capistrano-exfel 0.2.2 → 0.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.rubocop.yml +0 -6
- data/Gemfile +3 -1
- data/README.md +2 -2
- data/Rakefile +2 -0
- data/capistrano-exfel.gemspec +5 -3
- data/capistrano.graph +86 -56
- data/capistrano.png +0 -0
- data/lib/capistrano/exfel.rb +2 -0
- data/lib/capistrano/exfel/co7.rb +3 -3
- data/lib/capistrano/exfel/version.rb +3 -1
- data/lib/capistrano/recipes/{co7 → apache}/00-passenger.conf +0 -0
- data/lib/capistrano/recipes/{ub14/apache.conf → apache/app_ssl.conf} +11 -4
- data/lib/capistrano/recipes/{co7 → apache}/httpd.conf +6 -0
- data/lib/capistrano/recipes/apache/ssl.conf +49 -0
- data/lib/capistrano/tasks/apache.rake +268 -0
- data/lib/capistrano/tasks/app_home.rake +2 -0
- data/lib/capistrano/tasks/application.rake +2 -0
- data/lib/capistrano/tasks/assets.rake +2 -0
- data/lib/capistrano/tasks/database.rake +2 -0
- data/lib/capistrano/tasks/secrets.rake +2 -0
- data/lib/capistrano/tasks/util.rake +2 -0
- metadata +14 -26
- data/lib/capistrano/exfel/sl6.rb +0 -21
- data/lib/capistrano/exfel/ub14.rb +0 -20
- data/lib/capistrano/recipes/apache_http.conf +0 -46
- data/lib/capistrano/recipes/apache_ssl.conf +0 -252
- data/lib/capistrano/recipes/co7/apache_http.conf +0 -7
- data/lib/capistrano/recipes/co7/apache_ssl.conf +0 -66
- data/lib/capistrano/recipes/ub14/passenger.conf +0 -6
- data/lib/capistrano/tasks/apache_co7.rake +0 -133
- data/lib/capistrano/tasks/apache_common.rake +0 -75
- data/lib/capistrano/tasks/apache_rpm.rake +0 -50
- data/lib/capistrano/tasks/apache_sl6.rake +0 -241
- data/lib/capistrano/tasks/apache_ub14.rake +0 -116
@@ -1,66 +0,0 @@
|
|
1
|
-
Listen 443 https
|
2
|
-
|
3
|
-
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
|
4
|
-
|
5
|
-
SSLSessionCache shmcb:/run/httpd/sslcache(512000)
|
6
|
-
SSLSessionCacheTimeout 300
|
7
|
-
|
8
|
-
SSLRandomSeed startup file:/dev/urandom 256
|
9
|
-
SSLRandomSeed connect builtin
|
10
|
-
|
11
|
-
SSLCryptoDevice builtin
|
12
|
-
|
13
|
-
<VirtualHost _default_:443>
|
14
|
-
|
15
|
-
ErrorLog logs/ssl_error_log
|
16
|
-
TransferLog logs/ssl_access_log
|
17
|
-
LogLevel warn
|
18
|
-
|
19
|
-
SSLEngine on
|
20
|
-
|
21
|
-
SSLProtocol all -SSLv2
|
22
|
-
|
23
|
-
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
|
24
|
-
|
25
|
-
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
|
26
|
-
|
27
|
-
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
|
28
|
-
|
29
|
-
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
30
|
-
SSLOptions +StdEnvVars
|
31
|
-
</Files>
|
32
|
-
<Directory "/var/www/cgi-bin">
|
33
|
-
SSLOptions +StdEnvVars
|
34
|
-
</Directory>
|
35
|
-
|
36
|
-
BrowserMatch "MSIE [2-5]" \
|
37
|
-
nokeepalive ssl-unclean-shutdown \
|
38
|
-
downgrade-1.0 force-response-1.0
|
39
|
-
|
40
|
-
CustomLog logs/ssl_request_log \
|
41
|
-
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
42
|
-
# <<APPLICATION_NAME>> - Ruby on Rails Application
|
43
|
-
#
|
44
|
-
# Application secured by SSL
|
45
|
-
|
46
|
-
Alias /<<APPLICATION_NAME>> /var/www/html/<<APPLICATION_NAME>>
|
47
|
-
|
48
|
-
#
|
49
|
-
# Application
|
50
|
-
#
|
51
|
-
<Directory "/var/www/html/<<APPLICATION_NAME>>/">
|
52
|
-
RackBaseURI /<<APPLICATION_NAME>>
|
53
|
-
RailsEnv <<ENVIRONMENT>>
|
54
|
-
|
55
|
-
PassengerUser nobody
|
56
|
-
# Scientific Linux: nobody / Ubuntu/Debian: nogroup
|
57
|
-
PassengerGroup nobody
|
58
|
-
|
59
|
-
# This relaxes Apache security settings.
|
60
|
-
Options -Indexes +MultiViews +FollowSymLinks
|
61
|
-
AllowOverride None
|
62
|
-
Require all granted
|
63
|
-
</Directory>
|
64
|
-
|
65
|
-
</VirtualHost>
|
66
|
-
|
@@ -1,133 +0,0 @@
|
|
1
|
-
namespace :apache do
|
2
|
-
desc 'Configure Apache configuration files'
|
3
|
-
task :configure do
|
4
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
5
|
-
|
6
|
-
invoke 'apache:create_apache_shared_folder'
|
7
|
-
invoke 'apache:configure_apache_modules'
|
8
|
-
invoke 'apache:configure_app_conf_file'
|
9
|
-
invoke 'apache:configure_app_ssl_conf_file'
|
10
|
-
|
11
|
-
on roles(:app) do
|
12
|
-
if remote_file_exists?('/etc/httpd/conf.d/ssl.conf')
|
13
|
-
execute "#{sudo_cmd} mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf_bck"
|
14
|
-
end
|
15
|
-
end
|
16
|
-
end
|
17
|
-
|
18
|
-
desc 'Configure (HTTP) Apache modules'
|
19
|
-
task :configure_apache_modules do
|
20
|
-
on roles(:app) do
|
21
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
22
|
-
|
23
|
-
debug '#' * 50
|
24
|
-
debug 'Configure (HTTP) Apache Passenger module'
|
25
|
-
|
26
|
-
set :shared_passenger_file, "#{fetch(:shared_apache_path)}/00-passenger.conf"
|
27
|
-
passenger_file = File.expand_path('../recipes/co7/00-passenger.conf', __dir__)
|
28
|
-
|
29
|
-
upload! StringIO.new(File.read(passenger_file)), fetch(:shared_passenger_file).to_s
|
30
|
-
|
31
|
-
debug "chmod g+w #{fetch(:shared_passenger_file)}"
|
32
|
-
execute "chmod g+w #{fetch(:shared_passenger_file)}"
|
33
|
-
|
34
|
-
passenger_root = get_command_output('/usr/local/rvm/bin/rvm default do passenger-config --root')
|
35
|
-
ruby_path = "/#{passenger_root.split('/')[1..5].join('/')}/wrappers/ruby"
|
36
|
-
|
37
|
-
debug "sed -i 's|<<PASSENGER_ROOT>>|#{passenger_root}|g' #{fetch(:shared_passenger_file)}"
|
38
|
-
execute "sed -i 's|<<PASSENGER_ROOT>>|#{passenger_root}|g' #{fetch(:shared_passenger_file)}"
|
39
|
-
execute "sed -i 's|<<RUBY_PATH>>|#{ruby_path}|g' #{fetch(:shared_passenger_file)}"
|
40
|
-
|
41
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_passenger_file)} /etc/httpd/conf.modules.d/"
|
42
|
-
|
43
|
-
debug '#' * 50
|
44
|
-
debug 'Deactivate unnecessary Apache modules'
|
45
|
-
%w[00-dav.conf 00-lua.conf 00-proxy.conf 01-cgi.conf].each do |file|
|
46
|
-
if remote_file_exists?("/etc/httpd/conf.modules.d/#{file}")
|
47
|
-
execute "#{sudo_cmd} mv /etc/httpd/conf.modules.d/#{file} /etc/httpd/conf.modules.d/#{file}_bck"
|
48
|
-
end
|
49
|
-
end
|
50
|
-
debug '#' * 50
|
51
|
-
end
|
52
|
-
end
|
53
|
-
|
54
|
-
# desc 'Configure (HTTP) Apache Application configuration files'
|
55
|
-
task :configure_app_conf_file do
|
56
|
-
on roles(:app), in: :sequence do
|
57
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
58
|
-
|
59
|
-
debug '#' * 50
|
60
|
-
debug 'Configure (HTTP) Apache Application configuration files'
|
61
|
-
|
62
|
-
set :shared_apache_conf_file, "#{fetch(:shared_apache_path)}/app_#{fetch(:app_name_uri)}.conf"
|
63
|
-
http_file = File.expand_path('../recipes/co7/apache_http.conf', __dir__)
|
64
|
-
upload! StringIO.new(File.read(http_file)), fetch(:shared_apache_conf_file).to_s
|
65
|
-
|
66
|
-
debug "chmod g+w #{fetch(:shared_apache_conf_file)}"
|
67
|
-
execute "chmod g+w #{fetch(:shared_apache_conf_file)}"
|
68
|
-
|
69
|
-
app_domain = fetch(:app_domain)
|
70
|
-
server_name = app_domain.split('/')[2]
|
71
|
-
|
72
|
-
execute "sed -i 's|<<APP_DOMAIN>>|#{app_domain}|g' #{fetch(:shared_apache_conf_file)}"
|
73
|
-
execute "sed -i 's|<<SERVER_NAME>>|#{server_name}|g' #{fetch(:shared_apache_conf_file)}"
|
74
|
-
|
75
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_apache_conf_file)} /etc/httpd/conf.d/"
|
76
|
-
|
77
|
-
debug '#' * 50
|
78
|
-
end
|
79
|
-
end
|
80
|
-
|
81
|
-
# desc 'Configure (HTTPS) Apache Application configuration files'
|
82
|
-
task :configure_app_ssl_conf_file do
|
83
|
-
on roles(:app), in: :sequence do
|
84
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
85
|
-
|
86
|
-
debug '#' * 50
|
87
|
-
debug 'Configure (HTTPS) Apache Application configuration files'
|
88
|
-
|
89
|
-
set :shared_apache_conf_ssl_file, "#{fetch(:shared_apache_path)}/app_#{fetch(:app_name_uri)}_ssl.conf"
|
90
|
-
http_ssl_file = File.expand_path('../recipes/co7/apache_ssl.conf', __dir__)
|
91
|
-
upload! StringIO.new(File.read(http_ssl_file)), fetch(:shared_apache_conf_ssl_file).to_s
|
92
|
-
|
93
|
-
debug "chmod g+w #{fetch(:shared_apache_conf_ssl_file)}"
|
94
|
-
execute "chmod g+w #{fetch(:shared_apache_conf_ssl_file)}"
|
95
|
-
|
96
|
-
execute "sed -i 's/<<APPLICATION_NAME>>/#{fetch(:app_name_uri)}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
97
|
-
execute "sed -i 's/<<ENVIRONMENT>>/#{fetch(:environment)}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
98
|
-
|
99
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_apache_conf_ssl_file)} /etc/httpd/conf.d/"
|
100
|
-
|
101
|
-
debug '#' * 50
|
102
|
-
end
|
103
|
-
end
|
104
|
-
|
105
|
-
desc 'Update httpd.conf to secure apache server'
|
106
|
-
task :secure_apache do
|
107
|
-
on roles(:web) do
|
108
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
109
|
-
|
110
|
-
debug '#' * 50
|
111
|
-
debug 'Update httpd.conf to secure apache server'
|
112
|
-
|
113
|
-
set :httpd_conf_file, '/etc/httpd/conf/httpd.conf'
|
114
|
-
|
115
|
-
# Replace the original Apache configuration file
|
116
|
-
if remote_file_exists?('/etc/httpd/conf/httpd.conf_bck')
|
117
|
-
info 'Apache original configuration file already backed up at: /etc/httpd/conf/httpd.conf_bck'
|
118
|
-
else
|
119
|
-
execute "#{sudo_cmd} cp -f #{fetch(:httpd_conf_file)} /etc/httpd/conf/httpd.conf_bck"
|
120
|
-
info 'Apache original configuration file backed up at: /etc/httpd/conf/httpd.conf_bck'
|
121
|
-
end
|
122
|
-
|
123
|
-
# Create a temporary copy of the Apache configuration file
|
124
|
-
set :tmp_httpd_file, '/tmp/httpd.conf'
|
125
|
-
httpd_safe_file = File.expand_path('../recipes/co7/httpd.conf', __dir__)
|
126
|
-
|
127
|
-
upload! StringIO.new(File.read(httpd_safe_file)), fetch(:tmp_httpd_file).to_s
|
128
|
-
|
129
|
-
# Replace the original Apache configuration file
|
130
|
-
execute "#{sudo_cmd} mv -f #{fetch(:tmp_httpd_file)} #{fetch(:httpd_conf_file)}"
|
131
|
-
end
|
132
|
-
end
|
133
|
-
end
|
@@ -1,75 +0,0 @@
|
|
1
|
-
# apache tasks common to all distros
|
2
|
-
|
3
|
-
namespace :apache do
|
4
|
-
desc 'Check that the user has write permissions in the Deploy and in Apache DocumentRoot folders'
|
5
|
-
task :check_write_permissions do
|
6
|
-
invoke 'apache:check_write_permissions_on_deploy'
|
7
|
-
invoke 'apache:check_write_permissions_on_document_root'
|
8
|
-
end
|
9
|
-
|
10
|
-
desc 'Check that we have the right permission to the folder the app should be deployed to'
|
11
|
-
task :check_write_permissions_on_deploy do
|
12
|
-
on roles(:app), in: :sequence do |host|
|
13
|
-
debug '#' * 50
|
14
|
-
debug "Checking folder '#{fetch(:deploy_to)}' (where the application has to be deployed) "\
|
15
|
-
"for the right permissions on Host '#{host}'"
|
16
|
-
|
17
|
-
if test("[ -w #{fetch(:deploy_to)} ]")
|
18
|
-
info "#{fetch(:deploy_to)} is writable on #{host}"
|
19
|
-
else
|
20
|
-
error "#{fetch(:deploy_to)} is not writable on #{host}"
|
21
|
-
end
|
22
|
-
|
23
|
-
debug '#' * 50
|
24
|
-
end
|
25
|
-
end
|
26
|
-
|
27
|
-
desc 'Check that we have the right permission to the Apache DocumentRoot folder'
|
28
|
-
task :check_write_permissions_on_document_root do
|
29
|
-
on roles(:web) do |host|
|
30
|
-
debug '#' * 50
|
31
|
-
debug "Checking Apache DocumentRoot folder (#{fetch(:apache_document_root)}) permissions on Host '#{host}'"
|
32
|
-
|
33
|
-
if test("[ -w #{fetch(:apache_document_root)} ]")
|
34
|
-
info "#{fetch(:apache_document_root)} is writable on #{host}"
|
35
|
-
else
|
36
|
-
info "#{fetch(:apache_document_root)} is not writable on #{host}"
|
37
|
-
end
|
38
|
-
|
39
|
-
debug '#' * 50
|
40
|
-
end
|
41
|
-
end
|
42
|
-
|
43
|
-
# desc 'Create Apache configuration files shared folder'
|
44
|
-
task :create_apache_shared_folder do
|
45
|
-
on roles(:app) do
|
46
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
47
|
-
|
48
|
-
debug '#' * 50
|
49
|
-
debug 'Create Apache configuration files shared folder'
|
50
|
-
|
51
|
-
debug "mkdir -p #{fetch(:shared_apache_path)}"
|
52
|
-
execute "#{sudo_cmd} mkdir -p #{fetch(:shared_apache_path)}"
|
53
|
-
|
54
|
-
debug "chmod g+ws #{fetch(:shared_apache_path)}"
|
55
|
-
execute "#{sudo_cmd} chmod g+ws #{fetch(:shared_apache_path)}"
|
56
|
-
|
57
|
-
debug '#' * 50
|
58
|
-
end
|
59
|
-
end
|
60
|
-
|
61
|
-
desc 'Create symbolic link to application public folder in Apache DocumentRoot folder'
|
62
|
-
task :create_symbolic_link do
|
63
|
-
on roles(:web), in: :sequence do
|
64
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
65
|
-
|
66
|
-
info '#' * 50
|
67
|
-
info 'Creating application symbolic link'
|
68
|
-
|
69
|
-
debug "ln -sfn #{fetch(:deploy_to)}/current/public #{fetch(:apache_deploy_symbolic_link)}"
|
70
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:deploy_to)}/current/public #{fetch(:apache_deploy_symbolic_link)}"
|
71
|
-
|
72
|
-
info '#' * 50
|
73
|
-
end
|
74
|
-
end
|
75
|
-
end
|
@@ -1,50 +0,0 @@
|
|
1
|
-
# apache tasks common to RPM-based distros (CentOS and Scientific Linux)
|
2
|
-
|
3
|
-
namespace :apache do
|
4
|
-
desc 'Configure Apache (httpd) and restart it'
|
5
|
-
task :configure_and_start do
|
6
|
-
invoke 'apache:configure'
|
7
|
-
invoke 'apache:chkconfig_on'
|
8
|
-
# invoke 'apache:restart'
|
9
|
-
invoke 'apache:secure_apache' # This should go to Puppet
|
10
|
-
invoke 'apache:create_symbolic_link'
|
11
|
-
end
|
12
|
-
|
13
|
-
desc 'Configure Apache to start at bootup'
|
14
|
-
task :chkconfig_on do
|
15
|
-
on roles(:web) do
|
16
|
-
info 'In task apache:chkconfig_on'
|
17
|
-
|
18
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
19
|
-
|
20
|
-
debug '#' * 50
|
21
|
-
|
22
|
-
debug 'chkconfig httpd on'
|
23
|
-
execute "#{sudo_cmd} chkconfig httpd on"
|
24
|
-
|
25
|
-
info 'Configured Apache to start at bootup'
|
26
|
-
debug '#' * 50
|
27
|
-
end
|
28
|
-
end
|
29
|
-
|
30
|
-
desc 'Restart Apache (httpd) service'
|
31
|
-
task :restart do
|
32
|
-
on roles(:web) do
|
33
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
34
|
-
|
35
|
-
debug '#' * 50
|
36
|
-
|
37
|
-
debug 'service httpd stop'
|
38
|
-
execute "#{sudo_cmd} service httpd stop"
|
39
|
-
|
40
|
-
debug 'pkill -9 httpd || true'
|
41
|
-
execute "#{sudo_cmd} pkill -9 httpd || true"
|
42
|
-
|
43
|
-
debug 'service httpd start'
|
44
|
-
execute "#{sudo_cmd} service httpd start"
|
45
|
-
|
46
|
-
info 'Restarted Apache (httpd) service'
|
47
|
-
debug '#' * 50
|
48
|
-
end
|
49
|
-
end
|
50
|
-
end
|
@@ -1,241 +0,0 @@
|
|
1
|
-
namespace :apache do
|
2
|
-
desc 'Configure Apache configuration files'
|
3
|
-
task :configure do
|
4
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
5
|
-
|
6
|
-
invoke 'apache:create_apache_shared_folder'
|
7
|
-
invoke 'apache:configure_app_conf_file'
|
8
|
-
invoke 'apache:configure_app_ssl_conf_file'
|
9
|
-
|
10
|
-
on roles(:app) do
|
11
|
-
if remote_file_exists?('/etc/httpd/conf.d/ssl.conf')
|
12
|
-
execute "#{sudo_cmd} mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf_bck"
|
13
|
-
end
|
14
|
-
end
|
15
|
-
end
|
16
|
-
|
17
|
-
# desc 'Configure (HTTP) Apache Application configuration files'
|
18
|
-
task :configure_app_conf_file do
|
19
|
-
on roles(:app), in: :sequence do
|
20
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
21
|
-
|
22
|
-
debug '#' * 50
|
23
|
-
debug 'Configure (HTTP) Apache Application configuration files'
|
24
|
-
|
25
|
-
set :shared_apache_conf_file, "#{fetch(:shared_apache_path)}/app_#{fetch(:app_name_uri)}.conf"
|
26
|
-
http_file = File.expand_path('../recipes/apache_http.conf', __dir__)
|
27
|
-
upload! StringIO.new(File.read(http_file)), fetch(:shared_apache_conf_file).to_s
|
28
|
-
|
29
|
-
debug "chmod g+w #{fetch(:shared_apache_conf_file)}"
|
30
|
-
execute "chmod g+w #{fetch(:shared_apache_conf_file)}"
|
31
|
-
|
32
|
-
passenger_root = get_command_output('/usr/local/rvm/bin/rvm default do passenger-config --root')
|
33
|
-
ruby_path = "/#{passenger_root.split('/')[1..5].join('/')}/wrappers/ruby"
|
34
|
-
app_domain = fetch(:app_domain)
|
35
|
-
server_name = app_domain.split('/')[2]
|
36
|
-
|
37
|
-
debug "sed -i 's|<<PASSENGER_ROOT>>|#{passenger_root}|g' #{fetch(:shared_apache_conf_file)}"
|
38
|
-
execute "sed -i 's|<<PASSENGER_ROOT>>|#{passenger_root}|g' #{fetch(:shared_apache_conf_file)}"
|
39
|
-
|
40
|
-
execute "sed -i 's|<<RUBY_PATH>>|#{ruby_path}|g' #{fetch(:shared_apache_conf_file)}"
|
41
|
-
execute "sed -i 's|<<APP_DOMAIN>>|#{app_domain}|g' #{fetch(:shared_apache_conf_file)}"
|
42
|
-
execute "sed -i 's|<<SERVER_NAME>>|#{server_name}|g' #{fetch(:shared_apache_conf_file)}"
|
43
|
-
|
44
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_apache_conf_file)} /etc/httpd/conf.d/"
|
45
|
-
|
46
|
-
debug '#' * 50
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
# desc 'Configure (HTTPS) Apache Application configuration files'
|
51
|
-
task :configure_app_ssl_conf_file do
|
52
|
-
on roles(:app), in: :sequence do
|
53
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
54
|
-
|
55
|
-
debug '#' * 50
|
56
|
-
debug 'Configure (HTTPS) Apache Application configuration files'
|
57
|
-
|
58
|
-
set :shared_apache_conf_ssl_file, "#{fetch(:shared_apache_path)}/app_#{fetch(:app_name_uri)}_ssl.conf"
|
59
|
-
http_ssl_file = File.expand_path('../recipes/apache_ssl.conf', __dir__)
|
60
|
-
upload! StringIO.new(File.read(http_ssl_file)), fetch(:shared_apache_conf_ssl_file).to_s
|
61
|
-
|
62
|
-
debug "chmod g+w #{fetch(:shared_apache_conf_ssl_file)}"
|
63
|
-
execute "chmod g+w #{fetch(:shared_apache_conf_ssl_file)}"
|
64
|
-
|
65
|
-
server_name = string_between_markers(fetch(:app_domain), '://', '/')
|
66
|
-
|
67
|
-
execute "sed -i 's/<<SERVER_NAME>>/#{server_name}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
68
|
-
execute "sed -i 's/<<APPLICATION_NAME>>/#{fetch(:app_name_uri)}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
69
|
-
execute "sed -i 's/<<ENVIRONMENT>>/#{fetch(:environment)}/g' #{fetch(:shared_apache_conf_ssl_file)}"
|
70
|
-
|
71
|
-
execute "#{sudo_cmd} ln -sfn #{fetch(:shared_apache_conf_ssl_file)} /etc/httpd/conf.d/"
|
72
|
-
|
73
|
-
debug '#' * 50
|
74
|
-
end
|
75
|
-
end
|
76
|
-
|
77
|
-
desc 'Update httpd.conf to secure apache server'
|
78
|
-
task :secure_apache do
|
79
|
-
on roles(:web) do
|
80
|
-
sudo_cmd = "echo #{fetch(:password)} | sudo -S"
|
81
|
-
|
82
|
-
debug '#' * 50
|
83
|
-
debug 'Update httpd.conf to secure apache server'
|
84
|
-
|
85
|
-
set :httpd_conf_file, '/etc/httpd/conf/httpd.conf'
|
86
|
-
|
87
|
-
# Replace the original Apache configuration file
|
88
|
-
if remote_file_exists?('/etc/httpd/conf/httpd.conf_bck')
|
89
|
-
info 'Apache original configuration file already backed up at: /etc/httpd/conf/httpd.conf_bck'
|
90
|
-
else
|
91
|
-
execute "#{sudo_cmd} cp -f #{fetch(:httpd_conf_file)} /etc/httpd/conf/httpd.conf_bck"
|
92
|
-
info 'Apache original configuration file backed up at: /etc/httpd/conf/httpd.conf_bck'
|
93
|
-
end
|
94
|
-
|
95
|
-
# The ServerSignature directive allows the configuration of a trailing footer line under server-generated docs
|
96
|
-
# Options: On | Off | EMail
|
97
|
-
# More details: http://httpd.apache.org/docs/current/mod/core.html#serversignature
|
98
|
-
set :server_signature_off, get_num_occurrences_in_file(fetch(:httpd_conf_file), 'ServerSignature Off')
|
99
|
-
|
100
|
-
if fetch(:server_signature_off) == 1
|
101
|
-
info 'ServerSignature Off is already set'
|
102
|
-
|
103
|
-
else
|
104
|
-
set :num_replacements, 0
|
105
|
-
%w[On Off EMail].each do |option|
|
106
|
-
set :server_signature_option,
|
107
|
-
get_num_occurrences_in_file(fetch(:httpd_conf_file), "ServerSignature #{option}")
|
108
|
-
|
109
|
-
if fetch(:server_signature_option) == 1
|
110
|
-
info "sed -i 's/ServerSignature #{option}/ServerSignature Off/g' #{fetch(:httpd_conf_file)}"
|
111
|
-
execute "#{sudo_cmd} sed -i 's/ServerSignature #{option}/ServerSignature Off/g' #{fetch(:httpd_conf_file)}"
|
112
|
-
set :num_replacements, fetch(:num_replacements) + 1
|
113
|
-
end
|
114
|
-
end
|
115
|
-
|
116
|
-
error 'ServerSignature was not found' if fetch(:num_replacements).zero?
|
117
|
-
end
|
118
|
-
|
119
|
-
# Don't give away too much information about all the subcomponents we are running.
|
120
|
-
#
|
121
|
-
# Options: Major|Minor|Min[imal]|Prod[uctOnly]|OS|Full
|
122
|
-
# More details: http://httpd.apache.org/docs/current/mod/core.html#servertokens
|
123
|
-
set :server_token_prod, get_num_occurrences_in_file(fetch(:httpd_conf_file), 'ServerTokens Prod')
|
124
|
-
if fetch(:server_token_prod) == 1
|
125
|
-
info 'ServerTokens Prod is already set'
|
126
|
-
else
|
127
|
-
set :num_replacements, 0
|
128
|
-
%w[Major Minor Minimal Min ProductOnly Prod OS Full].each do |option|
|
129
|
-
set :server_token_option, get_num_occurrences_in_file(fetch(:httpd_conf_file), "ServerTokens #{option}")
|
130
|
-
|
131
|
-
next unless fetch(:server_token_option) == 1
|
132
|
-
|
133
|
-
# Then, only if fetch(:server_token_option) == 1
|
134
|
-
info "sed -i 's/ServerTokens #{option}/ServerTokens Prod/g' #{fetch(:httpd_conf_file)}"
|
135
|
-
execute "#{sudo_cmd} sed -i 's/ServerTokens #{option}/ServerTokens Prod/g' #{fetch(:httpd_conf_file)}"
|
136
|
-
set :num_replacements, fetch(:num_replacements) + 1
|
137
|
-
end
|
138
|
-
|
139
|
-
error 'ServerTokens was not found' if fetch(:num_replacements).zero?
|
140
|
-
end
|
141
|
-
|
142
|
-
# Do not allow browsing outside the document root
|
143
|
-
#
|
144
|
-
# <Directory />
|
145
|
-
# Order Deny,Allow
|
146
|
-
# Deny from all
|
147
|
-
# Options None
|
148
|
-
# AllowOverride None
|
149
|
-
# </Directory>
|
150
|
-
#
|
151
|
-
message_line1 = '# Default Directory configuration changed via Capistrano.'
|
152
|
-
|
153
|
-
set :server_dir_secure_configuration, get_num_occurrences_in_file(fetch(:httpd_conf_file), message_line1)
|
154
|
-
|
155
|
-
if fetch(:server_token_prod) == 1
|
156
|
-
info 'The correct directory configuration is already correctly set'
|
157
|
-
else
|
158
|
-
|
159
|
-
set :tmp_dir_original_config, '/tmp/tmp_dir_original_config.conf'
|
160
|
-
set :tmp_dir_original_commented_config, '/tmp/tmp_dir_original_commented_config.conf'
|
161
|
-
set :tmp_dir_new_config, '/tmp/tmp_dir_new_config.conf'
|
162
|
-
|
163
|
-
# Create a temporary copy of the Apache configuration file
|
164
|
-
set :tmp_httpd_file, '/tmp/httpd.conf'
|
165
|
-
execute :cp, '-f', "#{fetch(:httpd_conf_file)} #{fetch(:tmp_httpd_file)}"
|
166
|
-
|
167
|
-
set :grep_for_directory, "grep -Pzo '^([ ]*<Directory />[ ]*)(\\n.*)+(\\n[ ]*</Directory>[ ]*)(\\n){1}$' "\
|
168
|
-
"#{fetch(:tmp_httpd_file)}"
|
169
|
-
|
170
|
-
# How many lines have the original configuration
|
171
|
-
command = "#{fetch(:grep_for_directory)} | grep -n '</Directory>' | head -n 1 | cut -d ':' -f1"
|
172
|
-
set :def_directory_num_lines, get_command_output(command).to_i
|
173
|
-
debug "Original configuration has #{fetch(:def_directory_num_lines)} lines."
|
174
|
-
|
175
|
-
# Saves to a file the original configuration
|
176
|
-
command = "#{fetch(:grep_for_directory)} | "\
|
177
|
-
"head -n #{fetch(:def_directory_num_lines)} > #{fetch(:tmp_dir_original_config)}"
|
178
|
-
debug command
|
179
|
-
execute command
|
180
|
-
|
181
|
-
# Saves to a file the original configuration commented
|
182
|
-
execute :cp, '-f', "#{fetch(:tmp_dir_original_config)} #{fetch(:tmp_dir_original_commented_config)}"
|
183
|
-
execute "sed -e 's/^/#/' -i #{fetch(:tmp_dir_original_commented_config)}"
|
184
|
-
|
185
|
-
# Save to a file the new desired configuration
|
186
|
-
new_directory_configs = <<-EOF
|
187
|
-
|
188
|
-
# Do not allow browsing outside the document root
|
189
|
-
<Directory />
|
190
|
-
Order Deny,Allow
|
191
|
-
Deny from all
|
192
|
-
Options None
|
193
|
-
AllowOverride None
|
194
|
-
</Directory>
|
195
|
-
|
196
|
-
EOF
|
197
|
-
upload! StringIO.new(new_directory_configs), fetch(:tmp_dir_new_config).to_s
|
198
|
-
|
199
|
-
# Update the new configuration file to have the original configuration commented
|
200
|
-
debug "cat #{fetch(:tmp_dir_new_config)} >> #{fetch(:tmp_dir_original_commented_config)}"
|
201
|
-
execute "cat #{fetch(:tmp_dir_new_config)} >> #{fetch(:tmp_dir_original_commented_config)}"
|
202
|
-
execute "mv -f #{fetch(:tmp_dir_original_commented_config)} #{fetch(:tmp_dir_new_config)}"
|
203
|
-
|
204
|
-
# Generates the special SED parameter: 'N;' per line that should be replaced
|
205
|
-
special_sed_param = 'N;' * fetch(:def_directory_num_lines)
|
206
|
-
debug "Special sed parameter is: ''#{special_sed_param}''"
|
207
|
-
|
208
|
-
# Replace the old original directory configuration for a specific message (in the temporary file)
|
209
|
-
message_complete = "#{message_line1}\\n#\\n"
|
210
|
-
command_to_replace = "out=$(sed -e :a -e '$!N;s/\\n/.*/;ta' #{fetch(:tmp_dir_original_config)} | "\
|
211
|
-
"sed -e :a -e '$!N;s/\//./;ta'); sed -i '/<Directory .>.*/ {#{special_sed_param} "\
|
212
|
-
"s/'$out'/#{message_complete}/g}' #{fetch(:tmp_httpd_file)}"
|
213
|
-
debug command_to_replace
|
214
|
-
execute command_to_replace
|
215
|
-
|
216
|
-
# Search for the line where the message was inserted
|
217
|
-
command = "grep -n '#{message_line1}' #{fetch(:tmp_httpd_file)} | cut -d':' -f 1"
|
218
|
-
debug command
|
219
|
-
line_with_match = get_command_output(command).to_i
|
220
|
-
next_line = line_with_match + 1
|
221
|
-
debug "New configuration will be added to line #{next_line}"
|
222
|
-
|
223
|
-
# Inserts the new directory configuration (with the old configuration commented)
|
224
|
-
# in the line following the comment added before
|
225
|
-
command = "sed '#{next_line}r #{fetch(:tmp_dir_new_config)}' < #{fetch(:tmp_httpd_file)} "\
|
226
|
-
'> tmp_httpd_new_conf_merge.conf'
|
227
|
-
|
228
|
-
debug command
|
229
|
-
execute command
|
230
|
-
execute "mv -f tmp_httpd_new_conf_merge.conf #{fetch(:tmp_httpd_file)}"
|
231
|
-
|
232
|
-
# Replace the original Apache configuration file
|
233
|
-
execute "#{sudo_cmd} mv -f #{fetch(:tmp_httpd_file)} #{fetch(:httpd_conf_file)}"
|
234
|
-
|
235
|
-
# Remove all created temporary files
|
236
|
-
execute "rm -f #{fetch(:tmp_dir_original_config)} #{fetch(:tmp_dir_original_commented_config)} "\
|
237
|
-
"#{fetch(:tmp_dir_new_config)} #{fetch(:tmp_httpd_file)}"
|
238
|
-
end
|
239
|
-
end
|
240
|
-
end
|
241
|
-
end
|