Skip to content

Commit c028cfb

Browse files
spacelamaspacelama
committed
pve loadbalancer created in front of each proxmox node, and ssl added
pve DNS is now served out publicly, so that port 80 and 443 webservers can respond as a vhost, enabling certbot letsencrypt signing. Then these redirect onto port 8006, which only works inside the network from mgmt hosts
1 parent b13059e commit c028cfb

File tree

6 files changed

+171
-9
lines changed

6 files changed

+171
-9
lines changed

‎files/etc/apache2.webserver.ext/ports.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,10 @@ Listen 80
66

77
<IfModule ssl_module>
88
Listen 443
9+
Listen 8006
910
</IfModule>
1011

1112
<IfModule mod_gnutls.c>
1213
Listen 443
14+
Listen 8006
1315
</IfModule>

‎files/etc/apache2.webserver.ext/sites-enabled/2-pve.conf

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
<VirtualHost *:80>
2+
# The ServerName directive sets the request scheme, hostname and port that
3+
# the server uses to identify itself. This is used when creating
4+
# redirection URLs. In the context of virtual hosts, the ServerName
5+
# specifies what hostname must appear in the request's Host: header to
6+
# match this virtual host. For the default virtual host (this file) this
7+
# value is not decisive as it is used as a last resort host regardless.
8+
# However, you must set it for any further virtual host explicitly.
9+
#ServerName www.example.com
10+
11+
# ServerAdmin webmaster@localhost
12+
ServerAdmin [email protected]
13+
# will redirect from local and remote onto pve load balancer only accessible on the inside:
14+
ServerName pve.rather.puzzling.org
15+
ServerAlias pve
16+
17+
RewriteEngine on
18+
RewriteCond %{SERVER_NAME} =pve.rather.puzzling.org [OR]
19+
RewriteCond %{SERVER_NAME} =pve
20+
RewriteRule ^ https://pve.rather.puzzling.org:8006%{REQUEST_URI} [END,NE,R=permanent]
21+
</VirtualHost>
22+
23+
<VirtualHost *:443>
24+
# The ServerName directive sets the request scheme, hostname and port that
25+
# the server uses to identify itself. This is used when creating
26+
# redirection URLs. In the context of virtual hosts, the ServerName
27+
# specifies what hostname must appear in the request's Host: header to
28+
# match this virtual host. For the default virtual host (this file) this
29+
# value is not decisive as it is used as a last resort host regardless.
30+
# However, you must set it for any further virtual host explicitly.
31+
#ServerName www.example.com
32+
33+
# ServerAdmin webmaster@localhost
34+
ServerAdmin [email protected]
35+
# will redirect from local and remote onto pve load balancer only accessible on the inside:
36+
ServerName pve.rather.puzzling.org
37+
38+
RewriteEngine on
39+
RewriteCond %{SERVER_NAME} =pve.rather.puzzling.org [OR]
40+
RewriteCond %{SERVER_NAME} =pve
41+
RewriteRule ^ https://pve.rather.puzzling.org:8006%{REQUEST_URI} [END,NE,R=permanent]
42+
43+
Include /etc/letsencrypt/options-ssl-apache.conf
44+
SSLCertificateFile /etc/letsencrypt/live/pve.rather.puzzling.org/fullchain.pem
45+
SSLCertificateKeyFile /etc/letsencrypt/live/pve.rather.puzzling.org/privkey.pem
46+
</VirtualHost>
47+
48+
<VirtualHost *:8006>
49+
# ServerAdmin webmaster@localhost
50+
ServerAdmin [email protected]
51+
# will redirect from local and remote onto pve load balancer only accessible on the inside:
52+
ServerName pve.rather.puzzling.org
53+
54+
<Location /*>
55+
56+
Order allow,deny
57+
Allow from 192.168.0.0/16
58+
59+
</Location>
60+
61+
<IfModule mod_proxy_balancer.c>
62+
63+
ProxyPass "/" "balancer://pvecluster/" stickysession=JSESSIONID|jsessionid nofailover=On
64+
<Proxy "balancer://pvecluster">
65+
BalancerMember "https://pve1:8006"
66+
BalancerMember "https://pve2:8006" loadfactor=2
67+
BalancerMember "https://pve3:8006" loadfactor=5
68+
</Proxy>
69+
70+
</IfModule>
71+
72+
<IfModule mod_proxy.c>
73+
74+
ProxyPreserveHost On
75+
ProxyRequests Off
76+
ProxyErrorOverride On
77+
78+
SSLProxyEngine On
79+
80+
SetEnv force-proxy-request-1.0 1
81+
SetEnv proxy-nokeepalive 1
82+
83+
SSLProxyVerify none
84+
SSLProxyCheckPeerCN off
85+
SSLProxyCheckPeerName off
86+
SSLProxyCheckPeerExpire off
87+
88+
ProxyPass "/" "balancer://proxmox/"
89+
ProxyPassReverse "/" "balancer://proxmox/"
90+
91+
</IfModule>
92+
93+
Include /etc/letsencrypt/options-ssl-apache.conf
94+
SSLCertificateFile /etc/letsencrypt/live/pve.rather.puzzling.org/fullchain.pem
95+
SSLCertificateKeyFile /etc/letsencrypt/live/pve.rather.puzzling.org/privkey.pem
96+
97+
#<Proxy "balancer://hotcluster">
98+
# BalancerMember "http://www2.example.com:8080" loadfactor=1
99+
# BalancerMember "http://www3.example.com:8080" loadfactor=2
100+
# ProxySet lbmethod=bytraffic
101+
102+
#</Proxy>
103+
104+
#<Proxy "http://backend">
105+
# ProxySet keepalive=On
106+
#</Proxy>
107+
#ProxySet "balancer://foo" lbmethod=bytraffic timeout=15
108+
#ProxySet "ajp://backend:7001" timeout=15
109+
110+
# ProxyPreserveHost On
111+
112+
# ProxyPass / http://127.0.0.1:8080/
113+
# ProxyPassReverse / http://127.0.0.1:8080/
114+
115+
# SSL Protocol Adjustments:
116+
# The safe and default but still SSL/TLS standard compliant shutdown
117+
# approach is that mod_ssl sends the close notify alert but doesn't wait for
118+
# the close notify alert from client. When you need a different shutdown
119+
# approach you can use one of the following variables:
120+
# o ssl-unclean-shutdown:
121+
# This forces an unclean shutdown when the connection is closed, i.e. no
122+
# SSL close notify alert is send or allowed to received. This violates
123+
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
124+
# this when you receive I/O errors because of the standard approach where
125+
# mod_ssl sends the close notify alert.
126+
# o ssl-accurate-shutdown:
127+
# This forces an accurate shutdown when the connection is closed, i.e. a
128+
# SSL close notify alert is send and mod_ssl waits for the close notify
129+
# alert of the client. This is 100% SSL/TLS standard compliant, but in
130+
# practice often causes hanging connections with brain-dead browsers. Use
131+
# this only for browsers where you know that their SSL implementation
132+
# works correctly.
133+
# Notice: Most problems of broken clients are also related to the HTTP
134+
# keep-alive facility, so you usually additionally want to disable
135+
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
136+
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
137+
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
138+
# "force-response-1.0" for this.
139+
# BrowserMatch "MSIE [2-6]" \
140+
# nokeepalive ssl-unclean-shutdown \
141+
# downgrade-1.0 force-response-1.0
142+
143+
#automatically inserted by `certbot --apache`: (also, generate www.$domain alias with: certbot certonly --expand -d rather.puzzling.org,www.rather.puzzling.org
144+
# Include /etc/letsencrypt/options-ssl-apache.conf
145+
# SSLCertificateFile /etc/letsencrypt/live/pve.rather.puzzling.org/fullchain.pem
146+
# SSLCertificateKeyFile /etc/letsencrypt/live/pve.rather.puzzling.org/privkey.pem
147+
</VirtualHost>
148+
149+
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

‎hosts.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ all:
3535
host_has_backports: true
3636
host_has_radeon: true
3737
host_is_small: true
38+
host_is_mgmt: true # needs to be able to access management hosts when everything else is broken
3839
XKBMODEL: "inspiron"
3940
dirac-laptop:
4041
host_is_desktop: true
@@ -76,6 +77,7 @@ all:
7677
munin_plugin_links:
7778
- { src: 'ssl_rather.puzzling.org', dest: 'ssl_' }
7879
- { src: 'ssl_angelahughes.org', dest: 'ssl_' }
80+
- { src: 'ssl_pve.rather.puzzling.org', dest: 'ssl_' }
7981
zm:
8082
debian_codename: buster
8183
host_is_container: true

‎roles/openwrt/templates/dnsmasq.hosts.j2

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,20 @@
1212
192.168.1.245 ap1
1313
192.168.1.244 ap2
1414
{#
15-
First pve entry is to ensure reverse DNS is correct (even though
15+
pve entries are to ensure reverse DNS is correct (even though
1616
that IP is already defined in DHCP reservations, for the sake of
17-
DHCP MAC mappings), and second entry is for the multiple records in
18-
A record pretending to be a proxmox HA cluster address. FIXME: need
19-
to share SSL certs, or maybe have pve point to a HA LXC container
20-
that forwards onto pve1,pve2,pve3. See also:
17+
DHCP MAC mappings; since these hosts don't request DHCP, they don't
18+
show up in DNS reverse mappings)
19+
#}
20+
192.168.1.6 pve2
21+
192.168.1.7 pve3
22+
192.168.1.8 pve1
23+
24+
{#
25+
And our pve loadbalancer on webserver that forwards onto
26+
pve1,pve2,pve3. We could have also just done it here by assining
27+
all three nodes to DNS and sharing SSL certs, but that would be
28+
suboptimal when there's an outage. See also:
2129
https://github.com/lae/ansible-role-proxmox/blob/develop/tasks/ssl_config.yml
2230
#}
23-
192.168.1.6 pve2 pve
24-
192.168.1.7 pve3 pve
25-
192.168.1.8 pve1 pve
31+
192.168.1.18 pve

‎roles/webserver/tasks/external_website.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,9 @@
5555
- proxy
5656
- proxy_http
5757
- proxy_wstunnel
58+
# proxy_balancer and lbmethod_byrequests for pve load balancer
59+
- proxy_balancer
60+
- lbmethod_byrequests
5861
- rewrite
5962
- ssl
6063
become: true

‎vars/main.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,7 @@
344344
- { name: /etc/updatedb.conf, source: etc/updatedb.conf.default, when: "{{ (inventory_hostname != 'dirac') and (inventory_hostname != 'fs') }}" }
345345

346346
- { source: etc/apache2/mods-available/userdir.conf.int, name: /etc/apache2/mods-available/userdir.conf, notify: "restart apache2", when: '{{ ( host_is_user_web_server | default(false) ) and ( deb_release == "bookworm" ) }}' }
347-
- { name: /etc/apache2/, source: etc/apache2.webserver.ext/, notify: "restart apache2", when: '{{ host_is_ext_web_server | default(false) }}' }
347+
- { name: /etc/apache2/, source: etc/apache2.webserver.ext/, notify: "restart apache2", when: '{{ host_is_ext_web_server | default(false) }}' }
348348
- { name: /etc/apache2/secrets/, source: etc/apache2.webserver.secrets, owner: www-data, group: www-data, mode: "0640", when: '{{ host_is_ext_web_server | default(false) }}' }
349349

350350
- { name: /etc/rkhunter.conf, source: etc/rkhunter.conf.j2 } # kept separate to the tree because we want to store the various distribution versions for easier comparison

0 commit comments

Comments
 (0)