From 5690551a351f3a4a0280d1d630468721a425b4f0 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <patrick@puiterwijk.org>
Date: Wed, 29 May 2019 16:56:52 +0200
Subject: [PATCH] Add vpn configmap

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
---
 playbooks/openshift-apps/fas.yml      |  5 +++++
 roles/totpcgi/templates/configmap.yml | 32 +++++++++------------------
 2 files changed, 16 insertions(+), 21 deletions(-)

diff --git a/playbooks/openshift-apps/fas.yml b/playbooks/openshift-apps/fas.yml
index 13c36eddaf..01ca2fcc5e 100644
--- a/playbooks/openshift-apps/fas.yml
+++ b/playbooks/openshift-apps/fas.yml
@@ -57,6 +57,11 @@
     app: fas
     template_fullpath: "{{roles_path}}/totpcgi/templates/configmap.yml"
     objectname: configmap-totpcgi.yml
+  - role: openshift/object
+    app: fas
+    template_fullpath: "{{roles_path}}/totpcgi/templates/configmap.yml"
+    objectname: configmap-totpcgi-vpn.yml
+    when: env == "production"
   - role: openshift/secret-file
     app: fas
     privatefile: "keytabs/{{env}}/fas_sync"
diff --git a/roles/totpcgi/templates/configmap.yml b/roles/totpcgi/templates/configmap.yml
index b7e0374eab..0c2ad39abe 100644
--- a/roles/totpcgi/templates/configmap.yml
+++ b/roles/totpcgi/templates/configmap.yml
@@ -3,7 +3,11 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
+{% if objectname == "configmap-totpcgi-vpn.yml" %}
+  name: totpcgi-vpn
+{% else %}
   name: totpcgi
+{% endif %}
   labels:
     app: fas
 data:
@@ -96,33 +100,19 @@ data:
     <VirtualHost *:8443>
 {% if env == "staging" %}
         ServerName fas-all.stg.phx2.fedoraproject.org:8443
+{% elif objectname == "configmap-totpcgi-vpn.yml" %}
+        ServerName fas-all.vpn.fedoraproject.org:8443
 {% else %}
         ServerName fas-all.phx2.fedoraproject.org:8443
 {% endif %}
         SSLEngine on
-        SSLCertificateFile /etc/pki/totp_primary/tls.crt
-        SSLCertificateKeyFile /etc/pki/totp_primary/tls.key
-        SSLCACertificateFile /etc/totpcgi/totpcgi-ca.crt
-        SSLHonorCipherOrder On
-        SSLCipherSuite {{ ssl_ciphers }}
-        SSLProtocol {{ ssl_protocols }}
-        AddHandler cgi-script .cgi
-
-        SSLVerifyClient require
-        SSLVerifyDepth 10
-
-         DocumentRoot /var/www/totpcgi
-         <Directory "/var/www/totpcgi">
-                Options ExecCGI
-        </Directory>
-    </VirtualHost>
-
-{% if env == "production" %}
-    <VirtualHost *:8443>
-        ServerName fas-all.vpn.fedoraproject.org:8443
-        SSLEngine on
+{% if objectname == "configmap-totpcgi-vpn.yml" %}
         SSLCertificateFile /etc/pki/totp_vpn/tls.crt
         SSLCertificateKeyFile /etc/pki/totp_vpn/tls.key
+{% else %}
+        SSLCertificateFile /etc/pki/totp_primary/tls.crt
+        SSLCertificateKeyFile /etc/pki/totp_primary/tls.key
+{% endif %}
         SSLCACertificateFile /etc/totpcgi/totpcgi-ca.crt
         SSLHonorCipherOrder On
         SSLCipherSuite {{ ssl_ciphers }}