ipaserver: Move /etc/httpd/ipa to /etc/ipa/httpd

freeipa.spec.in

@@ -1508,10 +1508,11 @@ fi
 %dir %{_sysconfdir}/ipa/html
 %config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
 %config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf
-%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
+%dir %{_sysconfdir}/ipa/http
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-rewrite.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-kdc-proxy.conf
+%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-pki-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
 %ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-ext.conf

install/share/Makefile.am

@@ -101,6 +101,7 @@ dist_app_DATA =				\
 	ipa-kdc-proxy.conf.template	\
 	ipa-pki-proxy.conf.template	\
 	ipa-rewrite.conf.template	\
+	ipa-vhost.conf.template		\
 	ipaca_default.ini		\
 	ipaca_customize.ini		\
 	ipaca_softhsm2.ini		\

install/share/ipa-vhost.conf.template

@@ -0,0 +1,50 @@
+#
+# VERSION 32 - DO NOT REMOVE THIS LINE
+#
+# This file may be overwritten on upgrades.
+#
+
+# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
+# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
+WSGISocketPrefix $WSGI_PREFIX_DIR
+
+# Configure mod_wsgi handler for /ipa
+WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
+  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
+  lang=C.UTF-8 locale=C.UTF-8
+
+<VirtualHost *:80>
+    ServerName $FQDN
+    ServerAlias ipa-ca.$DOMAIN
+
+    # Logging
+    CustomLog /var/log/httpd/ipa-access.log combined
+    ErrorLog /var/log/httpd/ipa-error.log
+
+    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
+    Include $HTTPD_IPA_REWRITE_CONF
+    Include $HTTPD_IPA_CONF
+</VirtualHost>
+
+# the below section is only need if you have above 3 lines and want SSL
+<VirtualHost *:443>
+    ServerName $FQDN
+    ServerAlias ipa-ca.$DOMAIN
+
+    # Logging
+    CustomLog /var/log/httpd/ipa-access.log combined
+    ErrorLog /var/log/httpd/ipa-error.log
+
+    # SSL
+    SSLEngine on
+    SSLCertificateFile $HTTPD_CERT_FILE
+    SSLCertificateKeyFile $HTTPD_KEY_FILE
+    SSLCACertificateFile $IPA_CA_CRT
+    SSLVerifyDepth $MOD_SSL_VERIFY_DEPTH
+
+    # FreeIPA
+    IncludeOptional $HTTPD_IPA_KDCPROXY_CONF_SYMLINK
+    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
+    Include $HTTPD_IPA_REWRITE_CONF
+    Include $HTTPD_IPA_CONF
+</VirtualHost>

install/share/ipa.conf.template

@@ -35,19 +35,11 @@ AddOutputFilterByType DEFLATE text/html text/plain text/xml \
  application/javascript application/json text/css \
  application/x-font-ttf
 
-# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
-# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
-WSGISocketPrefix $WSGI_PREFIX_DIR
-
 # Configure mod_wsgi handler for /ipa
-WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
-  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
-  lang=C.UTF-8 locale=C.UTF-8
 WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py process-group=ipa \
   application-group=%{GLOBAL}
 WSGIScriptReloading Off
 
-
 # Turn off mod_msgi handler for errors, config, crl:
 <Location "/ipa/errors">
   SetHandler None

ipaplatform/base/paths.py

@@ -46,11 +46,13 @@ class BasePathNamespace:
     GSSAPI_SESSION_KEY = "/etc/httpd/alias/ipasession.key"
     OLD_KRA_AGENT_PEM = "/etc/httpd/alias/kra-agent.pem"
     HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd"
     HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/conf.d/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/conf.d/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/httpd/conf.d/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/httpd/conf.d/ipa.conf"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/ipa-vhost.conf"
     HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf"
     HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/httpd/conf.d/ssl.conf"

ipaplatform/debian/paths.py

@@ -23,10 +23,12 @@ class DebianPathNamespace(BasePathNamespace):
     ALIAS_CACERT_ASC = "/etc/apache2/nssdb/cacert.asc"
     ALIAS_PWDFILE_TXT = "/etc/apache2/nssdb/pwdfile.txt"
     HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/apache2/sites-available/ipa.conf"
     HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf"
     HTTPD_SSL_CONF = "/etc/apache2/mods-available/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/apache2/sites-available/default-ssl.conf"

ipaplatform/suse/paths.py

@@ -17,10 +17,12 @@ class SusePathNamespace(BasePathNamespace):
     HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
     GSSAPI_SESSION_KEY = "/etc/apache2/ipa/ipasession.key"
     HTTPD_CONF_D_DIR = "/etc/apache2/conf.d/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf.d/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf.d/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf.d/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/apache2/conf.d/ipa.conf"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/apache2/conf.d/ipa-vhost.conf"
     HTTPD_NSS_CONF = "/etc/apache2/conf.d/nss.conf"
     HTTPD_SSL_CONF = "/etc/apache2/conf.d/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/apache2/conf.d/ssl.conf"

ipaserver/install/httpinstance.py

@@ -112,6 +112,14 @@ class HTTPInstance(service.Service):
             IPA_CCACHES=paths.IPA_CCACHES,
             WSGI_PREFIX_DIR=paths.WSGI_PREFIX_DIR,
             WSGI_PROCESSES=constants.WSGI_PROCESSES,
+            HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
+            HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
+            HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
+            HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
+            HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
+            HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
+            IPA_CA_CRT=paths.IPA_CA_CRT,
+            MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
         )
         self.ca_file = ca_file
         if ca_is_configured is not None:
@@ -129,7 +137,6 @@ class HTTPInstance(service.Service):
         self.step("configuring mod_ssl log directory",
                   self.set_mod_ssl_logdir)
         self.step("disabling mod_ssl OCSP", self.disable_mod_ssl_ocsp)
-        self.step("adding URL rewriting rules", self.__add_include)
         self.step("configuring httpd", self.__configure_http)
         self.step("setting up httpd keytab", self.request_service_keytab)
         self.step("configuring Gssproxy", self.configure_gssproxy)
@@ -191,6 +198,14 @@ class HTTPInstance(service.Service):
         # https://pagure.io/freeipa/issue/7662
         tasks.restore_context(session_dir)
 
+        # create /etc/httpd/ipa
+        if not os.path.isdir(paths.HTTPD_IPA_DIR):
+            os.makedirs(paths.HTTPD_IPA_DIR)
+        # Must be world-readable / executable
+        os.chmod(paths.HTTPD_IPA_DIR, 0o755)
+        # Restore SELinux context of /etc/httpd/ipa
+        tasks.restore_context(paths.HTTPD_IPA_DIR)
+
         target_fname = paths.HTTPD_IPA_CONF
         http_txt = ipautil.template_file(
             os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -202,6 +217,17 @@ class HTTPInstance(service.Service):
         http_fd.close()
         os.chmod(target_fname, 0o644)
 
+        target_fname = paths.HTTPD_IPA_SITE_CONF
+        http_txt = ipautil.template_file(
+            os.path.join(paths.USR_SHARE_IPA_DIR,
+                         "ipa-vhost.conf.template"),
+            self.sub_dict)
+        self.fstore.backup_file(paths.HTTPD_IPA_SITE_CONF)
+        http_fd = open(target_fname, "w")
+        http_fd.write(http_txt)
+        http_fd.close()
+        os.chmod(target_fname, 0o644)
+
         target_fname = paths.HTTPD_IPA_REWRITE_CONF
         http_txt = ipautil.template_file(
             os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -279,17 +305,6 @@ class HTTPInstance(service.Service):
             aug.set(ocsp_comment, '{} {}'.format(OCSP_DIRECTIVE, ocsp_state))
             aug.save()
 
-    def __add_include(self):
-        """This should run after __set_mod_nss_port so is already backed up"""
-        if installutils.update_file(paths.HTTPD_SSL_SITE_CONF,
-                                    '</VirtualHost>',
-                                    'Include {path}\n'
-                                    '</VirtualHost>'.format(
-                                        path=paths.HTTPD_IPA_REWRITE_CONF)
-                                    ) != 0:
-            self.print_msg("Adding Include conf.d/ipa-rewrite to "
-                           "%s failed." % paths.HTTPD_SSL_SITE_CONF)
-
     def configure_certmonger_renewal_guard(self):
         certmonger = services.knownservices.certmonger
         certmonger_stopped = not certmonger.is_running()
@@ -547,13 +562,14 @@ class HTTPInstance(service.Service):
             paths.HTTPD_PASSWD_FILE_FMT.format(host=api.env.host),
             paths.HTTPD_IPA_REWRITE_CONF,
             paths.HTTPD_IPA_CONF,
+            paths.HTTPD_IPA_SITE_CONF,
             paths.HTTPD_IPA_PKI_PROXY_CONF,
             paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
             paths.HTTPD_IPA_KDCPROXY_CONF,
             paths.GSSPROXY_CONF,
             paths.GSSAPI_SESSION_KEY,
             paths.HTTPD_PASSWORD_CONF,
-            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
+            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF
         ]
         # NSS DB backups
         remove_files.extend(
@@ -665,7 +681,6 @@ class HTTPInstance(service.Service):
         self.configure_mod_ssl_certs()
         self.set_mod_ssl_protocol()
         self.set_mod_ssl_logdir()
-        self.__add_include()
 
         self.cert = x509.load_certificate_from_file(paths.HTTPD_CERT_FILE)
 

ipaserver/install/ipa_backup.py

@@ -154,6 +154,7 @@ class Backup(admintool.AdminTool):
         paths.HTTPD_CERT_FILE,
         paths.HTTPD_KEY_FILE,
         paths.HTTPD_IPA_CONF,
+        paths.HTTPD_IPA_SITE_CONF,
         paths.SSHD_CONFIG,
         paths.SSHD_IPA_CONFIG,
         paths.SSH_CONFIG,

ipaserver/install/server/upgrade.py

@@ -20,7 +20,7 @@ from contextlib import contextmanager
 from augeas import Augeas
 
 from ipalib import api, x509
-from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD
+from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD, MOD_SSL_VERIFY_DEPTH
 from ipalib.install import certmonger
 from ipalib import sysrestore
 from ipalib.facts import is_ipa_configured
@@ -1658,6 +1658,14 @@ def upgrade_configuration():
         IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET,
         KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
         DOMAIN=api.env.domain,
+        HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
+        HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
+        HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
+        HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
+        HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
+        HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
+        IPA_CA_CRT=paths.IPA_CA_CRT,
+        MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
     )
 
     subject_base = find_subject_base()
@@ -1694,6 +1702,9 @@ def upgrade_configuration():
         upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
                                   "ipa.conf.template"))
+        upgrade_file(sub_dict, paths.HTTPD_IPA_SITE_CONF,
+                     os.path.join(paths.USR_SHARE_IPA_DIR,
+                                  "ipa-vhost.conf.template"))
         upgrade_file(sub_dict, paths.HTTPD_IPA_REWRITE_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
                                   "ipa-rewrite.conf.template"))