From c6ab9de1e71bdbf5b4dea4850f79f09410225959 Mon Sep 17 00:00:00 2001 From: C24-AK <139950630+C24-AK@users.noreply.github.com> Date: Mon, 13 Nov 2023 23:02:30 +0100 Subject: [PATCH] Add `http2` directive instead of `listen` option (#1579) * added http2 directive instead of listen option adjusted http2 checks adding nginx version to acceptance tests revert changes set default version to 1.25.2 adjusted docs revert changes Test with repository which contains the latest version Test with default repo source and manage repo true Test without setting version Test with 1.25.1 Debugging facts Debugging facts Debugging facts add version to mail fix a test for 1.14 testing testing Debug and tracing set package_ensure disable rubocop disable rubocop set package to altest set package to latest mailspec remove tracing set http2 set http2 directive mailhost mailhost tracing revert revert revert http2 tests http2 tests http2 tests testing testing testing http2 test http2 test http2 test http2 test Fix http2 for old versions * add http2 tests --- spec/defines/resource_server_spec.rb | 20 ++++++++++++++++++++ templates/server/server_ssl_header.erb | 8 ++++---- templates/server/server_ssl_ipv6_listen.erb | 4 ++-- templates/server/server_ssl_settings.erb | 3 +++ 4 files changed, 29 insertions(+), 6 deletions(-) diff --git a/spec/defines/resource_server_spec.rb b/spec/defines/resource_server_spec.rb index 9b4f8f101..60515a008 100644 --- a/spec/defines/resource_server_spec.rb +++ b/spec/defines/resource_server_spec.rb @@ -687,6 +687,26 @@ it { is_expected.to contain_concat__fragment("#{title}-ssl-header").without_content(%r{ ssl on;}) } end + context 'http2 on with fact nginx_version=1.25.1' do + let(:facts) { facts.merge(nginx_version: '1.25.1') } + let :params do + default_params.merge( + http2: 'on', + ssl: true, + ssl_key: '/tmp/dummy.key', + ssl_cert: '/tmp/dummy.crt' + ) + end + + it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{^\s+http2\s+on;}) } + end + + context 'with fact nginx_version=1.25.1' do + let(:facts) { facts.merge(nginx_version: '1.25.1') } + + it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{^\s+http2\s+off;}) } + end + context 'with ssl cert and key definitions' do let(:pre_condition) do <<-PUPPET diff --git a/templates/server/server_ssl_header.erb b/templates/server/server_ssl_header.erb index 0c6f319ac..47774ada5 100644 --- a/templates/server/server_ssl_header.erb +++ b/templates/server/server_ssl_header.erb @@ -4,10 +4,10 @@ server { <%- if @listen_ip.is_a?(Array) then -%> <%- @listen_ip.each do |ip| -%> - listen <%= ip %>:<%= @ssl_port %> <% if @ssl_listen_option %>ssl<% end %><% if @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @listen_options %> <%= @listen_options %><% end %>; + listen <%= ip %>:<%= @ssl_port %> <% if @ssl_listen_option %>ssl<% end %><% if scope.call_function('versioncmp', [scope['nginx::nginx_version'], '1.25.1']) < 0 && @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @listen_options %> <%= @listen_options %><% end %>; <%- end -%> <%- else -%> - listen <%= @listen_ip %>:<%= @ssl_port %> <% if @ssl_listen_option %>ssl<% end %><% if @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @listen_options %> <%= @listen_options %><% end %>; + listen <%= @listen_ip %>:<%= @ssl_port %> <% if @ssl_listen_option %>ssl<% end %><% if scope.call_function('versioncmp', [scope['nginx::nginx_version'], '1.25.1']) < 0 && @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @listen_options %> <%= @listen_options %><% end %>; <%- end -%> <%= scope.function_template(["nginx/server/server_ssl_ipv6_listen.erb"]) %> <%- if @rewrite_www_to_non_www -%> @@ -48,10 +48,10 @@ server { server { <%- if @listen_ip.is_a?(Array) then -%> <%- @listen_ip.each do |ip| -%> - listen <%= ip %>:<%= @ssl_port %> <% if @ssl_listen_option %>ssl<% end %><% if @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @listen_options %> <%= @listen_options %><% end %>; + listen <%= ip %>:<%= @ssl_port %> <% if @ssl_listen_option %>ssl<% end %><% if scope.call_function('versioncmp', [scope['nginx::nginx_version'], '1.25.1']) < 0 && @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @listen_options %> <%= @listen_options %><% end %>; <%- end -%> <%- else -%> - listen <%= @listen_ip %>:<%= @ssl_port %> <% if @ssl_listen_option %>ssl<% end %><% if @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @listen_options %> <%= @listen_options %><% end %>; + listen <%= @listen_ip %>:<%= @ssl_port %> <% if @ssl_listen_option %>ssl<% end %><% if scope.call_function('versioncmp', [scope['nginx::nginx_version'], '1.25.1']) < 0 && @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @listen_options %> <%= @listen_options %><% end %>; <%- end -%> <%= scope.function_template(["nginx/server/server_ssl_ipv6_listen.erb"]) %> <%- if @rewrite_www_to_non_www -%> diff --git a/templates/server/server_ssl_ipv6_listen.erb b/templates/server/server_ssl_ipv6_listen.erb index 48c5206cf..a62b1b27e 100644 --- a/templates/server/server_ssl_ipv6_listen.erb +++ b/templates/server/server_ssl_ipv6_listen.erb @@ -2,9 +2,9 @@ <%- if @ipv6_enable -%> <%- if @ipv6_listen_ip.is_a?(Array) then -%> <%- @ipv6_listen_ip.each do |ipv6| -%> - listen [<%= ipv6 %>]:<%= @ssl_port %> ssl<% if @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @ipv6_listen_options %> <%= @ipv6_listen_options %><% end %>; + listen [<%= ipv6 %>]:<%= @ssl_port %> ssl<% if scope.call_function('versioncmp', [scope['nginx::nginx_version'], '1.25.1']) < 0 && @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @ipv6_listen_options %> <%= @ipv6_listen_options %><% end %>; <%- end -%> <%- else -%> - listen [<%= @ipv6_listen_ip %>]:<%= @ssl_port %> ssl<% if @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @ipv6_listen_options %> <%= @ipv6_listen_options %><% end %>; + listen [<%= @ipv6_listen_ip %>]:<%= @ssl_port %> ssl<% if scope.call_function('versioncmp', [scope['nginx::nginx_version'], '1.25.1']) < 0 && @http2 == 'on' %> http2<% end %><% if @spdy == 'on' %> spdy<% end %><% if @ipv6_listen_options %> <%= @ipv6_listen_options %><% end %>; <%- end -%> <%- end -%> diff --git a/templates/server/server_ssl_settings.erb b/templates/server/server_ssl_settings.erb index 62bf67bae..16a056139 100755 --- a/templates/server/server_ssl_settings.erb +++ b/templates/server/server_ssl_settings.erb @@ -1,6 +1,9 @@ <% if scope.call_function('versioncmp', [scope['nginx::nginx_version'], '1.15.0']) < 0 -%> ssl on; <% end -%> +<% if scope.call_function('versioncmp', [scope['nginx::nginx_version'], '1.25.1']) >= 0 && @http2 -%> + http2 <%= @http2 %>; +<% end -%> <% if @ssl_cert_real -%> <% @ssl_cert_real.each do | cert | -%> ssl_certificate <%= cert %>;