Openstack contrib: WSGI endpoints listen on all interfaces

[pengwyn]

I believe there is an unnecessary open port in the current configuration for the openstack helpers. The current configuration seems to be:

• haproxy balances TCP traffic to each unit limiting to only the appropriate subnet
• apache2 openstack_https_frontend.conf terminates the TLS traffic and limits to only the appropriate incoming subnet
• apache2 wsgi-openstack-api.conf then runs the openstack API processes, but does not limit to any subnet/interface

The last part is due to the lines in wsgi-openstack-api.conf which read:

<VirtualHost *:{{ port }}>

Although this is not the public endpoint exposed via HTTPS, this is a HTTP endpoint which is available to anyone on the network connected to where these servers are running. Without additional security layers, this is then exposed globally.

Is my summary above correct or have I missed something?

Because the TLS terminating layer is reverse proxying to the WSGI HTTP endpoint on localhost only, is it possible to hardcode the interface in wsgi-openstack-api.conf to listen on localhost only?