From 71f7bd1a44fa45314e8007010b80c5a945e1413b Mon Sep 17 00:00:00 2001 From: Andrea Dell'Amico Date: Fri, 4 Sep 2026 19:54:37 +0000 Subject: [PATCH] meta and README: declare EL 8 and 9, document the merge and the rename Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_018sTDubHhviDWKZLtAtZXTW --- README.md | 158 +++++++++++++++++--------------------------------- meta/main.yml | 33 ++++++----- 2 files changed, 72 insertions(+), 119 deletions(-) diff --git a/README.md b/README.md index 580aa40..062a55c 100644 --- a/README.md +++ b/README.md @@ -1,121 +1,71 @@ -Role Name -========= +# ansible-role-apache -A role that installs and configures the apache web server +Installs and configures Apache httpd on Debian and Ubuntu and on EL 8 and 9. +The EL side comes from the separate `httpd` role of the old library, absorbed +here. -Role Variables --------------- +## Variable names -The most important variables are listed below: +There is one namespace, `apache_*`. The absorbed role used `httpd_*` and those +names are gone: a playbook that still sets them has no effect. The rename is +mechanical, `httpd_x` becomes `apache_x`, with four exceptions: -``` yaml -apache_service_enabled: True -apache_user: www-data -apache_pkg_state: latest -apache_group: '{{ apache_user }}' -apache_from_ppa: False -apache_ppa_repo: 'ppa:ondrej/apache2' +| old | new | +|----------------------------|------------------------------| +| `httpd_main_packages` | `apache_packages` | +| `httpd_ssl_enabled` | `apache_ssl_modules_enabled` | +| `httpd_modules` | see *Modules* below | +| `httpd_additional_modules` | see *Modules* below | -apache_listen_ports: - - 80 - - '{{ apache_ssl_port }}' +Distribution differences live inside the defaults, the convention already used +by `ansible-role-postgresql`, so every value stays a default and a playbook can +still override it. -# Possible choices: event, prefork (the old ones), worker (the threaded version), itm -apache_mpm_mode: worker +| | deb | EL | +|--------------------|---------------------------|-----------------------| +| packages | `apache2`, `apache2-utils`| `httpd`, `httpd-tools`| +| mod_ssl | part of `apache2` | separate package | +| service | `apache2` | `httpd` | +| config directory | `/etc/apache2` | `/etc/httpd` | +| user, group | `www-data` | `apache` | +| main config file | left to the package | fully templated | -apache_packages: - - apache2 - - apache2-utils - - libapache2-mod-xsendfile - - unzip - - zip +## Configuration model -apache_modules_packages: - - 'apache2-mpm-{{ apache_mpm_mode }}' +The two families do not configure Apache the same way, and the role does not +pretend otherwise. -# Only one can be present at the same time. It needs to be listed as the last one -apache_worker_modules: -# - { name: 'mpm_itm', state: 'absent' } - - { name: 'mpm_event', state: 'absent' } - - { name: 'mpm_prefork', state: 'absent' } - - { name: 'mpm_{{ apache_mpm_mode }}', state: 'present' } +On deb the packaged `apache2.conf` is left alone: the role manages `ports.conf`, +removes the default virtualhost and enables modules with `a2enmod`. -# apache RPAF is needed to obtain the real client addresses when behind a reverse proxy -apache_rpaf_install: False +On EL the whole `httpd.conf` is templated, because that is where the tuning and +the document root layout live. This is what the `apache_timeout`, +`apache_keepalive_*`, `apache_startservers`, `apache_maxclients`, +`apache_min_spare`, `apache_max_spare`, `apache_threads_per_child`, +`apache_serverlimit` and `apache_max_requests_per_child` variables feed, and they +have no effect on deb. -apache_default_modules: - - headers - - rewrite - - expires - - xsendfile +## Modules -apache_ssl_modules_enabled: True -apache_ssl_port: 443 -apache_ssl_modules: - - ssl - - socache_shmcb -apache_http_proxy_modules_enabled: False -apache_http_proxy_modules: - - proxy - - proxy_ajp - - proxy_http +On deb, modules are enabled with `apache2_module`, from `apache_default_modules`, +`apache_additional_modules_list`, `apache_ssl_modules` and +`apache_http_proxy_modules`. -apache_status_module: True -apache_status_location: '/server-status' -apache_status_allowed_hosts: - - 127.0.0.1/8 +On EL none of that applies. The `apache2_module` Ansible module requires the +`a2enmod` and `a2dismod` binaries, which the EL httpd package does not ship, so +the `httpd_modules` list of the absorbed role could never be applied there. What +EL needs is the MPM selection, written to `conf.modules.d/00-mpm.conf` from +`apache_mpm_mode`, while the individual `LoadModule` lines come from the +distribution's own `conf.modules.d`. `apache_el_extra_modules` adds the ones the +distribution does not load by default: -apache_info_module: True -apache_info_location: '/server-info' -apache_info_allowed_hosts: - - 127.0.0.1/8 - -apache_basic_auth: False -apache_basic_auth_single_file: True -apache_basic_auth_dir: /etc/apache2/auth -apache_basic_auth_file: '{{ apache_basic_auth_dir }}/htpasswd' - -apache_basic_auth_modules: - - auth_basic - - authn_file - - authz_user - -# Put them in a vault file. auth_file is optional. Not used when apache_basic_auth_single_file is true -apache_basic_users: - - { username:'', password:'', state:'present,absent', auth_file:'path_to_file' } - -# -apache_additional_packages: False -apache_additional_packages_list: -# - libapache2-mod-uwsgi -# - ... -# -# Set this variable to load the modules you need -apache_additional_modules: False -apache_additional_modules_list: [] -# - -# - - -apache_letsencrypt_managed: True -apache_letsencrypt_proxy_modules: - - proxy - - proxy_http - -apache_letsencrypt_proxy_conf: - - letsencrypt-proxy.conf +```yaml +apache_el_extra_modules: + - { identifier: 'jk_module', file: 'mod_jk.so' } ``` -Dependencies ------------- +## Handlers -None - -License -------- - -EUPL-1.2 - -Author Information ------------------- - -Andrea Dell'Amico, +`apache2 reload` and `apache2 restart` act on the right service on both +families. `httpd reload` and `httpd restart` exist as well, with the same +behaviour, for the roles that come from the absorbed one and notify those names. diff --git a/meta/main.yml b/meta/main.yml index fddbfd8..162682f 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -1,26 +1,29 @@ +--- galaxy_info: - author: Andrea Dell'Amico - description: Systems Architect + author: adellam + description: Apache httpd installation and configuration, on deb and EL systems company: ISTI-CNR - - issue_tracker_url: https://redmine-s2i2s.isti.cnr.it/projects/provisioning - + namespace: adellam + role_name: apache license: EUPL 1.2+ - - min_ansible_version: 2.8 - - # To view available platforms and versions (or releases), visit: - # https://galaxy.ansible.com/api/v1/platforms/ - # + min_ansible_version: "2.9" platforms: - name: Ubuntu versions: - - bionic - + - focal + - jammy + - noble + - name: Debian + versions: + - bullseye + - bookworm + - name: EL + versions: + - "8" + - "9" galaxy_tags: - apache - httpd + - web dependencies: [] - -