Use unix sockets for httpd -> Foreman and Pulp communication

src/roles/foreman/defaults/main.yaml

@@ -12,6 +12,7 @@ foreman_database_ssl_ca: # noqa: no-empty-defaults
 foreman_database_ssl_ca_path: /etc/foreman/db-ca.crt
 
 foreman_name: "{{ ansible_facts['fqdn'] }}"
+foreman_listen_stream: localhost:3000
 foreman_url: "http://{{ ansible_facts['fqdn'] }}:3000"
 foreman_aliases: []
 

src/roles/foreman/handlers/main.yml

@@ -1,4 +1,9 @@
 ---
+- name: Restart foreman socket
+  ansible.builtin.systemd:
+    name: foreman.socket
+    state: restarted
+
 - name: Restart foreman
   ansible.builtin.systemd:
     name: foreman

src/roles/foreman/tasks/main.yaml

@@ -100,6 +100,13 @@
     - Restart foreman
     - Restart dynflow-sidekiq@
 
+- name: Deploy Foreman socket
+  ansible.builtin.template:
+    src: foreman.socket.j2
+    dest: /etc/systemd/system/foreman.socket
+    mode: '0644'
+  notify: Restart foreman socket
+
 - name: Deploy Foreman Container
   containers.podman.podman_container:
     name: "foreman"
@@ -130,6 +137,8 @@
       FOREMAN_ENABLED_PLUGINS: "{{ foreman_plugins | join(' ') }}"
     quadlet_options:
       - |
+        [Unit]
+        Requires=foreman.socket
         [Install]
         WantedBy=default.target foreman.target
         [Unit]

src/roles/foreman/templates/foreman.socket.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Foreman socket
+
+[Socket]
+ListenStream={{ foreman_listen_stream }}
+SocketUser=apache
+SocketMode=0600
+
+NoDelay=true
+ReusePort=true
+# Default on EL10 (v254+), needed explicitly for EL9 (v252)
+Backlog=4294967295
+
+[Install]
+WantedBy=sockets.target

src/roles/httpd/tasks/main.yml

@@ -6,13 +6,22 @@
       - mod_ssl
     state: present
 
-- name: Set httpd_can_network_connect so Apache can connect to Puma and Gunicorn
+- name: Set daemons_enable_cluster_mode so Apache can connect to unix sockets
   ansible.posix.seboolean:
-    name: httpd_can_network_connect
+    name: daemons_enable_cluster_mode
     state: true
     persistent: true
   when: ansible_facts['selinux']['status'] == "enabled"
 
+- name: Set httpd_can_network_relay so Apache can reverse proxy to remote servers
+  ansible.posix.seboolean:
+    name: httpd_can_network_relay
+    state: true
+    persistent: true
+  when:
+    - ansible_facts['selinux']['status'] == "enabled"
+    - not httpd_with_foreman
+
 - name: Disable welcome page
   ansible.builtin.file:
     path: /etc/httpd/conf.d/welcome.conf

src/roles/pulp/defaults/main.yaml

@@ -20,6 +20,9 @@ pulp_api_container_name: pulp-api
 pulp_content_container_name: pulp-content
 pulp_worker_container_name: pulp-worker
 
+pulp_api_listen_stream: localhost:24817
+pulp_content_listen_stream: localhost:24816
+
 pulp_content_origin: "http://{{ ansible_facts['fqdn'] }}:24816"
 pulp_pulp_url: "http://{{ ansible_facts['fqdn'] }}:24817"
 

src/roles/pulp/handlers/main.yml

@@ -1,9 +1,19 @@
 ---
+- name: Restart pulp-api socket
+  ansible.builtin.systemd:
+    name: pulp-api.socket
+    state: restarted
+
 - name: Restart pulp-api
   ansible.builtin.systemd:
     name: pulp-api
     state: restarted
 
+- name: Restart pulp-content socket
+  ansible.builtin.systemd:
+    name: pulp-content.socket
+    state: restarted
+
 - name: Restart pulp-content
   ansible.builtin.systemd:
     name: pulp-content

src/roles/pulp/tasks/main.yaml

@@ -92,6 +92,13 @@
     - Restart pulp-content
     - Restart pulp-worker
 
+- name: Deploy Pulp API socket
+  ansible.builtin.template:
+    src: pulp-api.socket.j2
+    dest: /etc/systemd/system/pulp-api.socket
+    mode: '0644'
+  notify: Restart pulp-api socket
+
 - name: Deploy Pulp API Container
   containers.podman.podman_container:
     name: "{{ pulp_api_container_name }}"
@@ -112,6 +119,8 @@
     env: "{{ pulp_settings_env }}"
     quadlet_options:
       - |
+        [Unit]
+        Requires=pulp-api.socket
         [Install]
         WantedBy=default.target foreman.target
         [Unit]
@@ -123,6 +132,13 @@
         RestartSec=3
   notify: Restart pulp-api
 
+- name: Deploy Pulp Content socket
+  ansible.builtin.template:
+    src: pulp-content.socket.j2
+    dest: /etc/systemd/system/pulp-content.socket
+    mode: '0644'
+  notify: Restart pulp-content socket
+
 - name: Deploy Pulp Content Container
   containers.podman.podman_container:
     name: "{{ pulp_content_container_name }}"
@@ -143,6 +159,8 @@
     env: "{{ pulp_settings_env }}"
     quadlet_options:
       - |
+        [Unit]
+        Requires=pulp-content.socket
         [Install]
         WantedBy=default.target foreman.target
         [Unit]

src/roles/pulp/templates/pulp-api.socket.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Pulp API socket
+
+[Socket]
+ListenStream={{ pulp_api_listen_stream }}
+SocketUser=apache
+SocketMode=0600
+
+NoDelay=false
+ReusePort=true
+# Default on EL10 (v254+), needed explicitly for EL9 (v252)
+Backlog=4294967295
+
+[Install]
+WantedBy=sockets.target

src/roles/pulp/templates/pulp-content.socket.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Pulp Content socket
+
+[Socket]
+ListenStream={{ pulp_content_listen_stream }}
+SocketUser=apache
+SocketMode=0600
+
+NoDelay=false
+ReusePort=true
+# Default on EL10 (v254+), needed explicitly for EL9 (v252)
+Backlog=4294967295
+
+[Install]
+WantedBy=sockets.target

src/vars/base.yaml

@@ -23,6 +23,14 @@ foreman_plugins: "{{ enabled_features | features_to_foreman_plugins }}"
 foreman_name: "{{ ansible_facts['fqdn'] }}"
 foreman_url: "https://{{ foreman_name }}"
 
+foreman_listen_stream: /run/httpd.foreman.sock
+httpd_foreman_backend: "unix://{{ foreman_listen_stream }}|http://foreman"
+
+pulp_api_listen_stream: /run/httpd.pulp-api.sock
+pulp_content_listen_stream: /run/httpd.pulp-content.sock
+httpd_pulp_api_backend: "unix://{{ pulp_api_listen_stream }}|http://pulpcore-api"
+httpd_pulp_content_backend: "unix://{{ pulp_content_listen_stream }}|http://pulpcore-content"
+
 httpd_server_ca_certificate: "{{ server_ca_certificate }}"
 httpd_client_ca_certificate: "{{ client_ca_certificate }}"
 httpd_server_certificate: "{{ server_certificate }}"

tests/foreman_test.py

@@ -4,8 +4,7 @@
 
 pytestmark = pytest.mark.feature('foreman')
 
-FOREMAN_HOST = 'localhost'
-FOREMAN_PORT = 3000
+FOREMAN_SOCKET = '/run/httpd.foreman.sock'
 
 RECURRING_INSTANCES = [
     "hourly",
@@ -17,7 +16,7 @@
 
 @pytest.fixture(scope="module")
 def foreman_status_curl(server, server_fqdn):
-    return server.run(f"curl --header 'X-FORWARDED-PROTO: https' --silent --write-out '%{{stderr}}%{{http_code}}' http://{server_fqdn}:{FOREMAN_PORT}/api/v2/ping")
+    return server.run(f"curl --header 'X-FORWARDED-PROTO: https' --silent --write-out '%{{stderr}}%{{http_code}}' --unix-socket {FOREMAN_SOCKET} http://{server_fqdn}/api/v2/ping")
 
 
 @pytest.fixture(scope="module")
@@ -30,9 +29,8 @@ def test_foreman_service(server):
     assert foreman.is_running
 
 
-def test_foreman_port(server):
-    foreman = server.addr(FOREMAN_HOST)
-    assert foreman.port(FOREMAN_PORT).is_reachable
+def test_foreman_socket(server):
+    assert server.socket(f"unix://{FOREMAN_SOCKET}").is_listening
 
 
 def test_foreman_status(foreman_status_curl):
@@ -99,6 +97,6 @@ def test_foreman_domain_in_mail_settings(foremanapi, server_fqdn, setting):
 
 
 def test_foreman_host_injection(server):
-    cmd = server.run(f"curl --header 'X-FORWARDED-PROTO: https' --silent --write-out '%{{stderr}}%{{http_code}}' --resolve evil.hackers.test:{FOREMAN_PORT}:127.0.0.1 http://evil.hackers.test:{FOREMAN_PORT}/api/v2/ping")
+    cmd = server.run(f"curl --header 'X-FORWARDED-PROTO: https' --silent --write-out '%{{stderr}}%{{http_code}}' --unix-socket {FOREMAN_SOCKET} http://evil.hackers.test/api/v2/ping")
     assert cmd.succeeded
     assert cmd.stderr == '403'

tests/pulp_test.py

@@ -4,9 +4,8 @@
 import pytest
 import yaml
 
-PULP_HOST = 'localhost'
-PULP_API_PORT = 24817
-PULP_CONTENT_PORT = 24816
+PULP_API_SOCKET = '/run/httpd.pulp-api.sock'
+PULP_CONTENT_SOCKET = '/run/httpd.pulp-content.sock'
 
 
 def load_pulp_paths_from_parameters():
@@ -24,8 +23,8 @@ def load_pulp_paths_from_parameters():
 
 
 @pytest.fixture(scope="module")
-def pulp_status_curl(server):
-    return server.run(f"curl -k -s -w '%{{stderr}}%{{http_code}}' http://{PULP_HOST}:{PULP_API_PORT}/pulp/api/v3/status/")
+def pulp_status_curl(server, server_fqdn):
+    return server.run(f"curl -k -s -w '%{{stderr}}%{{http_code}}' --unix-socket {PULP_API_SOCKET} http://{server_fqdn}/pulp/api/v3/status/")
 
 
 @pytest.fixture(scope="module")
@@ -58,14 +57,12 @@ def test_pulp_worker_services(server):
         assert worker.is_running
 
 
-def test_pulp_api_port(server):
-    pulp_api = server.addr(PULP_HOST)
-    assert pulp_api.port(PULP_API_PORT).is_reachable
+def test_pulp_api_socket(server):
+    assert server.socket(f"unix://{PULP_API_SOCKET}").is_listening
 
 
-def test_pulp_content_port(server):
-    pulp_content = server.addr(PULP_HOST)
-    assert pulp_content.port(PULP_CONTENT_PORT).is_reachable
+def test_pulp_content_socket(server):
+    assert server.socket(f"unix://{PULP_CONTENT_SOCKET}").is_listening
 
 
 def test_pulp_status(pulp_status_curl):