httpd configuration by stejskalleos · Pull Request #293 · theforeman/foremanctl

stejskalleos · 2025-11-11T08:59:35Z

No description provided.

src/roles/httpd/templates/foreman-vhost.conf.j2

stejskalleos · 2025-11-19T07:46:50Z

@ekohl Removed the unnecessary SSL options.

One thing I noticed is that the Rails app does not enforce HTTPS. With current changes I can browse and make API calls via http without any problems, no redirect or enforcing https.

src/roles/httpd/templates/foreman-vhost.conf.j2

evgeni · 2025-11-21T09:23:21Z

I think it'd be good to add a test that port 80 works as expected, e.g.

GET /unattended/public/foreman_raw_ca returns something that looks like a cert
GET /pulp/content/ contains Index of /pulp/content/ in the returned body
GET /users/login redirects to HTTPs (once require_ssl: true is set, not sure it belongs in this PR or not)

stejskalleos · 2025-11-25T08:59:29Z

Updated & added tests, the require_ssl: true will be handled in a separate PR.

src/playbooks/deploy/deploy.yaml

src/roles/httpd/templates/foreman-vhost.conf.j2

evgeni · 2025-11-25T11:07:39Z

For comparison, here's a /etc/httpd/conf.d/05-foreman.conf from a nightly box

# ************************************
# Vhost template in module puppetlabs-apache
# Managed by Puppet
# ************************************
# 
<VirtualHost *:80>
  ServerName centos9-stream-katello-nightly.juuni.example.com

  ## Vhost docroot
  DocumentRoot "/usr/share/foreman/public"

  ## Directories, there should at least be a declaration for /usr/share/foreman/public

  <Directory "/usr/share/foreman/public">
    Options SymLinksIfOwnerMatch
    AllowOverride None
    Require all granted
  </Directory>

  ## Load additional static includes
  IncludeOptional "/etc/httpd/conf.d/05-foreman.d/*.conf"

  ## Logging
  ErrorLog "/var/log/httpd/foreman_error.log"
  ServerSignature Off
  CustomLog "/var/log/httpd/foreman_access.log" combined 

  ## Request header rules
  ## as per http://httpd.apache.org/docs/2.4/mod/mod_headers.html#requestheader
  RequestHeader set X-FORWARDED-PROTO "http"
  RequestHeader set SSL-CLIENT-S-DN ""
  RequestHeader set SSL-CLIENT-CERT ""
  RequestHeader set SSL-CLIENT-VERIFY ""
  RequestHeader unset REMOTE-USER
  RequestHeader unset REMOTE_USER
  RequestHeader unset REMOTE-USER-EMAIL
  RequestHeader unset REMOTE-USER_EMAIL
  RequestHeader unset REMOTE_USER-EMAIL
  RequestHeader unset REMOTE_USER_EMAIL
  RequestHeader unset REMOTE-USER-FIRSTNAME
  RequestHeader unset REMOTE-USER_FIRSTNAME
  RequestHeader unset REMOTE_USER-FIRSTNAME
  RequestHeader unset REMOTE_USER_FIRSTNAME
  RequestHeader unset REMOTE-USER-LASTNAME
  RequestHeader unset REMOTE-USER_LASTNAME
  RequestHeader unset REMOTE_USER-LASTNAME
  RequestHeader unset REMOTE_USER_LASTNAME
  RequestHeader unset REMOTE-USER-GROUPS
  RequestHeader unset REMOTE-USER_GROUPS
  RequestHeader unset REMOTE_USER-GROUPS
  RequestHeader unset REMOTE_USER_GROUPS

  <Location "/pulp/deb">
    RequestHeader unset X-CLIENT-CERT
    RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
    ProxyPass unix:///run/pulpcore-content.sock|http://pulpcore-content/pulp/content disablereuse=on timeout=600
    ProxyPassReverse unix:///run/pulpcore-content.sock|http://pulpcore-content/pulp/content
  </Location>

  <Location "/pulp/isos">
    RequestHeader unset X-CLIENT-CERT
    RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
    ProxyPass unix:///run/pulpcore-content.sock|http://pulpcore-content/pulp/content disablereuse=on timeout=600
    ProxyPassReverse unix:///run/pulpcore-content.sock|http://pulpcore-content/pulp/content
  </Location>

  <Location "/pulp/repos">
    RequestHeader unset X-CLIENT-CERT
    RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
    ProxyPass unix:///run/pulpcore-content.sock|http://pulpcore-content/pulp/content disablereuse=on timeout=600
    ProxyPassReverse unix:///run/pulpcore-content.sock|http://pulpcore-content/pulp/content
  </Location>
Alias /pub /var/www/html/pub

<Location /pub>
  <IfModule mod_passenger.c>
    PassengerEnabled off
  </IfModule>
  Options +FollowSymLinks +Indexes
  Require all granted
</Location>

  <Location "/pulp/content">
    RequestHeader unset X-CLIENT-CERT
    RequestHeader set X-CLIENT-CERT "%{SSL_CLIENT_CERT}s" env=SSL_CLIENT_CERT
    RequestHeader set X-FORWARDED-PROTO expr=%{REQUEST_SCHEME}
    ProxyPass unix:///run/pulpcore-content.sock|http://pulpcore-content/pulp/content disablereuse=on timeout=600
    ProxyPassReverse unix:///run/pulpcore-content.sock|http://pulpcore-content/pulp/content
  </Location>

  ## Proxy rules
  ProxyRequests Off
  ProxyPreserveHost On
  ProxyAddHeaders On
  ProxyPass /pulp !
  ProxyPass /pub !
  ProxyPass /icons !
  ProxyPass /images !
  ProxyPass /server-status !
  ProxyPass /webpack !
  ProxyPass /assets !
  ProxyPass / unix:///run/foreman.sock|http://foreman/ retry=0 timeout=900 upgrade=websocket
  ProxyPassReverse / unix:///run/foreman.sock|http://foreman/

  ## Server aliases
  ServerAlias foreman

  ## Custom fragment
  # Set headers for all possible assets which are compressed
<FilesMatch \.css\.gz$>
  ForceType text/css
  Header set Content-Encoding gzip
  SetEnv no-gzip
</FilesMatch>
<FilesMatch \.js\.gz$>
  ForceType text/javascript
  Header set Content-Encoding gzip
  SetEnv no-gzip
</FilesMatch>
<FilesMatch \.svg\.gz$>
  ForceType image/svg+xml
  Header set Content-Encoding gzip
  SetEnv no-gzip
</FilesMatch>

<LocationMatch "^/(assets|webpack)">
  Options SymLinksIfOwnerMatch
  AllowOverride None
  Require all granted

  # Use standard http expire header for assets instead of ETag
  <IfModule mod_expires.c>
    Header unset ETag
    FileETag None
    ExpiresActive On
    ExpiresDefault "access plus 1 year"
  </IfModule>

  # Return compressed assets if they are precompiled
  RewriteEngine On
  # Make sure the browser supports gzip encoding and file with .gz added
  # does exist on disc before we rewrite with the extension
  RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
  RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
  RewriteCond %{REQUEST_FILENAME}.gz -s
  RewriteRule ^(.+) $1.gz [L]
</LocationMatch>


  AddDefaultCharset UTF-8
</VirtualHost>

not sure we need the whole assets blurb at the end -- we don't serve the UI via http-only, but thought it's nice to compare

ekohl · 2025-11-25T11:39:05Z

GET /users/login redirects to HTTPs (once require_ssl: true is set, not sure it belongs in this PR or not)

I think it does. Prior to this PR it was secure over HTTPS, without it we would regress.

tests/httpd_test.py

evgeni · 2025-11-26T12:28:02Z

#316 was merged, so you can include /pub here now too (and tests for it)

stejskalleos · 2025-12-01T11:58:59Z

@ekohl @evgeni ready for review

src/roles/httpd/templates/foreman-vhost.conf.j2

src/roles/httpd/templates/foreman-ssl-vhost.conf.j2

src/roles/httpd/templates/foreman-vhost.conf.j2

tests/foreman_test.py

tests/httpd_test.py

src/roles/httpd/templates/foreman-ssl-vhost.conf.j2

src/roles/httpd/templates/foreman-vhost.conf.j2

evgeni

See inline comments.
Also, can you add http versions of test_pub_ca_certificate_downloadable and test_pub_directory_accessible?

tests/foreman_test.py

* SSL & non-SSL configs for httpd * Rails require_ssl: true * Updated tests

stejskalleos · 2025-12-04T09:33:32Z

Rebased, updated tests & added new: http/https test_pub_ca_certificate_downloadable & test_pub_directory_accessible

tests/foreman_test.py

tests/httpd_test.py

evgeni

two tiny comments on the tests, but these are cosmetic

Co-authored-by: Evgeni Golov <evgeni@golov.de>

shubhamsg199

Ack, Only issue is the assets not being served for eg: https://foreman.example.com/pulp/api/v3 , which is expected for now and a low priority issue as discussed on slack thread

ekohl · 2025-12-04T12:59:38Z

Ack, Only issue is the assets not being served for eg: https://foreman.example.com/pulp/api/v3 , which is expected for now and a low priority issue as discussed on slack thread

We didn't serve them before this PR either so it's not a regression.

ekohl · 2025-12-04T13:01:10Z

tests/foreman_test.py

    "ldap-refresh_usergroups",
 ]

-


Nit: Python convention is to have 2 empty lines here and my linter is unhappy about this.

ekohl · 2025-12-04T13:01:47Z

tests/foreman_test.py

 @pytest.fixture(scope="module")
 def foreman_status_curl(server):
-    return server.run(f"curl --silent --write-out '%{{stderr}}%{{http_code}}' http://{FOREMAN_HOST}:{FOREMAN_PORT}/api/v2/ping")
+    return server.run(f"curl --header 'X-FORWARDED-PROTO: https' --silent --write-out '%{{stderr}}%{{http_code}}' http://{FOREMAN_HOST}:{FOREMAN_PORT}/api/v2/ping")


Yeah, we wanted the test not to rely on Apache :)

tests/httpd_test.py

ekohl · 2025-12-04T13:04:40Z

tests/httpd_test.py


-def test_pub_ca_certificate_downloadable(server, certificates, server_fqdn):
+def test_http_pub_ca_certificate_downloadable(server, server_fqdn):
+    cmd = server.run(f"curl --silent --output /dev/null --write-out '%{{http_code}}' http://{server_fqdn}/pub/katello-server-ca.crt")


Suggested change

cmd = server.run(f"curl --silent --output /dev/null --write-out '%{{http_code}}' http://{server_fqdn}/pub/katello-server-ca.crt")

cmd = server.run(f"{CURL_CMD} --write-out '%{{http_code}}' http://{server_fqdn}/pub/katello-server-ca.crt")

evgeni · 2025-12-04T13:27:40Z

dang, I merged w/o seeing @ekohl's last comments. feel free to open a follow up

stejskalleos · 2025-12-04T15:01:32Z

@evgeni #350

stejskalleos changed the title ~~HTTPd vhost configuration~~ [WIP] HTTPd vhost configuration Nov 11, 2025

stejskalleos force-pushed the ls/https branch from 3bf4fa8 to 0bb2883 Compare November 13, 2025 13:42

stejskalleos marked this pull request as ready for review November 13, 2025 13:42

stejskalleos changed the title ~~[WIP] HTTPd vhost configuration~~ httpd vhost:80 configuration Nov 13, 2025

ekohl reviewed Nov 15, 2025

View reviewed changes

src/roles/httpd/templates/foreman-vhost.conf.j2 Outdated Show resolved Hide resolved

stejskalleos force-pushed the ls/https branch 2 times, most recently from 11462a3 to e581de1 Compare November 18, 2025 12:25

ekohl reviewed Nov 18, 2025

View reviewed changes

stejskalleos force-pushed the ls/https branch from e581de1 to c398e74 Compare November 19, 2025 07:44

stejskalleos force-pushed the ls/https branch 2 times, most recently from b08db75 to 5cced9c Compare November 20, 2025 07:29

shubhamsg199 reviewed Nov 20, 2025

View reviewed changes

src/roles/httpd/templates/foreman-vhost.conf.j2 Show resolved Hide resolved

evgeni reviewed Nov 20, 2025

View reviewed changes

src/roles/httpd/templates/foreman-vhost.conf.j2 Outdated Show resolved Hide resolved

evgeni mentioned this pull request Nov 25, 2025

Expose /pub directory #316

Merged

stejskalleos force-pushed the ls/https branch from 5cced9c to df390ba Compare November 25, 2025 08:58

evgeni reviewed Nov 25, 2025

View reviewed changes

src/playbooks/deploy/deploy.yaml Outdated Show resolved Hide resolved

stejskalleos force-pushed the ls/https branch from df390ba to 8ecad90 Compare November 25, 2025 09:00

stejskalleos mentioned this pull request Nov 25, 2025

[WIP] Foreman - Enable require_ssl & unattended #321

Closed

evgeni reviewed Nov 25, 2025

View reviewed changes

src/roles/httpd/templates/foreman-vhost.conf.j2 Outdated Show resolved Hide resolved

evgeni reviewed Nov 25, 2025

View reviewed changes

src/roles/httpd/templates/foreman-vhost.conf.j2 Outdated Show resolved Hide resolved

shubhamsg199 reviewed Nov 25, 2025

View reviewed changes

tests/httpd_test.py Outdated Show resolved Hide resolved

stejskalleos force-pushed the ls/https branch from 965d544 to ec009f7 Compare November 27, 2025 14:14

stejskalleos changed the title ~~httpd vhost:80 configuration~~ httpd configuration Nov 27, 2025

stejskalleos force-pushed the ls/https branch from ec009f7 to 6e28ce9 Compare November 27, 2025 14:16

stejskalleos force-pushed the ls/https branch from 6e28ce9 to e941490 Compare November 28, 2025 13:20

ekohl reviewed Dec 1, 2025

View reviewed changes

evgeni reviewed Dec 1, 2025

View reviewed changes

tests/foreman_test.py Outdated Show resolved Hide resolved

evgeni reviewed Dec 1, 2025

View reviewed changes

tests/httpd_test.py Show resolved Hide resolved

evgeni reviewed Dec 1, 2025

View reviewed changes

tests/httpd_test.py Show resolved Hide resolved

stejskalleos force-pushed the ls/https branch from e941490 to 13a16c3 Compare December 1, 2025 13:04

ekohl reviewed Dec 1, 2025

View reviewed changes

evgeni requested changes Dec 3, 2025

View reviewed changes

tests/foreman_test.py Outdated Show resolved Hide resolved

tests/foreman_test.py Show resolved Hide resolved

tests/foreman_test.py Outdated Show resolved Hide resolved

pr-processor bot added the Waiting on contributor label Dec 3, 2025

httpd configuration

55d2ea1

* SSL & non-SSL configs for httpd * Rails require_ssl: true * Updated tests

stejskalleos force-pushed the ls/https branch from 0a1da18 to 55d2ea1 Compare December 4, 2025 09:32

pr-processor bot added Needs re-review and removed Waiting on contributor labels Dec 4, 2025

evgeni reviewed Dec 4, 2025

View reviewed changes

tests/foreman_test.py Outdated Show resolved Hide resolved

pr-processor bot removed the Needs re-review label Dec 4, 2025

evgeni reviewed Dec 4, 2025

View reviewed changes

tests/httpd_test.py Outdated Show resolved Hide resolved

evgeni approved these changes Dec 4, 2025

View reviewed changes

Yet another test updates

5c11f74

Co-authored-by: Evgeni Golov <evgeni@golov.de>

shubhamsg199 approved these changes Dec 4, 2025

View reviewed changes

ekohl approved these changes Dec 4, 2025

View reviewed changes

evgeni merged commit 8df2f52 into theforeman:master Dec 4, 2025
10 checks passed

	cmd = server.run(f"curl --silent --output /dev/null --write-out '%{{http_code}}' http://{server_fqdn}/pub/katello-server-ca.crt")
	cmd = server.run(f"{CURL_CMD} --write-out '%{{http_code}}' http://{server_fqdn}/pub/katello-server-ca.crt")

Conversation

stejskalleos commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stejskalleos commented Nov 19, 2025

Uh oh!

Uh oh!

Uh oh!

evgeni commented Nov 21, 2025

Uh oh!

stejskalleos commented Nov 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

evgeni commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ekohl commented Nov 25, 2025

Uh oh!

Uh oh!

evgeni commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stejskalleos commented Dec 1, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

evgeni left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stejskalleos commented Dec 4, 2025

Uh oh!

Uh oh!

Uh oh!

evgeni left a comment

Choose a reason for hiding this comment

Uh oh!

shubhamsg199 left a comment

Choose a reason for hiding this comment

Uh oh!

ekohl commented Dec 4, 2025

Uh oh!

ekohl Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

ekohl Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

evgeni Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ekohl Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

evgeni commented Dec 4, 2025

stejskalleos commented Nov 11, 2025 •

edited

Loading

evgeni commented Nov 25, 2025 •

edited

Loading

evgeni commented Nov 26, 2025 •

edited

Loading