155 lines
4.7 KiB
YAML
155 lines
4.7 KiB
YAML
---
|
|
apache_service_enabled: True
|
|
apache_user: '{% if ansible_distribution_file_variety == "Debian" %}www-data{% else %}apache{% endif %}'
|
|
apache_pkg_state: present
|
|
apache_group: '{{ apache_user }}'
|
|
apache_from_ppa: False
|
|
apache_ppa_repo: 'ppa:ondrej/apache2'
|
|
|
|
apache_listen_ports:
|
|
- 80
|
|
- '{{ apache_ssl_port }}'
|
|
|
|
# Possible choices: event, prefork (the old ones), worker (the threaded version), itm
|
|
apache_mpm_mode: worker
|
|
|
|
apache_packages: "{{ apache_deb_packages if ansible_distribution_file_variety == 'Debian' else apache_el_packages }}"
|
|
apache_deb_packages:
|
|
- apache2
|
|
- apache2-utils
|
|
- libapache2-mod-xsendfile
|
|
- unzip
|
|
- zip
|
|
apache_el_packages:
|
|
- httpd
|
|
- httpd-tools
|
|
# EL only: mod_ssl is a separate package, on deb it is part of apache2
|
|
apache_ssl_packages:
|
|
- mod_ssl
|
|
|
|
apache_service_name: '{% if ansible_distribution_file_variety == "Debian" %}apache2{% else %}httpd{% endif %}'
|
|
apache_base_conf_dir: '{% if ansible_distribution_file_variety == "Debian" %}/etc/apache2{% else %}/etc/httpd{% endif %}'
|
|
apache_base_document_root: '{% if ansible_distribution_file_variety == "Debian" %}/var/www{% else %}/var/www{% endif %}'
|
|
apache_document_root: '{{ apache_base_document_root }}/html'
|
|
|
|
apache_modules_packages:
|
|
- 'apache2-mpm-{{ apache_mpm_mode }}'
|
|
|
|
# Only one can be present at the same time. It needs to be listed as the last one
|
|
apache_worker_modules:
|
|
# - { name: 'mpm_itm', state: 'absent' }
|
|
- { name: 'mpm_event', state: 'absent' }
|
|
- { name: 'mpm_prefork', state: 'absent' }
|
|
- { name: 'mpm_{{ apache_mpm_mode }}', state: 'present' }
|
|
|
|
# apache RPAF is needed to obtain the real client addresses when behind a reverse proxy
|
|
apache_rpaf_install: False
|
|
|
|
apache_default_modules:
|
|
- headers
|
|
- rewrite
|
|
- expires
|
|
- xsendfile
|
|
|
|
apache_ssl_modules_enabled: True
|
|
apache_ssl_port: 443
|
|
apache_ssl_modules:
|
|
- ssl
|
|
- socache_shmcb
|
|
apache_http_proxy_modules_enabled: False
|
|
apache_http_proxy_modules:
|
|
- proxy
|
|
- proxy_ajp
|
|
- proxy_http
|
|
|
|
apache_status_module: True
|
|
apache_status_location: '/server-status'
|
|
apache_status_allowed_hosts:
|
|
- 127.0.0.1/8
|
|
|
|
apache_info_module: True
|
|
apache_info_location: '/server-info'
|
|
apache_info_allowed_hosts:
|
|
- 127.0.0.1/8
|
|
|
|
apache_basic_auth: False
|
|
apache_basic_auth_single_file: True
|
|
apache_basic_auth_dir: '{{ apache_base_conf_dir }}/auth'
|
|
apache_basic_auth_file: '{{ apache_basic_auth_dir }}/htpasswd'
|
|
|
|
apache_basic_auth_modules:
|
|
- auth_basic
|
|
- authn_file
|
|
- authz_user
|
|
|
|
# Put them in a vault file. auth_file is optional. Not used when apache_basic_auth_single_file is true
|
|
# apache_basic_users:
|
|
# - { username:'', password:'', state:'present,absent', auth_file:'path_to_file' }
|
|
|
|
#
|
|
apache_additional_packages_list: []
|
|
# - libapache2-mod-uwsgi
|
|
# - ...
|
|
#
|
|
# Set this variable to load the modules you need
|
|
apache_additional_modules_list: []
|
|
# -
|
|
# -
|
|
|
|
apache_letsencrypt_managed: True
|
|
apache_letsencrypt_proxy_modules:
|
|
- proxy
|
|
- proxy_http
|
|
|
|
apache_letsencrypt_proxy_conf:
|
|
- letsencrypt-proxy.conf
|
|
|
|
#
|
|
# EL only settings. They come from the httpd role this one absorbs, renamed from
|
|
# httpd_* to apache_*: on EL the whole httpd.conf is templated, while on deb the
|
|
# packaged apache2.conf is left alone and only ports.conf and the modules are
|
|
# managed.
|
|
#
|
|
apache_server_admin: root@localhost
|
|
apache_base_document_root_override: 'None'
|
|
apache_base_document_root_access: 'denied'
|
|
apache_document_root_options: 'Indexes FollowSymLinks'
|
|
apache_document_root_override: 'None'
|
|
apache_document_root_access: 'granted'
|
|
|
|
apache_cgi_enabled: False
|
|
apache_sendfile_enabled: 'on'
|
|
apache_mmap_enabled: 'on'
|
|
apache_use_canonicalname: 'off'
|
|
# The httpd role this one absorbs used OS. Prod is the safer value, but changing
|
|
# it here would be a silent change for every host that inherits the default.
|
|
apache_servertokens: 'OS'
|
|
apache_hostname_lookups: 'off'
|
|
apache_default_charset: 'UTF-8'
|
|
apache_languages:
|
|
- en
|
|
- it
|
|
|
|
apache_timeout: 60
|
|
apache_keepalive_enabled: True
|
|
apache_keepalive_timeout: 5
|
|
apache_keepalive_requests: 100
|
|
|
|
# MPM tuning, used by the EL httpd.conf template
|
|
apache_startservers: 8
|
|
apache_maxclients: 300
|
|
apache_min_spare: 25
|
|
apache_max_spare: 75
|
|
apache_max_requests_per_child: 0
|
|
apache_threads_per_child: 25
|
|
apache_serverlimit: 256
|
|
|
|
# Modules on EL are not managed with a2enmod: the apache2_module Ansible module
|
|
# requires the a2enmod and a2dismod binaries, which the EL httpd package does not
|
|
# ship, so the module list of the old role could never be applied there. What EL
|
|
# actually needs is the MPM selection, written into conf.modules.d/00-mpm.conf,
|
|
# plus an optional file for modules the distribution does not load by default.
|
|
# Every entry is emitted as: LoadModule <identifier> modules/<file>
|
|
apache_el_extra_modules: []
|
|
# - { identifier: 'jk_module', file: 'mod_jk.so' }
|