meta and README: declare EL 8 and 9, document the merge and the rename
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018sTDubHhviDWKZLtAtZXTW
This commit is contained in:
parent
03bf17004d
commit
71f7bd1a44
158
README.md
158
README.md
|
|
@ -1,121 +1,71 @@
|
|||
Role Name
|
||||
=========
|
||||
# ansible-role-apache
|
||||
|
||||
A role that installs and configures the apache web server <http://httpd.apache.org>
|
||||
Installs and configures Apache httpd on Debian and Ubuntu and on EL 8 and 9.
|
||||
The EL side comes from the separate `httpd` role of the old library, absorbed
|
||||
here.
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
## Variable names
|
||||
|
||||
The most important variables are listed below:
|
||||
There is one namespace, `apache_*`. The absorbed role used `httpd_*` and those
|
||||
names are gone: a playbook that still sets them has no effect. The rename is
|
||||
mechanical, `httpd_x` becomes `apache_x`, with four exceptions:
|
||||
|
||||
``` yaml
|
||||
apache_service_enabled: True
|
||||
apache_user: www-data
|
||||
apache_pkg_state: latest
|
||||
apache_group: '{{ apache_user }}'
|
||||
apache_from_ppa: False
|
||||
apache_ppa_repo: 'ppa:ondrej/apache2'
|
||||
| old | new |
|
||||
|----------------------------|------------------------------|
|
||||
| `httpd_main_packages` | `apache_packages` |
|
||||
| `httpd_ssl_enabled` | `apache_ssl_modules_enabled` |
|
||||
| `httpd_modules` | see *Modules* below |
|
||||
| `httpd_additional_modules` | see *Modules* below |
|
||||
|
||||
apache_listen_ports:
|
||||
- 80
|
||||
- '{{ apache_ssl_port }}'
|
||||
Distribution differences live inside the defaults, the convention already used
|
||||
by `ansible-role-postgresql`, so every value stays a default and a playbook can
|
||||
still override it.
|
||||
|
||||
# Possible choices: event, prefork (the old ones), worker (the threaded version), itm
|
||||
apache_mpm_mode: worker
|
||||
| | deb | EL |
|
||||
|--------------------|---------------------------|-----------------------|
|
||||
| packages | `apache2`, `apache2-utils`| `httpd`, `httpd-tools`|
|
||||
| mod_ssl | part of `apache2` | separate package |
|
||||
| service | `apache2` | `httpd` |
|
||||
| config directory | `/etc/apache2` | `/etc/httpd` |
|
||||
| user, group | `www-data` | `apache` |
|
||||
| main config file | left to the package | fully templated |
|
||||
|
||||
apache_packages:
|
||||
- apache2
|
||||
- apache2-utils
|
||||
- libapache2-mod-xsendfile
|
||||
- unzip
|
||||
- zip
|
||||
## Configuration model
|
||||
|
||||
apache_modules_packages:
|
||||
- 'apache2-mpm-{{ apache_mpm_mode }}'
|
||||
The two families do not configure Apache the same way, and the role does not
|
||||
pretend otherwise.
|
||||
|
||||
# Only one can be present at the same time. It needs to be listed as the last one
|
||||
apache_worker_modules:
|
||||
# - { name: 'mpm_itm', state: 'absent' }
|
||||
- { name: 'mpm_event', state: 'absent' }
|
||||
- { name: 'mpm_prefork', state: 'absent' }
|
||||
- { name: 'mpm_{{ apache_mpm_mode }}', state: 'present' }
|
||||
On deb the packaged `apache2.conf` is left alone: the role manages `ports.conf`,
|
||||
removes the default virtualhost and enables modules with `a2enmod`.
|
||||
|
||||
# apache RPAF is needed to obtain the real client addresses when behind a reverse proxy
|
||||
apache_rpaf_install: False
|
||||
On EL the whole `httpd.conf` is templated, because that is where the tuning and
|
||||
the document root layout live. This is what the `apache_timeout`,
|
||||
`apache_keepalive_*`, `apache_startservers`, `apache_maxclients`,
|
||||
`apache_min_spare`, `apache_max_spare`, `apache_threads_per_child`,
|
||||
`apache_serverlimit` and `apache_max_requests_per_child` variables feed, and they
|
||||
have no effect on deb.
|
||||
|
||||
apache_default_modules:
|
||||
- headers
|
||||
- rewrite
|
||||
- expires
|
||||
- xsendfile
|
||||
## Modules
|
||||
|
||||
apache_ssl_modules_enabled: True
|
||||
apache_ssl_port: 443
|
||||
apache_ssl_modules:
|
||||
- ssl
|
||||
- socache_shmcb
|
||||
apache_http_proxy_modules_enabled: False
|
||||
apache_http_proxy_modules:
|
||||
- proxy
|
||||
- proxy_ajp
|
||||
- proxy_http
|
||||
On deb, modules are enabled with `apache2_module`, from `apache_default_modules`,
|
||||
`apache_additional_modules_list`, `apache_ssl_modules` and
|
||||
`apache_http_proxy_modules`.
|
||||
|
||||
apache_status_module: True
|
||||
apache_status_location: '/server-status'
|
||||
apache_status_allowed_hosts:
|
||||
- 127.0.0.1/8
|
||||
On EL none of that applies. The `apache2_module` Ansible module requires the
|
||||
`a2enmod` and `a2dismod` binaries, which the EL httpd package does not ship, so
|
||||
the `httpd_modules` list of the absorbed role could never be applied there. What
|
||||
EL needs is the MPM selection, written to `conf.modules.d/00-mpm.conf` from
|
||||
`apache_mpm_mode`, while the individual `LoadModule` lines come from the
|
||||
distribution's own `conf.modules.d`. `apache_el_extra_modules` adds the ones the
|
||||
distribution does not load by default:
|
||||
|
||||
apache_info_module: True
|
||||
apache_info_location: '/server-info'
|
||||
apache_info_allowed_hosts:
|
||||
- 127.0.0.1/8
|
||||
|
||||
apache_basic_auth: False
|
||||
apache_basic_auth_single_file: True
|
||||
apache_basic_auth_dir: /etc/apache2/auth
|
||||
apache_basic_auth_file: '{{ apache_basic_auth_dir }}/htpasswd'
|
||||
|
||||
apache_basic_auth_modules:
|
||||
- auth_basic
|
||||
- authn_file
|
||||
- authz_user
|
||||
|
||||
# Put them in a vault file. auth_file is optional. Not used when apache_basic_auth_single_file is true
|
||||
apache_basic_users:
|
||||
- { username:'', password:'', state:'present,absent', auth_file:'path_to_file' }
|
||||
|
||||
#
|
||||
apache_additional_packages: False
|
||||
apache_additional_packages_list:
|
||||
# - libapache2-mod-uwsgi
|
||||
# - ...
|
||||
#
|
||||
# Set this variable to load the modules you need
|
||||
apache_additional_modules: False
|
||||
apache_additional_modules_list: []
|
||||
# -
|
||||
# -
|
||||
|
||||
apache_letsencrypt_managed: True
|
||||
apache_letsencrypt_proxy_modules:
|
||||
- proxy
|
||||
- proxy_http
|
||||
|
||||
apache_letsencrypt_proxy_conf:
|
||||
- letsencrypt-proxy.conf
|
||||
```yaml
|
||||
apache_el_extra_modules:
|
||||
- { identifier: 'jk_module', file: 'mod_jk.so' }
|
||||
```
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
## Handlers
|
||||
|
||||
None
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
EUPL-1.2
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
Andrea Dell'Amico, <andrea.dellamico@isti.cnr.it>
|
||||
`apache2 reload` and `apache2 restart` act on the right service on both
|
||||
families. `httpd reload` and `httpd restart` exist as well, with the same
|
||||
behaviour, for the roles that come from the absorbed one and notify those names.
|
||||
|
|
|
|||
|
|
@ -1,26 +1,29 @@
|
|||
---
|
||||
galaxy_info:
|
||||
author: Andrea Dell'Amico
|
||||
description: Systems Architect
|
||||
author: adellam
|
||||
description: Apache httpd installation and configuration, on deb and EL systems
|
||||
company: ISTI-CNR
|
||||
|
||||
issue_tracker_url: https://redmine-s2i2s.isti.cnr.it/projects/provisioning
|
||||
|
||||
namespace: adellam
|
||||
role_name: apache
|
||||
license: EUPL 1.2+
|
||||
|
||||
min_ansible_version: 2.8
|
||||
|
||||
# To view available platforms and versions (or releases), visit:
|
||||
# https://galaxy.ansible.com/api/v1/platforms/
|
||||
#
|
||||
min_ansible_version: "2.9"
|
||||
platforms:
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- bionic
|
||||
|
||||
- focal
|
||||
- jammy
|
||||
- noble
|
||||
- name: Debian
|
||||
versions:
|
||||
- bullseye
|
||||
- bookworm
|
||||
- name: EL
|
||||
versions:
|
||||
- "8"
|
||||
- "9"
|
||||
galaxy_tags:
|
||||
- apache
|
||||
- httpd
|
||||
- web
|
||||
|
||||
dependencies: []
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue