[chef] Re: How best to force SSL with application_php and apache2 cookbooks?

[Ryan Walker < >]

I use an attribute in my cookbook that allows me to set the ports for HTTP 
and HTTPS and then have a template file for http and https configuration that 
uses this attribute directly. Then, when I call mod_php_apache2 within the 
application resource, I give it the HTTP template using "webapp_template" 
(which could include the rewrites you want):

    mod_php_apache2 do
      app_root "#{node['php_app']['public']}"
      webapp_template "app.conf.erb"
      server_aliases node["php_app"]["server_aliases"]
    end

Then, outside of the application resource, I check to see if my deployment 
includes any SSL stuff and if so, I call the apache2 cookbook's web_app 
resource directly to create the SSL configuration file and again give it my 
own template that is specific to my app using "template":

  if node["php_app"]["sslcert"] and node["php_app"]["sslkey"]
    include_recipe "apache2::mod_ssl"
   
   <some stuff that creates the SSL key and cert files, but is really long, 
so I'm omitting them>

    web_app "#{node['php_app']['domain']}-ssl" do
      template "https_app.conf.erb"
      server_name node['domain']
      server_aliases node['php_app']['server_aliases']
      port node['php_app']['https_port']
      listen_ports [node['php_app']['http_port'], 
node['php_app']['https_port']]
      sslcert node["php_app"]["sslcert_file"]
      sslkey node["php_app"]["sslkey_file"]
      cacert ndoe["php_app"]["sslcacert_file"] if 
node["php_app"]["sslcacert_file"]
    end
  end

Inside the template files, I set the port with this:

HTTP:
<VirtualHost *:<%= node["php_app"]["http_port"] %>>
...

HTTPS:
<VirtualHost _default_:<%= node["php_app"]["https_port"] %>>

Might be a better way to do this, but this seems to work.

--
Ryan Walker


On Mar 14, 2013, at 12:55 PM, Phil Mocek 
<
 >
 wrote:

> What is the preferred method of configuring a Web application
> deployed via the [application_php cookbook][1] to accept HTTP over
> SSL connections on port 443 and to redirect requests on 80 to 443?
> 
> I'm using application_php with success, but it is [hard-coded to
> cause the http server to listen on 8080][2].  I don't find any
> discussion of SSL or of alternative ports in documentation of the
> application_php and application cookbooks or of the deploy
> provider.  The apache2 cookbook docs show how to install mod_ssl
> and to specify some cipher configuration, but as far as I can
> tell, none of that matters as long as application_php is
> configuring Apache to do name-based virtual hosting on 8080.  Web
> searches for relevant keywords have turned up nothing relevant.
> 
> 
> References:
> 
> [1]: <http://community.opscode.com/cookbooks/application_php>
> [2]: 
> <https://github.com/opscode-cookbooks/application_php/blob/master/templates/default/php.conf.erb#L1>
> 
> -- 
> Phil Mocek
> http://mocek.org/