main.yml

---
# defaults file for jetty

#
# package and installation settings
jetty_version: 9.4.31.v20200723
jetty_install: true
jetty_force_install: false

system_base: /opt
jetty_home: /opt/jetty
jetty_base: /var/lib/jetty
jetty_logs: /var/log/jetty
jetty_dir_mode: 0750
jetty_file_mode: 0640

jetty_user_name: jetty
jetty_group_name: jetty
jetty_runtime_user: "{{ jetty_user_name }}"

jetty_group_create: true
jetty_user_create: true

jetty_clean_old: false
jetty_demo_delete: true

#
# systemd service settings
jetty_service_enabled: true
jetty_service_name: "jetty"
jetty_pid: "{{ jetty_base }}/jetty.pid"
jetty_start: false
jetty_start_log: "{{ jetty_logs }}/jetty-start.log"
jetty_state: "{{ jetty_base }}/jetty.state"

#
# runtime settings
#
jetty_web_default:
  compiler: 11
  development: true
  log_verbosity: "WARNING"

# see all available modules in `{{ jetty_home }}/modules/` or
# at https://www.eclipse.org/jetty/documentation/current/startup-modules.html#startup-listing-modules
# TODO: implement all available modules by default
jetty_modules_configure: false
jetty_modules_enabled:
  - "connectionlimit"
  - "customrequestlog"
  - "deploy"
  - "ext"
  - "gzip"
  - "http"
  - "http2"
  - "http2c"
  - "https"
  - "inetaccess"
  - "jsp"
  - "jstl"
  - "lowresources"
  - "plus"
  - "resources"
  - "rewrite"
  - "security"
  - "server"
  - "ssl"
  - "threadlimit"
  - "websocket"

# TODO: find a better solution to incorporate it in the above list
jetty_modules_config_overrides:
  - "jetty-inetaccess.xml"
  - "jetty-rewrite.xml"
  - "jetty-ssl-context.xml"
  - "webdefault.xml"

#
# example of default settings for Jetty modules. Will be merged with `jetty_modules` variable.
jetty_modules_defaults:
  connectionlimit:
    maxConnections: 1500
  # also applicable for `customrequestlog`
  requestlog:
    filePath: "logs/access.yyyy_mm_dd.log"
    append: true
  deploy:
    extractWars: true
    scanInterval: 60
  gzip:
    minGzipSize: 128
  http:
    compliance: RFC7230
  http2:
    rateControl:
      maxEventsPerSecond: 10
  inetaccess:
    include: "127.0.0.1"
    includeConnectors: "http,https"
    excludeConnectors: ""
  # part of `server.ini`
  httpConfig:
    sendServerVersion: false
    sendDateHeader: false
    requestCookieCompliance: RFC6265
    responseCookieCompliance: RFC6265
    multiPartFormDataCompliance: RFC7578
  server:
    dumpAfterStart: true
  ssl:
    stsMaxAgeSeconds: 15552000
  sslContext:
    # IMPORTANT: the path must be relative to `jetty_base`, as Jetty service will add it automatically
    keyStorePath: "etc/keystore"
    keyStorePassword: "CHANGE_ME_password"
    keyStoreType: PKCS12
    trustStoreType: PKCS12
    renegotiationAllowed: false
  threadlimit:
    forwardedHeader: "Forwarded"

# merge any overrides with the default settings dictionary
jetty_modules: "{{ jetty_modules_defaults | combine(jetty_modules_overrides | default({}), recursive=True) }}"

# see https://securityheaders.com for more information
jetty_headers:
  cache_control: "no-store, no-cache, must-revalidate, proxy-revalidate"
  expect_ct: "enforce, max-age=86400"
  expires: 0
  pragma: "no-cache"
  referrer_policy: "same-origin"
  surrogate_control: "no-store"
  x_content_type_options: "nosniff"
  x_dns_prefetch_control: "off"
  x_download_options: "noopen"
  x_frame_options: "SAMEORIGIN"
  x_xss_protection: "1; mode=block"


jetty_ssl_generate_cert: false
# see https://www.ssllabs.com/ssltest and https://github.com/dev-sec/ssl-baseline for details
tls_cipher_suites:
  # TLS 1.3 cipher suites
  - "TLS_AES_256_GCM_SHA384"
  # TODO: not available in Java 11
  # - "TLS_CHACHA20_POLY1305_SHA256"
  # TLS 1.2 cipher suites
  - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
  - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
  - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"

# must be explicitly enabled
tls_protocols:
  - "TLSv1.3"
  - "TLSv1.2"


java_options: >-
  -server
  -Xms1g
  -Xmx1g
  -XX:MetaspaceSize=256m
  -XX:MaxMetaspaceSize=256m
  -XX:+UseContainerSupport
  -XX:MaxTenuringThreshold=1
  -XX:+UseAES
  -XX:+UseCompressedOops
  -Djava.security.egd=file:/dev/./urandom
  -Dhttps.protocols={{ tls_protocols | join(",") }}
  -XX:+DisableExplicitGC
  -XX:+UnlockExperimentalVMOptions
  -XX:+UseZGC
  -Xlog:gc:file={{ jetty_logs }}/jvm_gc.log:utctime,pid,level,tags:filecount=5,filesize=1024
  -XX:+PrintClassHistogram
  -XX:+HeapDumpOnOutOfMemoryError
  -XX:HeapDumpPath={{ jetty_logs }}/jvm_heapdump.hprof