diff --git a/manifests/mod/php.pp b/manifests/mod/php.pp index 0f15fba3..e072590c 100644 --- a/manifests/mod/php.pp +++ b/manifests/mod/php.pp @@ -1,118 +1,118 @@ # @summary # Installs `mod_php`. # # @todo # Add docs class apache::mod::php ( $package_name = undef, $package_ensure = 'present', $path = undef, Array $extensions = ['.php'], $content = undef, $template = 'apache/mod/php.conf.erb', $source = undef, $root_group = $apache::params::root_group, $php_version = $apache::params::php_version, $libphp_prefix = 'libphp' ) inherits apache::params { include apache - if (versioncmp($php_version, '7') <= 0) { + if (versioncmp($php_version, '8') < 0) { $mod = "php${php_version}" } else { $mod = 'php' } if $apache::version::scl_httpd_version == undef and $apache::version::scl_php_version != undef { fail('If you define apache::version::scl_php_version, you also need to specify apache::version::scl_httpd_version') } if defined(Class['::apache::mod::prefork']) { Class['::apache::mod::prefork']->File["${mod}.conf"] } elsif defined(Class['::apache::mod::itk']) { Class['::apache::mod::itk']->File["${mod}.conf"] } else { fail('apache::mod::php requires apache::mod::prefork or apache::mod::itk; please enable mpm_module => \'prefork\' or mpm_module => \'itk\' on Class[\'apache\']') } if $source and ($content or $template != 'apache/mod/php.conf.erb') { warning('source and content or template parameters are provided. source parameter will be used') } elsif $content and $template != 'apache/mod/php.conf.erb' { warning('content and template parameters are provided. content parameter will be used') } $manage_content = $source ? { undef => $content ? { undef => template($template), default => $content, }, default => undef, } # Determine if we have a package $mod_packages = $apache::mod_packages if $package_name { $_package_name = $package_name } elsif has_key($mod_packages, $mod) { # 2.6 compatibility hack $_package_name = $mod_packages[$mod] } elsif has_key($mod_packages, 'phpXXX') { # 2.6 compatibility hack $_package_name = regsubst($mod_packages['phpXXX'], 'XXX', $php_version) } else { $_package_name = undef } $_php_major = regsubst($php_version, '^(\d+)\..*$', '\1') $_php_version_no_dot = regsubst($php_version, '\.', '') if $apache::version::scl_httpd_version { $_lib = "librh-php${_php_version_no_dot}-php${_php_major}.so" } else { # Controls php version and libphp prefix $_lib = "${libphp_prefix}${php_version}.so" } if $::operatingsystem == 'SLES' { ::apache::mod { $mod: package => $_package_name, package_ensure => $package_ensure, lib => "mod_${mod}.so", id => "php${_php_major}_module", path => "${apache::lib_path}/mod_${mod}.so", } - } elsif (versioncmp($php_version, '7') <= 0) { + } elsif (versioncmp($php_version, '8') < 0) { ::apache::mod { $mod: package => $_package_name, package_ensure => $package_ensure, lib => $_lib, id => "php${_php_major}_module", path => $path, } } else { ::apache::mod { $mod: package => $_package_name, package_ensure => $package_ensure, lib => "${libphp_prefix}.so", id => 'php_module', path => $path, } } include apache::mod::mime include apache::mod::dir Class['::apache::mod::mime'] -> Class['::apache::mod::dir'] -> Class['::apache::mod::php'] # Template uses $extensions file { "${mod}.conf": ensure => file, path => "${apache::mod_dir}/${mod}.conf", owner => 'root', group => $root_group, mode => $apache::file_mode, content => $manage_content, source => $source, require => [ Exec["mkdir ${apache::mod_dir}"], ], before => File[$apache::mod_dir], notify => Class['apache::service'], } } diff --git a/manifests/params.pp b/manifests/params.pp index bad6f3e5..0576ec0d 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -1,798 +1,799 @@ # @summary # This class manages Apache parameters # # @api private class apache::params inherits ::apache::version { if($::fqdn) { $servername = $::fqdn } else { $servername = $::hostname } # The default error log level $log_level = 'warn' $use_optional_includes = false # Default mime types settings $mime_types_additional = { 'AddHandler' => { 'type-map' => 'var', }, 'AddType' => { 'text/html' => '.shtml', }, 'AddOutputFilter' => { 'INCLUDES' => '.shtml', }, } # should we use systemd module? $use_systemd = true # Default mode for files $file_mode = '0644' # The default value for host hame lookup $hostname_lookups = 'Off' # Default options for / directory $root_directory_options = ['FollowSymLinks'] $vhost_include_pattern = '*' $modsec_audit_log_parts = 'ABIJDEFHZ' $modsec_audit_log_type = 'Serial' # no client certs should be trusted for auth by default. $ssl_certs_dir = undef # Allow overriding the autoindex alias location $icons_prefix = 'icons' if ($apache::version::scl_httpd_version) { if $apache::version::scl_php_version == undef { fail('If you define apache::version::scl_httpd_version, you also need to specify apache::version::scl_php_version') } $_scl_httpd_version_nodot = regsubst($apache::version::scl_httpd_version, '\.', '') $_scl_httpd_name = "httpd${_scl_httpd_version_nodot}" $_scl_php_version_no_dot = regsubst($apache::version::scl_php_version, '\.', '') $user = 'apache' $group = 'apache' $root_group = 'root' $apache_name = "${_scl_httpd_name}-httpd" $service_name = "${_scl_httpd_name}-httpd" $httpd_root = "/opt/rh/${_scl_httpd_name}/root" $httpd_dir = "${httpd_root}/etc/httpd" $server_root = "${httpd_root}/etc/httpd" $conf_dir = "${httpd_dir}/conf" $confd_dir = "${httpd_dir}/conf.d" $mod_dir = $apache::version::distrelease ? { '7' => "${httpd_dir}/conf.modules.d", default => "${httpd_dir}/conf.d", } $mod_enable_dir = undef $vhost_dir = "${httpd_dir}/conf.d" $vhost_enable_dir = undef $conf_file = 'httpd.conf' $conf_enabled = undef $ports_file = "${conf_dir}/ports.conf" $pidfile = 'run/httpd.pid' $logroot = "/var/log/${_scl_httpd_name}" $logroot_mode = undef $lib_path = 'modules' $mpm_module = 'prefork' $dev_packages = "${_scl_httpd_name}-httpd-devel" $default_ssl_cert = '/etc/pki/tls/certs/localhost.crt' $default_ssl_key = '/etc/pki/tls/private/localhost.key' $ssl_sessioncache = '/var/cache/mod_ssl/scache(512000)' $passenger_conf_file = 'passenger_extra.conf' $passenger_conf_package_file = 'passenger.conf' $passenger_root = undef $passenger_ruby = undef $passenger_default_ruby = undef $suphp_addhandler = 'php5-script' $suphp_engine = 'off' $suphp_configpath = undef $php_version = $apache::version::scl_php_version $mod_packages = { 'authnz_ldap' => "${_scl_httpd_name}-mod_ldap", 'ldap' => "${_scl_httpd_name}-mod_ldap", "php${apache::version::scl_php_version}" => "rh-php${_scl_php_version_no_dot}-php", 'ssl' => "${_scl_httpd_name}-mod_ssl", } $mod_libs = { 'nss' => 'libmodnss.so', } $conf_template = 'apache/httpd.conf.erb' $http_protocol_options = undef $keepalive = 'On' $keepalive_timeout = 15 $max_keepalive_requests = 100 $fastcgi_lib_path = undef $mime_support_package = 'mailcap' $mime_types_config = '/etc/mime.types' $docroot = "${httpd_root}/var/www/html" $alias_icons_path = $apache::version::distrelease ? { '7' => "${httpd_root}/usr/share/httpd/icons", default => '/var/www/icons', } $error_documents_path = $apache::version::distrelease ? { '7' => "${httpd_root}/usr/share/httpd/error", default => '/var/www/error' } if $::osfamily == 'RedHat' { $wsgi_socket_prefix = '/var/run/wsgi' } else { $wsgi_socket_prefix = undef } $cas_cookie_path = '/var/cache/mod_auth_cas/' $mellon_lock_file = '/run/mod_auth_mellon/lock' $mellon_cache_size = 100 $mellon_post_directory = undef $modsec_version = 1 $modsec_crs_package = 'mod_security_crs' $modsec_crs_path = '/usr/lib/modsecurity.d' $modsec_dir = '/etc/httpd/modsecurity.d' $secpcrematchlimit = 1500 $secpcrematchlimitrecursion = 1500 $modsec_secruleengine = 'On' $modsec_default_rules = [ 'base_rules/modsecurity_35_bad_robots.data', 'base_rules/modsecurity_35_scanners.data', 'base_rules/modsecurity_40_generic_attacks.data', 'base_rules/modsecurity_50_outbound.data', 'base_rules/modsecurity_50_outbound_malware.data', 'base_rules/modsecurity_crs_20_protocol_violations.conf', 'base_rules/modsecurity_crs_21_protocol_anomalies.conf', 'base_rules/modsecurity_crs_23_request_limits.conf', 'base_rules/modsecurity_crs_30_http_policy.conf', 'base_rules/modsecurity_crs_35_bad_robots.conf', 'base_rules/modsecurity_crs_40_generic_attacks.conf', 'base_rules/modsecurity_crs_41_sql_injection_attacks.conf', 'base_rules/modsecurity_crs_41_xss_attacks.conf', 'base_rules/modsecurity_crs_42_tight_security.conf', 'base_rules/modsecurity_crs_45_trojans.conf', 'base_rules/modsecurity_crs_47_common_exceptions.conf', 'base_rules/modsecurity_crs_49_inbound_blocking.conf', 'base_rules/modsecurity_crs_50_outbound.conf', 'base_rules/modsecurity_crs_59_outbound_blocking.conf', 'base_rules/modsecurity_crs_60_correlation.conf', ] $error_log = 'error_log' $scriptalias = "${httpd_root}/var/www/cgi-bin" $access_log_file = 'access_log' } elsif $::osfamily == 'RedHat' or $::operatingsystem =~ /^[Aa]mazon$/ { $user = 'apache' $group = 'apache' $root_group = 'root' $apache_name = 'httpd' $service_name = 'httpd' $httpd_dir = '/etc/httpd' $server_root = '/etc/httpd' $conf_dir = "${httpd_dir}/conf" $confd_dir = "${httpd_dir}/conf.d" $conf_enabled = undef if $::operatingsystem =~ /^[Aa]mazon$/ and $::operatingsystemmajrelease == '2' { # Amazon Linux 2 uses the /conf.modules.d/ dir $mod_dir = "${httpd_dir}/conf.modules.d" } else { $mod_dir = $apache::version::distrelease ? { '7' => "${httpd_dir}/conf.modules.d", '8' => "${httpd_dir}/conf.modules.d", default => "${httpd_dir}/conf.d", } } $mod_enable_dir = undef $vhost_dir = "${httpd_dir}/conf.d" $vhost_enable_dir = undef $conf_file = 'httpd.conf' $ports_file = "${conf_dir}/ports.conf" $pidfile = 'run/httpd.pid' $logroot = '/var/log/httpd' $logroot_mode = undef $lib_path = 'modules' $mpm_module = 'prefork' $dev_packages = 'httpd-devel' $default_ssl_cert = '/etc/pki/tls/certs/localhost.crt' $default_ssl_key = '/etc/pki/tls/private/localhost.key' $ssl_sessioncache = '/var/cache/mod_ssl/scache(512000)' $passenger_conf_file = 'passenger_extra.conf' $passenger_conf_package_file = 'passenger.conf' $passenger_root = undef $passenger_ruby = undef $passenger_default_ruby = undef $suphp_addhandler = 'php5-script' $suphp_engine = 'off' $suphp_configpath = undef $php_version = $apache::version::distrelease ? { '8' => '7', # RedHat8 default => '5', # RedHat5, RedHat6, RedHat7 } $mod_packages = { # NOTE: The auth_cas module isn't available on RH/CentOS without providing dependency packages provided by EPEL. 'auth_cas' => 'mod_auth_cas', 'auth_kerb' => 'mod_auth_kerb', 'auth_gssapi' => 'mod_auth_gssapi', 'auth_mellon' => 'mod_auth_mellon', 'auth_openidc' => 'mod_auth_openidc', 'authnz_ldap' => $apache::version::distrelease ? { '7' => 'mod_ldap', '8' => 'mod_ldap', default => 'mod_authz_ldap', }, 'authnz_pam' => 'mod_authnz_pam', 'fastcgi' => $apache::version::distrelease ? { '5' => 'mod_fastcgi', '6' => 'mod_fastcgi', default => undef, }, 'fcgid' => 'mod_fcgid', 'geoip' => 'mod_geoip', 'intercept_form_submit' => 'mod_intercept_form_submit', 'ldap' => $apache::version::distrelease ? { '5' => undef, '6' => undef, default => 'mod_ldap', }, 'lookup_identity' => 'mod_lookup_identity', 'md' => 'mod_md', 'pagespeed' => 'mod-pagespeed-stable', # NOTE: The passenger module isn't available on RH/CentOS without # providing dependency packages provided by EPEL and passenger # repositories. See # https://www.phusionpassenger.com/library/install/apache/install/oss/el7/ 'passenger' => 'mod_passenger', 'perl' => 'mod_perl', 'php5' => $apache::version::distrelease ? { '5' => 'php53', default => 'php', }, 'phpXXX' => 'php', 'proxy_html' => 'mod_proxy_html', 'python' => 'mod_python', 'security' => 'mod_security', # NOTE: The module for Shibboleth is not available on RH/CentOS without # providing dependency packages provided by Shibboleth's repositories. # See http://wiki.aaf.edu.au/tech-info/sp-install-guide 'shibboleth' => 'shibboleth', 'ssl' => 'mod_ssl', 'wsgi' => $apache::version::distrelease ? { '8' => 'python3-mod_wsgi', # RedHat8 default => 'mod_wsgi', # RedHat5, RedHat6, RedHat7 }, 'dav_svn' => 'mod_dav_svn', 'suphp' => 'mod_suphp', 'xsendfile' => 'mod_xsendfile', 'nss' => 'mod_nss', 'shib2' => 'shibboleth', } $mod_libs = { 'nss' => 'libmodnss.so', 'wsgi' => $apache::version::distrelease ? { '8' => 'mod_wsgi_python3.so', default => 'mod_wsgi.so', }, } $conf_template = 'apache/httpd.conf.erb' $http_protocol_options = undef $keepalive = 'On' $keepalive_timeout = 15 $max_keepalive_requests = 100 $fastcgi_lib_path = undef $mime_support_package = 'mailcap' $mime_types_config = '/etc/mime.types' $docroot = '/var/www/html' $alias_icons_path = $apache::version::distrelease ? { '7' => '/usr/share/httpd/icons', '8' => '/usr/share/httpd/icons', default => '/var/www/icons', } $error_documents_path = $apache::version::distrelease ? { '7' => '/usr/share/httpd/error', '8' => '/usr/share/httpd/error', default => '/var/www/error' } if $::osfamily == 'RedHat' { $wsgi_socket_prefix = '/var/run/wsgi' } else { $wsgi_socket_prefix = undef } $cas_cookie_path = '/var/cache/mod_auth_cas/' $mellon_lock_file = '/run/mod_auth_mellon/lock' $mellon_cache_size = 100 $mellon_post_directory = undef $modsec_version = 1 $modsec_crs_package = 'mod_security_crs' $modsec_crs_path = '/usr/lib/modsecurity.d' $modsec_dir = '/etc/httpd/modsecurity.d' $secpcrematchlimit = 1500 $secpcrematchlimitrecursion = 1500 $modsec_secruleengine = 'On' $modsec_default_rules = [ 'base_rules/modsecurity_35_bad_robots.data', 'base_rules/modsecurity_35_scanners.data', 'base_rules/modsecurity_40_generic_attacks.data', 'base_rules/modsecurity_50_outbound.data', 'base_rules/modsecurity_50_outbound_malware.data', 'base_rules/modsecurity_crs_20_protocol_violations.conf', 'base_rules/modsecurity_crs_21_protocol_anomalies.conf', 'base_rules/modsecurity_crs_23_request_limits.conf', 'base_rules/modsecurity_crs_30_http_policy.conf', 'base_rules/modsecurity_crs_35_bad_robots.conf', 'base_rules/modsecurity_crs_40_generic_attacks.conf', 'base_rules/modsecurity_crs_41_sql_injection_attacks.conf', 'base_rules/modsecurity_crs_41_xss_attacks.conf', 'base_rules/modsecurity_crs_42_tight_security.conf', 'base_rules/modsecurity_crs_45_trojans.conf', 'base_rules/modsecurity_crs_47_common_exceptions.conf', 'base_rules/modsecurity_crs_49_inbound_blocking.conf', 'base_rules/modsecurity_crs_50_outbound.conf', 'base_rules/modsecurity_crs_59_outbound_blocking.conf', 'base_rules/modsecurity_crs_60_correlation.conf', ] $error_log = 'error_log' $scriptalias = '/var/www/cgi-bin' $access_log_file = 'access_log' } elsif $::osfamily == 'Debian' { $user = 'www-data' $group = 'www-data' $root_group = 'root' $apache_name = 'apache2' $service_name = 'apache2' $httpd_dir = '/etc/apache2' $server_root = '/etc/apache2' $conf_dir = $httpd_dir $confd_dir = "${httpd_dir}/conf.d" # Overwrite conf_enabled causes errors with Shibboleth when enabled on Ubuntu 18.04 $conf_enabled = undef #"${httpd_dir}/conf-enabled.d" $mod_dir = "${httpd_dir}/mods-available" $mod_enable_dir = "${httpd_dir}/mods-enabled" $vhost_dir = "${httpd_dir}/sites-available" $vhost_enable_dir = "${httpd_dir}/sites-enabled" $conf_file = 'apache2.conf' $ports_file = "${conf_dir}/ports.conf" $pidfile = "\${APACHE_PID_FILE}" $logroot = '/var/log/apache2' $logroot_mode = undef $lib_path = '/usr/lib/apache2/modules' $mpm_module = 'worker' $default_ssl_cert = '/etc/ssl/certs/ssl-cert-snakeoil.pem' $default_ssl_key = '/etc/ssl/private/ssl-cert-snakeoil.key' $ssl_sessioncache = "\${APACHE_RUN_DIR}/ssl_scache(512000)" $suphp_addhandler = 'x-httpd-php' $suphp_engine = 'off' $suphp_configpath = '/etc/php5/apache2' if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '16.04') < 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '9') < 0) { # Only the major version is used here $php_version = '5' $mod_packages = { 'auth_cas' => 'libapache2-mod-auth-cas', 'auth_kerb' => 'libapache2-mod-auth-kerb', 'auth_openidc' => 'libapache2-mod-auth-openidc', 'auth_gssapi' => 'libapache2-mod-auth-gssapi', 'auth_mellon' => 'libapache2-mod-auth-mellon', 'authnz_pam' => 'libapache2-mod-authnz-pam', 'dav_svn' => 'libapache2-svn', 'fastcgi' => 'libapache2-mod-fastcgi', 'fcgid' => 'libapache2-mod-fcgid', 'geoip' => 'libapache2-mod-geoip', 'intercept_form_submit' => 'libapache2-mod-intercept-form-submit', 'jk' => 'libapache2-mod-jk', 'lookup_identity' => 'libapache2-mod-lookup-identity', 'nss' => 'libapache2-mod-nss', 'pagespeed' => 'mod-pagespeed-stable', 'passenger' => 'libapache2-mod-passenger', 'perl' => 'libapache2-mod-perl2', 'phpXXX' => 'libapache2-mod-phpXXX', 'proxy_html' => 'libapache2-mod-proxy-html', 'python' => 'libapache2-mod-python', 'rpaf' => 'libapache2-mod-rpaf', 'security' => 'libapache2-modsecurity', 'shib2' => 'libapache2-mod-shib2', 'suphp' => 'libapache2-mod-suphp', 'wsgi' => 'libapache2-mod-wsgi', 'xsendfile' => 'libapache2-mod-xsendfile', } } else { $php_version = $facts['operatingsystemmajrelease'] ? { '9' => '7.0', # Debian Stretch '16.04' => '7.0', # Ubuntu Xenial '10' => '7.3', # Debian Buster '20.04' => '7.4', # Ubuntu Foccal Fossal default => '7.2', # Ubuntu Bionic, Cosmic and Disco } $mod_packages = { 'apreq2' => 'libapache2-mod-apreq2', 'auth_cas' => 'libapache2-mod-auth-cas', 'auth_kerb' => 'libapache2-mod-auth-kerb', 'auth_openidc' => 'libapache2-mod-auth-openidc', 'auth_gssapi' => 'libapache2-mod-auth-gssapi', 'auth_mellon' => 'libapache2-mod-auth-mellon', 'authnz_pam' => 'libapache2-mod-authnz-pam', 'dav_svn' => 'libapache2-mod-svn', 'fastcgi' => 'libapache2-mod-fastcgi', 'fcgid' => 'libapache2-mod-fcgid', 'geoip' => 'libapache2-mod-geoip', 'intercept_form_submit' => 'libapache2-mod-intercept-form-submit', 'jk' => 'libapache2-mod-jk', 'lookup_identity' => 'libapache2-mod-lookup-identity', 'nss' => 'libapache2-mod-nss', 'pagespeed' => 'mod-pagespeed-stable', 'passenger' => 'libapache2-mod-passenger', 'perl' => 'libapache2-mod-perl2', 'phpXXX' => 'libapache2-mod-phpXXX', 'python' => 'libapache2-mod-python', 'rpaf' => 'libapache2-mod-rpaf', 'security' => 'libapache2-mod-security2', 'shib2' => 'libapache2-mod-shib2', 'wsgi' => 'libapache2-mod-wsgi', 'xsendfile' => 'libapache2-mod-xsendfile', } } $error_log = 'error.log' $scriptalias = '/usr/lib/cgi-bin' $access_log_file = 'access.log' if $::osfamily == 'Debian' and versioncmp($::operatingsystemrelease, '8') < 0 { $shib2_lib = 'mod_shib_22.so' } elsif ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '19.04') < 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '10') < 0) { $shib2_lib = 'mod_shib2.so' } else { $shib2_lib = 'mod_shib.so' } $mod_libs = { 'shib2' => $shib2_lib, } $conf_template = 'apache/httpd.conf.erb' $http_protocol_options = undef $keepalive = 'On' $keepalive_timeout = 15 $max_keepalive_requests = 100 $fastcgi_lib_path = '/var/lib/apache2/fastcgi' $mime_support_package = 'mime-support' $mime_types_config = '/etc/mime.types' if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '13.10') >= 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '8') >= 0) { $docroot = '/var/www/html' } else { $docroot = '/var/www' } $cas_cookie_path = '/var/cache/apache2/mod_auth_cas/' $mellon_lock_file = undef $mellon_cache_size = undef $mellon_post_directory = '/var/cache/apache2/mod_auth_mellon/' $modsec_version = 1 $modsec_crs_package = 'modsecurity-crs' $modsec_crs_path = '/usr/share/modsecurity-crs' $modsec_dir = '/etc/modsecurity' $secpcrematchlimit = 1500 $secpcrematchlimitrecursion = 1500 $modsec_secruleengine = 'On' if ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '9') >= 0) or ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '18.04') >= 0) { $modsec_default_rules = [ 'crawlers-user-agents.data', 'iis-errors.data', 'java-code-leakages.data', 'java-errors.data', 'lfi-os-files.data', 'php-config-directives.data', 'php-errors.data', 'php-function-names-933150.data', 'php-function-names-933151.data', 'php-variables.data', 'restricted-files.data', 'scanners-headers.data', 'scanners-urls.data', 'scanners-user-agents.data', 'scripting-user-agents.data', 'sql-errors.data', 'sql-function-names.data', 'unix-shell.data', 'windows-powershell-commands.data', ] } else { $modsec_default_rules = [ 'base_rules/modsecurity_35_bad_robots.data', 'base_rules/modsecurity_35_scanners.data', 'base_rules/modsecurity_40_generic_attacks.data', 'base_rules/modsecurity_50_outbound.data', 'base_rules/modsecurity_50_outbound_malware.data', 'base_rules/modsecurity_crs_20_protocol_violations.conf', 'base_rules/modsecurity_crs_21_protocol_anomalies.conf', 'base_rules/modsecurity_crs_23_request_limits.conf', 'base_rules/modsecurity_crs_30_http_policy.conf', 'base_rules/modsecurity_crs_35_bad_robots.conf', 'base_rules/modsecurity_crs_40_generic_attacks.conf', 'base_rules/modsecurity_crs_41_sql_injection_attacks.conf', 'base_rules/modsecurity_crs_41_xss_attacks.conf', 'base_rules/modsecurity_crs_42_tight_security.conf', 'base_rules/modsecurity_crs_45_trojans.conf', 'base_rules/modsecurity_crs_47_common_exceptions.conf', 'base_rules/modsecurity_crs_49_inbound_blocking.conf', 'base_rules/modsecurity_crs_50_outbound.conf', 'base_rules/modsecurity_crs_59_outbound_blocking.conf', 'base_rules/modsecurity_crs_60_correlation.conf', ] } $alias_icons_path = '/usr/share/apache2/icons' $error_documents_path = '/usr/share/apache2/error' if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '13.10') >= 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '8') >= 0) { $dev_packages = ['libaprutil1-dev', 'libapr1-dev', 'apache2-dev'] } else { $dev_packages = ['libaprutil1-dev', 'libapr1-dev', 'apache2-prefork-dev'] } # # Passenger-specific settings # $passenger_conf_file = 'passenger.conf' $passenger_conf_package_file = undef if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '14.04') < 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '8') < 0) { $passenger_root = '/usr' $passenger_ruby = '/usr/bin/ruby' $passenger_default_ruby = undef } else { $passenger_root = '/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini' $passenger_ruby = undef $passenger_default_ruby = '/usr/bin/ruby' } $wsgi_socket_prefix = undef } elsif $::osfamily == 'FreeBSD' { $user = 'www' $group = 'www' $root_group = 'wheel' $apache_name = 'apache24' $service_name = 'apache24' $httpd_dir = '/usr/local/etc/apache24' $server_root = '/usr/local' $conf_dir = $httpd_dir $confd_dir = "${httpd_dir}/Includes" $conf_enabled = undef $mod_dir = "${httpd_dir}/Modules" $mod_enable_dir = undef $vhost_dir = "${httpd_dir}/Vhosts" $vhost_enable_dir = undef $conf_file = 'httpd.conf' $ports_file = "${conf_dir}/ports.conf" $pidfile = '/var/run/httpd.pid' $logroot = '/var/log/apache24' $logroot_mode = undef $lib_path = '/usr/local/libexec/apache24' $mpm_module = 'prefork' $dev_packages = undef $default_ssl_cert = '/usr/local/etc/apache24/server.crt' $default_ssl_key = '/usr/local/etc/apache24/server.key' $ssl_sessioncache = '/var/run/ssl_scache(512000)' $passenger_conf_file = 'passenger.conf' $passenger_conf_package_file = undef $passenger_root = '/usr/local/lib/ruby/gems/2.0/gems/passenger-4.0.58' $passenger_ruby = '/usr/local/bin/ruby' $passenger_default_ruby = undef $suphp_addhandler = 'php5-script' $suphp_engine = 'off' $suphp_configpath = undef $php_version = '5' $mod_packages = { # NOTE: I list here only modules that are not included in www/apache24 # NOTE: 'passenger' needs to enable APACHE_SUPPORT in make config # NOTE: 'php' needs to enable APACHE option in make config # NOTE: 'dav_svn' needs to enable MOD_DAV_SVN make config # NOTE: not sure where the shibboleth should come from 'auth_kerb' => 'www/mod_auth_kerb2', 'auth_gssapi' => 'www/mod_auth_gssapi', 'auth_openidc'=> 'www/mod_auth_openidc', 'fcgid' => 'www/mod_fcgid', 'passenger' => 'www/rubygem-passenger', 'perl' => 'www/mod_perl2', 'phpXXX' => 'www/mod_phpXXX', 'proxy_html' => 'www/mod_proxy_html', 'python' => 'www/mod_python3', 'wsgi' => 'www/mod_wsgi', 'dav_svn' => 'devel/subversion', 'xsendfile' => 'www/mod_xsendfile', 'rpaf' => 'www/mod_rpaf2', 'shib2' => 'security/shibboleth2-sp', } $mod_libs = { } $conf_template = 'apache/httpd.conf.erb' $http_protocol_options = undef $keepalive = 'On' $keepalive_timeout = 15 $max_keepalive_requests = 100 $fastcgi_lib_path = undef # TODO: revisit $mime_support_package = 'misc/mime-support' $mime_types_config = '/usr/local/etc/mime.types' $wsgi_socket_prefix = undef $docroot = '/usr/local/www/apache24/data' $alias_icons_path = '/usr/local/www/apache24/icons' $error_documents_path = '/usr/local/www/apache24/error' $error_log = 'httpd-error.log' $scriptalias = '/usr/local/www/apache24/cgi-bin' $access_log_file = 'httpd-access.log' } elsif $::osfamily == 'Gentoo' { $user = 'apache' $group = 'apache' $root_group = 'wheel' $apache_name = 'www-servers/apache' $service_name = 'apache2' $httpd_dir = '/etc/apache2' $server_root = '/var/www' $conf_dir = $httpd_dir $confd_dir = "${httpd_dir}/conf.d" $conf_enabled = undef $mod_dir = "${httpd_dir}/modules.d" $mod_enable_dir = undef $vhost_dir = "${httpd_dir}/vhosts.d" $vhost_enable_dir = undef $conf_file = 'httpd.conf' $ports_file = "${conf_dir}/ports.conf" $logroot = '/var/log/apache2' $logroot_mode = undef $lib_path = '/usr/lib/apache2/modules' $mpm_module = 'prefork' $dev_packages = undef $default_ssl_cert = '/etc/ssl/apache2/server.crt' $default_ssl_key = '/etc/ssl/apache2/server.key' $ssl_sessioncache = '/var/run/ssl_scache(512000)' $passenger_root = '/usr' $passenger_ruby = '/usr/bin/ruby' $passenger_conf_file = 'passenger.conf' $passenger_conf_package_file = undef $passenger_default_ruby = undef $suphp_addhandler = 'x-httpd-php' $suphp_engine = 'off' $suphp_configpath = '/etc/php5/apache2' $php_version = '5' $mod_packages = { # NOTE: I list here only modules that are not included in www-servers/apache 'auth_kerb' => 'www-apache/mod_auth_kerb', 'auth_gssapi' => 'www-apache/mod_auth_gssapi', 'authnz_external' => 'www-apache/mod_authnz_external', 'fcgid' => 'www-apache/mod_fcgid', 'passenger' => 'www-apache/passenger', 'perl' => 'www-apache/mod_perl', 'phpXXX' => 'dev-lang/php', 'proxy_html' => 'www-apache/mod_proxy_html', 'proxy_fcgi' => 'www-apache/mod_proxy_fcgi', 'python' => 'www-apache/mod_python', 'wsgi' => 'www-apache/mod_wsgi', 'dav_svn' => 'dev-vcs/subversion', 'xsendfile' => 'www-apache/mod_xsendfile', 'rpaf' => 'www-apache/mod_rpaf', 'xml2enc' => 'www-apache/mod_xml2enc', } $mod_libs = { } $conf_template = 'apache/httpd.conf.erb' $http_protocol_options = undef $keepalive = 'On' $keepalive_timeout = 15 $max_keepalive_requests = 100 $fastcgi_lib_path = undef # TODO: revisit $mime_support_package = 'app-misc/mime-types' $mime_types_config = '/etc/mime.types' $wsgi_socket_prefix = undef $docroot = '/var/www/localhost/htdocs' $alias_icons_path = '/usr/share/apache2/icons' $error_documents_path = '/usr/share/apache2/error' $pidfile = '/var/run/apache2.pid' $error_log = 'error.log' $scriptalias = '/var/www/localhost/cgi-bin' $access_log_file = 'access.log' } elsif $::osfamily == 'Suse' { $user = 'wwwrun' $group = 'www' $root_group = 'root' $apache_name = 'apache2' $service_name = 'apache2' $httpd_dir = '/etc/apache2' $server_root = '/etc/apache2' $conf_dir = $httpd_dir $confd_dir = "${httpd_dir}/conf.d" $conf_enabled = undef $mod_dir = "${httpd_dir}/mods-available" $mod_enable_dir = "${httpd_dir}/mods-enabled" $vhost_dir = "${httpd_dir}/sites-available" $vhost_enable_dir = "${httpd_dir}/sites-enabled" $conf_file = 'httpd.conf' $ports_file = "${conf_dir}/ports.conf" $pidfile = '/var/run/httpd2.pid' $logroot = '/var/log/apache2' $logroot_mode = undef $lib_path = '/usr/lib64/apache2' #changes for some modules based on mpm $mpm_module = 'prefork' - if versioncmp($::operatingsystemrelease, '15') < 0 { $default_ssl_cert = '/etc/apache2/ssl.crt/server.crt' $default_ssl_key = '/etc/apache2/ssl.key/server.key' + $php_version = '5' } else { $default_ssl_cert = '/etc/apache2/ssl.crt/default-server.crt' $default_ssl_key = '/etc/apache2/ssl.key/default-server.key' + $php_version = '7' } + $suphp_configpath = "/etc/php${php_version}/apache2" $ssl_sessioncache = '/var/lib/apache2/ssl_scache(512000)' $suphp_addhandler = 'x-httpd-php' $suphp_engine = 'off' - $suphp_configpath = '/etc/php5/apache2' - $php_version = '5' if versioncmp($::operatingsystemrelease, '11') < 0 or versioncmp($::operatingsystemrelease, '12') >= 0 { - $mod_packages = { + $mod_packages = { 'auth_kerb' => 'apache2-mod_auth_kerb', 'auth_gssapi' => 'apache2-mod_auth_gssapi', 'dav_svn' => 'subversion-server', 'perl' => 'apache2-mod_perl', 'php5' => 'apache2-mod_php5', + 'php7' => 'apache2-mod_php7', 'python' => 'apache2-mod_python', 'security' => 'apache2-mod_security2', 'worker' => 'apache2-worker', } } else { $mod_packages = { 'auth_kerb' => 'apache2-mod_auth_kerb', 'auth_gssapi' => 'apache2-mod_auth_gssapi', 'dav_svn' => 'subversion-server', 'perl' => 'apache2-mod_perl', 'php5' => 'apache2-mod_php53', 'python' => 'apache2-mod_python', 'security' => 'apache2-mod_security2', } } $mod_libs = { 'security' => '/usr/lib64/apache2/mod_security2.so', 'php53' => '/usr/lib64/apache2/mod_php5.so', } $conf_template = 'apache/httpd.conf.erb' $http_protocol_options = undef $keepalive = 'On' $keepalive_timeout = 15 $max_keepalive_requests = 100 $fastcgi_lib_path = '/var/lib/apache2/fastcgi' $mime_support_package = 'aaa_base' $mime_types_config = '/etc/mime.types' $docroot = '/srv/www' $cas_cookie_path = '/var/cache/apache2/mod_auth_cas/' $mellon_lock_file = undef $mellon_cache_size = undef $mellon_post_directory = undef $alias_icons_path = '/usr/share/apache2/icons' $error_documents_path = '/usr/share/apache2/error' $dev_packages = ['libapr-util1-devel', 'libapr1-devel', 'libcurl-devel'] $modsec_version = 1 $modsec_crs_package = undef $modsec_crs_path = undef $modsec_default_rules = undef $modsec_dir = '/etc/apache2/modsecurity' $secpcrematchlimit = 1500 $secpcrematchlimitrecursion = 1500 $modsec_secruleengine = 'On' $error_log = 'error.log' $scriptalias = '/usr/lib/cgi-bin' $access_log_file = 'access.log' # # Passenger-specific settings # $passenger_conf_file = 'passenger.conf' $passenger_conf_package_file = undef $passenger_root = '/usr/lib64/ruby/gems/1.8/gems/passenger-5.0.30' $passenger_ruby = '/usr/bin/ruby' $passenger_default_ruby = '/usr/bin/ruby' $wsgi_socket_prefix = undef } else { fail("Class['apache::params']: Unsupported osfamily: ${::osfamily}") } if ($::operatingsystem == 'Ubuntu' and $::lsbdistrelease == '10.04') or ($::operatingsystem == 'SLES') { $verify_command = '/usr/sbin/apache2ctl -t' } elsif $::operatingsystem == 'FreeBSD' { $verify_command = '/usr/local/sbin/apachectl -t' } elsif ($apache::version::scl_httpd_version) { $verify_command = "/opt/rh/${_scl_httpd_name}/root/usr/sbin/apachectl -t" } else { $verify_command = '/usr/sbin/apachectl -t' } if $::osfamily == 'RedHat' and versioncmp($::operatingsystemrelease, '8.0') >= 0 { $ssl_protocol = ['all'] # Implementations of the SSLv2 and SSLv3 protocol versions have been removed from OpenSSL (and hence mod_ssl) because these are no longer considered secure. For additional documentation https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/deploying_different_types_of_servers/setting-apache-web-server_deploying-different-types-of-servers } else { $ssl_protocol = ['all', '-SSLv2', '-SSLv3'] } } diff --git a/spec/acceptance/mod_php_spec.rb b/spec/acceptance/mod_php_spec.rb index b95f7385..29174454 100644 --- a/spec/acceptance/mod_php_spec.rb +++ b/spec/acceptance/mod_php_spec.rb @@ -1,89 +1,93 @@ # frozen_string_literal: true require 'spec_helper_acceptance' apache_hash = apache_settings_hash describe 'apache::mod::php class', if: mod_supported_on_platform?('apache::mod::php') do context 'default php config' do pp = <<-MANIFEST class { 'apache': mpm_module => 'prefork', } class { 'apache::mod::php': } apache::vhost { 'php.example.com': port => '80', docroot => '#{apache_hash['doc_root']}/php', } host { 'php.example.com': ip => '127.0.0.1', } file { '#{apache_hash['doc_root']}/php/index.php': ensure => file, content => "\\n", } MANIFEST it 'succeeds in puppeting php' do apply_manifest(pp, catch_failures: true) end if (os[:family] == 'ubuntu' && os[:release] == '16.04') || (os[:family] == 'debian' && os[:release] =~ %r{^9\.}) describe file("#{apache_hash['mod_dir']}/php7.0.conf") do it { is_expected.to contain 'DirectoryIndex index.php' } end elsif os[:family] == 'debian' && os[:release] =~ %r{^10\.} describe file("#{apache_hash['mod_dir']}/php7.3.conf") do it { is_expected.to contain 'DirectoryIndex index.php' } end elsif os[:family] == 'ubuntu' && os[:release] == '18.04' describe file("#{apache_hash['mod_dir']}/php7.2.conf") do it { is_expected.to contain 'DirectoryIndex index.php' } end elsif os[:family] == 'ubuntu' && os[:release] == '20.04' describe file("#{apache_hash['mod_dir']}/php7.4.conf") do it { is_expected.to contain 'DirectoryIndex index.php' } end elsif os[:family] == 'redhat' && os[:release] =~ %r{^8\.} describe file("#{apache_hash['mod_dir']}/php7.conf") do it { is_expected.to contain 'DirectoryIndex index.php' } end + elsif os[:family] == 'sles' && os[:release].to_i >= 15 + describe file("#{apache_hash['mod_dir']}/php7.conf") do + it { is_expected.to contain 'DirectoryIndex index.php' } + end else describe file("#{apache_hash['mod_dir']}/php5.conf") do it { is_expected.to contain 'DirectoryIndex index.php' } end end end context 'custom extensions, php_flag, php_value, php_admin_flag, and php_admin_value' do pp = <<-MANIFEST class { 'apache': mpm_module => 'prefork', } class { 'apache::mod::php': extensions => ['.php','.php5'], } apache::vhost { 'php.example.com': port => '80', docroot => '#{apache_hash['doc_root']}/php', php_values => { 'include_path' => '.:/usr/share/pear:/usr/bin/php', }, php_flags => { 'display_errors' => 'on', }, php_admin_values => { 'open_basedir' => '/var/www/php/:/usr/share/pear/', }, php_admin_flags => { 'engine' => 'on', }, } host { 'php.example.com': ip => '127.0.0.1', } file { '#{apache_hash['doc_root']}/php/index.php5': ensure => file, content => "\\n", } MANIFEST it 'succeeds in puppeting php' do apply_manifest(pp, catch_failures: true) end describe file("#{apache_hash['vhost_dir']}/25-php.example.com.conf") do it { is_expected.to contain ' php_flag display_errors on' } it { is_expected.to contain ' php_value include_path ".:/usr/share/pear:/usr/bin/php"' } it { is_expected.to contain ' php_admin_flag engine on' } it { is_expected.to contain ' php_admin_value open_basedir /var/www/php/:/usr/share/pear/' } end end end diff --git a/spec/classes/mod/php_spec.rb b/spec/classes/mod/php_spec.rb index 05a6de02..1fb0637b 100644 --- a/spec/classes/mod/php_spec.rb +++ b/spec/classes/mod/php_spec.rb @@ -1,301 +1,302 @@ # frozen_string_literal: true require 'spec_helper' describe 'apache::mod::php', type: :class do on_supported_os.each do |os, facts| context "on #{os} " do let :facts do facts end let :pre_condition do 'class { "apache": mpm_module => prefork, }' end case facts[:os]['family'] when 'Debian' describe 'on a Debian OS' do context 'with mpm_module => prefork' do it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_class('apache::mod::prefork') } end case facts[:os]['release']['major'] when '8' context 'on jessie' do it { is_expected.to contain_file('php5.load').with( content: "LoadModule php5_module /usr/lib/apache2/modules/libphp5.so\n", ) } context 'with mpm_module => itk on jessie' do let :pre_condition do 'class { "apache": mpm_module => itk, }' end it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_class('apache::mod::itk') } it { is_expected.to contain_apache__mod('php5') } it { is_expected.to contain_package('libapache2-mod-php5') } it { is_expected.to contain_file('php5.load').with( content: "LoadModule php5_module /usr/lib/apache2/modules/libphp5.so\n", ) } end end when '9' context 'on stretch' do it { is_expected.to contain_apache__mod('php7.0') } it { is_expected.to contain_package('libapache2-mod-php7.0') } it { is_expected.to contain_file('php7.0.load').with( content: "LoadModule php7_module /usr/lib/apache2/modules/libphp7.0.so\n", ) } end when '16.04' context 'on stretch' do let :params do { content: 'somecontent' } end it { is_expected.to contain_file('php7.0.conf').with( content: 'somecontent', ) } end when '18.04' context 'on stretch' do let :params do { content: 'somecontent' } end it { is_expected.to contain_file('php7.2.conf').with( content: 'somecontent', ) } end end end when 'RedHat' describe 'on a RedHat OS' do context 'with default params' do let :pre_condition do 'class { "apache": }' end it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_apache__mod('php5') } if facts[:os]['release']['major'].to_i < 8 it { is_expected.to contain_package('php') } if facts[:os]['release']['major'].to_i > 5 it { is_expected.to contain_file('php5.load').with(content: "LoadModule php5_module modules/libphp5.so\n") } if facts[:os]['release']['major'].to_i < 8 it { is_expected.to contain_file('php7.load').with(content: "LoadModule php7_module modules/libphp7.so\n") } if facts[:os]['release']['major'].to_i >= 8 end context 'with alternative package name' do let :pre_condition do 'class { "apache": }' end let :params do { package_name: 'php54' } end it { is_expected.to contain_package('php54') } end context 'with alternative path' do let :pre_condition do 'class { "apache": }' end let :params do { path: 'alternative-path' } end it { is_expected.to contain_file('php5.load').with(content: "LoadModule php5_module alternative-path\n") } if facts[:os]['release']['major'].to_i < 8 it { is_expected.to contain_file('php7.load').with(content: "LoadModule php7_module alternative-path\n") } if facts[:os]['release']['major'].to_i >= 8 end context 'with alternative extensions' do let :pre_condition do 'class { "apache": }' end let :params do { extensions: ['.php', '.php5'], } end it { is_expected.to contain_file('php5.conf').with_content(Regexp.new(Regexp.escape(''))) } if facts[:os]['release']['major'].to_i < 8 end if facts[:os]['release']['major'].to_i > 5 context 'with specific version' do let :pre_condition do 'class { "apache": }' end let :params do { package_ensure: '5.3.13' } end it { is_expected.to contain_package('php').with( ensure: '5.3.13', ) } end end context 'with mpm_module => prefork' do it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_class('apache::mod::prefork') } it { is_expected.to contain_apache__mod('php5') } if facts[:os]['release']['major'].to_i < 8 it { is_expected.to contain_package('php') } if facts[:os]['release']['major'].to_i > 5 it { is_expected.to contain_file('php5.load').with(content: "LoadModule php5_module modules/libphp5.so\n") } if facts[:os]['release']['major'].to_i < 8 it { is_expected.to contain_file('php7.load').with(content: "LoadModule php7_module modules/libphp7.so\n") } if facts[:os]['release']['major'].to_i >= 8 end context 'with mpm_module => itk' do let :pre_condition do 'class { "apache": mpm_module => itk, }' end it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_class('apache::mod::itk') } it { is_expected.to contain_apache__mod('php5') } if facts[:os]['release']['major'].to_i < 8 it { is_expected.to contain_package('php') } if facts[:os]['release']['major'].to_i > 5 it { is_expected.to contain_file('php5.load').with(content: "LoadModule php5_module modules/libphp5.so\n") } if facts[:os]['release']['major'].to_i < 8 it { is_expected.to contain_file('php7.load').with(content: "LoadModule php7_module modules/libphp7.so\n") } if facts[:os]['release']['major'].to_i >= 8 end end when 'FreeBSD' describe 'on a FreeBSD OS' do context 'with mpm_module => prefork' do it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_apache__mod('php5') } it { is_expected.to contain_package('www/mod_php5') } it { is_expected.to contain_file('php5.load') } end context 'with mpm_module => itk' do let :pre_condition do 'class { "apache": mpm_module => itk, }' end it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_class('apache::mod::itk') } it { is_expected.to contain_apache__mod('php5') } it { is_expected.to contain_package('www/mod_php5') } it { is_expected.to contain_file('php5.load') } end end when 'Gentoo' describe 'on a Gentoo OS' do context 'with mpm_module => prefork' do it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_apache__mod('php5') } it { is_expected.to contain_package('dev-lang/php') } it { is_expected.to contain_file('php5.load') } end context 'with mpm_module => itk' do let :pre_condition do 'class { "apache": mpm_module => itk, }' end it { is_expected.to contain_class('apache::params') } it { is_expected.to contain_class('apache::mod::itk') } it { is_expected.to contain_apache__mod('php5') } it { is_expected.to contain_package('dev-lang/php') } it { is_expected.to contain_file('php5.load') } end end end # all the following tests are for legacy php/apache versions. They don't work on modern ubuntu and redhat 8 next if (facts[:os]['release']['major'].to_i > 15 && facts[:os]['name'] == 'Ubuntu') || + (facts[:os]['release']['major'].to_i >= 15 && facts[:os]['name'] == 'SLES') || (facts[:os]['release']['major'].to_i >= 9 && facts[:os]['name'] == 'Debian') || (facts[:os]['release']['major'].to_i >= 8 && (facts[:os]['name'] == 'RedHat' || facts[:os]['name'] == 'CentOS')) describe 'OS independent tests' do context 'with content param' do let :params do { content: 'somecontent' } end it { is_expected.to contain_file('php5.conf').with( content: 'somecontent', ) } end context 'with template param' do let :params do { template: 'apache/mod/php.conf.erb' } end it { is_expected.to contain_file('php5.conf').with( content: %r{^# PHP is an HTML-embedded scripting language which attempts to make it}, ) } end context 'with source param' do let :params do { source: 'some-path' } end it { is_expected.to contain_file('php5.conf').with( source: 'some-path', ) } end context 'content has priority over template' do let :params do { template: 'apache/mod/php5.conf.erb', content: 'somecontent', } end it { is_expected.to contain_file('php5.conf').with( content: 'somecontent', ) } end context 'source has priority over template' do let :params do { template: 'apache/mod/php5.conf.erb', source: 'some-path', } end it { is_expected.to contain_file('php5.conf').with( source: 'some-path', ) } end context 'source has priority over content' do let :params do { content: 'somecontent', source: 'some-path', } end it { is_expected.to contain_file('php5.conf').with( source: 'some-path', ) } end context 'with mpm_module => worker' do let :pre_condition do 'class { "apache": mpm_module => worker, }' end it 'raises an error' do is_expected.to compile.and_raise_error(%r{mpm_module => 'prefork' or mpm_module => 'itk'}) end end end end end end