diff --git a/README.md b/README.md index 1c11f11..5c5a8a0 100644 --- a/README.md +++ b/README.md @@ -9,11 +9,18 @@ See also [ansible-infra-playbooks](https://github.com/CentOS/ansible-infra-playb See [defaults variables and explanations](defaults/main.yml) ``` -mbs_import_default_modules: boolean flag to import modules from mbs_default_modules_dir +mbs_env: mbs environment, it will try to inherit the value from "centos_infra_env", valud choices: dev, stg and prod. +mbs_import_default_modules: boolean flag to import modules from a local dir mbs_upgrade_db: boolean flag which defines if `mbs-manager upgrade db` should run during instllation mbs_num_workers: number of mbs workers added as systemd service mbs_celery_max_worker_tasks: max of tasks that can be executed per worker mbs_default_modules_dir: local module dir to import modules from (yaml files) +# postgresql +mbs_postgres_local: boolean flag to determine if mbs role needs to install psql using centos postgresql role +mbs_postgres_hostname: postgresql hostname +mbs_postgres_username: postgresql username +mbs_postgres_password: postgresql password +mbs_postgres_database: potsgresql database # rabbitmq rabbitmq_local: boolean flag that wll install a local rabbitmq instance if set to true rabbitmq_vhost: rabbitmq vhost to use or create @@ -27,16 +34,15 @@ kojihub_kerberos_rdns: bool flag to enable/disable koji kerberos rdns #mbs config.py mbs_config_broker_url: celery broker url to use, defaults to local rabbitmq instance mbs_config_debug: bool flag that enables/disables mbs debug mode -mbs_config_env: "{{ mbs_config_type }}" # -mbs_config_secret_key: a1b2c3d4 # -mbs_config_database_url: mbs database url +mbs_config_secret_key: random string to be used by mbs frontend +mbs_config_database_url: mbs postgresql url, it is formed by psql vars: "postgresql://{{ mbs_postgres_username }}:{{ mbs_postgres_password }}@{{ mbs_postgres_hostname }}/{{ mbs_postgres_database }}" mbs_config_system: mbs build system, defaults to "koji" mbs_config_messaging: mbs messaging backend type, defaults to "fedmsg" mbs_config_messaging_topic_prefix: 'org.centos.mbs' # mbs_config_koji_file: path to the mbs koji conf file, defaulta to /etc/module-build-service/koji.conf mbs_config_koji_profile: mbs koji profile to use, defaults to "koji" mbs_config_arches: a list of supported archs by this mbs instance -mbs_config_koji_proxy_user: true # +mbs_config_koji_proxy_user: boolean flag to tell if mbs needs to proxy mbs username to koji mbs_config_koji_repository_url: koji repos url mbs_config_scm_urls: a list of allowed git urls for mbs to pull modules from mbs_config_polling_interval: mbs polling interval for mbs-poller diff --git a/defaults/main.yml b/defaults/main.yml index a62e049..60f4f2d 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,32 +1,37 @@ --- # defaults file for mbs - -# Do we want to deploy frontend, backend -mbs_frontend: False -mbs_backend: False - - +mbs_buildtools_repo_gpgkey: "{{ kojid_buildtools_repo_gpgkey | default('') }}" +mbs_env: "{{ centos_infra_env | default('prod') }}" +mbs_frontend: True +mbs_backend: True mbs_cert_prefix: mbs mbs_import_default_modules: true mbs_upgrade_db: true mbs_num_workers: 3 mbs_celery_max_worker_tasks: 10 mbs_default_modules_dir: default-modules +mbs_pki_store: "{{ pkistore | default('./') }}" +# psql +mbs_postgres_local: True +mbs_postgres_hostname: localhost +mbs_postgres_username: mbs +mbs_postgres_password: mbs +mbs_postgres_database: mbs # rabbitmq -rabbitmq_local: True -rabbitmq_vhost: mbs -rabbitmq_username: mbs -rabbitmq_password: mbs +mbs_rabbitmq_local: True +mbs_rabbitmq_vhost: mbs +mbs_rabbitmq_username: mbs +mbs_rabbitmq_password: mbs # kojihub -kojihub_top_url: https://cbs.centos.org -kojihub_use_fast_upload: true -kojihub_auth_type: kerberos -kojihub_kerberos_rdns: false +mbs_kojihub_top_url: https://cbs.centos.org +mbs_kojihub_use_fast_upload: true +mbs_kojihub_auth_type: kerberos +mbs_kojihub_kerberos_rdns: false #mbs config.py -mbs_config_broker_url: 'amqp://{{ rabbitmq_username }}@{{ rabbitmq_password }}:localhost:5627/{{ rabbitmq_vhost }}' +mbs_config_broker_url: 'amqp://{{ mbs_rabbitmq_username }}@{{ mbs_rabbitmq_password }}:localhost:5627/{{ mbs_rabbitmq_vhost }}' mbs_config_debug: false mbs_config_secret_key: a1b2c3d4 -mbs_config_database_url: postgresql://mbs:mbs@localhost/mbs +mbs_config_database_url: postgresql://{{ mbs_postgres_username }}:{{ mbs_postgres_password }}@{{ mbs_postgres_hostname }}/{{ mbs_postgres_database }} mbs_config_system: koji mbs_config_messaging: fedmsg mbs_config_messaging_topic_prefix: ['org.centos.prod'] @@ -48,7 +53,7 @@ mbs_config_log_backend: file mbs_config_log_file: /var/log/mbs/module_build_service.log mbs_config_log_level: info mbs_config_logs_build_dir: /var/tmp -mbs_config_krb_keytab: /etc/krb5.mbs_mbs{{ mbs_config_env }}.centos.org.keytab +mbs_config_krb_keytab: mbs-{{ mbs_env }}.centos.org.keytab mbs_config_krb_principal: cbs-koji@DEV.CENTOS.ORG mbs_config_allowed_groups: - packager diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml index be0c541..23ff462 100644 --- a/molecule/default/molecule.yml +++ b/molecule/default/molecule.yml @@ -26,19 +26,15 @@ provisioner: inventory: group_vars: all: - # psql vars - psql_hba_conf_file: ${MOLECULE_PROJECT_DIRECTORY}/molecule/files/pg_hba.conf # msb vars mbs_env: stg mbs_default_modules_dir: ${MOLECULE_PROJECT_DIRECTORY}/molecule/files/default-modules mbs_frontend_https_enabled: false mbs_frontend_http_enabled: true mbs_config_no_auth: true + mbs_kojihub_auth_type: 'kerberos' + mbs_pki_store: ${MOLECULE_PROJECT_DIRECTORY}/molecule/files/ # fedmsg vars - fedmsg_buildtools_repo_name: BuildTools - fedmsg_buildtools_repo_baseurl: http://buildlogs.centos.org/centos/8/infra/x86_64/buildtools-common/ - fedmsg_buildtools_repo_enabled: 1 - fedmsg_buildtools_repo_gpgcheck: 0 fedmsg_hub_bin: /usr/bin/fedmsg-hub fedmsg_env: stg fedmsg_log_level: DEBUG @@ -48,9 +44,6 @@ provisioner: fedmsg_websocket_port: 9919 fedmsg_status_directory: /var/run/fedmsg/status fedmsg_post_init_sleep: 1 - # httpd role vars - httpd_public: false - pki_hostname: localhost verifier: name: ansible scenario: diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml index d034d3a..efe5adf 100644 --- a/molecule/default/prepare.yml +++ b/molecule/default/prepare.yml @@ -3,67 +3,4 @@ hosts: all become: true become_user: root - tasks: - # prepare - - name: Ensure psql data dir exists - stat: - path: /var/lib/pgsql/data/PG_VERSION - register: output - - - name: Install postgresql - yum: - name: - - postgresql-server - - postgresql-server-devel - - postgresql - - python36 - - python36-devel - state: present - - - name: setups psql data dir - shell: postgresql-setup --initdb - when: not output.stat.exists - - - name: - pip: - name: - - psycopg2-binary - executable: /usr/bin/pip3.6 - - - name: Copy psql dev config file - copy: - src: "{{ psql_hba_conf_file }}" - dest: /var/lib/pgsql/data/pg_hba.conf - - - name: Start postgresql - service: - name: postgresql - state: started - enabled: true - - - name: Create a new database - become_method: sudo - become_user: postgres - postgresql_db: - name: mbs - encoding: 'UTF-8' - lc_collate: 'en_US.UTF-8' - lc_ctype: 'en_US.UTF-8' - state: present - - - name: Postgres reset database user - become_method: sudo - become_user: postgres - postgresql_user: - db: mbs - name: mbs - password: mbs - priv: ALL - state: present - - - name: Set db owner - become_method: sudo - become_user: postgres - postgresql_owner: - db: mbs - new_owner: mbs + tasks: [] \ No newline at end of file diff --git a/molecule/default/requirements.yml b/molecule/default/requirements.yml index 6aa87f5..ac556bf 100644 --- a/molecule/default/requirements.yml +++ b/molecule/default/requirements.yml @@ -1,7 +1,15 @@ - src: https://github.com/CentOS/ansible-role-httpd name: httpd + +- src: https://github.com/CentOS/ansible-role-fedmsg + name: fedmsg version: staging -- src: https://github.com/odra/ansible-role-fedmsg - name: fedmsg - version: infra-fixes \ No newline at end of file +- src: https://github.com/CentOS/ansible-role-postgresql + name: postgresql + +- src: https://github.com/CentOS/ansible-role-centos-backup + name: centos-backup + +- src: https://github.com/CentOS/ansible-role-iptables + name: iptables diff --git a/molecule/files/krb5/localhost.keytab b/molecule/files/krb5/localhost.keytab new file mode 100644 index 0000000..3ee4afb --- /dev/null +++ b/molecule/files/krb5/localhost.keytab @@ -0,0 +1 @@ +keepme \ No newline at end of file diff --git a/molecule/files/krb5/mbs-stg.centos.org.keytab b/molecule/files/krb5/mbs-stg.centos.org.keytab new file mode 100644 index 0000000..3ee4afb --- /dev/null +++ b/molecule/files/krb5/mbs-stg.centos.org.keytab @@ -0,0 +1 @@ +keepme \ No newline at end of file diff --git a/molecule/files/pg_hba.conf b/molecule/files/pg_hba.conf deleted file mode 100644 index 1ac8c01..0000000 --- a/molecule/files/pg_hba.conf +++ /dev/null @@ -1,13 +0,0 @@ -# TYPE DATABASE USER ADDRESS METHOD - -# "local" is for Unix domain socket connections only -local all all trust -# IPv4 local connections: -host all all 127.0.0.1/32 trust -# IPv6 local connections: -host all all ::1/128 trust -# Allow replication connections from localhost, by a user with the -# replication privilege. -local replication all peer -host replication all 127.0.0.1/32 ident -host replication all ::1/128 ident \ No newline at end of file diff --git a/requirements.yml b/requirements.yml deleted file mode 100644 index b2b9a6a..0000000 --- a/requirements.yml +++ /dev/null @@ -1,5 +0,0 @@ -- src: https://github.com/CentOS/ansible-role-httpd - name: httpd - -- src: https://github.com/CentOS/ansible-role-fedmsg - name: fedmsg diff --git a/tasks/main.yml b/tasks/main.yml index 0687f5e..bc85e7a 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -3,10 +3,10 @@ - include_tasks: system.yml # rabbitmq - include_tasks: rabbitmq.yml - when: rabbitmq_local + when: mbs_rabbitmq_local | bool # msb-backend setup - include_tasks: mbs-backend.yml - when: mbs_backend + when: mbs_backend | bool # msb-frontend setup - include_tasks: mbs-frontend.yml - when: mbs_frontend + when: mbs_frontend | bool diff --git a/tasks/mbs-backend.yml b/tasks/mbs-backend.yml index f53ca2c..0baa20b 100644 --- a/tasks/mbs-backend.yml +++ b/tasks/mbs-backend.yml @@ -18,6 +18,7 @@ file: path: /etc/fedmsg.d/{{ item }} state: absent + changed_when: true with_items: - module_build_service.py - mbs-logging.py @@ -150,3 +151,13 @@ - shell: /usr/bin/mbs-manager import_module {{ item }} with_items: "{{ default_modules.files }}" when: mbs_import_default_modules + + +- name: Copy mbs-backend koji keytab + copy: + src: "{{ mbs_pki_store }}/krb5/{{ mbs_config_krb_keytab }}" + dest: /etc/module-build-service/{{ mbs_config_krb_keytab }} + owner: fedmsg + group: fedmsg + mode: '0644' + when: mbs_kojihub_auth_type == 'kerberos' diff --git a/tasks/mbs-frontend.yml b/tasks/mbs-frontend.yml index 8018265..da7a708 100644 --- a/tasks/mbs-frontend.yml +++ b/tasks/mbs-frontend.yml @@ -1,5 +1,4 @@ --- - - name: Configuring httpd include_role: name: httpd @@ -7,13 +6,15 @@ - include_role: name: httpd vars: - - httpd_tls: True + - httpd_tls: "{{ mbs_frontend_https_enabled | bool }}" - include_role: name: httpd tasks_from: pki-tls vars: pki_hostname: "{{ mbs_frontend_host }}" + pkistore: "{{ mbs_pki_store }}" + when: mbs_frontend_https_enabled | bool - name: Install mbs-frontend packages yum: @@ -22,27 +23,25 @@ - module-build-service - mod_auth_gssapi state: installed - notify: restart_httpd + notify: + - Restart apache - name: Copy mbs httpd config template: - src: "mbs/{{ item }}.j2" - dest: "/etc/httpd/conf.d/{{ item }}" + src: "mbs/mbs.conf.j2" + dest: "/etc/httpd/conf.d/mbs.conf" owner: apache group: apache mode: 0644 - with_items: - - mbs.conf - - 02_mbs.conf - - ssl-mbs.conf notify: - Restart apache - name: Ensure we have proper httpd keytab copy: - src: "{{ pkistore }}/krb5/{{ mbs_frontend_krb_keytab }}" + src: "{{ mbs_pki_store }}/krb5/{{ mbs_frontend_krb_keytab }}" dest: "/etc/httpd/conf.d/{{ mbs_frontend_krb_keytab }}" owner: apache + when: (mbs_config_no_auth | bool) == False - name: Ensure /usr/share/mbs folder exists file: @@ -67,4 +66,3 @@ - httpd_can_network_memcache - httpd_can_network_connect - httpd_can_sendmail - diff --git a/tasks/rabbitmq.yml b/tasks/rabbitmq.yml index 23711bc..aba6565 100644 --- a/tasks/rabbitmq.yml +++ b/tasks/rabbitmq.yml @@ -25,14 +25,14 @@ - name: Ensure vhost exists rabbitmq_vhost: - name: "{{ rabbitmq_vhost }}" + name: "{{ mbs_rabbitmq_vhost }}" state: present - name: Ensure user exists and has access to vhost rabbitmq_user: - user: "{{ rabbitmq_username }}" - password: "{{ rabbitmq_password }}" - vhost: "{{ rabbitmq_vhost }}" + user: "{{ mbs_rabbitmq_username }}" + password: "{{ mbs_rabbitmq_password }}" + vhost: "{{ mbs_rabbitmq_vhost }}" configure_priv: .* read_priv: .* write_priv: .* diff --git a/tasks/system.yml b/tasks/system.yml index 6de2ff6..f780bdc 100644 --- a/tasks/system.yml +++ b/tasks/system.yml @@ -4,6 +4,21 @@ include_role: name: fedmsg +- name: Install postgresql if needed + include_role: + name: postgresql + vars: + pgsql_tls: false + pgsql_users: + - name: "{{ mbs_postgres_username }}" + password: "{{ mbs_postgres_password }}" + role_attr: "NOCREATEDB,NOSUPERUSER,NOCREATEROLE" + db: "{{ mbs_postgres_database }}" + pgsql_databases: + - name: "{{ mbs_postgres_database }}" + owner: "{{ mbs_postgres_username }}" + when: mbs_postgres_local | bool + - name: Add the buildtools repo if needed template: src: buildtools.repo.j2 diff --git a/templates/buildtools.repo.j2 b/templates/buildtools.repo.j2 index 932d6ed..08e1fa7 100644 --- a/templates/buildtools.repo.j2 +++ b/templates/buildtools.repo.j2 @@ -4,14 +4,14 @@ {% set contentdir = 'centos' %} {% endif %} -{% if centos_infra_env == 'prod' %} +{% if mbs_env == 'prod' %} [centos-buildtools-common] name=CentOS koji buildtools repository baseurl=http://mirror.centos.org/{{ contentdir }}/$releasever/infra/$basearch/buildtools-common/ enabled=1 gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/{{ kojid_buildtools_repo_gpgkey }} -{% elif centos_infra_env == 'stg' %} +gpgkey=file:///etc/pki/rpm-gpg/{{ mbs_buildtools_repo_gpgkey }} +{% elif mbs_env == 'stg' %} [centos-buildtools-common] name=CentOS STG koji buildtools repository baseurl=http://buildlogs.centos.org/centos/$releasever/infra/$basearch/buildtools-common/ @@ -23,5 +23,4 @@ name=CentOS dev koji buildtools repository baseurl=http://repo.dev.centos.org/$releasever/infra/buildtools-common/$basearch/ enabled=1 gpgcheck=0 -{% endif %} - +{% endif %} \ No newline at end of file diff --git a/templates/mbs/02_mbs.conf.j2 b/templates/mbs/02_mbs.conf.j2 deleted file mode 100644 index ac73ae2..0000000 --- a/templates/mbs/02_mbs.conf.j2 +++ /dev/null @@ -1,14 +0,0 @@ - - - DocumentRoot /var/www/html - ServerName {{ mbs_frontend_host }} - CustomLog logs/{{ mbs_frontend_host }}_access.log combined - ErrorLog logs/{{ mbs_frontend_host }}_error.log - - RewriteEngine On - RewriteCond $1 !^.well-known - RewriteCond %{HTTPS} !=on - RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] - - - diff --git a/templates/mbs/client_secrets.json.j2 b/templates/mbs/client_secrets.json.j2 deleted file mode 100644 index 334df27..0000000 --- a/templates/mbs/client_secrets.json.j2 +++ /dev/null @@ -1,11 +0,0 @@ -{ - "web": { - "auth_uri": "{{ mbs_oidc_uri }}", - "client_id": "{{ mbs_oidc_client_id }}", - "client_secret": "{{ mbs_oidc_client_secret }}", - "redirect_uris": {{ mbs_oidc_redirect_uris }}, - "token_uri": "{{ mbs_oidc_token_uri }}", - "token_introspection_uri": "{{ mbs_oidc_token_introspection_uri }}", - "userinfo_uri": "{{ mbs_oidc_userinfo_uri }}" - } -} diff --git a/templates/mbs/koji.conf.j2 b/templates/mbs/koji.conf.j2 index b5c8a47..f23154b 100644 --- a/templates/mbs/koji.conf.j2 +++ b/templates/mbs/koji.conf.j2 @@ -1,19 +1,19 @@ [koji] -server = {{ kojihub_top_url }}/kojihub -weburl = {{ kojihub_top_url }}/koji -topurl = {{ kojihub_top_url }} +server = {{ mbs_kojihub_top_url }}/kojihub +weburl = {{ mbs_kojihub_top_url }}/koji +topurl = {{ mbs_kojihub_top_url }} -authtype = {{ kojihub_auth_type }} -{% if kojihub_auth_type == 'kerberos' %} -krb_rdns = {{ kojihub_kerberos_rdns | bool }} +authtype = {{ mbs_kojihub_auth_type }} +{% if mbs_kojihub_auth_type == 'kerberos' %} +krb_rdns = {{ mbs_kojihub_kerberos_rdns | bool }} ;the principal to auth as for automated clients principal = {{ mbs_config_krb_principal }} ;the keytab to auth as for automated clients -keytab = {{ mbs_config_krb_keytab }} +keytab = /etc/module-build-service/{{ mbs_config_krb_keytab }} {% endif %} -{% if kojihub_auth_type == 'ssl' %} -cert = {{ kojihub_ssl_cert }} -serverca = {{ kojihub_ssl_ca }} +{% if mbs_kojihub_auth_type == 'ssl' %} +cert = {{ mbs_kojihub_ssl_cert }} +serverca = {{ mbs_kojihub_ssl_ca }} {% endif %} -use_fast_upload = {{ kojihub_use_fast_upload | bool }} \ No newline at end of file +use_fast_upload = {{ mbs_kojihub_use_fast_upload | bool }} \ No newline at end of file diff --git a/templates/mbs/mbs.conf.j2 b/templates/mbs/mbs.conf.j2 index be3a0b8..96c0766 100644 --- a/templates/mbs/mbs.conf.j2 +++ b/templates/mbs/mbs.conf.j2 @@ -1,4 +1,3 @@ - WSGIDaemonProcess mbs user=fedmsg group=fedmsg maximum-requests=1000 display-name=mbs processes={{ mbs_wsgi_procs }} threads={{ mbs_wsgi_threads }} WSGIApplicationGroup %{GLOBAL} WSGISocketPrefix run/wsgi @@ -29,5 +28,53 @@ WSGIScriptAlias / /usr/share/mbs/mbs.wsgi {% endif %} -RewriteEngine on -RewriteRule ^(|/+)$ /module-build-service/1/module-builds/ [L,R=302] +{% if mbs_frontend_https_enabled %} + + DocumentRoot /var/www/html + ServerName {{ mbs_frontend_host }} + CustomLog logs/{{ mbs_frontend_host }}_access.log combined + ErrorLog logs/{{ mbs_frontend_host }}_error.log + + {% if (mbs_config_no_auth | bool) == True %} + RewriteEngine On + RewriteCond $1 !^.well-known + RewriteCond %{HTTPS} !=on + RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] + {% endif %} + +{% endif %} + +{% if mbs_frontend_https_enabled %} + + ServerName {{ mbs_frontend_host }} + DocumentRoot /var/www/{{ mbs_frontend_host }} + ErrorLog logs/ssl-{{ mbs_frontend_host }}_error.log + TransferLog logs/ssl-{{ mbs_frontend_host }}_access.log + LogLevel warn + + Header always set X-Frame-Options "SAMEORIGIN" + Header always set X-Xss-Protection "1; mode=block" + Header always set X-Content-Type-Options "nosniff" + Header always set Referrer-Policy "same-origin" + Header always set Strict-Transport-Security "max-age=31536000" + + SSLEngine on + SSLHonorCipherOrder on + SSLProtocol all -SSLv2 -SSLv3 + SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:!aNULL:!eNULL:!DES:!MD5:!PSK:!RC4 + SSLCertificateFile /etc/pki/tls/certs/{{ mbs_frontend_host }}.crt + SSLCertificateKeyFile /etc/pki/tls/private/{{ mbs_frontend_host }}.key + SSLCertificateChainFile /etc/pki/tls/certs/{{ mbs_frontend_host }}-CAChain.crt + + SSLOptions +StdEnvVars + + + SSLOptions +StdEnvVars + + SetEnvIf User-Agent ".*MSIE.*" \ + nokeepalive ssl-unclean-shutdown \ + downgrade-1.0 force-response-1.0 + CustomLog logs/ssl-{{ mbs_frontend_host }}_request.log \ + "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" + +{% endif %} \ No newline at end of file diff --git a/templates/mbs/pdc-client.json.j2 b/templates/mbs/pdc-client.json.j2 deleted file mode 100644 index d96155c..0000000 --- a/templates/mbs/pdc-client.json.j2 +++ /dev/null @@ -1,7 +0,0 @@ -{ - "{{ mbs_pdc_client_name }}": { - "host": "{{ mbs_pdc_client_url }}", - "develop": {{ mbs_pdc_client_develop | bool }}, - "insecure": {{ mbs_pdc_client_insecure | bool }} - } -} \ No newline at end of file diff --git a/templates/mbs/ssl-mbs.conf.j2 b/templates/mbs/ssl-mbs.conf.j2 deleted file mode 100644 index 4dd377b..0000000 --- a/templates/mbs/ssl-mbs.conf.j2 +++ /dev/null @@ -1,31 +0,0 @@ - -DocumentRoot /var/www/{{ mbs_frontend_host }} -ErrorLog logs/ssl-{{ mbs_frontend_host }}_error.log -TransferLog logs/ssl-{{ mbs_frontend_host }}_access.log -LogLevel warn - - Header always set X-Frame-Options "SAMEORIGIN" - Header always set X-Xss-Protection "1; mode=block" - Header always set X-Content-Type-Options "nosniff" - Header always set Referrer-Policy "same-origin" - Header always set Strict-Transport-Security "max-age=31536000" - -SSLEngine on -SSLHonorCipherOrder on -SSLProtocol all -SSLv2 -SSLv3 -SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:!aNULL:!eNULL:!DES:!MD5:!PSK:!RC4 -SSLCertificateFile /etc/pki/tls/certs/{{ mbs_frontend_host }}.crt -SSLCertificateKeyFile /etc/pki/tls/private/{{ mbs_frontend_host }}.key -SSLCertificateChainFile /etc/pki/tls/certs/{{ mbs_frontend_host }}-CAChain.crt - - SSLOptions +StdEnvVars - - - SSLOptions +StdEnvVars - -SetEnvIf User-Agent ".*MSIE.*" \ - nokeepalive ssl-unclean-shutdown \ - downgrade-1.0 force-response-1.0 -CustomLog logs/ssl-{{ mbs_frontend_host }}_request.log \ - "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" -