capistrano-exfel 0.2.2 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rubocop.yml +0 -6
- data/Gemfile +3 -1
- data/README.md +2 -2
- data/Rakefile +2 -0
- data/capistrano-exfel.gemspec +5 -3
- data/capistrano.graph +86 -56
- data/capistrano.png +0 -0
- data/lib/capistrano/exfel.rb +2 -0
- data/lib/capistrano/exfel/co7.rb +3 -3
- data/lib/capistrano/exfel/version.rb +3 -1
- data/lib/capistrano/recipes/{co7 → apache}/00-passenger.conf +0 -0
- data/lib/capistrano/recipes/{ub14/apache.conf → apache/app_ssl.conf} +11 -4
- data/lib/capistrano/recipes/{co7 → apache}/httpd.conf +6 -0
- data/lib/capistrano/recipes/apache/ssl.conf +49 -0
- data/lib/capistrano/tasks/apache.rake +268 -0
- data/lib/capistrano/tasks/app_home.rake +2 -0
- data/lib/capistrano/tasks/application.rake +2 -0
- data/lib/capistrano/tasks/assets.rake +2 -0
- data/lib/capistrano/tasks/database.rake +2 -0
- data/lib/capistrano/tasks/secrets.rake +2 -0
- data/lib/capistrano/tasks/util.rake +2 -0
- metadata +14 -26
- data/lib/capistrano/exfel/sl6.rb +0 -21
- data/lib/capistrano/exfel/ub14.rb +0 -20
- data/lib/capistrano/recipes/apache_http.conf +0 -46
- data/lib/capistrano/recipes/apache_ssl.conf +0 -252
- data/lib/capistrano/recipes/co7/apache_http.conf +0 -7
- data/lib/capistrano/recipes/co7/apache_ssl.conf +0 -66
- data/lib/capistrano/recipes/ub14/passenger.conf +0 -6
- data/lib/capistrano/tasks/apache_co7.rake +0 -133
- data/lib/capistrano/tasks/apache_common.rake +0 -75
- data/lib/capistrano/tasks/apache_rpm.rake +0 -50
- data/lib/capistrano/tasks/apache_sl6.rake +0 -241
- data/lib/capistrano/tasks/apache_ub14.rake +0 -116
@@ -1,66 +0,0 @@
|
|
1
|
-
Listen 443 https
|
2
|
-
|
3
|
-
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
|
4
|
-
|
5
|
-
SSLSessionCache shmcb:/run/httpd/sslcache(512000)
|
6
|
-
SSLSessionCacheTimeout 300
|
7
|
-
|
8
|
-
SSLRandomSeed startup file:/dev/urandom 256
|
9
|
-
SSLRandomSeed connect builtin
|
10
|
-
|
11
|
-
SSLCryptoDevice builtin
|
12
|
-
|
13
|
-
<VirtualHost _default_:443>
|
14
|
-
|
15
|
-
ErrorLog logs/ssl_error_log
|
16
|
-
TransferLog logs/ssl_access_log
|
17
|
-
LogLevel warn
|
18
|
-
|
19
|
-
SSLEngine on
|
20
|
-
|
21
|
-
SSLProtocol all -SSLv2
|
22
|
-
|
23
|
-
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
|
24
|
-
|
25
|
-
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
|
26
|
-
|
27
|
-
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
|
28
|
-
|
29
|
-
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
30
|
-
SSLOptions +StdEnvVars
|
31
|
-
</Files>
|
32
|
-
<Directory "/var/www/cgi-bin">
|
33
|
-
SSLOptions +StdEnvVars
|
34
|
-
</Directory>
|
35
|
-
|
36
|
-
BrowserMatch "MSIE [2-5]" \
|
37
|
-
nokeepalive ssl-unclean-shutdown \
|
38
|
-
downgrade-1.0 force-response-1.0
|
39
|
-
|
40
|
-
CustomLog logs/ssl_request_log \
|
41
|
-
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
42
|
-
# <<APPLICATION_NAME>> - Ruby on Rails Application
|
43
|
-
#
|
44
|
-
# Application secured by SSL
|
45
|
-
|
46
|
-
Alias /<<APPLICATION_NAME>> /var/www/html/<<APPLICATION_NAME>>
|
47
|
-
|
48
|
-
#
|
49
|
-
# Application
|
50
|
-
#
|
51
|
-
<Directory "/var/www/html/<<APPLICATION_NAME>>/">
|
52
|
-
RackBaseURI /<<APPLICATION_NAME>>
|
53
|
-
RailsEnv <<ENVIRONMENT>>
|
54
|
-
|
55
|
-
PassengerUser nobody
|
56
|
-
# Scientific Linux: nobody / Ubuntu/Debian: nogroup
|
57
|
-
PassengerGroup nobody
|
58
|
-
|
59
|
-
# This relaxes Apache security settings.
|
60
|
-
Options -Indexes +MultiViews +FollowSymLinks
|
61
|
-
AllowOverride None
|
62
|
-
Require all granted
|
63
|
-
</Directory>
|
64
|
-
|
65
|
-
</VirtualHost>
|
66
|
-
|
@@ -1,133 +0,0 @@
|
|
1
|
-
namespace :apache do
|
2
|
-
desc 'Configure Apache configuration files'
|
3
|
-
task :configure do
|
4
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
5
|
-
|
6
|
-
invoke 'apache:create_apache_shared_folder'
|
7
|
-
invoke 'apache:configure_apache_modules'
|
8
|
-
invoke 'apache:configure_app_conf_file'
|
9
|
-
invoke 'apache:configure_app_ssl_conf_file'
|
10
|
-
|
11
|
-
on roles(:app) do
|
12
|
-
if remote_file_exists?('/etc/httpd/conf.d/ssl.conf')
|
13
|
-
execute "#{sudo_cmd} mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf_bck"
|
14
|
-
end
|
15
|
-
end
|
16
|
-
end
|
17
|
-
|
18
|
-
desc 'Configure (HTTP) Apache modules'
|
19
|
-
task :configure_apache_modules do
|
20
|
-
on roles(:app) do
|
21
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
22
|
-
|
23
|
-
debug '#' * 50
|
24
|
-
debug 'Configure (HTTP) Apache Passenger module'
|
25
|
-
|
26
|
-
set :shared_passenger_file, "#{fetch(:shared_apache_path)}/00-passenger.conf"
|
27
|
-
passenger_file = File.expand_path('../recipes/co7/00-passenger.conf', __dir__)
|
28
|
-
|
29
|
-
upload! StringIO.new(File.read(passenger_file)), fetch(:shared_passenger_file).to_s
|
30
|
-
|
31
|
-
debug "chmod g+w #{fetch(:shared_passenger_file)}"
|
32
|
-
execute "chmod g+w #{fetch(:shared_passenger_file)}"
|
33
|
-
|
34
|
-
passenger_root = get_command_output('/usr/local/rvm/bin/rvm default do passenger-config --root')
|
35
|
-
ruby_path = "/#{passenger_root.split('/')[1..5].join('/')}/wrappers/ruby"
|
36
|
-
|
37
|
-
debug "sed -i 's|<<PASSENGER_ROOT>>|#{passenger_root}|g' #{fetch(:shared_passenger_file)}"
|
38
|
-
execute "sed -i 's|<<PASSENGER_ROOT>>|#{passenger_root}|g' #{fetch(:shared_passenger_file)}"
|
39
|
-
execute "sed -i 's|<<RUBY_PATH>>|#{ruby_path}|g' #{fetch(:shared_passenger_file)}"
|
40
|
-
|
41
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_passenger_file)} /etc/httpd/conf.modules.d/"
|
42
|
-
|
43
|
-
debug '#' * 50
|
44
|
-
debug 'Deactivate unnecessary Apache modules'
|
45
|
-
%w[00-dav.conf 00-lua.conf 00-proxy.conf 01-cgi.conf].each do |file|
|
46
|
-
if remote_file_exists?("/etc/httpd/conf.modules.d/#{file}")
|
47
|
-
execute "#{sudo_cmd} mv /etc/httpd/conf.modules.d/#{file} /etc/httpd/conf.modules.d/#{file}_bck"
|
48
|
-
end
|
49
|
-
end
|
50
|
-
debug '#' * 50
|
51
|
-
end
|
52
|
-
end
|
53
|
-
|
54
|
-
# desc 'Configure (HTTP) Apache Application configuration files'
|
55
|
-
task :configure_app_conf_file do
|
56
|
-
on roles(:app), in: :sequence do
|
57
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
58
|
-
|
59
|
-
debug '#' * 50
|
60
|
-
debug 'Configure (HTTP) Apache Application configuration files'
|
61
|
-
|
62
|
-
set :shared_apache_conf_file, "#{fetch(:shared_apache_path)}/app_#{fetch(:app_name_uri)}.conf"
|
63
|
-
http_file = File.expand_path('../recipes/co7/apache_http.conf', __dir__)
|
64
|
-
upload! StringIO.new(File.read(http_file)), fetch(:shared_apache_conf_file).to_s
|
65
|
-
|
66
|
-
debug "chmod g+w #{fetch(:shared_apache_conf_file)}"
|
67
|
-
execute "chmod g+w #{fetch(:shared_apache_conf_file)}"
|
68
|
-
|
69
|
-
app_domain = fetch(:app_domain)
|
70
|
-
server_name = app_domain.split('/')[2]
|
71
|
-
|
72
|
-
execute "sed -i 's|<<APP_DOMAIN>>|#{app_domain}|g' #{fetch(:shared_apache_conf_file)}"
|
73
|
-
execute "sed -i 's|<<SERVER_NAME>>|#{server_name}|g' #{fetch(:shared_apache_conf_file)}"
|
74
|
-
|
75
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_apache_conf_file)} /etc/httpd/conf.d/"
|
76
|
-
|
77
|
-
debug '#' * 50
|
78
|
-
end
|
79
|
-
end
|
80
|
-
|
81
|
-
# desc 'Configure (HTTPS) Apache Application configuration files'
|
82
|
-
task :configure_app_ssl_conf_file do
|
83
|
-
on roles(:app), in: :sequence do
|
84
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
85
|
-
|
86
|
-
debug '#' * 50
|
87
|
-
debug 'Configure (HTTPS) Apache Application configuration files'
|
88
|
-
|
89
|
-
set :shared_apache_conf_ssl_file, "#{fetch(:shared_apache_path)}/app_#{fetch(:app_name_uri)}_ssl.conf"
|
90
|
-
http_ssl_file = File.expand_path('../recipes/co7/apache_ssl.conf', __dir__)
|
91
|
-
upload! StringIO.new(File.read(http_ssl_file)), fetch(:shared_apache_conf_ssl_file).to_s
|
92
|
-
|
93
|
-
debug "chmod g+w #{fetch(:shared_apache_conf_ssl_file)}"
|
94
|
-
execute "chmod g+w #{fetch(:shared_apache_conf_ssl_file)}"
|
95
|
-
|
96
|
-
execute "sed -i 's/<<APPLICATION_NAME>>/#{fetch(:app_name_uri)}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
97
|
-
execute "sed -i 's/<<ENVIRONMENT>>/#{fetch(:environment)}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
98
|
-
|
99
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_apache_conf_ssl_file)} /etc/httpd/conf.d/"
|
100
|
-
|
101
|
-
debug '#' * 50
|
102
|
-
end
|
103
|
-
end
|
104
|
-
|
105
|
-
desc 'Update httpd.conf to secure apache server'
|
106
|
-
task :secure_apache do
|
107
|
-
on roles(:web) do
|
108
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
109
|
-
|
110
|
-
debug '#' * 50
|
111
|
-
debug 'Update httpd.conf to secure apache server'
|
112
|
-
|
113
|
-
set :httpd_conf_file, '/etc/httpd/conf/httpd.conf'
|
114
|
-
|
115
|
-
# Replace the original Apache configuration file
|
116
|
-
if remote_file_exists?('/etc/httpd/conf/httpd.conf_bck')
|
117
|
-
info 'Apache original configuration file already backed up at: /etc/httpd/conf/httpd.conf_bck'
|
118
|
-
else
|
119
|
-
execute "#{sudo_cmd} cp -f #{fetch(:httpd_conf_file)} /etc/httpd/conf/httpd.conf_bck"
|
120
|
-
info 'Apache original configuration file backed up at: /etc/httpd/conf/httpd.conf_bck'
|
121
|
-
end
|
122
|
-
|
123
|
-
# Create a temporary copy of the Apache configuration file
|
124
|
-
set :tmp_httpd_file, '/tmp/httpd.conf'
|
125
|
-
httpd_safe_file = File.expand_path('../recipes/co7/httpd.conf', __dir__)
|
126
|
-
|
127
|
-
upload! StringIO.new(File.read(httpd_safe_file)), fetch(:tmp_httpd_file).to_s
|
128
|
-
|
129
|
-
# Replace the original Apache configuration file
|
130
|
-
execute "#{sudo_cmd} mv -f #{fetch(:tmp_httpd_file)} #{fetch(:httpd_conf_file)}"
|
131
|
-
end
|
132
|
-
end
|
133
|
-
end
|
@@ -1,75 +0,0 @@
|
|
1
|
-
# apache tasks common to all distros
|
2
|
-
|
3
|
-
namespace :apache do
|
4
|
-
desc 'Check that the user has write permissions in the Deploy and in Apache DocumentRoot folders'
|
5
|
-
task :check_write_permissions do
|
6
|
-
invoke 'apache:check_write_permissions_on_deploy'
|
7
|
-
invoke 'apache:check_write_permissions_on_document_root'
|
8
|
-
end
|
9
|
-
|
10
|
-
desc 'Check that we have the right permission to the folder the app should be deployed to'
|
11
|
-
task :check_write_permissions_on_deploy do
|
12
|
-
on roles(:app), in: :sequence do |host|
|
13
|
-
debug '#' * 50
|
14
|
-
debug "Checking folder '#{fetch(:deploy_to)}' (where the application has to be deployed) "\
|
15
|
-
"for the right permissions on Host '#{host}'"
|
16
|
-
|
17
|
-
if test("[ -w #{fetch(:deploy_to)} ]")
|
18
|
-
info "#{fetch(:deploy_to)} is writable on #{host}"
|
19
|
-
else
|
20
|
-
error "#{fetch(:deploy_to)} is not writable on #{host}"
|
21
|
-
end
|
22
|
-
|
23
|
-
debug '#' * 50
|
24
|
-
end
|
25
|
-
end
|
26
|
-
|
27
|
-
desc 'Check that we have the right permission to the Apache DocumentRoot folder'
|
28
|
-
task :check_write_permissions_on_document_root do
|
29
|
-
on roles(:web) do |host|
|
30
|
-
debug '#' * 50
|
31
|
-
debug "Checking Apache DocumentRoot folder (#{fetch(:apache_document_root)}) permissions on Host '#{host}'"
|
32
|
-
|
33
|
-
if test("[ -w #{fetch(:apache_document_root)} ]")
|
34
|
-
info "#{fetch(:apache_document_root)} is writable on #{host}"
|
35
|
-
else
|
36
|
-
info "#{fetch(:apache_document_root)} is not writable on #{host}"
|
37
|
-
end
|
38
|
-
|
39
|
-
debug '#' * 50
|
40
|
-
end
|
41
|
-
end
|
42
|
-
|
43
|
-
# desc 'Create Apache configuration files shared folder'
|
44
|
-
task :create_apache_shared_folder do
|
45
|
-
on roles(:app) do
|
46
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
47
|
-
|
48
|
-
debug '#' * 50
|
49
|
-
debug 'Create Apache configuration files shared folder'
|
50
|
-
|
51
|
-
debug "mkdir -p #{fetch(:shared_apache_path)}"
|
52
|
-
execute "#{sudo_cmd} mkdir -p #{fetch(:shared_apache_path)}"
|
53
|
-
|
54
|
-
debug "chmod g+ws #{fetch(:shared_apache_path)}"
|
55
|
-
execute "#{sudo_cmd} chmod g+ws #{fetch(:shared_apache_path)}"
|
56
|
-
|
57
|
-
debug '#' * 50
|
58
|
-
end
|
59
|
-
end
|
60
|
-
|
61
|
-
desc 'Create symbolic link to application public folder in Apache DocumentRoot folder'
|
62
|
-
task :create_symbolic_link do
|
63
|
-
on roles(:web), in: :sequence do
|
64
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
65
|
-
|
66
|
-
info '#' * 50
|
67
|
-
info 'Creating application symbolic link'
|
68
|
-
|
69
|
-
debug "ln -sfn #{fetch(:deploy_to)}/current/public #{fetch(:apache_deploy_symbolic_link)}"
|
70
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:deploy_to)}/current/public #{fetch(:apache_deploy_symbolic_link)}"
|
71
|
-
|
72
|
-
info '#' * 50
|
73
|
-
end
|
74
|
-
end
|
75
|
-
end
|
@@ -1,50 +0,0 @@
|
|
1
|
-
# apache tasks common to RPM-based distros (CentOS and Scientific Linux)
|
2
|
-
|
3
|
-
namespace :apache do
|
4
|
-
desc 'Configure Apache (httpd) and restart it'
|
5
|
-
task :configure_and_start do
|
6
|
-
invoke 'apache:configure'
|
7
|
-
invoke 'apache:chkconfig_on'
|
8
|
-
# invoke 'apache:restart'
|
9
|
-
invoke 'apache:secure_apache' # This should go to Puppet
|
10
|
-
invoke 'apache:create_symbolic_link'
|
11
|
-
end
|
12
|
-
|
13
|
-
desc 'Configure Apache to start at bootup'
|
14
|
-
task :chkconfig_on do
|
15
|
-
on roles(:web) do
|
16
|
-
info 'In task apache:chkconfig_on'
|
17
|
-
|
18
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
19
|
-
|
20
|
-
debug '#' * 50
|
21
|
-
|
22
|
-
debug 'chkconfig httpd on'
|
23
|
-
execute "#{sudo_cmd} chkconfig httpd on"
|
24
|
-
|
25
|
-
info 'Configured Apache to start at bootup'
|
26
|
-
debug '#' * 50
|
27
|
-
end
|
28
|
-
end
|
29
|
-
|
30
|
-
desc 'Restart Apache (httpd) service'
|
31
|
-
task :restart do
|
32
|
-
on roles(:web) do
|
33
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
34
|
-
|
35
|
-
debug '#' * 50
|
36
|
-
|
37
|
-
debug 'service httpd stop'
|
38
|
-
execute "#{sudo_cmd} service httpd stop"
|
39
|
-
|
40
|
-
debug 'pkill -9 httpd || true'
|
41
|
-
execute "#{sudo_cmd} pkill -9 httpd || true"
|
42
|
-
|
43
|
-
debug 'service httpd start'
|
44
|
-
execute "#{sudo_cmd} service httpd start"
|
45
|
-
|
46
|
-
info 'Restarted Apache (httpd) service'
|
47
|
-
debug '#' * 50
|
48
|
-
end
|
49
|
-
end
|
50
|
-
end
|
@@ -1,241 +0,0 @@
|
|
1
|
-
namespace :apache do
|
2
|
-
desc 'Configure Apache configuration files'
|
3
|
-
task :configure do
|
4
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
5
|
-
|
6
|
-
invoke 'apache:create_apache_shared_folder'
|
7
|
-
invoke 'apache:configure_app_conf_file'
|
8
|
-
invoke 'apache:configure_app_ssl_conf_file'
|
9
|
-
|
10
|
-
on roles(:app) do
|
11
|
-
if remote_file_exists?('/etc/httpd/conf.d/ssl.conf')
|
12
|
-
execute "#{sudo_cmd} mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf_bck"
|
13
|
-
end
|
14
|
-
end
|
15
|
-
end
|
16
|
-
|
17
|
-
# desc 'Configure (HTTP) Apache Application configuration files'
|
18
|
-
task :configure_app_conf_file do
|
19
|
-
on roles(:app), in: :sequence do
|
20
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
21
|
-
|
22
|
-
debug '#' * 50
|
23
|
-
debug 'Configure (HTTP) Apache Application configuration files'
|
24
|
-
|
25
|
-
set :shared_apache_conf_file, "#{fetch(:shared_apache_path)}/app_#{fetch(:app_name_uri)}.conf"
|
26
|
-
http_file = File.expand_path('../recipes/apache_http.conf', __dir__)
|
27
|
-
upload! StringIO.new(File.read(http_file)), fetch(:shared_apache_conf_file).to_s
|
28
|
-
|
29
|
-
debug "chmod g+w #{fetch(:shared_apache_conf_file)}"
|
30
|
-
execute "chmod g+w #{fetch(:shared_apache_conf_file)}"
|
31
|
-
|
32
|
-
passenger_root = get_command_output('/usr/local/rvm/bin/rvm default do passenger-config --root')
|
33
|
-
ruby_path = "/#{passenger_root.split('/')[1..5].join('/')}/wrappers/ruby"
|
34
|
-
app_domain = fetch(:app_domain)
|
35
|
-
server_name = app_domain.split('/')[2]
|
36
|
-
|
37
|
-
debug "sed -i 's|<<PASSENGER_ROOT>>|#{passenger_root}|g' #{fetch(:shared_apache_conf_file)}"
|
38
|
-
execute "sed -i 's|<<PASSENGER_ROOT>>|#{passenger_root}|g' #{fetch(:shared_apache_conf_file)}"
|
39
|
-
|
40
|
-
execute "sed -i 's|<<RUBY_PATH>>|#{ruby_path}|g' #{fetch(:shared_apache_conf_file)}"
|
41
|
-
execute "sed -i 's|<<APP_DOMAIN>>|#{app_domain}|g' #{fetch(:shared_apache_conf_file)}"
|
42
|
-
execute "sed -i 's|<<SERVER_NAME>>|#{server_name}|g' #{fetch(:shared_apache_conf_file)}"
|
43
|
-
|
44
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_apache_conf_file)} /etc/httpd/conf.d/"
|
45
|
-
|
46
|
-
debug '#' * 50
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
# desc 'Configure (HTTPS) Apache Application configuration files'
|
51
|
-
task :configure_app_ssl_conf_file do
|
52
|
-
on roles(:app), in: :sequence do
|
53
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
54
|
-
|
55
|
-
debug '#' * 50
|
56
|
-
debug 'Configure (HTTPS) Apache Application configuration files'
|
57
|
-
|
58
|
-
set :shared_apache_conf_ssl_file, "#{fetch(:shared_apache_path)}/app_#{fetch(:app_name_uri)}_ssl.conf"
|
59
|
-
http_ssl_file = File.expand_path('../recipes/apache_ssl.conf', __dir__)
|
60
|
-
upload! StringIO.new(File.read(http_ssl_file)), fetch(:shared_apache_conf_ssl_file).to_s
|
61
|
-
|
62
|
-
debug "chmod g+w #{fetch(:shared_apache_conf_ssl_file)}"
|
63
|
-
execute "chmod g+w #{fetch(:shared_apache_conf_ssl_file)}"
|
64
|
-
|
65
|
-
server_name = string_between_markers(fetch(:app_domain), '://', '/')
|
66
|
-
|
67
|
-
execute "sed -i 's/<<SERVER_NAME>>/#{server_name}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
68
|
-
execute "sed -i 's/<<APPLICATION_NAME>>/#{fetch(:app_name_uri)}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
69
|
-
execute "sed -i 's/<<ENVIRONMENT>>/#{fetch(:environment)}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
70
|
-
|
71
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_apache_conf_ssl_file)} /etc/httpd/conf.d/"
|
72
|
-
|
73
|
-
debug '#' * 50
|
74
|
-
end
|
75
|
-
end
|
76
|
-
|
77
|
-
desc 'Update httpd.conf to secure apache server'
|
78
|
-
task :secure_apache do
|
79
|
-
on roles(:web) do
|
80
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
81
|
-
|
82
|
-
debug '#' * 50
|
83
|
-
debug 'Update httpd.conf to secure apache server'
|
84
|
-
|
85
|
-
set :httpd_conf_file, '/etc/httpd/conf/httpd.conf'
|
86
|
-
|
87
|
-
# Replace the original Apache configuration file
|
88
|
-
if remote_file_exists?('/etc/httpd/conf/httpd.conf_bck')
|
89
|
-
info 'Apache original configuration file already backed up at: /etc/httpd/conf/httpd.conf_bck'
|
90
|
-
else
|
91
|
-
execute "#{sudo_cmd} cp -f #{fetch(:httpd_conf_file)} /etc/httpd/conf/httpd.conf_bck"
|
92
|
-
info 'Apache original configuration file backed up at: /etc/httpd/conf/httpd.conf_bck'
|
93
|
-
end
|
94
|
-
|
95
|
-
# The ServerSignature directive allows the configuration of a trailing footer line under server-generated docs
|
96
|
-
# Options: On | Off | EMail
|
97
|
-
# More details: http://httpd.apache.org/docs/current/mod/core.html#serversignature
|
98
|
-
set :server_signature_off, get_num_occurrences_in_file(fetch(:httpd_conf_file), 'ServerSignature Off')
|
99
|
-
|
100
|
-
if fetch(:server_signature_off) == 1
|
101
|
-
info 'ServerSignature Off is already set'
|
102
|
-
|
103
|
-
else
|
104
|
-
set :num_replacements, 0
|
105
|
-
%w[On Off EMail].each do |option|
|
106
|
-
set :server_signature_option,
|
107
|
-
get_num_occurrences_in_file(fetch(:httpd_conf_file), "ServerSignature #{option}")
|
108
|
-
|
109
|
-
if fetch(:server_signature_option) == 1
|
110
|
-
info "sed -i 's/ServerSignature #{option}/ServerSignature Off/g' #{fetch(:httpd_conf_file)}"
|
111
|
-
execute "#{sudo_cmd} sed -i 's/ServerSignature #{option}/ServerSignature Off/g' #{fetch(:httpd_conf_file)}"
|
112
|
-
set :num_replacements, fetch(:num_replacements) + 1
|
113
|
-
end
|
114
|
-
end
|
115
|
-
|
116
|
-
error 'ServerSignature was not found' if fetch(:num_replacements).zero?
|
117
|
-
end
|
118
|
-
|
119
|
-
# Don't give away too much information about all the subcomponents we are running.
|
120
|
-
#
|
121
|
-
# Options: Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full
|
122
|
-
# More details: http://httpd.apache.org/docs/current/mod/core.html#servertokens
|
123
|
-
set :server_token_prod, get_num_occurrences_in_file(fetch(:httpd_conf_file), 'ServerTokens Prod')
|
124
|
-
if fetch(:server_token_prod) == 1
|
125
|
-
info 'ServerTokens Prod is already set'
|
126
|
-
else
|
127
|
-
set :num_replacements, 0
|
128
|
-
%w[Major Minor Minimal Min ProductOnly Prod OS Full].each do |option|
|
129
|
-
set :server_token_option, get_num_occurrences_in_file(fetch(:httpd_conf_file), "ServerTokens #{option}")
|
130
|
-
|
131
|
-
next unless fetch(:server_token_option) == 1
|
132
|
-
|
133
|
-
# Then, only if fetch(:server_token_option) == 1
|
134
|
-
info "sed -i 's/ServerTokens #{option}/ServerTokens Prod/g' #{fetch(:httpd_conf_file)}"
|
135
|
-
execute "#{sudo_cmd} sed -i 's/ServerTokens #{option}/ServerTokens Prod/g' #{fetch(:httpd_conf_file)}"
|
136
|
-
set :num_replacements, fetch(:num_replacements) + 1
|
137
|
-
end
|
138
|
-
|
139
|
-
error 'ServerTokens was not found' if fetch(:num_replacements).zero?
|
140
|
-
end
|
141
|
-
|
142
|
-
# Do not allow browsing outside the document root
|
143
|
-
#
|
144
|
-
# <Directory />
|
145
|
-
# Order Deny,Allow
|
146
|
-
# Deny from all
|
147
|
-
# Options None
|
148
|
-
# AllowOverride None
|
149
|
-
# </Directory>
|
150
|
-
#
|
151
|
-
message_line1 = '# Default Directory configuration changed via Capistrano.'
|
152
|
-
|
153
|
-
set :server_dir_secure_configuration, get_num_occurrences_in_file(fetch(:httpd_conf_file), message_line1)
|
154
|
-
|
155
|
-
if fetch(:server_token_prod) == 1
|
156
|
-
info 'The correct directory configuration is already correctly set'
|
157
|
-
else
|
158
|
-
|
159
|
-
set :tmp_dir_original_config, '/tmp/tmp_dir_original_config.conf'
|
160
|
-
set :tmp_dir_original_commented_config, '/tmp/tmp_dir_original_commented_config.conf'
|
161
|
-
set :tmp_dir_new_config, '/tmp/tmp_dir_new_config.conf'
|
162
|
-
|
163
|
-
# Create a temporary copy of the Apache configuration file
|
164
|
-
set :tmp_httpd_file, '/tmp/httpd.conf'
|
165
|
-
execute :cp, '-f', "#{fetch(:httpd_conf_file)} #{fetch(:tmp_httpd_file)}"
|
166
|
-
|
167
|
-
set :grep_for_directory, "grep -Pzo '^([ ]*<Directory />[ ]*)(\\n.*)+(\\n[ ]*</Directory>[ ]*)(\\n){1}$' "\
|
168
|
-
"#{fetch(:tmp_httpd_file)}"
|
169
|
-
|
170
|
-
# How many lines have the original configuration
|
171
|
-
command = "#{fetch(:grep_for_directory)} | grep -n '</Directory>' | head -n 1 | cut -d ':' -f1"
|
172
|
-
set :def_directory_num_lines, get_command_output(command).to_i
|
173
|
-
debug "Original configuration has #{fetch(:def_directory_num_lines)} lines."
|
174
|
-
|
175
|
-
# Saves to a file the original configuration
|
176
|
-
command = "#{fetch(:grep_for_directory)} | "\
|
177
|
-
"head -n #{fetch(:def_directory_num_lines)} > #{fetch(:tmp_dir_original_config)}"
|
178
|
-
debug command
|
179
|
-
execute command
|
180
|
-
|
181
|
-
# Saves to a file the original configuration commented
|
182
|
-
execute :cp, '-f', "#{fetch(:tmp_dir_original_config)} #{fetch(:tmp_dir_original_commented_config)}"
|
183
|
-
execute "sed -e 's/^/#/' -i #{fetch(:tmp_dir_original_commented_config)}"
|
184
|
-
|
185
|
-
# Save to a file the new desired configuration
|
186
|
-
new_directory_configs = <<-EOF
|
187
|
-
|
188
|
-
# Do not allow browsing outside the document root
|
189
|
-
<Directory />
|
190
|
-
Order Deny,Allow
|
191
|
-
Deny from all
|
192
|
-
Options None
|
193
|
-
AllowOverride None
|
194
|
-
</Directory>
|
195
|
-
|
196
|
-
EOF
|
197
|
-
upload! StringIO.new(new_directory_configs), fetch(:tmp_dir_new_config).to_s
|
198
|
-
|
199
|
-
# Update the new configuration file to have the original configuration commented
|
200
|
-
debug "cat #{fetch(:tmp_dir_new_config)} >> #{fetch(:tmp_dir_original_commented_config)}"
|
201
|
-
execute "cat #{fetch(:tmp_dir_new_config)} >> #{fetch(:tmp_dir_original_commented_config)}"
|
202
|
-
execute "mv -f #{fetch(:tmp_dir_original_commented_config)} #{fetch(:tmp_dir_new_config)}"
|
203
|
-
|
204
|
-
# Generates the special SED parameter: 'N;' per line that should be replaced
|
205
|
-
special_sed_param = 'N;' * fetch(:def_directory_num_lines)
|
206
|
-
debug "Special sed parameter is: ''#{special_sed_param}''"
|
207
|
-
|
208
|
-
# Replace the old original directory configuration for a specific message (in the temporary file)
|
209
|
-
message_complete = "#{message_line1}\\n#\\n"
|
210
|
-
command_to_replace = "out=$(sed -e :a -e '$!N;s/\\n/.*/;ta' #{fetch(:tmp_dir_original_config)} | "\
|
211
|
-
"sed -e :a -e '$!N;s/\//./;ta'); sed -i '/<Directory .>.*/ {#{special_sed_param} "\
|
212
|
-
"s/'$out'/#{message_complete}/g}' #{fetch(:tmp_httpd_file)}"
|
213
|
-
debug command_to_replace
|
214
|
-
execute command_to_replace
|
215
|
-
|
216
|
-
# Search for the line where the message was inserted
|
217
|
-
command = "grep -n '#{message_line1}' #{fetch(:tmp_httpd_file)} | cut -d':' -f 1"
|
218
|
-
debug command
|
219
|
-
line_with_match = get_command_output(command).to_i
|
220
|
-
next_line = line_with_match + 1
|
221
|
-
debug "New configuration will be added to line #{next_line}"
|
222
|
-
|
223
|
-
# Inserts the new directory configuration (with the old configuration commented)
|
224
|
-
# in the line following the comment added before
|
225
|
-
command = "sed '#{next_line}r #{fetch(:tmp_dir_new_config)}' < #{fetch(:tmp_httpd_file)} "\
|
226
|
-
'> tmp_httpd_new_conf_merge.conf'
|
227
|
-
|
228
|
-
debug command
|
229
|
-
execute command
|
230
|
-
execute "mv -f tmp_httpd_new_conf_merge.conf #{fetch(:tmp_httpd_file)}"
|
231
|
-
|
232
|
-
# Replace the original Apache configuration file
|
233
|
-
execute "#{sudo_cmd} mv -f #{fetch(:tmp_httpd_file)} #{fetch(:httpd_conf_file)}"
|
234
|
-
|
235
|
-
# Remove all created temporary files
|
236
|
-
execute "rm -f #{fetch(:tmp_dir_original_config)} #{fetch(:tmp_dir_original_commented_config)} "\
|
237
|
-
"#{fetch(:tmp_dir_new_config)} #{fetch(:tmp_httpd_file)}"
|
238
|
-
end
|
239
|
-
end
|
240
|
-
end
|
241
|
-
end
|