Open Stack

Thanks Chris.

Sounds like you're saying building out the apache element may be a sensible
next step?

-Stuart

--------------------------------------------------------
Hi

We don't have a strong attachment to stunnel though, I quickly dropped it in front of our CI/CD undercloud and Rob wrote the element so we could repeat the deployment.

In the fullness of time I would expect there to exist elements for several SSL terminators, but we shouldn't necessarily stick with stunnel because it happened to be the one I was most familiar with :)

I would think that an httpd would be a good option to go with as the default, because I tend to think that we'll need an httpd running/managing the python code by default.

Cheers,
--
Chris Jones

> On 26 Mar 2014, at 13:49, stuart.mclaren at hp.com wrote:
> 
> Just spotted the openstack-ssl element which uses 'stunnel'...
> 
> 
>> On Wed, 26 Mar 2014, stuart.mclaren at hp.com wrote:
>> 
>> All,
>> 
>> I know there's a preference for using a proxy to terminate
>> SSL connections rather than using the native python code.
>> 
>> There's a good write up of configuring the various proxies here:
>> 
>> http://docs.openstack.org/security-guide/content/ch020_ssl-everywhere.html
>> 
>> If we're not using native python SSL termination in TripleO we'll
>> need to pick which one of these would be a reasonable choice for
>> initial https support.
>> 
>> Pound may be a good choice -- its lightweight (6,000 lines of C),
>> easy to configure and gives good control over the SSL connections (ciphers etc).
>> Plus, we've experience with pushing large (GB) requests through it.
>> 
>> I'm interested if others have a strong preference for one of the other
>> options (stud, nginx, apache) and if so, what are the reasons you feel it
>> would make a better choice for a first implementation.
>> 
>> Thanks,
>> 
>> -Stuart
> 
> _______________________________________________
> OpenStack-dev mailing list
> OpenStack-dev at lists.openstack.org
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev