--- /dev/null
+#
+# Class to serve keystone with apache mod_wsgi in place of keystone service
+#
+# Serving keystone from apache is the recommended way to go for production
+# systems as the current keystone implementation is not multi-processor aware,
+# thus limiting the performance for concurrent accesses.
+#
+# See the following URIs for reference:
+# https://etherpad.openstack.org/havana-keystone-performance
+# http://adam.younglogic.com/2012/03/keystone-should-move-to-apache-httpd/
+#
+# When using this class you should disable your keystone service.
+#
+# == Parameters
+#
+# [*servername*]
+# The servername for the virtualhost.
+# Optional. Defaults to $::fqdn
+#
+# [*public_port*]
+# The public port.
+# Optional. Defaults to 5000
+#
+# [*admin_port*]
+# The admin port.
+# Optional. Defaults to 35357
+#
+# [*bind_host*]
+# The host/ip address Apache will listen on.
+# Optional. Defaults to undef (listen on all ip addresses).
+#
+# [*public_path*]
+# The prefix for the public endpoint.
+# Optional. Defaults to '/'
+#
+# [*admin_path*]
+# The prefix for the admin endpoint.
+# Optional. Defaults to '/'
+#
+# [*ssl*]
+# Use ssl ? (boolean)
+# Optional. Defaults to true
+#
+# [*workers*]
+# Number of WSGI workers to spawn.
+# Optional. Defaults to 1
+#
+# [*ssl_cert*]
+# [*ssl_key*]
+# [*ssl_chain*]
+# [*ssl_ca*]
+# [*ssl_crl_path*]
+# [*ssl_crl*]
+# [*ssl_certs_dir*]
+# apache::vhost ssl parameters.
+# Optional. Default to apache::vhost 'ssl_*' defaults.
+#
+# == Dependencies
+#
+# requires Class['apache'] & Class['keystone']
+#
+# == Examples
+#
+# include apache
+#
+# class { 'keystone::wsgi::apache': }
+#
+# == Note about ports & paths
+#
+# When using same port for both endpoints (443 anyone ?), you *MUST* use two
+# different public_path & admin_path !
+#
+# == Authors
+#
+# François Charlier <francois.charlier@enovance.com>
+#
+# == Copyright
+#
+# Copyright 2013 eNovance <licensing@enovance.com>
+#
+class keystone::wsgi::apache (
+ $servername = $::fqdn,
+ $public_port = 5000,
+ $admin_port = 35357,
+ $bind_host = undef,
+ $public_path = '/',
+ $admin_path = '/',
+ $ssl = true,
+ $workers = 1,
+ $ssl_cert = undef,
+ $ssl_key = undef,
+ $ssl_chain = undef,
+ $ssl_ca = undef,
+ $ssl_crl_path = undef,
+ $ssl_crl = undef,
+ $ssl_certs_dir = undef,
+ $threads = $::processorcount,
+ $priority = '10',
+) {
+
+ include ::keystone::params
+ include ::apache
+ include ::apache::mod::wsgi
+ if $ssl {
+ include ::apache::mod::ssl
+ }
+
+ Package['keystone'] -> Package['httpd']
+ Package['keystone'] ~> Service['httpd']
+ Keystone_config <| |> ~> Service['httpd']
+ Service['httpd'] -> Keystone_endpoint <| |>
+ Service['httpd'] -> Keystone_role <| |>
+ Service['httpd'] -> Keystone_service <| |>
+ Service['httpd'] -> Keystone_tenant <| |>
+ Service['httpd'] -> Keystone_user <| |>
+ Service['httpd'] -> Keystone_user_role <| |>
+
+ ## Sanitize parameters
+
+ # Ensure there's no trailing '/' except if this is also the only character
+ $public_path_real = regsubst($public_path, '(^/.*)/$', '\1')
+ # Ensure there's no trailing '/' except if this is also the only character
+ $admin_path_real = regsubst($admin_path, '(^/.*)/$', '\1')
+
+ if $public_port == $admin_port and $public_path_real == $admin_path_real {
+ fail('When using the same port for public & private endpoints, public_path and admin_path should be different.')
+ }
+
+ file { $::keystone::params::keystone_wsgi_script_path:
+ ensure => directory,
+ owner => 'keystone',
+ group => 'keystone',
+ require => Package['httpd'],
+ }
+
+ file { 'keystone_wsgi_admin':
+ ensure => file,
+ path => "${::keystone::params::keystone_wsgi_script_path}/admin",
+ source => $::keystone::params::keystone_wsgi_script_source,
+ owner => 'keystone',
+ group => 'keystone',
+ mode => '0644',
+ # source file provided by keystone package
+ require => [File[$::keystone::params::keystone_wsgi_script_path], Package['keystone']],
+ }
+
+ file { 'keystone_wsgi_main':
+ ensure => file,
+ path => "${::keystone::params::keystone_wsgi_script_path}/main",
+ source => $::keystone::params::keystone_wsgi_script_source,
+ owner => 'keystone',
+ group => 'keystone',
+ mode => '0644',
+ # source file provided by keystone package
+ require => [File[$::keystone::params::keystone_wsgi_script_path], Package['keystone']],
+ }
+
+ $wsgi_daemon_process_options_main = {
+ user => 'keystone',
+ group => 'keystone',
+ processes => $workers,
+ threads => $threads,
+ display-name => 'keystone-main',
+ }
+
+ $wsgi_daemon_process_options_admin = {
+ user => 'keystone',
+ group => 'keystone',
+ processes => $workers,
+ threads => $threads,
+ display-name => 'keystone-admin',
+ }
+
+ $wsgi_script_aliases_main = hash([$public_path_real,"${::keystone::params::keystone_wsgi_script_path}/main"])
+ $wsgi_script_aliases_admin = hash([$admin_path_real, "${::keystone::params::keystone_wsgi_script_path}/admin"])
+
+ if $public_port == $admin_port {
+ $wsgi_script_aliases_main_real = merge($wsgi_script_aliases_main, $wsgi_script_aliases_admin)
+ } else {
+ $wsgi_script_aliases_main_real = $wsgi_script_aliases_main
+ }
+
+ ::apache::vhost { 'keystone_wsgi_main':
+ ensure => 'present',
+ servername => $servername,
+ ip => $bind_host,
+ port => $public_port,
+ docroot => $::keystone::params::keystone_wsgi_script_path,
+ docroot_owner => 'keystone',
+ docroot_group => 'keystone',
+ priority => $priority,
+ ssl => $ssl,
+ ssl_cert => $ssl_cert,
+ ssl_key => $ssl_key,
+ ssl_chain => $ssl_chain,
+ ssl_ca => $ssl_ca,
+ ssl_crl_path => $ssl_crl_path,
+ ssl_crl => $ssl_crl,
+ ssl_certs_dir => $ssl_certs_dir,
+ wsgi_daemon_process => 'keystone_main',
+ wsgi_daemon_process_options => $wsgi_daemon_process_options_main,
+ wsgi_process_group => 'keystone_main',
+ wsgi_script_aliases => $wsgi_script_aliases_main_real,
+ require => File['keystone_wsgi_main'],
+ }
+
+ if $public_port != $admin_port {
+ ::apache::vhost { 'keystone_wsgi_admin':
+ ensure => 'present',
+ servername => $servername,
+ ip => $bind_host,
+ port => $admin_port,
+ docroot => $::keystone::params::keystone_wsgi_script_path,
+ docroot_owner => 'keystone',
+ docroot_group => 'keystone',
+ priority => $priority,
+ ssl => $ssl,
+ ssl_cert => $ssl_cert,
+ ssl_key => $ssl_key,
+ ssl_chain => $ssl_chain,
+ ssl_ca => $ssl_ca,
+ ssl_crl_path => $ssl_crl_path,
+ ssl_crl => $ssl_crl,
+ ssl_certs_dir => $ssl_certs_dir,
+ wsgi_daemon_process => 'keystone_admin',
+ wsgi_daemon_process_options => $wsgi_daemon_process_options_admin,
+ wsgi_process_group => 'keystone_admin',
+ wsgi_script_aliases => $wsgi_script_aliases_admin,
+ require => File['keystone_wsgi_admin'],
+ }
+ }
+}
projects / dsa-puppet.git / blobdiff