What is it?

A puppet module that installs apache with mod_evasive and mod_security (optional). This module has been written and tested on CentOS 6 and is primarily used for configuring apache as a proxy for Tomcat via AJP and other services via TCP, but it also has support for mod_passenger, mod_python, and mod_wsgi as well.

Disabling mod_security by vhost, rule, or IP are provided. JSON logging for vhosts allowing easy import into logstash is available.

Support for SSL certificates, password files, or any other sensitive information may be installed installed to a limted access directory through apache::securefile.

Monitoring by sensu is provided, but additional monitoring solutions can easily be added.

Usage:

Generic apache install

  class { 'apache': }

Adding a NameVirtualHost on port 80:

  apache::namevhost { '80': }

Generic config files:

  apache::cfgfile { 'myapp':
    content   => template('mymodule/apache.cfg'),
    filename  => 'myapp.cfg',
  }

Tomcat AJP proxy with http -> https redirect:

  apache::vhost { 'example-http':
    port            => 80,
    serverName      => $::fqdn,
    serverAlias     => [ 'example.com' ],
    redirectToHTTPS => true,
    logstash        => true,
  }

  apache::vhost { 'example-https':
    serverName        => $::fqdn,
    serverAlias       => [ 'example.com' ],
    proxy             => true,
    proxyTomcat       => true,
    port              => 443,
    rewrite_to_https  => true,
    modSecOverrides   => true,
    modSecRemoveById  => [ '11111' ],
    logstash          => true,
  }

TCP proxy:

  apache::vhost { 'newservice':
    port              => 80,
    serverName        => $::fqdn,
    serverAlias       => [ 'newservice.example.com' ],
    proxy             => true,
    proxyThin         => true,
    thinPort          => 3000,
    thinNumServers    => 3,
    modSecOverrides   => true,
    modSecRemoveById  => [ '970901', '960015' ],
    logstash          => true,
  }

Static content:

  apache::vhost { 'example.com':
    serverName        => $::fqdn,
    serverAlias       => ['www.example.com', 'example.com'],
    docroot           => '/var/www/html/example',
    modSecOverrides   => true,
    modSecRemoveById  => [ '970901', '960015' ];
  }

Known Issues:

Only tested on CentOS 6

TODO:

---

[ ] Make mod_evasive optional [ ] Make mod_status optional and configurable [ ] Allow disabling mod_security by file [ ] Improve documentation, complex module

License:

---

Released under the Apache 2.0 licence

Contribute:

• Fork it
• Create a topic branch
• Improve/fix (with spec tests)
• Push new topic branch
• Submit a PR