Skip to content

Commit 775c075

Browse files
geerlingguygeerlingguy
committed
Issue geerlingguy#83: Add HTTPS examples.
1 parent 1e04451 commit 775c075

File tree

11 files changed

+199
-0
lines changed

11 files changed

+199
-0
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ vagrant_ansible_inventory_default
44
*.cache
55
*.retry
66
test.sh
7+
8+
*/provisioning/roles/geerlingguy.*

‎.travis.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ env:
2525
# - playbook: dynamic-inventory.yml
2626
# distro: ubuntu1604
2727

28+
- playbook: https-self-signed.yml
29+
distro: ubuntu1604
30+
2831
- playbook: includes.yml
2932
distro: ubuntu1604
3033

‎https-self-signed/README.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# HTTPS Demonstration VM
2+
3+
This project spins up a VM and demonstrates generating self-signed certificates locally, or Let's Encrypt certificates on a public server.
4+
5+
## Quick Start Guide
6+
7+
### 1 - Install dependencies (VirtualBox, Vagrant, Ansible)
8+
9+
1. Download and install [VirtualBox](https://www.virtualbox.org/wiki/Downloads).
10+
2. Download and install [Vagrant](http://www.vagrantup.com/downloads.html).
11+
3. [Mac/Linux only] Install [Ansible](http://docs.ansible.com/intro_installation.html).
12+
13+
Note for Windows users: *This guide assumes you're on a Mac or Linux host. Windows hosts are unsupported at this time.*
14+
15+
### 2 - Build the Virtual Machine
16+
17+
1. Download this project and put it wherever you want.
18+
2. Open Terminal, cd to this 'provisioning' directory.
19+
3. Run `ansible-galaxy install -r requirements.yml` to install required Ansible roles.
20+
4. cd up one level to this directory (with the README and Vagrantfile).
21+
4. Type in `vagrant up`, and let Vagrant do its magic.
22+
23+
Note: *If there are any errors during the course of running `vagrant up`, and it drops you back to your command prompt, just run `vagrant provision` to continue building the VM from where you left off. If there are still errors after doing this a few times, post an issue to this project's issue queue on GitHub with the error.*
24+
25+
### 3 - Configure your host machine to access the VM.
26+
27+
1. [Edit your hosts file](http://www.rackspace.com/knowledge_center/article/how-do-i-modify-my-hosts-file), adding the line `192.168.76.84 https.test` so you can connect to the VM.
28+
2. Open your browser and access [https://https.test](https://https.test).
29+
30+
## Notes
31+
32+
- To shut down the virtual machine, enter `vagrant halt` in the Terminal in the same folder that has the `Vagrantfile`. To destroy it completely (if you want to save a little disk space, or want to rebuild it from scratch with `vagrant up` again), type in `vagrant destroy`.
33+
34+
## About the Author
35+
36+
This project was created by [Jeff Geerling](https://www.jeffgeerling.com/) as an example for [Ansible for DevOps](https://www.ansiblefordevops.com/).

‎https-self-signed/Vagrantfile‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# -*- mode: ruby -*-
2+
# vi: set ft=ruby :
3+
4+
VAGRANTFILE_API_VERSION = "2"
5+
6+
Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
7+
config.vm.box = "geerlingguy/ubuntu1604"
8+
config.vm.hostname = "https.test"
9+
config.vm.network :private_network, ip: "192.168.76.84"
10+
config.ssh.insert_key = false
11+
12+
config.vm.provider :virtualbox do |v|
13+
v.memory = 512
14+
end
15+
16+
# Ansible provisioning.
17+
config.vm.provision "ansible" do |ansible|
18+
ansible.playbook = "provisioning/main.yml"
19+
ansible.become = true
20+
ansible.extra_vars = {
21+
ansible_python_interpreter: "/usr/bin/python3",
22+
}
23+
end
24+
end

‎https-self-signed/provisioning/ansible.cfg‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[defaults]
2+
host_key_checking = False
3+
roles_path = ./roles
4+
nocows = 1
5+
vault_password_file = ~/.ansible/J2-vault-password.txt
6+
7+
[ssh_connection]
8+
control_path = %(directory)s/%%h-%%p-%%r
9+
pipelining = True

‎https-self-signed/provisioning/files/index.html‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<title>HTTPS Self-Signed Certificate Test</title>
5+
<style>* { font-family: Helvetica, Arial, sans-serif }</style>
6+
</head>
7+
<body>
8+
<h1>HTTPS Self-Signed Certificate Test</h1>
9+
<p>If you can see this message, it worked!</p>
10+
</body>
11+
</html>

‎https-self-signed/provisioning/main.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
- hosts: all
3+
4+
vars:
5+
# Firewall settings.
6+
firewall_allowed_tcp_ports:
7+
- "22"
8+
- "80"
9+
- "443"
10+
11+
# Python settings.
12+
pip_package: python3-pip
13+
pip_install_packages: ['pyopenssl']
14+
15+
# Nginx settings.
16+
nginx_vhosts: []
17+
nginx_remove_default_vhost: True
18+
nginx_ppa_use: True
19+
nginx_ppa_version: stable
20+
nginx_docroot: /var/www/html
21+
22+
# Self-signed certificate settings.
23+
certificate_dir: /etc/letsencrypt/live
24+
server_hostname: https.test
25+
26+
roles:
27+
- geerlingguy.firewall
28+
- geerlingguy.pip
29+
- geerlingguy.nginx
30+
31+
tasks:
32+
- import_tasks: tasks/self-signed-cert.yml
33+
34+
- name: Ensure docroot exists.
35+
file:
36+
path: "{{ nginx_docroot }}"
37+
state: directory
38+
39+
- name: Copy example index.html file in place.
40+
copy:
41+
src: files/index.html
42+
dest: "{{ nginx_docroot }}/index.html"
43+
mode: 0755
44+
45+
- name: Copy Nginx server configuration in place.
46+
template:
47+
src: templates/https.test.conf.j2
48+
dest: /etc/nginx/sites-enabled/https.test.conf
49+
mode: 0644
50+
notify: restart nginx

‎https-self-signed/provisioning/requirements.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
- src: geerlingguy.firewall
3+
- src: geerlingguy.pip
4+
- src: geerlingguy.nginx

‎https-self-signed/provisioning/tasks/self-signed-cert.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
- name: Ensure directory exists for local self-signed TLS certs.
3+
file:
4+
path: "{{ certificate_dir }}/{{ server_hostname }}"
5+
state: directory
6+
7+
- name: Generate an OpenSSL private key.
8+
openssl_privatekey:
9+
path: "{{ certificate_dir }}/{{ server_hostname }}/privkey.pem"
10+
11+
- name: Generate an OpenSSL CSR.
12+
openssl_csr:
13+
path: "/etc/ssl/private/{{ server_hostname }}.csr"
14+
privatekey_path: "{{ certificate_dir }}/{{ server_hostname }}/privkey.pem"
15+
common_name: "{{ server_hostname }}"
16+
17+
- name: Generate a Self Signed OpenSSL certificate.
18+
openssl_certificate:
19+
path: "{{ certificate_dir }}/{{ server_hostname }}/fullchain.pem"
20+
privatekey_path: "{{ certificate_dir }}/{{ server_hostname }}/privkey.pem"
21+
csr_path: /etc/ssl/private/{{ server_hostname }}.csr
22+
provider: selfsigned

‎https-self-signed/provisioning/templates/https.test.conf.j2‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# HTTPS Test server configuration.
2+
server {
3+
listen 80 default_server;
4+
server_name _;
5+
index index.html;
6+
return 301 https://$host$request_uri;
7+
}
8+
9+
server {
10+
listen 443 ssl default_server;
11+
server_name {{ server_hostname }};
12+
index index.html;
13+
root {{ nginx_docroot }};
14+
15+
ssl_certificate {{ certificate_dir }}/{{ server_hostname }}/fullchain.pem;
16+
ssl_certificate_key {{ certificate_dir }}/{{ server_hostname }}/privkey.pem;
17+
ssl_trusted_certificate {{ certificate_dir }}/{{ server_hostname }}/fullchain.pem;
18+
ssl_session_timeout 1d;
19+
ssl_session_cache shared:SSL:50m;
20+
ssl_session_tickets off;
21+
22+
ssl_protocols TLSv1.2;
23+
ssl_ciphers EECDH+AESGCM:EECDH+AES;
24+
ssl_ecdh_curve secp384r1;
25+
ssl_prefer_server_ciphers on;
26+
27+
ssl_stapling on;
28+
ssl_stapling_verify on;
29+
30+
add_header Strict-Transport-Security "max-age=15768000; includeSubdomains; preload";
31+
add_header X-Frame-Options DENY;
32+
add_header X-Content-Type-Options nosniff;
33+
}

0 commit comments

Comments
 (0)