---
# Copyright 2024, Cleura AB
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

cache_timeout: 300

# Generic configuration
httpd_conf_dir: "/etc/{{ httpd_system_service_name }}"
httpd_conf_file: "{{ _httpd_conf_file }}"
httpd_default_sites: "{{ _httpd_default_sites }}"
httpd_distro_packages: "{{ _httpd_distro_packages }}"
httpd_extra_packages: []
httpd_extra_conf_files: "{{ _httpd_extra_conf_files }}"

## List of modules and MPMs to enable/disable is defined only for DEB systems
httpd_default_modules: "{{ _httpd_default_modules }}"
httpd_extra_modules: []
httpd_modules: "{{ httpd_default_modules + httpd_extra_modules }}"
httpd_mpms: "{{ _httpd_mpms }}"

httpd_package_state: "{{ package_state | default('latest') }}"
httpd_security_conf: "{{ _httpd_security_conf }}"
httpd_server_name: "{{ ansible_facts['fqdn'] }}"
httpd_vhost_enable_path: "{{ _httpd_vhost_enable_path }}"

httpd_service_home_folder: "{{ _httpd_service_home_folder }}"
httpd_service_user_name: "{{ _httpd_service_user_name }}"
httpd_service_group_name: "{{ _httpd_service_group_name }}"
httpd_system_service_name: "{{ _httpd_system_service_name }}"

## vHost defenition example:
# httpd_vhosts:
#   - address: ""
#     document_root:
#     directories:
#       - path: "/"
#         options: []
#     headers: []
#     locations:
#       - path: "/"
#         options: []
#     options: []
#     port: 80
#     server_name: "{{ inventory_hostname }}"
#     state: present
#     enabled: false
#     ssl:
#       # In case `cert` or `key` is undefined, certificate will be generated.
#       # You can use `san` key to adjust CNs for the generated certificate.
#       # `ca` key is optional and can be ommited.
#       # You can also set ``ssl: false`` to explicitly disable any TLS configuration
#       # for vhost
#       cert: /path/to/vhost.crt
#       key: /path/to/key.crt
#       ca: /path/to/ca.crt
httpd_vhosts: []

# Logging
httpd_custom_log_format: '"%h %l %u \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""'
httpd_log_level: info

# MPM tunables
httpd_mpm_backend: "{{ openstack_apache_mpm_backend | default('event') }}"
httpd_mpm_max_conn_child: "{{ openstack_apache_max_conn_child | default(0) }}"
httpd_mpm_max_requests: "{{ httpd_mpm_server_limit | int * httpd_mpm_thread_child | int }}"
httpd_mpm_max_spare_threads: "{{ openstack_apache_max_spare_threads | default(75) }}"
httpd_mpm_min_spare_threads: "{{ openstack_apache_min_spare_threads | default(25) }}"
httpd_mpm_server_limit: "{{ [[ansible_facts['processor_vcpus'] | default(2) // 2, 1] | max, httpd_mpm_thread_max | int] | min }}"
httpd_mpm_start_servers: "{{ openstack_apache_start_servers | default(2) }}"
httpd_mpm_thread_child: "{{ openstack_apache_thread_child | default(25) }}"
httpd_mpm_thread_limit: "{{ openstack_apache_thread_limit | default(64) }}"
httpd_mpm_thread_max: "{{ openstack_apache_thread_max | default(16) }}"

# TLS configuration
httpd_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1') }}"
## TLS v1.2 and below
httpd_ssl_cipher_suite_tls12: "{{ ssl_cipher_suite | default('ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM') }}"
## TLS v1.3
httpd_ssl_cipher_suite_tls13: "{{ ssl_cipher_suite_tls13 | default('TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256') }}"

httpd_pki_dir: "{{ openstack_pki_dir | default('/etc/pki') }}"
httpd_pki_setup_host: "{{ openstack_pki_setup_host | default('localhost') }}"

## Create a certificate authority if one does not already exist
httpd_pki_create_ca: "{{ openstack_pki_authorities is not defined | bool and httpd_pki_create_certificates }}"
httpd_pki_regen_ca: ""
httpd_pki_authorities:
  - name: "HTTPDRoot"
    country: "GB"
    state_or_province_name: "England"
    organization_name: "Example Corporation"
    organizational_unit_name: "IT Security"
    cn: "Apache HTTPD Root CA"
    provider: selfsigned
    basic_constraints: "CA:TRUE"
    key_usage:
      - digitalSignature
      - cRLSign
      - keyCertSign
    not_after: "+3650d"
  - name: "HTTPDIntermediate"
    country: "GB"
    state_or_province_name: "England"
    organization_name: "Example Corporation"
    organizational_unit_name: "IT Security"
    cn: "Apache HTTPD Intermediate CA"
    provider: ownca
    basic_constraints: "CA:TRUE,pathlen:0"
    key_usage:
      - digitalSignature
      - cRLSign
      - keyCertSign
    not_after: "+3650d"
    signed_by: "HTTPDRoot"

# Installation details for certificate authorities
httpd_pki_install_ca:
  - name: "HTTPDRoot"
    condition: "{{ httpd_pki_create_ca }}"

# HTTPD server certificates to generate
httpd_pki_certs_path: "{{ httpd_pki_dir ~ '/certs/certs/' }}"
httpd_pki_certificates: "{{ _httpd_pki_generate_certificates_vhosts }}"
httpd_pki_create_certificates: "{{ httpd_pki_certificates | length > 0 }}"
httpd_pki_default_san: "{{ openstack_pki_san | default('DNS:' ~ ansible_facts['hostname'] ~ ',DNS:' ~ ansible_facts['fqdn']) }}"
httpd_pki_keys_path: "{{ httpd_pki_dir ~ '/certs/private/' }}"
httpd_pki_regen_cert: ""

httpd_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert_name | default('HTTPDIntermediate') }}"
httpd_pki_intermediate_cert_path: "{{ httpd_pki_dir ~ '/roots/' ~ httpd_pki_intermediate_cert_name ~ '/certs/' ~ httpd_pki_intermediate_cert_name ~ '.crt' }}"

## Installation details for SSL certificates
httpd_pki_install_certificates: "{{ _httpd_pki_install_certificates_vhosts }}"

## Destination directories for SSL certificates
httpd_ssl_certs_dir: /etc/ssl/certs/
httpd_ssl_keys_dir: /etc/ssl/private/