[SSL] Sync new options for apache and nginx
Set the same options via apache[nginx]/files/_ssl.conf template for sites as
they were set by apache[nginx]/files/_ssl_secure.conf (deprecated) earlier.
By default the same set of ciphers was set in nginx and apache in _ssl_secure.conf
Now the same list of ciphers is set through pillar.
Change-Id: I64b6bfe0cbb23d204a50c6bde8d9de6ed6fac306
Related-Prod: https://mirantis.jira.com/browse/PROD-20921
diff --git a/classes/cluster/virtual-mcp-pike-dvr-ssl/openstack/control.yml b/classes/cluster/virtual-mcp-pike-dvr-ssl/openstack/control.yml
index 077e701..71b96e2 100644
--- a/classes/cluster/virtual-mcp-pike-dvr-ssl/openstack/control.yml
+++ b/classes/cluster/virtual-mcp-pike-dvr-ssl/openstack/control.yml
@@ -34,6 +34,8 @@
- system.designate.server.cluster
- system.galera.server.cluster
- service.galera.ssl
+- system.apache.server.ssl
+- system.nginx.server.proxy.ssl
- system.galera.server.database.cinder
- system.galera.server.database.glance
- system.galera.server.database.heat
@@ -56,10 +58,12 @@
_param:
keepalived_vip_interface: ens4
salt_minion_ca_authority: salt_master_ca
- ### nginx ssl sites settings
nginx_proxy_ssl:
- enabled: true
- engine: salt
+ authority: "${_param:salt_minion_ca_authority}"
+ key_file: "/etc/ssl/private/internal_proxy.key"
+ cert_file: "/etc/ssl/certs/internal_proxy.crt"
+ chain_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
+ apache_ssl:
authority: "${_param:salt_minion_ca_authority}"
key_file: "/etc/ssl/private/internal_proxy.key"
cert_file: "/etc/ssl/certs/internal_proxy.crt"
@@ -72,13 +76,10 @@
nginx_proxy_openstack_heat_host: 127.0.0.1
nginx_proxy_openstack_designate_host: 127.0.0.1
apache_manila_api_address: ${_param:single_address}
- apache_manila_ssl: ${_param:nginx_proxy_ssl}
apache_keystone_api_host: ${_param:single_address}
- apache_keystone_ssl: ${_param:nginx_proxy_ssl}
apache_nova_placement_api_address: ${_param:cluster_local_address}
- apache_nova_placement_ssl: ${_param:nginx_proxy_ssl}
apache_cinder_api_address: ${_param:cluster_local_address}
- apache_cinder_ssl: ${_param:nginx_proxy_ssl}
+
rabbitmq:
server:
ssl: