etc/krb5.mbs_mbs{{ mbs_config_env }}.centos.org.keytab
+mbs_config_krb_keytab: mbs-{{ mbs_env }}.centos.org.keytab
 mbs_config_krb_principal: cbs-koji@DEV.CENTOS.ORG
 mbs_config_allowed_groups:
   - packager

molecule/default/molecule.yml

@@ -26,19 +26,15 @@ provisioner:
   inventory:
     group_vars:
       all:
-        # psql vars
-        psql_hba_conf_file: ${MOLECULE_PROJECT_DIRECTORY}/molecule/files/pg_hba.conf
         # msb vars
         mbs_env: stg
         mbs_default_modules_dir: ${MOLECULE_PROJECT_DIRECTORY}/molecule/files/default-modules
         mbs_frontend_https_enabled: false
         mbs_frontend_http_enabled: true
         mbs_config_no_auth: true
+        mbs_kojihub_auth_type: 'kerberos'
+        mbs_pki_store:  ${MOLECULE_PROJECT_DIRECTORY}/molecule/files/
         # fedmsg vars
-        fedmsg_buildtools_repo_name: BuildTools
-        fedmsg_buildtools_repo_baseurl: http://buildlogs.centos.org/centos/8/infra/x86_64/buildtools-common/
-        fedmsg_buildtools_repo_enabled: 1
-        fedmsg_buildtools_repo_gpgcheck:  0
         fedmsg_hub_bin: /usr/bin/fedmsg-hub
         fedmsg_env: stg
         fedmsg_log_level: DEBUG
@@ -48,9 +44,6 @@ provisioner:
         fedmsg_websocket_port: 9919
         fedmsg_status_directory: /var/run/fedmsg/status
         fedmsg_post_init_sleep: 1
-        # httpd role vars
-        httpd_public: false
-        pki_hostname: localhost
 verifier:
   name: ansible
 scenario:

molecule/default/prepare.yml

@@ -3,67 +3,4 @@
   hosts: all
   become: true
   become_user: root
-  tasks:
-    # prepare
-    - name: Ensure psql data dir exists
-      stat:
-        path: /var/lib/pgsql/data/PG_VERSION
-      register: output
-
-    - name: Install postgresql
-      yum:
-        name:
-          - postgresql-server
-          - postgresql-server-devel
-          - postgresql
-          - python36
-          - python36-devel
-        state: present
-
-    - name: setups psql data dir
-      shell: postgresql-setup --initdb
-      when: not output.stat.exists
-
-    - name:
-      pip:
-        name: 
-          - psycopg2-binary
-        executable: /usr/bin/pip3.6
-
-    - name: Copy psql dev config file
-      copy:
-        src: "{{ psql_hba_conf_file }}"
-        dest: /var/lib/pgsql/data/pg_hba.conf
-
-    - name: Start postgresql
-      service:
-        name: postgresql
-        state: started
-        enabled: true
-
-    - name: Create a new database
-      become_method: sudo
-      become_user: postgres
-      postgresql_db:
-        name: mbs
-        encoding: 'UTF-8'
-        lc_collate: 'en_US.UTF-8'
-        lc_ctype: 'en_US.UTF-8'
-        state: present
-
-    - name: Postgres reset database user
-      become_method: sudo
-      become_user: postgres
-      postgresql_user:
-        db: mbs
-        name: mbs
-        password: mbs
-        priv: ALL
-        state: present
-
-    - name: Set db owner
-      become_method: sudo
-      become_user: postgres
-      postgresql_owner:
-        db: mbs
-        new_owner: mbs
+  tasks: []

molecule/default/requirements.yml

@@ -1,7 +1,15 @@
 - src: https://github.com/CentOS/ansible-role-httpd
   name: httpd
+
+- src: https://github.com/CentOS/ansible-role-fedmsg
+  name: fedmsg
   version: staging
 
-- src: https://github.com/odra/ansible-role-fedmsg
-  name: fedmsg
-  version: infra-fixes
+- src: https://github.com/CentOS/ansible-role-postgresql
+  name: postgresql
+
+- src: https://github.com/CentOS/ansible-role-centos-backup
+  name: centos-backup
+
+- src: https://github.com/CentOS/ansible-role-iptables
+  name: iptables

molecule/files/krb5/localhost.keytab

@@ -0,0 +1 @@
+keepme

molecule/files/krb5/mbs-stg.centos.org.keytab

@@ -0,0 +1 @@
+keepme

molecule/files/pg_hba.conf

@@ -1,13 +0,0 @@
-# TYPE  DATABASE        USER            ADDRESS                 METHOD
-
-# "local" is for Unix domain socket connections only
-local   all             all                                     trust
-# IPv4 local connections:
-host    all             all             127.0.0.1/32            trust
-# IPv6 local connections:
-host    all             all             ::1/128                 trust
-# Allow replication connections from localhost, by a user with the
-# replication privilege.
-local   replication     all                                     peer
-host    replication     all             127.0.0.1/32            ident
-host    replication     all             ::1/128                 ident

requirements.yml

@@ -1,5 +0,0 @@
-- src: https://github.com/CentOS/ansible-role-httpd
-  name: httpd
-
-- src: https://github.com/CentOS/ansible-role-fedmsg
-  name: fedmsg

tasks/main.yml

@@ -3,10 +3,10 @@
 - include_tasks: system.yml
 # rabbitmq
 - include_tasks: rabbitmq.yml
-  when: rabbitmq_local
+  when: mbs_rabbitmq_local | bool
 # msb-backend setup
 - include_tasks: mbs-backend.yml
-  when: mbs_backend
+  when: mbs_backend | bool
 # msb-frontend setup
 - include_tasks: mbs-frontend.yml
-  when: mbs_frontend
+  when: mbs_frontend | bool

tasks/mbs-backend.yml

@@ -18,6 +18,7 @@
   file:
     path: /etc/fedmsg.d/{{ item }}
     state: absent
+  changed_when: true
   with_items:
     - module_build_service.py
     - mbs-logging.py
@@ -150,3 +151,13 @@
     - shell: /usr/bin/mbs-manager import_module {{ item }}
       with_items: "{{ default_modules.files }}"
   when: mbs_import_default_modules
+
+
+- name: Copy mbs-backend koji keytab
+  copy:
+    src: "{{ mbs_pki_store }}/krb5/{{ mbs_config_krb_keytab }}"
+    dest: /etc/module-build-service/{{ mbs_config_krb_keytab }}
+    owner: fedmsg
+    group: fedmsg
+    mode: '0644'
+  when: mbs_kojihub_auth_type == 'kerberos'

tasks/mbs-frontend.yml

@@ -1,5 +1,4 @@
 ---
-
 - name: Configuring httpd
   include_role:
     name: httpd
@@ -7,13 +6,15 @@
 - include_role:
     name: httpd
   vars:
-    - httpd_tls: True
+    - httpd_tls: "{{ mbs_frontend_https_enabled | bool }}"
  
 - include_role:
     name: httpd
     tasks_from: pki-tls
   vars:
     pki_hostname: "{{ mbs_frontend_host }}"
+    pkistore: "{{ mbs_pki_store }}"
+  when: mbs_frontend_https_enabled | bool
 
 - name: Install mbs-frontend packages
   yum:
@@ -22,27 +23,25 @@
       - module-build-service
       - mod_auth_gssapi
     state: installed
-  notify: restart_httpd 
+  notify:
+    - Restart apache
 
 - name: Copy mbs httpd config
   template:
-    src: "mbs/{{ item }}.j2"
-    dest: "/etc/httpd/conf.d/{{ item }}"
+    src: "mbs/mbs.conf.j2"
+    dest: "/etc/httpd/conf.d/mbs.conf"
     owner: apache
     group: apache
     mode: 0644
-  with_items:
-    - mbs.conf
-    - 02_mbs.conf
-    - ssl-mbs.conf
   notify:
     - Restart apache
 
 - name: Ensure we have proper httpd keytab
   copy:
-    src: "{{ pkistore }}/krb5/{{ mbs_frontend_krb_keytab }}"
+    src: "{{ mbs_pki_store }}/krb5/{{ mbs_frontend_krb_keytab }}"
     dest: "/etc/httpd/conf.d/{{ mbs_frontend_krb_keytab }}"
     owner: apache
+  when: (mbs_config_no_auth | bool) == False
 
 - name: Ensure /usr/share/mbs folder exists
   file:
@@ -67,4 +66,3 @@
     - httpd_can_network_memcache
     - httpd_can_network_connect
     - httpd_can_sendmail
-  

tasks/rabbitmq.yml

@@ -25,14 +25,14 @@
 
 - name: Ensure vhost exists
   rabbitmq_vhost:
-    name: "{{ rabbitmq_vhost }}"
+    name: "{{ mbs_rabbitmq_vhost }}"
     state: present
 
 - name: Ensure user exists and has access to vhost
   rabbitmq_user:
-    user: "{{ rabbitmq_username }}"
-    password: "{{ rabbitmq_password }}"
-    vhost: "{{ rabbitmq_vhost }}"
+    user: "{{ mbs_rabbitmq_username }}"
+    password: "{{ mbs_rabbitmq_password }}"
+    vhost: "{{ mbs_rabbitmq_vhost }}"
     configure_priv: .*
     read_priv: .*
     write_priv: .*

tasks/system.yml

@@ -4,6 +4,21 @@
   include_role:
     name: fedmsg
 
+- name: Install postgresql if needed
+  include_role:
+    name: postgresql
+  vars:
+    pgsql_tls: false
+    pgsql_users:
+      - name: "{{ mbs_postgres_username }}"
+        password: "{{ mbs_postgres_password }}"
+        role_attr: "NOCREATEDB,NOSUPERUSER,NOCREATEROLE"
+        db: "{{ mbs_postgres_database }}"
+    pgsql_databases:
+      - name: "{{ mbs_postgres_database }}"
+        owner: "{{ mbs_postgres_username }}"
+  when: mbs_postgres_local | bool
+
 - name: Add the buildtools repo if needed
   template:
     src: buildtools.repo.j2

templates/buildtools.repo.j2

@@ -4,14 +4,14 @@
 {% set contentdir = 'centos' %} 
 {% endif %}
 
-{% if centos_infra_env == 'prod' %}
+{% if mbs_env == 'prod' %}
 [centos-buildtools-common]
 name=CentOS koji buildtools repository
 baseurl=http://mirror.centos.org/{{ contentdir }}/$releasever/infra/$basearch/buildtools-common/
 enabled=1
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/{{ kojid_buildtools_repo_gpgkey }}
-{% elif centos_infra_env == 'stg' %}
+gpgkey=file:///etc/pki/rpm-gpg/{{ mbs_buildtools_repo_gpgkey }}
+{% elif mbs_env == 'stg' %}
 [centos-buildtools-common]
 name=CentOS STG koji buildtools repository
 baseurl=http://buildlogs.centos.org/centos/$releasever/infra/$basearch/buildtools-common/
@@ -23,5 +23,4 @@ name=CentOS dev koji buildtools repository
 baseurl=http://repo.dev.centos.org/$releasever/infra/buildtools-common/$basearch/
 enabled=1
 gpgcheck=0
-{% endif %}
-
+{% endif %}

templates/mbs/02_mbs.conf.j2

@@ -1,14 +0,0 @@
-
-<VirtualHost *:80>
-   DocumentRoot /var/www/html
-   ServerName {{ mbs_frontend_host }}
-   CustomLog logs/{{ mbs_frontend_host }}_access.log combined
-   ErrorLog logs/{{ mbs_frontend_host }}_error.log
-
-   RewriteEngine On
-   RewriteCond $1 !^.well-known
-   RewriteCond %{HTTPS} !=on
-   RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
-
-</VirtualHost>
-

templates/mbs/client_secrets.json.j2

@@ -1,11 +0,0 @@
-{
-    "web": {
-        "auth_uri": "{{ mbs_oidc_uri }}",
-        "client_id": "{{ mbs_oidc_client_id }}",
-        "client_secret": "{{ mbs_oidc_client_secret }}",
-        "redirect_uris": {{ mbs_oidc_redirect_uris }},
-        "token_uri": "{{ mbs_oidc_token_uri }}",
-        "token_introspection_uri": "{{ mbs_oidc_token_introspection_uri }}",
-        "userinfo_uri": "{{ mbs_oidc_userinfo_uri }}"
-    }
-}

templates/mbs/koji.conf.j2

@@ -1,19 +1,19 @@
 [koji]
-server = {{ kojihub_top_url }}/kojihub
-weburl = {{ kojihub_top_url }}/koji
-topurl = {{ kojihub_top_url }}
+server = {{ mbs_kojihub_top_url }}/kojihub
+weburl = {{ mbs_kojihub_top_url }}/koji
+topurl = {{ mbs_kojihub_top_url }}
 
-authtype = {{ kojihub_auth_type }}
-{% if  kojihub_auth_type == 'kerberos' %}
-krb_rdns = {{ kojihub_kerberos_rdns | bool }}
+authtype = {{ mbs_kojihub_auth_type }}
+{% if  mbs_kojihub_auth_type == 'kerberos' %}
+krb_rdns = {{ mbs_kojihub_kerberos_rdns | bool }}
 ;the principal to auth as for automated clients
 principal = {{ mbs_config_krb_principal }}
 ;the keytab to auth as for automated clients
-keytab = {{ mbs_config_krb_keytab }}
+keytab = /etc/module-build-service/{{ mbs_config_krb_keytab }}
 {% endif %}
-{% if  kojihub_auth_type == 'ssl' %}
-cert = {{ kojihub_ssl_cert }}
-serverca = {{ kojihub_ssl_ca }}
+{% if  mbs_kojihub_auth_type == 'ssl' %}
+cert = {{ mbs_kojihub_ssl_cert }}
+serverca = {{ mbs_kojihub_ssl_ca }}
 {% endif %}
 
-use_fast_upload = {{ kojihub_use_fast_upload | bool }}
+use_fast_upload = {{ mbs_kojihub_use_fast_upload | bool }}

templates/mbs/mbs.conf.j2

@@ -1,4 +1,3 @@
-
 WSGIDaemonProcess mbs user=fedmsg group=fedmsg maximum-requests=1000 display-name=mbs processes={{ mbs_wsgi_procs }} threads={{ mbs_wsgi_threads }}
 WSGIApplicationGroup %{GLOBAL}
 WSGISocketPrefix run/wsgi
@@ -29,5 +28,53 @@ WSGIScriptAlias / /usr/share/mbs/mbs.wsgi
 {% endif %}
 </Location>
 
-RewriteEngine on
-RewriteRule ^(|/+)$ /module-build-service/1/module-builds/ [L,R=302]
+{% if mbs_frontend_https_enabled %}
+<VirtualHost *:80>
+   DocumentRoot /var/www/html
+   ServerName {{ mbs_frontend_host }}
+   CustomLog logs/{{ mbs_frontend_host }}_access.log combined
+   ErrorLog logs/{{ mbs_frontend_host }}_error.log
+
+   {% if (mbs_config_no_auth | bool) == True %}
+   RewriteEngine On
+   RewriteCond $1 !^.well-known
+   RewriteCond %{HTTPS} !=on
+   RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
+   {% endif %}
+</VirtualHost>
+{% endif %}
+
+{% if mbs_frontend_https_enabled %}
+<VirtualHost *:443>
+  ServerName {{ mbs_frontend_host }}
+  DocumentRoot /var/www/{{ mbs_frontend_host }}
+  ErrorLog logs/ssl-{{ mbs_frontend_host }}_error.log
+  TransferLog logs/ssl-{{ mbs_frontend_host }}_access.log
+  LogLevel warn
+
+  Header always set X-Frame-Options "SAMEORIGIN"
+  Header always set X-Xss-Protection "1; mode=block"
+  Header always set X-Content-Type-Options "nosniff"
+  Header always set Referrer-Policy "same-origin"
+  Header always set Strict-Transport-Security "max-age=31536000"
+
+  SSLEngine on
+  SSLHonorCipherOrder on
+  SSLProtocol all -SSLv2 -SSLv3
+  SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:!aNULL:!eNULL:!DES:!MD5:!PSK:!RC4
+  SSLCertificateFile /etc/pki/tls/certs/{{ mbs_frontend_host }}.crt
+  SSLCertificateKeyFile /etc/pki/tls/private/{{ mbs_frontend_host }}.key
+  SSLCertificateChainFile /etc/pki/tls/certs/{{ mbs_frontend_host }}-CAChain.crt
+  <Files ~ "\.(cgi|shtml|phtml|php3?)$">
+      SSLOptions +StdEnvVars
+  </Files>
+  <Directory "/var/www/cgi-bin">
+      SSLOptions +StdEnvVars
+  </Directory>
+  SetEnvIf User-Agent ".*MSIE.*" \
+           nokeepalive ssl-unclean-shutdown \
+           downgrade-1.0 force-response-1.0
+  CustomLog logs/ssl-{{ mbs_frontend_host }}_request.log \
+            "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
+</VirtualHost>
+{% endif %}

templates/mbs/pdc-client.json.j2

@@ -1,7 +0,0 @@
-{
-    "{{ mbs_pdc_client_name }}": {
-        "host": "{{ mbs_pdc_client_url }}",
-        "develop": {{ mbs_pdc_client_develop | bool }},
-        "insecure": {{ mbs_pdc_client_insecure | bool }}
-    }
-}

templates/mbs/ssl-mbs.conf.j2

@@ -1,31 +0,0 @@
-<VirtualHost *:443>
-DocumentRoot /var/www/{{ mbs_frontend_host }}
-ErrorLog logs/ssl-{{ mbs_frontend_host }}_error.log
-TransferLog logs/ssl-{{ mbs_frontend_host }}_access.log
-LogLevel warn
-
- Header always set X-Frame-Options "SAMEORIGIN"
- Header always set X-Xss-Protection "1; mode=block"
- Header always set X-Content-Type-Options "nosniff"
- Header always set Referrer-Policy "same-origin"
- Header always set Strict-Transport-Security "max-age=31536000"
-
-SSLEngine on
-SSLHonorCipherOrder on
-SSLProtocol all -SSLv2 -SSLv3
-SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:!aNULL:!eNULL:!DES:!MD5:!PSK:!RC4
-SSLCertificateFile /etc/pki/tls/certs/{{ mbs_frontend_host }}.crt
-SSLCertificateKeyFile /etc/pki/tls/private/{{ mbs_frontend_host }}.key
-SSLCertificateChainFile /etc/pki/tls/certs/{{ mbs_frontend_host }}-CAChain.crt
-<Files ~ "\.(cgi|shtml|phtml|php3?)$">
-    SSLOptions +StdEnvVars
-</Files>
-<Directory "/var/www/cgi-bin">
-    SSLOptions +StdEnvVars
-</Directory>
-SetEnvIf User-Agent ".*MSIE.*" \
-         nokeepalive ssl-unclean-shutdown \
-         downgrade-1.0 force-response-1.0
-CustomLog logs/ssl-{{ mbs_frontend_host }}_request.log \
-          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
-</VirtualHost>