200 lines
5.8 KiB
Markdown
200 lines
5.8 KiB
Markdown
[](https://httpd.apache.org/)
|
|
|
|
# Ansible Role - Apache2 Webserver
|
|
|
|
Ansible Role to deploy one or multiple Apache2 sites on a linux server.
|
|
|
|
[](https://github.com/O-X-L/ansible-role-apache2/actions/workflows/lint.yml)
|
|
[](https://galaxy.ansible.com/ui/standalone/roles/oxlorg/apache2)
|
|
|
|
**Molecule Integration-Tests**:
|
|
|
|
* Status: [](https://github.com/O-X-L/ansible-role-oxl-cicd/blob/latest/templates/usr/local/bin/cicd/molecule.sh.j2) |
|
|
[](https://github.com/O-X-L/ansible-role-apache2/actions/workflows/integration_test_result.yml)
|
|
* Logs: [API](https://ci.oss.oxl.app/api/job/ansible-test-molecule-infra_apache/logs?token=2b7bba30-9a37-4b57-be8a-99e23016ce70&lines=1000) | [Short](https://badges.oss.oxl.app/log/molecule_infra_apache_test_short.log) | [Full](https://badges.oss.oxl.app/log/molecule_infra_apache_test.log)
|
|
|
|
Internal CI: [Tester Role](https://github.com/O-X-L/ansible-role-oxl-cicd) | [Jobs API](https://github.com/O-X-L/github-self-hosted-jobs-systemd)
|
|
|
|
**Tested:**
|
|
* Debian 11
|
|
* Debian 12
|
|
|
|
----
|
|
|
|
## Install
|
|
|
|
```bash
|
|
# latest
|
|
ansible-galaxy role install git+https://github.com/O-X-L/ansible-role-apache2
|
|
|
|
# from galaxy
|
|
ansible-galaxy install oxlorg.apache2
|
|
|
|
# or to custom role-path
|
|
ansible-galaxy install oxlorg.apache2 --roles-path ./roles
|
|
|
|
# install dependencies
|
|
ansible-galaxy install -r requirements.yml
|
|
```
|
|
|
|
----
|
|
|
|
## Advertisement
|
|
|
|
* Need **professional support** using Ansible or managing Web-Applications? Contact us:
|
|
|
|
E-Mail: [contact@oxl.at](mailto:contact@oxl.at)
|
|
|
|
Tel: [+43 3115 40 900 0](tel:+433115409000)
|
|
|
|
Web: [EN](https://www.o-x-l.com) | [DE](https://www.oxl.at)
|
|
|
|
Language: German or English
|
|
|
|
* You want a simple **Ansible GUI**?
|
|
|
|
Check-out this [Ansible WebUI](https://github.com/O-X-L/ansible-webui)
|
|
|
|
----
|
|
|
|
## Usage
|
|
|
|
### Config
|
|
|
|
Define the apache dictionary as needed!
|
|
|
|
```yaml
|
|
apache:
|
|
headers:
|
|
mySuperCustom: 'headerContent'
|
|
|
|
modules:
|
|
present: ['evasive', 'ssl', 'headers', 'rewrite']
|
|
|
|
guys_statics:
|
|
mode: 'serve'
|
|
domain: 'static.guy.net'
|
|
serve:
|
|
path: '/var/www/site_guys_statics'
|
|
|
|
ssl:
|
|
mode: 'snakeoil'
|
|
|
|
config: # add settings as key-value pairs
|
|
KeepAliveTimeout: 10
|
|
config_additions: # add a list of custom lines of config
|
|
- 'location = / { return 301 /kitty.jpg; }'
|
|
|
|
git_stuff:
|
|
mode: 'redirect'
|
|
domain: 'oxl.at'
|
|
aliases: ['www.oxl.at']
|
|
redirect:
|
|
target: 'https://github.com/O-X-L'
|
|
|
|
ssl:
|
|
mode: 'letsencrypt'
|
|
|
|
letsencrypt:
|
|
email: 'apache@template.oxl.at'
|
|
|
|
security:
|
|
restrict_methods: false
|
|
```
|
|
|
|
### Execution
|
|
|
|
Run the playbook:
|
|
```bash
|
|
ansible-playbook -K -D -i inventory/hosts.yml playbook.yml
|
|
```
|
|
|
|
There are also some useful **tags** available:
|
|
* base => only configure basics; sites will not be touched
|
|
* sites
|
|
* config => configuration (base and instances)
|
|
* certs
|
|
|
|
To debug errors - you can set the 'debug' variable at runtime:
|
|
```bash
|
|
ansible-playbook -K -D -i inventory/hosts.yml playbook.yml -e debug=yes
|
|
```
|
|
|
|
----
|
|
|
|
## Functionality
|
|
|
|
* **Package installation**
|
|
* Ansible dependencies (_minimal_)
|
|
* Apache2
|
|
|
|
|
|
* **Configuration**
|
|
* Support for multiple sites/servers
|
|
* Two **config-modes**:
|
|
* serve (_default_)
|
|
* redirect
|
|
* Support for specific configurations using the 'config' and 'config_additions' parameters
|
|
|
|
|
|
* **Default config**:
|
|
* Disabled: <TLS1.2, unsecure ciphers, autoindex, servertokens/-signature, ServerSideIncludes, CGI
|
|
* Security headers: HSTS, X-Frame, Referrer-Policy, Content-Type nosniff, X-Domain-Policy, XXS-Protection
|
|
* Limits to prevent DDoS
|
|
* Using a Self-Signed certificate
|
|
* Modules: +ssl, +http2, headers, rewrite; -autoindex
|
|
* HTTP2 enabled with fallback to HTTP1.1
|
|
* IPv6 support disabled (*at least one ipv6 address MUST EXIST*)
|
|
|
|
|
|
* **SSL modes** (_for more info see: [CERT ROLE](https://github.com/O-X-L/ansible-role-certs)_)
|
|
* **selfsigned** => Generate self-signed ones
|
|
* **ca** => Generate a minimal Certificate Authority and certificate signed by it
|
|
* **letsencrypt** => Uses the LetsEncrypt certbot
|
|
* **existing** => Copy certificate files or use existing ones
|
|
|
|
|
|
* **Default opt-ins**:
|
|
* restricting methods to POST/GET/HEAD
|
|
* status-page listener on localhost
|
|
* Logging to syslog
|
|
* http2
|
|
|
|
|
|
* **Default opt-outs**:
|
|
* Include the config file 'sites-available/site_{{ site_name }}_app.conf' for advanced usage
|
|
|
|
|
|
Options to provide module config will be added in the future!<br>
|
|
Also some basic mods will get a pre-config added. (_prefork, evasive_)
|
|
|
|
----
|
|
|
|
## Info
|
|
|
|
* **Note:** Most of the role's functionality can be opted in or out.
|
|
|
|
For all available options - see the default-config located in the main/site defaults-file!
|
|
|
|
|
|
* **Note:** this role currently only supports debian-based systems
|
|
|
|
|
|
* **Note:** This role expects that the site's unencrypted 'server' will only redirect to its encrypted connection.
|
|
|
|
|
|
* **Note:** If you want any requested domain to get handled by a site/server you need to add a **wildcard** '*' as alias!<br>
|
|
|
|
BUT: You still have to provide a main domain!
|
|
|
|
|
|
* **Warning:** Not every setting/variable you provide will be checked for validity. Bad config might break the role!
|
|
|
|
|
|
* **Info:** To disable default settings and headers => just set their value to: ''
|
|
|
|
|
|
* **Info:** For LetsEncrypt renewal to work, you must allow outgoing connections to:
|
|
|
|
80/tcp, 443/tcp+udp to acme-v02.api.letsencrypt.org, staging-v02.api.letsencrypt.org (_debug mode_) and r3.o.lencr.org
|