helm: Use Apache instead of nginx to serve our static repo files (sync collabora/production from collabora/staging)

This includes support for injecting custom Apache configuration blocks by editing the values file, which should make it possible to add authentication later on.

This simplifies the switchover of deployments that are currently using Apache + mod_auth_oidc to guard their published repositories.

Staging MRs:

• !10 (merged)
• !18 (merged)
• !20 (merged)

Task: https://phabricator.apertis.org/T10135

chart/templates/configmap-publish.yaml

@@ -5,19 +5,65 @@ metadata:
   labels:
     {{- include "aptly.labels" . | nindent 4 }}
 data:
-  default.conf: |
-    server {
-      listen       80 default_server;
-      listen  [::]:80 default_server;
-
-      #access_log  /var/log/nginx/host.access.log  main;
-      location ~ /apertis/dists/(?<dist>[^/]+)/snapshots/latest\.txt$ {
-        resolver kube-dns.kube-system.svc.cluster.local;
-        proxy_pass http://{{ include "aptly.fullname" . }}-latest-snapshots.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.latestSnapshots.service.port }}/latest/$dist;
-      }
-      location / {
-        root   /data;
-        autoindex on;
-        try_files $uri $uri/ =404;
-      }
-    }
+  httpd.conf: |
+    ServerRoot "/usr/local/apache2"
+    Listen 80
+
+    {{ .Values.publish.config.before_modules | indent 4 }}
+    LoadModule mpm_event_module modules/mod_mpm_event.so
+    LoadModule authz_core_module modules/mod_authz_core.so
+    LoadModule allowmethods_module modules/mod_allowmethods.so
+    LoadModule reqtimeout_module modules/mod_reqtimeout.so
+    LoadModule mime_module modules/mod_mime.so
+    LoadModule log_config_module modules/mod_log_config.so
+    LoadModule headers_module modules/mod_headers.so
+    LoadModule proxy_module modules/mod_proxy.so
+    LoadModule proxy_http_module modules/mod_proxy_http.so
+    LoadModule unixd_module modules/mod_unixd.so
+    LoadModule dir_module modules/mod_dir.so
+    LoadModule autoindex_module modules/mod_autoindex.so
+    {{ .Values.publish.config.after_modules | indent 4 }}
+
+    <IfModule unixd_module>
+      User www-data
+      Group www-data
+    </IfModule>
+
+    ErrorLog /proc/self/fd/2
+    LogLevel warn
+
+    <IfModule log_config_module>
+      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" common
+      CustomLog /proc/self/fd/1 common
+    </IfModule>
+
+    <IfModule headers_module>
+      RequestHeader unset Proxy early
+    </IfModule>
+
+    <Directory />
+      AllowOverride none
+      Require all denied
+    </Directory>
+
+    DocumentRoot /data
+    <Directory /data>
+      AllowMethods GET
+      AllowOverride none
+      Require all granted
+      Options +Indexes
+      AddDefaultCharset utf-8
+    </Directory>
+
+    define SNAPSHOTS_SERVICE "{{ include "aptly.fullname" . }}-latest-snapshots.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.latestSnapshots.service.port }}"
+    <LocationMatch "^/apertis/dists/(?<dist>[^/]+)/snapshots/latest\.txt$">
+      AllowMethods GET
+      ProxyPassMatch "http://${SNAPSHOTS_SERVICE}/latest/$1"
+      ProxyPassReverse ${SNAPSHOTS_SERVICE}
+    </LocationMatch>
+
+    <IfModule mime_module>
+      TypesConfig conf/mime.types
+    </IfModule>
+
+    {{ .Values.publish.config.after_body | indent 4 }}