denc-webcluster: nginx AppArmor rules

Allow access to static content.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

pillar/cluster/denc/web-proxy.sls

@@ -209,3 +209,9 @@ firewalld:
       services:
         - http
         - https
+
+profile:
+  apparmor:
+    local:
+      usr.sbin.nginx:
+        - '/srv/www/{libsso.net,sso.casa,sso.syscid.com}/{index.html,stuff/tacit-css-1.5.2.min.css} r,'

pillar/role/web-proxy.sls

@@ -68,3 +68,9 @@ firewalld:
       services:
         - http
         - https
+
+profile:
+  apparmor:
+    local:
+      usr.sbin.nginx:
+        - '{{ trustcrt }} r,'

salt/role/web-proxy.sls

@@ -1,4 +1,5 @@
 include:
+  - apparmor.local
   - nginx.pkg
   - nginx.config
   - nginx.snippets