Skip to content

Commit 0c8018b

Browse files
dasJdasJ
committed
Add support for verifying SSL certs
1 parent 035fef6 commit 0c8018b

File tree

3 files changed

+45
-37
lines changed

3 files changed

+45
-37
lines changed

‎README.md

Lines changed: 35 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ A Debian based distribution with certbot available in current apt sources. Corre
2525
| default_cert_group | string | `root` | Default owner group for certificates at target servers | N |
2626
| default_cert_owner | string | `root` | Default owner user for certificates at target servers | N |
2727
| default_crypto | boolean | `true` | Use https as default to forward traffic | N |
28+
| reverse_proxy_default_proxy_ssl_verify | boolean | `false` | Whether the SSL certificate of the proxied host should be verified by default | N |
2829
| domain_suffixes | list of strings | `['']` | Domain suffixes to append to every not full qualified domain name | N |
2930
| domain_prefixes | list of strings | `['']` | Domain prefixes to append to every not full qualified domain name | N |
3031
| letsencrypt_staging | boolean | `false` | Use letsencrypt staging servers | N |
@@ -60,39 +61,40 @@ A Debian based distribution with certbot available in current apt sources. Corre
6061

6162
### served_domains
6263

63-
| Option | Type | Default | Description | Required |
64-
|:----------------------|:------------------------|:------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------|:--------:|
65-
| no_proxy | boolean | `false` | Don't actually configure anything target-related (use extra_* variables from below) | N |
66-
| port | integer | | Target port to redirect to | N |
67-
| crypto | boolean | [`{{ default_crypto }}`](#primary) | Use https to forward traffic | N |
68-
| auth | boolean | `false` | restrict access to system users | N |
69-
| domains | list of strings | | A list of domains to proxy [(see below for more information)¹](#served_domains__1) | Y |
70-
| access_control | list of dicts | | A list of dicts to restrict access to given set of ip ranges | N |
71-
| fullchain_path | string | | [Destination path²](#served_domains__2) for fullchain.pem at _target_host_ | N |
72-
| cert_path | string | | [Destination path²](#served_domains__2) for cert.pem at _target_host_ | N |
73-
| chain_path | string | | [Destination path²](#served_domains__2) for chain.pem at _target_host_ | N |
74-
| privkey_path | string | | [Destination path²](#served_domains__2) for privkey.pem at _target_host_ | N |
75-
| fullchain_mode | string | [`{{ default_cert_mode }}`](#primary) | File access mode for fullchain.pwm at _target_host_ | N |
76-
| cert_mode | string | [`{{ default_cert_mode }}`](#primary) | File access mode for cert.pwm at _target_host_ | N |
77-
| chain_mode | string | [`{{ default_cert_mode }}`](#primary) | File access mode for chain.pwm at _target_host_ | N |
78-
| privkey_mode | string | [`{{ default_cert_mode }}`](#primary) | File access mode for privkey.pwm at _target_host_ | N |
79-
| fullchain_group | string | [`{{ default_cert_group }}`](#primary) | Owner group of fullchain.pwm at _target_host_ | N |
80-
| cert_group | string | [`{{ default_cert_group }}`](#primary) | Owner group of cert.pwm at _target_host_ | N |
81-
| chain_group | string | [`{{ default_cert_group }}`](#primary) | Owner group of chain.pwm at _target_host_ | N |
82-
| privkey_group | string | [`{{ default_cert_group }}`](#primary) | Owner group of privkey.pwm at _target_host_ | N |
83-
| fullchain_owner | string | [`{{ default_cert_owner }}`](#primary) | Owner of fullchain.pwm at _target_host_ | N |
84-
| cert_owner | string | [`{{ default_cert_owner }}`](#primary) | Owner of cert.pwm at _target_host_ | N |
85-
| chain_owner | string | [`{{ default_cert_owner }}`](#primary) | Owner of chain.pwm at _target_host_ | N |
86-
| privkey_owner | string | [`{{ default_cert_owner }}`](#primary) | Owner of privkey.pwm at _target_host_ | N |
87-
| client_max_body_size | string | | Set the maximum upload size at server context | N |
88-
| extra_server_config | string | | Additional configuration items to add to the server block before location blocks | N |
89-
| extra_location_config | string | | Additional configuration items to add to the default location block (location /) | N |
90-
| extra_locations | list of key value dicts | [] | Add custom locations to this server block, the key should be a location string, the value defines the location body | N |
91-
| redirect | string | | Instead of proxying the request, redirect to this URL. The request URI is automatically appended. | N |
92-
| redirect_code | integer | [`{{ reverse_proxy_redirect_code }}`](#primary) | HTTP status code used to redirect the user to the URL specified by `redirect` | N |
93-
| enable_http2_proxy | boolean | `false` | Enable http2 for this host | N |
94-
| use_keepalive | boolean | `false` | Enable keepalive for this host | N |
95-
| proxy_keepalive | integer | `1024` | Number of connections to keepalive between the proxy and the host | N |
64+
| Option | Type | Default | Description | Required |
65+
|:-------------------------|:------------------------|:-----------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------|:--------:|
66+
| no_proxy | boolean | `false` | Don't actually configure anything target-related (use extra_* variables from below) | N |
67+
| port | integer | | Target port to redirect to | N |
68+
| crypto | boolean | [`{{ default_crypto }}`](#primary) | Use https to forward traffic | N |
69+
| auth | boolean | `false` | restrict access to system users | N |
70+
| reverse_proxy_ssl_verify | boolean | [`{{ reverse_proxy_default_proxy_ssl_verify }}`](#primary) | Whether the SSL certificate of the proxied host should be verified | N |
71+
| domains | list of strings | | A list of domains to proxy [(see below for more information)¹](#served_domains__1) | Y |
72+
| access_control | list of dicts | | A list of dicts to restrict access to given set of ip ranges | N |
73+
| fullchain_path | string | | [Destination path²](#served_domains__2) for fullchain.pem at _target_host_ | N |
74+
| cert_path | string | | [Destination path²](#served_domains__2) for cert.pem at _target_host_ | N |
75+
| chain_path | string | | [Destination path²](#served_domains__2) for chain.pem at _target_host_ | N |
76+
| privkey_path | string | | [Destination path²](#served_domains__2) for privkey.pem at _target_host_ | N |
77+
| fullchain_mode | string | [`{{ default_cert_mode }}`](#primary) | File access mode for fullchain.pwm at _target_host_ | N |
78+
| cert_mode | string | [`{{ default_cert_mode }}`](#primary) | File access mode for cert.pwm at _target_host_ | N |
79+
| chain_mode | string | [`{{ default_cert_mode }}`](#primary) | File access mode for chain.pwm at _target_host_ | N |
80+
| privkey_mode | string | [`{{ default_cert_mode }}`](#primary) | File access mode for privkey.pwm at _target_host_ | N |
81+
| fullchain_group | string | [`{{ default_cert_group }}`](#primary) | Owner group of fullchain.pwm at _target_host_ | N |
82+
| cert_group | string | [`{{ default_cert_group }}`](#primary) | Owner group of cert.pwm at _target_host_ | N |
83+
| chain_group | string | [`{{ default_cert_group }}`](#primary) | Owner group of chain.pwm at _target_host_ | N |
84+
| privkey_group | string | [`{{ default_cert_group }}`](#primary) | Owner group of privkey.pwm at _target_host_ | N |
85+
| fullchain_owner | string | [`{{ default_cert_owner }}`](#primary) | Owner of fullchain.pwm at _target_host_ | N |
86+
| cert_owner | string | [`{{ default_cert_owner }}`](#primary) | Owner of cert.pwm at _target_host_ | N |
87+
| chain_owner | string | [`{{ default_cert_owner }}`](#primary) | Owner of chain.pwm at _target_host_ | N |
88+
| privkey_owner | string | [`{{ default_cert_owner }}`](#primary) | Owner of privkey.pwm at _target_host_ | N |
89+
| client_max_body_size | string | | Set the maximum upload size at server context | N |
90+
| extra_server_config | string | | Additional configuration items to add to the server block before location blocks | N |
91+
| extra_location_config | string | | Additional configuration items to add to the default location block (location /) | N |
92+
| extra_locations | list of key value dicts | [] | Add custom locations to this server block, the key should be a location string, the value defines the location body | N |
93+
| redirect | string | | Instead of proxying the request, redirect to this URL. The request URI is automatically appended. | N |
94+
| redirect_code | integer | [`{{ reverse_proxy_redirect_code }}`](#primary) | HTTP status code used to redirect the user to the URL specified by `redirect` | N |
95+
| enable_http2_proxy | boolean | `false` | Enable http2 for this host | N |
96+
| use_keepalive | boolean | `false` | Enable keepalive for this host | N |
97+
| proxy_keepalive | integer | `1024` | Number of connections to keepalive between the proxy and the host | N |
9698

9799

98100
<a id="served_domains__1">¹</a> Can be either a fully qualified domain name(with following dot ex. `www.example.com.`) or a short internal domain(will be expanded by `domain_suffixes` and `domain_prefixes` ex. `wiki` or `static.media`)

‎defaults/main.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ reverse_proxy_ssl_ciphers:
4848
- '!DSS'
4949
reverse_proxy_ssl_prefer_server_ciphers: True
5050
reverse_proxy_ssl_stapling: True
51+
reverse_proxy_default_proxy_ssl_verify: False
5152
reverse_proxy_redirect_to_first_domain: True
5253
reverse_proxy_redirect_to_first_domain_code: 302
5354
reverse_proxy_redirect_code: 302

‎templates/reverse_proxy.conf.j2

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,18 @@ server {
2929

3030
{{ domains.extra_server_config | default('') }}
3131

32-
{% if reverse_proxy_ssl_stapling %}
33-
ssl_stapling on;
34-
ssl_stapling_verify on;
32+
{% if 'reverse_proxy_ssl_verify' in domains and domains.reverse_proxy_ssl_verify or reverse_proxy_default_proxy_ssl_verify %}
33+
proxy_ssl_verify on;
34+
3535
{% if reverse_proxy_ssl_trusted_certificate is defined -%}
36-
ssl_trusted_certificate {{ reverse_proxy_ssl_trusted_certificate }};
36+
proxy_ssl_trusted_certificate {{ reverse_proxy_ssl_trusted_certificate }};
3737
{%- endif %}
3838

39+
{% if reverse_proxy_ssl_stapling %}
40+
ssl_stapling on;
41+
ssl_stapling_verify on;
42+
{% endif %}
43+
3944
{% endif %}
4045
{% if reverse_proxy_use_dhparam %}
4146
ssl_dhparam {{ reverse_proxy_dhparam_path }};

0 commit comments

Comments
 (0)