From e6bcf41f4bc44e85f84fce1cceee9bb37dd562aa Mon Sep 17 00:00:00 2001 From: Jimmy McCrory Date: Thu, 9 Feb 2017 17:40:33 -0800 Subject: [PATCH] Provide default horizon_ssl variables Provide default 'horizon_ssl_protocol' and 'horizon_ssl_cipher_suite' variables for when this role is run outside of an integrated OpenStack-Ansible deployment. Change-Id: I5aee1a06b161329c1d4ea9f92a3e65c485fda641 (cherry picked from commit 6eca30751e90b3586a0776bcbe9b78f66b062322) --- defaults/main.yml | 4 ++-- doc/source/index.rst | 2 -- examples/playbook.yml | 2 -- tests/os_horizon-overrides.yml | 2 -- 4 files changed, 2 insertions(+), 8 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 170a36ed..ed2f4a69 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -121,8 +121,8 @@ horizon_enable_ha_router: False horizon_ssl_cert: /etc/ssl/certs/horizon.pem horizon_ssl_key: /etc/ssl/private/horizon.key horizon_ssl_ca_cert: /etc/ssl/certs/horizon-ca.pem -horizon_ssl_protocol: "{{ ssl_protocol }}" -horizon_ssl_cipher_suite: "{{ ssl_cipher_suite }}" +horizon_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3') }}" +horizon_ssl_cipher_suite: "{{ ssl_cipher_suite | default('ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS') }}" # if using a self-signed certificate, set this to true to regenerate it horizon_ssl_self_signed_regen: false horizon_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ horizon_server_name }}/subjectAltName=IP.1={{ external_lb_vip_address }}" diff --git a/doc/source/index.rst b/doc/source/index.rst index 40dc59cc..7d53d339 100644 --- a/doc/source/index.rst +++ b/doc/source/index.rst @@ -30,8 +30,6 @@ details. .. code-block:: yaml - horizon_ssl_protocol: "ALL -SSLv2 -SSLv3" - horizon_ssl_cipher_suite: "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" horizon_galera_address: 10.100.100.101 horizon_container_mysql_password: "SuperSecrete" horizon_secret_key: "SuperSecreteHorizonKey" diff --git a/examples/playbook.yml b/examples/playbook.yml index 4b1d7288..89cf7abc 100644 --- a/examples/playbook.yml +++ b/examples/playbook.yml @@ -11,8 +11,6 @@ horizon_container_mysql_password: "SuperSecrete" horizon_secret_key: "SuperSecreteHorizonKey" horizon_external_ssl: true - horizon_ssl_protocol: "ALL -SSLv2 -SSLv3" - horizon_ssl_cipher_suite: "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" galera_root_password: "secrete" rabbitmq_servers: 10.100.100.101 rabbitmq_use_ssl: false diff --git a/tests/os_horizon-overrides.yml b/tests/os_horizon-overrides.yml index e4939fdf..b740a576 100644 --- a/tests/os_horizon-overrides.yml +++ b/tests/os_horizon-overrides.yml @@ -26,8 +26,6 @@ horizon_rabbitmq_vhost: /horizon horizon_container_mysql_password: "SuperSecrete" horizon_secret_key: "SuperSecreteHorizonKey" horizon_external_ssl: False -horizon_ssl_protocol: "ALL -SSLv2 -SSLv3" -horizon_ssl_cipher_suite: "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" # User for nova service registration required for Horizon tempest tests nova_service_name: nova