ENT-11440: Enable http2 in apache for Mission Portal

README.md

@@ -154,6 +154,7 @@ File `install-dependencies` and the relevant subdirectories in `deps-packaging`
 | [apr-util](https://apr.apache.org/)                 | 1.6.3  | 1.6.3  | 1.6.3  |
 | [Git](https://www.kernel.org/pub/software/scm/git/) | 2.47.0 | 2.47.0 | 2.47.0 |
 | [libexpat](https://libexpat.github.io/)             | -      | 2.6.3  | 2.6.3  |
+| [nghttp2](https://nghttp2.opg/)                     | -      | -      | 1.62.1 |
 | [PHP](http://php.net/)                              | 8.3.12 | 8.3.12 | 8.3.12 |
 | [PostgreSQL](http://www.postgresql.org/)            | 15.8   | 16.4   | 17.0   |
 | [rsync](https://download.samba.org/pub/rsync/)      | 3.3.0  | 3.3.0  | 3.3.0  |

build-scripts/compile-options

@@ -208,7 +208,7 @@ case "$ROLE" in
     # HUB-ONLY dependencies
     hub)
         var_append DEPS "libcurl-hub"
-        var_append DEPS "libexpat apr apr-util apache git rsync"
+        var_append DEPS "nghttp2 libexpat apr apr-util apache git rsync"
         var_append DEPS "postgresql php"
         ;;
     # AGENT-ONLY dependencies

build-scripts/install-dependencies

@@ -48,7 +48,7 @@ check_and_install_perl()
              "too old"
         PERL_OK="no"
     fi
-    if ! perl -e 'use List::Util qw(pairs);'; then
+    if ! $PERL -e 'use List::Util qw(pairs);'; then
         echo "$PERL has List::Util that does not export pairs. Needs to be at least version 1.29 for OpenSSL version 3.3.2."
         PERL_OK="no"
     fi

deps-packaging/apache/cfbuild-apache.spec

@@ -30,13 +30,13 @@ CPPFLAGS=-I%{buildprefix}/include
     --prefix=%{prefix}/httpd \
     --enable-so \
     --enable-mods-shared="all ssl ldap authnz_ldap" \
+    --enable-http2 \
     --with-z=%{prefix} \
     --with-ssl=%{prefix} \
     --with-ldap=%{prefix} \
     --with-apr=%{prefix} \
     --with-apr-util=%{prefix} \
     --with-pcre=%{prefix}/bin/pcre2-config \
-    --with-mpm=prefork \
     CPPFLAGS="$CPPFLAGS"
 
 %build

deps-packaging/apache/debian/rules

@@ -24,7 +24,6 @@ build-stamp:
 --with-apr=$(PREFIX) \
 --with-apr-util=$(PREFIX) \
 --with-pcre=$(PREFIX)/bin/pcre2-config \
---with-mpm=prefork \
 CPPFLAGS="$(CPPFLAGS)"
 	make
 

deps-packaging/apache/httpd.conf

@@ -235,11 +235,19 @@ LogLevel warn
 
 </IfModule>
 
-
-LoadModule php_module       modules/libphp.so
-AddHandler php-script       .php
-AddType    application/x-httpd-php-source php
-
+# Use mod_http2
+LoadModule http2_module modules/mod_http2.so
+# Prefer http2 protocol
+Protocols h2 h2c http/1.1
+
+# Setup php to be handled by php-fpm. Required for use of mod_http2 due to threading issues in php.
+LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
+# need to pass Authorization headers to fpm for API requests
+SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
+<FilesMatch \.php$>
+SetHandler "proxy:fcgi://127.0.0.1:9000"
+</FilesMatch>
 
 <Directory "/var/cfengine/httpd/htdocs/public">
 

deps-packaging/nghttp2/cfbuild-nghttp2.spec

@@ -0,0 +1,67 @@
+%define nghttp2_version 1.62.1
+
+Summary: CFEngine Build Automation -- nghttp2
+Name: cfbuild-nghttp2
+Version: %{version}
+Release: 1
+Source0: nghttp2-%{nghttp2_version}.tar.xz
+License: MIT
+Group: Other
+Url: nghttp2.org
+BuildRoot: %{_topdir}/BUILD/%{name}-%{version}-%{release}-buildroot
+
+AutoReqProv: no
+
+%define prefix %{buildprefix}
+%prep
+mkdir -p %{_builddir}
+%setup -q -n nghttp2-%{nghttp2_version}
+
+./configure --prefix=%{prefix}
+
+%build
+
+make
+
+%install
+
+rm -rf ${RPM_BUILD_ROOT}
+
+make install DESTDIR=${RPM_BUILD_ROOT}
+
+# Remove unused files
+rm -rf ${RPM_BUILD_ROOT}%{prefix}/lib/libnghttp2.*a
+rm -rf ${RPM_BUILD_ROOT}%{prefix}/share/doc/nghttp2/README.rst
+rm -rf ${RPM_BUILD_ROOT}%{prefix}/share/man/man1/h2load.1
+rm -rf ${RPM_BUILD_ROOT}%{prefix}/share/man/man1/nghttp*
+rm -rf ${RPM_BUILD_ROOT}%{prefix}/share/nghttp2/fetch-ocsp-response
+
+%clean
+
+rm -rf $RPM_BUILD_ROOT
+
+%package devel
+Summary: CFEngine Build Automation -- nghttp2 -- development files
+Group: Other
+AutoReqProv: no
+
+%description
+CFEngine Build Automation -- nghttp2
+
+%description devel
+CFEngine Build Automation -- nghttp2 -- development files
+
+%files
+%defattr(-,root,root)
+
+%dir %prefix/lib
+%prefix/lib/*.so*
+
+%files devel
+%defattr(-,root,root)
+
+%prefix/include
+%dir %prefix/lib
+%prefix/lib/pkgconfig
+
+%changelog

deps-packaging/nghttp2/debian/cfbuild-nghttp2-devel.install

@@ -0,0 +1,2 @@
+/var/cfengine/include
+/var/cfengine/lib/pkgconfig

deps-packaging/nghttp2/debian/cfbuild-nghttp2.install

@@ -0,0 +1 @@
+/var/cfengine/lib/*.so*

deps-packaging/nghttp2/debian/compat

@@ -0,0 +1 @@
+10

deps-packaging/nghttp2/debian/control

@@ -0,0 +1,18 @@
+Source: cfbuild-nghttp2
+Section: libs
+Priority: optional
+Maintainer: CFEngine Packages <[email protected]>
+Build-Depends: debhelper
+Standard-Version: 3.8.4
+
+Package: cfbuild-nghttp2
+Section: libs
+Architecture: any
+Description: CFEngine Build Automation -- nghttp2
+ CFEngine Build Automation -- nghttp2
+
+Package: cfbuild-nghttp2-devel
+Section: libdevel
+Architecture: any
+Desciption: CFEngine Build Automation -- cfbuild-nghttp2-devel
+ CFEngine Build Automation -- cfbuild-nghttp2-devel

deps-packaging/nghttp2/debian/rules

@@ -0,0 +1,50 @@
+#!/usr/bin/make -f
+PREFIX=$(BUILDPREFIX)
+
+clean:
+	dh_testdir
+	dh_testroot
+
+	dh_clean
+
+build: build-stamp
+build-stamp:
+	dh_testdir
+
+	./configure --prefix=$(PREFIX)
+
+	make
+
+	touch build-stamp
+
+install: build
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+
+	$(MAKE) install DESTDIR=$(CURDIR)/debian/tmp
+
+	rm -rf $(CURDIR)/debian/tmp$(PREFIX)/lib/libnghttp2.*a
+	rm -rf $(CURDIR)/debian/tmp$(PREFIX)/share/doc/nghttp2/README.rst
+	rm -rf $(CURDIR)/debian/tmp$(PREFIX)/share/man/man1/h2load.1
+	rm -rf $(CURDIR)/debian/tmp$(PREFIX)/share/man/man1/nghttp*
+	rm -rf $(CURDIR)/debian/tmp$(PREFIX)/share/nghttp2
+
+binary-indep: build install
+
+binary-arch: build install
+	dh_testdir
+	dh_testroot
+	dh_install --sourcedir=debian/tmp
+	dh_link
+	dh_strip
+	dh_compress
+	dh_fixperms
+	dh_installdeb
+	dh_gencontrol
+	dh_md5sums
+	dh_builddeb
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch binary install configure

deps-packaging/nghttp2/distfiles

@@ -0,0 +1 @@
+2345d4dc136fda28ce243e0bb21f2e7e8ef6293d62c799abbf6f633a6887af72  nghttp2-1.62.1.tar.xz

deps-packaging/nghttp2/source

@@ -0,0 +1 @@
+https://github.com/nghttp2/nghttp2/releases/download/v1.62.1/

deps-packaging/php/cfbuild-php.spec

@@ -6,6 +6,7 @@ Version: %{version}
 Release: 1
 Source0: php-%{php_version}.tar.gz
 Source1: php.ini
+Source2: php-fpm.conf
 License: MIT
 Group: Other
 Url: http://example.com/
@@ -45,10 +46,7 @@ LDFLAGS=""
   --enable-mbstring \
   --enable-sockets \
   --disable-mbregex \
-  --without-fpm-user \
-  --without-fpm-group \
-  --without-fpm-systemd \
-  --without-fpm-acl \
+  --enable-fpm \
   --without-layout \
   --without-sqlite3 \
   --without-bz2 \
@@ -113,7 +111,9 @@ make
 %install
 rm -rf ${RPM_BUILD_ROOT}
 mkdir -p ${RPM_BUILD_ROOT}%{prefix}/httpd/conf
+mkdir -p ${RPM_BUILD_ROOT}%{prefix}/httpd/php/etc
 cp %{prefix}/httpd/conf/httpd.conf ${RPM_BUILD_ROOT}%{prefix}/httpd/conf
+cp ${RPM_BUILD_ROOT}/../../SOURCES/php-fpm.conf ${RPM_BUILD_ROOT}%{prefix}/httpd/php/etc
 
 INSTALL_ROOT=${RPM_BUILD_ROOT} make install
 
@@ -168,7 +168,8 @@ CFEngine Build Automation -- php -- development files
 %prefix/httpd/php/lib
 %prefix/httpd/php/bin
 %prefix/httpd/php/php
-%prefix/httpd/php/lib/php.ini
+%prefix/httpd/php/etc
+%prefix/httpd/php/sbin
 
 %dir %prefix/httpd/modules
 %prefix/httpd/modules/libphp.so

deps-packaging/php/debian/cfbuild-php.install

@@ -3,3 +3,5 @@
 /var/cfengine/httpd/php/php
 /var/cfengine/httpd/modules/libphp.so
 /var/cfengine/httpd/php/lib/php.ini
+/var/cfengine/httpd/php/etc/php-fpm.conf
+/var/cfengine/httpd/php/sbin/php-fpm

deps-packaging/php/debian/rules

@@ -25,10 +25,7 @@ build-stamp:
 --enable-mbstring \
 --enable-sockets \
 --disable-mbregex \
---without-fpm-user \
---without-fpm-group \
---without-fpm-systemd \
---without-fpm-acl \
+--enable-fpm \
 --without-layout \
 --without-sqlite3 \
 --without-bz2 \
@@ -96,7 +93,9 @@ install: build
 	dh_installdirs
 
 	mkdir -p $(CURDIR)/debian/tmp$(PREFIX)/httpd/conf
+	mkdir -p $(CURDIR)/debian/tmp$(PREFIX)/httpd/php/etc
 	cp $(PREFIX)/httpd/conf/httpd.conf $(CURDIR)/debian/tmp$(PREFIX)/httpd/conf/httpd.conf
+	cp $(CURDIR)/php-fpm.conf $(CURDIR)/debian/tmp$(PREFIX)/httpd/php/etc/
 
 	INSTALL_ROOT=$(CURDIR)/debian/tmp CPPFLAGS="-I$(PREFIX)/include" LD_LIBRARY_PATH="$(PREFIX)/lib" LD_RUN_PATH="$(PREFIX)/lib" $(MAKE) install