|
1 # Class: apache |
|
2 # |
|
3 # This class installs Apache |
|
4 # |
|
5 # Parameters: |
|
6 # |
|
7 # Actions: |
|
8 # - Install Apache |
|
9 # - Manage Apache service |
|
10 # |
|
11 # Requires: |
|
12 # |
|
13 # Sample Usage: |
|
14 # |
|
15 class apache ( |
|
16 $apache_name = $::apache::params::apache_name, |
|
17 $service_name = $::apache::params::service_name, |
|
18 $default_mods = true, |
|
19 $default_vhost = true, |
|
20 $default_charset = undef, |
|
21 $default_confd_files = true, |
|
22 $default_ssl_vhost = false, |
|
23 $default_ssl_cert = $::apache::params::default_ssl_cert, |
|
24 $default_ssl_key = $::apache::params::default_ssl_key, |
|
25 $default_ssl_chain = undef, |
|
26 $default_ssl_ca = undef, |
|
27 $default_ssl_crl_path = undef, |
|
28 $default_ssl_crl = undef, |
|
29 $default_ssl_crl_check = undef, |
|
30 $default_type = 'none', |
|
31 $dev_packages = $::apache::params::dev_packages, |
|
32 $ip = undef, |
|
33 $service_enable = true, |
|
34 $service_manage = true, |
|
35 $service_ensure = 'running', |
|
36 $service_restart = undef, |
|
37 $purge_configs = true, |
|
38 $purge_vhost_dir = undef, |
|
39 $purge_vdir = false, |
|
40 $serveradmin = 'root@localhost', |
|
41 $sendfile = 'On', |
|
42 $error_documents = false, |
|
43 $timeout = '120', |
|
44 $httpd_dir = $::apache::params::httpd_dir, |
|
45 $server_root = $::apache::params::server_root, |
|
46 $conf_dir = $::apache::params::conf_dir, |
|
47 $confd_dir = $::apache::params::confd_dir, |
|
48 $vhost_dir = $::apache::params::vhost_dir, |
|
49 $vhost_enable_dir = $::apache::params::vhost_enable_dir, |
|
50 $vhost_include_pattern = $::apache::params::vhost_include_pattern, |
|
51 $mod_dir = $::apache::params::mod_dir, |
|
52 $mod_enable_dir = $::apache::params::mod_enable_dir, |
|
53 $mpm_module = $::apache::params::mpm_module, |
|
54 $lib_path = $::apache::params::lib_path, |
|
55 $conf_template = $::apache::params::conf_template, |
|
56 $servername = $::apache::params::servername, |
|
57 $pidfile = $::apache::params::pidfile, |
|
58 $rewrite_lock = undef, |
|
59 $manage_user = true, |
|
60 $manage_group = true, |
|
61 $user = $::apache::params::user, |
|
62 $group = $::apache::params::group, |
|
63 $keepalive = $::apache::params::keepalive, |
|
64 $keepalive_timeout = $::apache::params::keepalive_timeout, |
|
65 $max_keepalive_requests = $::apache::params::max_keepalive_requests, |
|
66 $logroot = $::apache::params::logroot, |
|
67 $logroot_mode = $::apache::params::logroot_mode, |
|
68 $log_level = $::apache::params::log_level, |
|
69 $log_formats = {}, |
|
70 $ports_file = $::apache::params::ports_file, |
|
71 $docroot = $::apache::params::docroot, |
|
72 $apache_version = $::apache::version::default, |
|
73 $server_tokens = 'OS', |
|
74 $server_signature = 'On', |
|
75 $trace_enable = 'On', |
|
76 $allow_encoded_slashes = undef, |
|
77 $package_ensure = 'installed', |
|
78 $use_optional_includes = $::apache::params::use_optional_includes, |
|
79 $use_systemd = $::apache::params::use_systemd, |
|
80 ) inherits ::apache::params { |
|
81 validate_bool($default_vhost) |
|
82 validate_bool($default_ssl_vhost) |
|
83 validate_bool($default_confd_files) |
|
84 # true/false is sufficient for both ensure and enable |
|
85 validate_bool($service_enable) |
|
86 validate_bool($service_manage) |
|
87 validate_bool($use_optional_includes) |
|
88 |
|
89 $valid_mpms_re = $apache_version ? { |
|
90 '2.4' => '(event|itk|peruser|prefork|worker)', |
|
91 default => '(event|itk|prefork|worker)' |
|
92 } |
|
93 |
|
94 if $mpm_module { |
|
95 validate_re($mpm_module, $valid_mpms_re) |
|
96 } |
|
97 |
|
98 if $allow_encoded_slashes { |
|
99 validate_re($allow_encoded_slashes, '(^on$|^off$|^nodecode$)', "${allow_encoded_slashes} is not permitted for allow_encoded_slashes. Allowed values are 'on', 'off' or 'nodecode'.") |
|
100 } |
|
101 |
|
102 # NOTE: on FreeBSD it's mpm module's responsibility to install httpd package. |
|
103 # NOTE: the same strategy may be introduced for other OSes. For this, you |
|
104 # should delete the 'if' block below and modify all MPM modules' manifests |
|
105 # such that they include apache::package class (currently event.pp, itk.pp, |
|
106 # peruser.pp, prefork.pp, worker.pp). |
|
107 if $::osfamily != 'FreeBSD' { |
|
108 package { 'httpd': |
|
109 ensure => $package_ensure, |
|
110 name => $apache_name, |
|
111 notify => Class['Apache::Service'], |
|
112 } |
|
113 } |
|
114 validate_re($sendfile, [ '^[oO]n$' , '^[oO]ff$' ]) |
|
115 |
|
116 # declare the web server user and group |
|
117 # Note: requiring the package means the package ought to create them and not puppet |
|
118 validate_bool($manage_user) |
|
119 if $manage_user { |
|
120 user { $user: |
|
121 ensure => present, |
|
122 gid => $group, |
|
123 require => Package['httpd'], |
|
124 } |
|
125 } |
|
126 validate_bool($manage_group) |
|
127 if $manage_group { |
|
128 group { $group: |
|
129 ensure => present, |
|
130 require => Package['httpd'] |
|
131 } |
|
132 } |
|
133 |
|
134 validate_apache_log_level($log_level) |
|
135 |
|
136 class { '::apache::service': |
|
137 service_name => $service_name, |
|
138 service_enable => $service_enable, |
|
139 service_manage => $service_manage, |
|
140 service_ensure => $service_ensure, |
|
141 service_restart => $service_restart, |
|
142 } |
|
143 |
|
144 # Deprecated backwards-compatibility |
|
145 if $purge_vdir { |
|
146 warning('Class[\'apache\'] parameter purge_vdir is deprecated in favor of purge_configs') |
|
147 $purge_confd = $purge_vdir |
|
148 } else { |
|
149 $purge_confd = $purge_configs |
|
150 } |
|
151 |
|
152 # Set purge vhostd appropriately |
|
153 if $purge_vhost_dir == undef { |
|
154 $purge_vhostd = $purge_confd |
|
155 } else { |
|
156 $purge_vhostd = $purge_vhost_dir |
|
157 } |
|
158 |
|
159 Exec { |
|
160 path => '/bin:/sbin:/usr/bin:/usr/sbin', |
|
161 } |
|
162 |
|
163 exec { "mkdir ${confd_dir}": |
|
164 creates => $confd_dir, |
|
165 require => Package['httpd'], |
|
166 } |
|
167 file { $confd_dir: |
|
168 ensure => directory, |
|
169 recurse => true, |
|
170 purge => $purge_confd, |
|
171 notify => Class['Apache::Service'], |
|
172 require => Package['httpd'], |
|
173 } |
|
174 |
|
175 if ! defined(File[$mod_dir]) { |
|
176 exec { "mkdir ${mod_dir}": |
|
177 creates => $mod_dir, |
|
178 require => Package['httpd'], |
|
179 } |
|
180 # Don't purge available modules if an enable dir is used |
|
181 $purge_mod_dir = $purge_configs and !$mod_enable_dir |
|
182 file { $mod_dir: |
|
183 ensure => directory, |
|
184 recurse => true, |
|
185 purge => $purge_mod_dir, |
|
186 notify => Class['Apache::Service'], |
|
187 require => Package['httpd'], |
|
188 } |
|
189 } |
|
190 |
|
191 if $mod_enable_dir and ! defined(File[$mod_enable_dir]) { |
|
192 $mod_load_dir = $mod_enable_dir |
|
193 exec { "mkdir ${mod_enable_dir}": |
|
194 creates => $mod_enable_dir, |
|
195 require => Package['httpd'], |
|
196 } |
|
197 file { $mod_enable_dir: |
|
198 ensure => directory, |
|
199 recurse => true, |
|
200 purge => $purge_configs, |
|
201 notify => Class['Apache::Service'], |
|
202 require => Package['httpd'], |
|
203 } |
|
204 } else { |
|
205 $mod_load_dir = $mod_dir |
|
206 } |
|
207 |
|
208 if ! defined(File[$vhost_dir]) { |
|
209 exec { "mkdir ${vhost_dir}": |
|
210 creates => $vhost_dir, |
|
211 require => Package['httpd'], |
|
212 } |
|
213 file { $vhost_dir: |
|
214 ensure => directory, |
|
215 recurse => true, |
|
216 purge => $purge_vhostd, |
|
217 notify => Class['Apache::Service'], |
|
218 require => Package['httpd'], |
|
219 } |
|
220 } |
|
221 |
|
222 if $vhost_enable_dir and ! defined(File[$vhost_enable_dir]) { |
|
223 $vhost_load_dir = $vhost_enable_dir |
|
224 exec { "mkdir ${vhost_load_dir}": |
|
225 creates => $vhost_load_dir, |
|
226 require => Package['httpd'], |
|
227 } |
|
228 file { $vhost_enable_dir: |
|
229 ensure => directory, |
|
230 recurse => true, |
|
231 purge => $purge_vhostd, |
|
232 notify => Class['Apache::Service'], |
|
233 require => Package['httpd'], |
|
234 } |
|
235 } else { |
|
236 $vhost_load_dir = $vhost_dir |
|
237 } |
|
238 |
|
239 concat { $ports_file: |
|
240 owner => 'root', |
|
241 group => $::apache::params::root_group, |
|
242 mode => '0644', |
|
243 notify => Class['Apache::Service'], |
|
244 require => Package['httpd'], |
|
245 } |
|
246 concat::fragment { 'Apache ports header': |
|
247 ensure => present, |
|
248 target => $ports_file, |
|
249 content => template('apache/ports_header.erb') |
|
250 } |
|
251 |
|
252 if $::apache::conf_dir and $::apache::params::conf_file { |
|
253 case $::osfamily { |
|
254 'debian': { |
|
255 $error_log = 'error.log' |
|
256 $scriptalias = '/usr/lib/cgi-bin' |
|
257 $access_log_file = 'access.log' |
|
258 } |
|
259 'redhat': { |
|
260 $error_log = 'error_log' |
|
261 $scriptalias = '/var/www/cgi-bin' |
|
262 $access_log_file = 'access_log' |
|
263 } |
|
264 'freebsd': { |
|
265 $error_log = 'httpd-error.log' |
|
266 $scriptalias = '/usr/local/www/apache24/cgi-bin' |
|
267 $access_log_file = 'httpd-access.log' |
|
268 } 'gentoo': { |
|
269 $error_log = 'error.log' |
|
270 $error_documents_path = '/usr/share/apache2/error' |
|
271 $scriptalias = '/var/www/localhost/cgi-bin' |
|
272 $access_log_file = 'access.log' |
|
273 |
|
274 ::portage::makeconf { 'apache2_modules': |
|
275 content => $default_mods, |
|
276 } |
|
277 file { [ |
|
278 '/etc/apache2/modules.d/.keep_www-servers_apache-2', |
|
279 '/etc/apache2/vhosts.d/.keep_www-servers_apache-2' |
|
280 ]: |
|
281 ensure => absent, |
|
282 require => Package['httpd'], |
|
283 } |
|
284 } |
|
285 'Suse': { |
|
286 $error_log = 'error.log' |
|
287 $scriptalias = '/usr/lib/cgi-bin' |
|
288 $access_log_file = 'access.log' |
|
289 } |
|
290 default: { |
|
291 fail("Unsupported osfamily ${::osfamily}") |
|
292 } |
|
293 } |
|
294 |
|
295 $apxs_workaround = $::osfamily ? { |
|
296 'freebsd' => true, |
|
297 default => false |
|
298 } |
|
299 |
|
300 if $rewrite_lock { |
|
301 validate_absolute_path($rewrite_lock) |
|
302 } |
|
303 |
|
304 # Template uses: |
|
305 # - $pidfile |
|
306 # - $user |
|
307 # - $group |
|
308 # - $logroot |
|
309 # - $error_log |
|
310 # - $sendfile |
|
311 # - $mod_dir |
|
312 # - $ports_file |
|
313 # - $confd_dir |
|
314 # - $vhost_dir |
|
315 # - $error_documents |
|
316 # - $error_documents_path |
|
317 # - $apxs_workaround |
|
318 # - $keepalive |
|
319 # - $keepalive_timeout |
|
320 # - $max_keepalive_requests |
|
321 # - $server_root |
|
322 # - $server_tokens |
|
323 # - $server_signature |
|
324 # - $trace_enable |
|
325 # - $rewrite_lock |
|
326 file { "${::apache::conf_dir}/${::apache::params::conf_file}": |
|
327 ensure => file, |
|
328 content => template($conf_template), |
|
329 notify => Class['Apache::Service'], |
|
330 require => [Package['httpd'], File[$ports_file]], |
|
331 } |
|
332 |
|
333 # preserve back-wards compatibility to the times when default_mods was |
|
334 # only a boolean value. Now it can be an array (too) |
|
335 if is_array($default_mods) { |
|
336 class { '::apache::default_mods': |
|
337 all => false, |
|
338 mods => $default_mods, |
|
339 } |
|
340 } else { |
|
341 class { '::apache::default_mods': |
|
342 all => $default_mods, |
|
343 } |
|
344 } |
|
345 class { '::apache::default_confd_files': |
|
346 all => $default_confd_files |
|
347 } |
|
348 if $mpm_module { |
|
349 class { "::apache::mod::${mpm_module}": } |
|
350 } |
|
351 |
|
352 $default_vhost_ensure = $default_vhost ? { |
|
353 true => 'present', |
|
354 false => 'absent' |
|
355 } |
|
356 $default_ssl_vhost_ensure = $default_ssl_vhost ? { |
|
357 true => 'present', |
|
358 false => 'absent' |
|
359 } |
|
360 |
|
361 ::apache::vhost { 'default': |
|
362 ensure => $default_vhost_ensure, |
|
363 port => 80, |
|
364 docroot => $docroot, |
|
365 scriptalias => $scriptalias, |
|
366 serveradmin => $serveradmin, |
|
367 access_log_file => $access_log_file, |
|
368 priority => '15', |
|
369 ip => $ip, |
|
370 logroot_mode => $logroot_mode, |
|
371 manage_docroot => $default_vhost, |
|
372 } |
|
373 $ssl_access_log_file = $::osfamily ? { |
|
374 'freebsd' => $access_log_file, |
|
375 default => "ssl_${access_log_file}", |
|
376 } |
|
377 ::apache::vhost { 'default-ssl': |
|
378 ensure => $default_ssl_vhost_ensure, |
|
379 port => 443, |
|
380 ssl => true, |
|
381 docroot => $docroot, |
|
382 scriptalias => $scriptalias, |
|
383 serveradmin => $serveradmin, |
|
384 access_log_file => $ssl_access_log_file, |
|
385 priority => '15', |
|
386 ip => $ip, |
|
387 logroot_mode => $logroot_mode, |
|
388 manage_docroot => $default_ssl_vhost, |
|
389 } |
|
390 } |
|
391 |
|
392 # This anchor can be used as a reference point for things that need to happen *after* |
|
393 # all modules have been put in place. |
|
394 anchor { '::apache::modules_set_up': } |
|
395 } |