nginx authproxy module

modules/nginxproxy/manifests/authproxy.pp

@@ -0,0 +1,15 @@
+class nginxproxy::authproxy {
+  file { $nginxproxy::auth_ldap_config:
+    ensure  => file,
+    content => epp('nginxproxy/auth-ldap.py.epp', {
+        'params' => $nginxproxy::auth_ldap_params
+      }
+    ),
+    mode    => '0644',
+  }
+
+  #package { 'nginx-auth-ldap':
+  #  ensure   => 'present',
+  #  provider => 'pip',
+  #}
+}

modules/nginxproxy/manifests/config.pp

@@ -0,0 +1,67 @@
+# manage configuration for nginxproxy
+class nginxproxy::config {
+  $proxyurl = "${nginxproxy::proxy_scheme}://${nginxproxy::proxy_host}:${nginxproxy::proxy_port}${nginxproxy::proxy_path}"
+  $server_names = unique([$facts['networking']['fqdn'], $nginxproxy::nginx_vhost] + $nginxproxy::nginx_aliases)
+
+  case $nginxproxy::nginx_cert_type {
+    'vault': {
+      $selected_ssl_cert = '/etc/pki/tls/vault/certificate.crt'
+      $selected_ssl_key  = '/etc/pki/tls/vault/private.key'
+    }
+    default: {
+      $selected_ssl_cert = "/etc/pki/tls/puppet/${facts['networking']['fqdn']}.crt"
+      $selected_ssl_key  = "/etc/pki/tls/puppet/${facts['networking']['fqdn']}.key"
+    }
+  }
+
+  case $nginxproxy::nginx_listen_mode {
+    'http': {
+      $enable_ssl = false
+      $ssl_cert = undef
+      $ssl_key = undef
+      $listen_port = $nginxproxy::nginx_port
+      $listen_ssl_port = undef
+      $extras_hash = {}
+    }
+    'https': {
+      $enable_ssl = true
+      $ssl_cert = $selected_ssl_cert
+      $ssl_key = $selected_ssl_key
+      $listen_port = $nginxproxy::nginx_ssl_port
+      $listen_ssl_port = $nginxproxy::nginx_ssl_port
+      $extras_hash = {
+        'subscribe' => [File[$ssl_cert], File[$ssl_key]],
+      }
+    }
+    default: {
+      $enable_ssl = true
+      $ssl_cert = $selected_ssl_cert
+      $ssl_key = $selected_ssl_key
+      $listen_port = $nginxproxy::nginx_port
+      $listen_ssl_port = $nginxproxy::nginx_ssl_port
+      $extras_hash = {
+        'subscribe' => [File[$ssl_cert], File[$ssl_key]],
+      }
+    }
+  }
+
+  $defaults = {
+    'listen_port'          => $listen_port,
+    'server_name'          => $server_names,
+    'use_default_location' => true,
+    'access_log'           => "/var/log/nginx/${nginxproxy::nginx_vhost}_access.log",
+    'error_log'            => "/var/log/nginx/${nginxproxy::nginx_vhost}_error.log",
+    'autoindex'            => 'on',
+    'ssl'                  => $enable_ssl,
+    'ssl_cert'             => $ssl_cert,
+    'ssl_key'              => $ssl_key,
+    'ssl_port'             => $listen_ssl_port,
+    'proxy'                => $proxyurl,
+  }
+
+  $nginx_parameters = merge($defaults, $extras_hash)
+
+  include 'nginx'
+
+  create_resources('nginx::resource::server', { $nginxproxy::nginx_vhost => $nginx_parameters })
+}

modules/nginxproxy/manifests/init.pp

@@ -0,0 +1,38 @@
+# manage a nginx proxy with a wraoper module
+class nginxproxy (
+  Stdlib::Fqdn          $nginx_vhost = $nginxproxy::params::nginx_vhost,
+  Array[Stdlib::Host]   $nginx_aliases = $nginxproxy::params::nginx_aliases,
+  Stdlib::Port          $nginx_port = $nginxproxy::params::nginx_port,
+  Stdlib::Port          $nginx_ssl_port = $nginxproxy::params::nginx_ssl_port,
+  Enum['http','https','both'] $nginx_listen_mode = $nginxproxy::params::nginx_listen_mode,
+  Enum['puppet', 'vault'] $nginx_cert_type = $nginxproxy::params::nginx_cert_type,
+  Enum['http','https']  $proxy_scheme = $nginxproxy::params::proxy_scheme,
+  Stdlib::Port          $proxy_port = $nginxproxy::params::proxy_port,
+  Stdlib::Host          $proxy_host = $nginxproxy::params::proxy_host,
+  String                $proxy_path = $nginxproxy::params::proxy_path,
+  Boolean               $simple_mode = $nginxproxy::params::simple_mode,
+  Array[Hash]           $locations = $nginxproxy::params::locations,
+  Boolean               $manage_auth_ldap = $nginxproxy::params::manage_auth_ldap,
+  Stdlib::Absolutepath  $auth_ldap_config = $nginxproxy::params::auth_ldap_config,
+  Hash                  $auth_ldap_params = $nginxproxy::params::auth_ldap_params,
+) {
+
+  if ! $facts['nginx_version'] {
+    package { 'nginx':
+      ensure => 'present',
+    }
+  } else {
+    include nginxproxy::config
+    include nginxproxy::selinux
+
+    if $manage_auth_ldap {
+      include nginxproxy::authproxy
+    }
+
+    if ! $simple_mode {
+      nginxproxy::locations { 'default':
+        locations => $locations,
+      }
+    }
+  }
+}

modules/nginxproxy/manifests/locations.pp

@@ -0,0 +1,10 @@
+define nginxproxy::locations (
+  Array[Hash] $locations = [],
+) {
+  $locations.each |$location| {
+    nginx::resource::location { $location['path']:
+      server => $nginxproxy::nginx_vhost,
+      proxy  => $location['proxy'],
+    }
+  }
+}

modules/nginxproxy/manifests/params.pp

@@ -0,0 +1,18 @@
+# nginxproxy params
+class nginxproxy::params (
+  Stdlib::Fqdn          $nginx_vhost = 'localhost',
+  Array[Stdlib::Host]   $nginx_aliases = [],
+  Stdlib::Port          $nginx_port = 80,
+  Stdlib::Port          $nginx_ssl_port = 443,
+  Enum['http','https','both'] $nginx_listen_mode = 'https',
+  Enum['puppet', 'vault'] $nginx_cert_type = 'vault',
+  Enum['http','https']  $proxy_scheme = 'http',
+  Stdlib::Port          $proxy_port = 80,
+  Stdlib::Host          $proxy_host = $facts['networking']['ip'],
+  String                $proxy_path = '/',
+  Boolean               $simple_mode = true,
+  Array[Hash]           $locations = [],
+  Boolean               $manage_auth_ldap = false,
+  Stdlib::Absolutepath  $auth_ldap_config = '/etc/nginx/auth-ldap.conf',
+  Hash                  $auth_ldap_params = {},
+){}

modules/nginxproxy/manifests/selinux.pp

@@ -0,0 +1,9 @@
+# manage selinux for nginxproxy
+class nginxproxy::selinux {
+  if $::facts['os']['selinux']['config_mode'] == 'enforcing' {
+    selboolean { 'httpd_can_network_connect':
+      persistent => true,
+      value      => 'on',
+    }
+  }
+}