Merge lp:~james-page/charms/precise/openstack-dashboard/ha-support into lp:~openstack-charmers/charms/precise/openstack-dashboard/ha-support

[James Page]

[James Page (james-page)]

This update adds a few features:

1) HTTPS configuration options ssl_cert and ssl_key

HTTPS is on by default using snakeoil certs; this allows a user provided cert to be used.

2) Config options to

a) enable online compression (useful for use with trunk)
b) enable debugging

3) HA + HTTPS support

A little different in that Apache listens on 70/433 and haproxy fronts apache in full, using the tcp option for the SSL connections. This provides end-to-end SSL security.

General - I made this charm a little less bumpy by configuring the haproxy instance up-front; the cluster hook simply adds new nodes to the haproxy config using reload.

[Adam Gandelman (gandelman-a)]

Hey James, some comments:

- Please add a note to config.yaml or docs stating ssl_cert + ssl_key are expected to be input as base64 encoded.

- Once I realized that, I did a juju set openstack-dashboard ssl_key="$(cat /tmp/key | base64)" ssl_cert="$(cat tmp/cert | base64)" but was getting base64 decode errors in config-changed, needed to update the horizon-common cert config function:

   key=$2
- echo $cert | base64 -d > /etc/ssl/certs/dashboard.cert
- echo $key | base64 -d > /etc/ssl/private/dashboard.key
+ echo $cert | base64 -di > /etc/ssl/certs/dashboard.cert
+ echo $key | base64 -di > /etc/ssl/private/dashboard.key
   chmod 0600 /etc/ssl/private/dashboard.key

- I don't think its a blocker, but one issue with putting SSL termination behind haproxy is that all service units are sharing the same certificate. When deploying with custom certificates, its the deployers responsibility to provide a certificate that will work for all dashboard hosts. When using hacluster/VIP, a cert signed for a single common name (the VIP) would work. However, if we want to use keystone-provided certificates (I hope to), when there is no VIP/hacluster, the generated certificate will only be signed for the eligible leader at the time the keystone <-> dashboard relation is made. This will work okay initially, but if that initial leader host goes away and requests start hitting another node in the service group, a certificate for an invalid host will be used and a browser warning. This is less of an issue for the dashboard since it ends with a browser warning, but more of an issue if we plan on using this configuration for the internal openstack API traffic.

- Also, can you please include the latest openstack-common helper from lp:~openstack-charmers/openstack-charm-helpers/ha-helpers and rebase your changes to that code against the latest? It'll make syncing these changes easier once this merges, and I expect we'll be using the haproxy changes elsewhere.

review: Needs Fixing

[lp:~james-page/charms/precise/openstack-dashboard/ha-support]

42. By James Page on 2013-03-12

Fixup base64 encoding features

43. By James Page on 2013-03-13

Rebase from target

=== modified file 'config.yaml'
--- config.yaml	2013-02-13 16:00:50 +0000
+++ config.yaml	2013-03-13 11:10:27 +0000
@@ -49,3 +49,28 @@
         description: |
           Default multicast port number that will be used to communicate between
           HA Cluster nodes.
+    # User provided SSL cert and key
+    ssl_cert:
+        type: string
+        description: |
+          Base64 encoded SSL certificate to install and use for API ports.
+          .
+             juju set swift-proxy ssl_cert="$(cat cert | base64)" \
+                                  ssl_key="$(cat key | base64)"
+          .
+          Setting this value (and ssl_key) will enable reverse proxying, point
+          Swifts's entry in the Keystone catalog to use https, and override
+          any certficiate and key issued by Keystone (if it is configured to
+          do so).
+    ssl_key:
+        type: string
+        description: |
+          Base64 encoded SSL key to use with certificate specified as ssl_cert.
+    offline-compression:
+        type: string
+        default: "yes"
+        description: Use pre-generated Less compiled JS and CSS.
+    debug:
+        type: string
+        default: "no"
+        description: Show Django debug messages.

=== modified file 'hooks/horizon-common'
--- hooks/horizon-common	2013-02-14 14:22:41 +0000
+++ hooks/horizon-common	2013-03-13 11:10:27 +0000
@@ -1,4 +1,5 @@
 #!/bin/bash
+# vim: set ts=2:et
 
 CHARM="openstack-dashboard"
 
@@ -16,15 +17,28 @@
   local key=$1 value=$2
   [[ -z "$key" ]] || [[ -z "$value" ]] &&
     juju-log "$CHARM set_or_update: ERROR - missing parameters" && return 1
-  grep -q "^$key = \"$value\"" "$LOCAL_SETTINGS" &&
-    juju-log "$CHARM set_or_update: $key = $value already set" && return 0
+  if [ "$value" == "True" ] || [ "$value" == "False" ]; then
+    grep -q "^$key = $value" "$LOCAL_SETTINGS" &&
+      juju-log "$CHARM set_or_update: $key = $value already set" && return 0
+  else
+    grep -q "^$key = \"$value\"" "$LOCAL_SETTINGS" &&
+      juju-log "$CHARM set_or_update: $key = $value already set" && return 0
+  fi
   if grep -q "^$key = " "$LOCAL_SETTINGS" ; then
     juju-log "$CHARM set_or_update: Setting $key = $value"
     cp "$LOCAL_SETTINGS" /etc/openstack-dashboard/local_settings.last
-    sed -i "s|\(^$key = \).*|\1\"$value\"|g" "$LOCAL_SETTINGS" || return 1
+    if [ "$value" == "True" ] || [ "$value" == "False" ]; then
+      sed -i "s|\(^$key = \).*|\1$value|g" "$LOCAL_SETTINGS" || return 1
+    else
+      sed -i "s|\(^$key = \).*|\1\"$value\"|g" "$LOCAL_SETTINGS" || return 1
+    fi
   else
     juju-log "$CHARM set_or_update: Adding $key = $value"
-    echo "$key = \"$value\"" >>$LOCAL_SETTINGS || return 1
+    if [ "$value" == "True" ] || [ "$value" == "False" ]; then
+      echo "$key = $value" >>$LOCAL_SETTINGS || return 1
+    else
+      echo "$key = \"$value\"" >>$LOCAL_SETTINGS || return 1
+    fi
   fi
   return 0
 }
@@ -46,35 +60,37 @@
     export JUJU_REMOTE_UNIT=$(relation-list -r $r_id | head -n1)
     export JUJU_RELATION="identity-service"
     export JUJU_RELATION_ID="$r_id"
-    local ks_host=$(relation-get -r $r_id private-address)
-    if [[ -n "$ks_host" ]] ; then
-      service_url="http://$ks_host:5000/v2.0"
+    local service_host=$(relation-get -r $r_id service_host)
+    local service_port=$(relation-get -r $r_id service_port)
+    if [[ -n "$service_host" ]] && [[ -n "$service_port" ]] ; then
+      service_url="http://$service_host:$service_port/v2.0"
       set_or_update OPENSTACK_KEYSTONE_URL "$service_url"
     fi
   fi
 }
 
-configure_memcached() {
-  tfile=`mktemp /etc/.memcached.conf.XXXXXXX`
-  cat > $tfile << EOF
-# memcache config file - juju openstack-dashboard
--d
-logfile /var/log/memcached.log
--m 64
--p 11211
--u memcache
--l 0.0.0.0
-# TODO: Enable SASL auth
-# -S
-EOF
-  new_hash=`md5sum $tfile|cut -d' ' -f1`
-  old_hash=`md5sum /etc/memcached.conf|cut -d' ' -f1`
-  if [ "$new_hash" != "$old_hash" ]; then
-    juju-log "Reconfiguring memcache for clustering"
-    # TODO: setup SASL authentication
-    mv -f /etc/memcached.conf /etc/memcached.conf.$old_hash
-    mv -f $tfile /etc/memcached.conf
-    service memcached restart
-  fi
+configure_apache() {
+  # Reconfigure to listen on provided port
+  a2ensite default-ssl || :
+  a2enmod ssl || :
+  for ports in $@; do
+    from_port=$(echo $ports | cut -d : -f 1)
+    to_port=$(echo $ports | cut -d : -f 2)
+    sed -i -e "s/$from_port/$to_port/g" /etc/apache2/ports.conf
+    for site in $(ls -1 /etc/apache2/sites-available); do
+      sed -i -e "s/$from_port/$to_port/g" \
+        /etc/apache2/sites-available/$site
+    done
+  done
 }
 
+configure_apache_cert() {
+  cert=$1
+  key=$2
+  echo $cert | base64 -di > /etc/ssl/certs/dashboard.cert
+  echo $key | base64 -di > /etc/ssl/private/dashboard.key
+  chmod 0600 /etc/ssl/private/dashboard.key
+  sed -i -e "s|\(.*SSLCertificateFile\).*|\1 /etc/ssl/certs/dashboard.cert|g" \
+         -e "s|\(.*SSLCertificateKeyFile\).*|\1 /etc/ssl/private/dashboard.key|g" \
+          /etc/apache2/sites-available/default-ssl
+}

=== modified file 'hooks/horizon-relations'
--- hooks/horizon-relations	2013-02-27 05:27:51 +0000
+++ hooks/horizon-relations	2013-03-13 11:10:27 +0000
@@ -50,6 +50,12 @@
     juju-log "Insufficient information to configure keystone url"
     exit 0
   fi
+  local ca_cert=$(relation-get ca_cert)
+  if [ -n "$ca_cert" ]; then
+    juju-log "Installing Keystone supplied CA cert."
+    echo $ca_cert | base64 -di > /usr/local/share/ca-certificates/keystone_juju_ca_cert.crt
+    update-ca-certificates --fresh
+  fi
   service_url="http://${service_host}:${service_port}/v2.0"
   juju-log "$CHARM: Configuring Horizon to access keystone @ $service_url."
   set_or_update OPENSTACK_KEYSTONE_URL "$service_url"
@@ -95,16 +101,39 @@
     keystone_joined "$relid"
   done
 
-  service apache2 reload
-
+  if [ "$(config-get offline-compression)" != "yes" ]; then
+    set_or_update COMPRESS_OFFLINE False
+    apt-get install -y nodejs node-less
+  else
+    set_or_update COMPRESS_OFFLINE True
+  fi
+
+  # Configure default HAProxy + Apache config
+  if [ -n "$(config-get ssl_cert)" ] && \
+     [ -n "$(config-get ssl_key)" ]; then
+    configure_apache_cert "$(config-get ssl_cert)" "$(config-get ssl_key)"
+  fi
+
+  if [ "$(config-get debug)" != "yes" ]; then
+    set_or_update DEBUG False
+  else
+    set_or_update DEBUG True
+  fi
+
+  # Reconfigure Apache Ports
+  configure_apache "80:70" "443:433"
+  service apache2 restart
+  configure_haproxy "dash_insecure:80:70:http dash_secure:443:433:tcp"
+  service haproxy restart
 }
 
 function cluster_changed() {
-  configure_haproxy "openstack_dashboard:80"
-  configure_memcached
+  configure_haproxy "dash_insecure:80:70:http dash_secure:443:433:tcp"
+  service haproxy reload
 }
 
 function ha_relation_joined() {
+  # Configure HA Cluster
   local corosync_bindiface=`config-get ha-bindiface`
   local corosync_mcastport=`config-get ha-mcastport`
   local vip=`config-get vip`
@@ -126,28 +155,19 @@
     init_services="{
 'res_horizon_haproxy':'haproxy'
 }"
-    groups="{
-'grp_horizon_haproxy':'res_horizon_vip res_horizon_haproxy'
+    clones="{
+'cl_horizon_haproxy':'res_horizon_haproxy'
 }"
     relation-set corosync_bindiface=$corosync_bindiface \
       corosync_mcastport=$corosync_mcastport \
       resources="$resources" resource_params="$resource_params" \
-      init_services="$init_services" groups="$groups"
+      init_services="$init_services" clones="$clones"
   else
     juju-log "Insufficient configuration data to configure hacluster"
     exit 1
   fi
 }
 
-
-function ha_relation_changed() {
-  local clustered=`relation-get clustered`
-  if [ -n "$clustered" ]; then
-    open-port 10080
-  fi
-}
-
-
 juju-log "$CHARM: Running hook $ARG0."
 case $ARG0 in
   "install") install_hook ;;
@@ -161,5 +181,4 @@
   "cluster-relation-changed") cluster_changed ;;
   "cluster-relation-departed") cluster_changed ;;
   "ha-relation-joined") ha_relation_joined ;;
-  "ha-relation-changed") ha_relation_changed ;;
 esac

=== modified file 'hooks/lib/openstack-common'
--- hooks/lib/openstack-common	2013-03-08 21:15:45 +0000
+++ hooks/lib/openstack-common	2013-03-13 11:10:27 +0000
@@ -321,18 +321,16 @@
 
 HAPROXY_CFG=/etc/haproxy/haproxy.cfg
 HAPROXY_DEFAULT=/etc/default/haproxy
-
 ##########################################################################
 # Description: Configures HAProxy services for Openstack API's
 # Parameters:
-#   Space delimited list of service:port combinations for which
+#   Space delimited list of service:port:mode combinations for which
 #   haproxy service configuration should be generated for.  The function
 #   assumes the name of the peer relation is 'cluster' and that every
 #   service unit in the peer relation is running the same services.
 #
-#   The HAProxy service will listen on port + 10000.
-# Example:
-#   configure_haproxy cinder_api:12345 nova_api:9999
+# Example
+#   configure_haproxy cinder_api:8776:8756:tcp nova_api:8774:8764:http
 ##########################################################################
 configure_haproxy() {
   local address=`unit-get private-address`
@@ -354,8 +352,8 @@
   retries 3
   timeout queue 1000
   timeout connect 1000
-  timeout client 10000
-  timeout server 10000
+  timeout client 30000
+  timeout server 30000
 
 listen stats :8888
   mode http
@@ -368,14 +366,20 @@
 EOF
   for service in $@; do
     local service_name=$(echo $service | cut -d : -f 1)
-    local api_listen_port=$(echo $service | cut -d : -f 2)
-    local haproxy_listen_port=$(($api_listen_port + 10000))
+    local haproxy_listen_port=$(echo $service | cut -d : -f 2)
+    local api_listen_port=$(echo $service | cut -d : -f 3)
+    local mode=$(echo $service | cut -d : -f 4)
+    juju-log "Adding haproxy configuration entry for $service "\
+             "($haproxy_listen_port -> $api_listen_port)"
     cat >> $HAPROXY_CFG << EOF
 listen $service_name 0.0.0.0:$haproxy_listen_port
   balance roundrobin
-  option tcplog
+  mode $mode
+  option ${mode}log
   server $name $address:$api_listen_port check
 EOF
+    local r_id=""
+    local unit=""
     for r_id in `relation-ids cluster`; do
       for unit in `relation-list -r $r_id`; do
         local unit_name=${unit////-}
@@ -388,6 +392,7 @@
     done
   done
   echo "ENABLED=1" > $HAPROXY_DEFAULT
+  service haproxy restart
 }
 
 ##########################################################################
@@ -395,18 +400,20 @@
 # Returns: 0 if configured, 1 if not configured
 ##########################################################################
 is_clustered() {
+  local r_id=""
+  local unit=""
   for r_id in $(relation-ids ha); do
     if [ -n "$r_id" ]; then
       for unit in $(relation-list -r $r_id); do
          clustered=$(relation-get -r $r_id clustered $unit)
          if [ -n "$clustered" ]; then
-           echo "Unit is clustered"
+           juju-log "Unit is haclustered"
            return 0
          fi
       done
     fi
   done
-  echo "Unit is not clustered"
+  juju-log "Unit is not haclustered"
   return 1
 }
 
@@ -415,6 +422,7 @@
 ##########################################################################
 peer_units() {
   local peers=""
+  local r_id=""
   for r_id in $(relation-ids cluster); do
     peers="$peers $(relation-list -r $r_id)"
   done
@@ -433,11 +441,11 @@
     echo "Comparing $JUJU_UNIT_NAME with peers: $peers"
     local r_unit_no=$(echo $peer | cut -d / -f 2)
     if (($r_unit_no<$l_unit_no)); then
-        echo "Not oldest peer; deferring"
+        juju-log "Not oldest peer; deferring"
         return 1
     fi
   done
-  echo "Oldest peer; might take charge?"
+  juju-log "Oldest peer; might take charge?"
   return 0
 }
 
@@ -451,13 +459,13 @@
 eligible_leader() {
   if is_clustered; then
     if ! is_leader $1; then
-      echo 'Deferring action to CRM leader'
+      juju-log 'Deferring action to CRM leader'
       return 1
     fi
   else
     peers=$(peer_units)
     if [ -n "$peers" ] && ! oldest_peer "$peers"; then
-      echo 'Deferring action to oldest service unit.'
+      juju-log 'Deferring action to oldest service unit.'
       return 1
     fi
   fi
@@ -469,14 +477,14 @@
 # Returns: 0 if peered, 1 if not peered
 ##########################################################################
 is_peered() {
-  r_id=$(relation-ids cluster)
+  local r_id=$(relation-ids cluster)
   if [ -n "$r_id" ]; then
     if [ -n "$(relation-list -r $r_id)" ]; then
-      echo "Unit peered"
+      juju-log "Unit peered"
       return 0
     fi
   fi
-  echo "Unit not peered"
+  juju-log "Unit not peered"
   return 1
 }
 
@@ -489,12 +497,207 @@
   hostname=`hostname`
   if [ -x /usr/sbin/crm ]; then
     if crm resource show $1 | grep -q $hostname; then
-      echo "$hostname is cluster leader"
+      juju-log "$hostname is cluster leader."
       return 0
     fi
   fi
-  echo "$hostname is not cluster leader"
-  return 1
+  juju-log "$hostname is not cluster leader."
+  return 1
+}
+
+##########################################################################
+# Description: Determines whether enough data has been provided in
+# configuration or relation data to configure HTTPS.
+# Parameters:  None
+# Returns: 0 if HTTPS can be configured, 1 if not.
+##########################################################################
+https() {
+  local r_id=""
+  if [[ -n "$(config-get ssl_cert)" ]] &&
+     [[ -n "$(config-get ssl_key)" ]] ; then
+    return 0
+  fi
+  for r_id in $(relation-ids identity-service) ; do
+    for unit in $(relation-list -r $r_id) ; do
+      if [[ "$(relation-get -r $r_id https_keystone $unit)" == "True" ]] &&
+         [[ -n "$(relation-get -r $r_id ssl_cert $unit)" ]] &&
+         [[ -n "$(relation-get -r $r_id ssl_key $unit)" ]] &&
+         [[ -n "$(relation-get -r $r_id ca_cert $unit)" ]] ; then
+          return 0
+      fi
+    done
+  done
+  return 1
+}
+
+##########################################################################
+# Description: For a given number of port mappings, configures apache2
+# HTTPs local reverse proxying using certficates and keys provided in
+# either configuration data (preferred) or relation data.  Assumes ports
+# are not in use (calling charm should ensure that).
+# Parameters:  Variable number of proxy port mappings as
+# $internal:$external.
+# Returns: 0 if reverse proxy(s) have been configured, 0 if not.
+##########################################################################
+enable_https() {
+  local port_maps="$@"
+  local http_restart=""
+  juju-log "Enabling HTTPS for port mappings: $port_maps."
+
+  # allow overriding of keystone provided certs with those set manually
+  # in config.
+  local cert=$(config-get ssl_cert)
+  local key=$(config-get ssl_key)
+  local ca_cert=""
+  if [[ -z "$cert" ]] || [[ -z "$key" ]] ; then
+    juju-log "Inspecting identity-service relations for SSL certificate."
+    local r_id=""
+    cert=""
+    key=""
+    ca_cert=""
+    for r_id in $(relation-ids identity-service) ; do
+      for unit in $(relation-list -r $r_id) ; do
+        [[ -z "$cert" ]] && cert="$(relation-get -r $r_id ssl_cert $unit)"
+        [[ -z "$key" ]] && key="$(relation-get -r $r_id ssl_key $unit)"
+        [[ -z "$ca_cert" ]] && ca_cert="$(relation-get -r $r_id ca_cert $unit)"
+      done
+    done
+    [[ -n "$cert" ]] && cert=$(echo $cert | base64 -di)
+    [[ -n "$key" ]] && key=$(echo $key | base64 -di)
+    [[ -n "$ca_cert" ]] && ca_cert=$(echo $ca_cert | base64 -di)
+  else
+    juju-log "Using SSL certificate provided in service config."
+  fi
+
+  [[ -z "$cert" ]] || [[ -z "$key" ]] &&
+    juju-log "Expected but could not find SSL certificate data, not "\
+             "configuring HTTPS!" && return 1
+
+  apt-get -y install apache2
+  a2enmod ssl proxy proxy_http | grep -v "To activate the new configuration" &&
+    http_restart=1
+
+  mkdir -p /etc/apache2/ssl/$CHARM
+  echo "$cert" >/etc/apache2/ssl/$CHARM/cert
+  echo "$key" >/etc/apache2/ssl/$CHARM/key
+  if [[ -n "$ca_cert" ]] ; then
+    juju-log "Installing Keystone supplied CA cert."
+    echo "$ca_cert" >/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt
+    update-ca-certificates --fresh
+
+    # XXX TODO: Find a better way of exporting this?
+    if [[ "$CHARM" == "nova-cloud-controller" ]] ; then
+      [[ -e /var/www/keystone_juju_ca_cert.crt ]] &&
+        rm -rf /var/www/keystone_juju_ca_cert.crt
+      ln -s  /usr/local/share/ca-certificates/keystone_juju_ca_cert.crt \
+             /var/www/keystone_juju_ca_cert.crt
+    fi
+
+  fi
+  for port_map in $port_maps ; do
+    local ext_port=$(echo $port_map | cut -d: -f1)
+    local int_port=$(echo $port_map | cut -d: -f2)
+    juju-log "Creating apache2 reverse proxy vhost for $port_map."
+    cat >/etc/apache2/sites-available/${CHARM}_${ext_port} <<END
+Listen $ext_port
+NameVirtualHost *:$ext_port
+<VirtualHost *:$ext_port>
+    ServerName $(unit-get private-address)
+    SSLEngine on
+    SSLCertificateFile /etc/apache2/ssl/$CHARM/cert
+    SSLCertificateKeyFile /etc/apache2/ssl/$CHARM/key
+    ProxyPass / http://localhost:$int_port/
+    ProxyPassReverse / http://localhost:$int_port/
+    ProxyPreserveHost on
+</VirtualHost>
+<Proxy *>
+    Order deny,allow
+    Allow from all
+</Proxy>
+<Location />
+    Order allow,deny
+    Allow from all
+</Location>
+END
+    a2ensite ${CHARM}_${ext_port} | grep -v "To activate the new configuration" &&
+      http_restart=1
+  done
+  if [[ -n "$http_restart" ]] ; then
+    service apache2 restart
+  fi
+}
+
+##########################################################################
+# Description: Ensure HTTPS reverse proxying is disabled for given port
+# mappings.
+# Parameters:  Variable number of proxy port mappings as
+# $internal:$external.
+# Returns: 0 if reverse proxy is not active for all portmaps, 1 on error.
+##########################################################################
+disable_https() {
+  local port_maps="$@"
+  local http_restart=""
+  juju-log "Ensuring HTTPS disabled for $port_maps."
+  ( [[ ! -d /etc/apache2 ]] || [[ ! -d /etc/apache2/ssl/$CHARM ]] ) && return 0
+  for port_map in $port_maps ; do
+    local ext_port=$(echo $port_map | cut -d: -f1)
+    local int_port=$(echo $port_map | cut -d: -f2)
+    if [[ -e /etc/apache2/sites-available/${CHARM}_${ext_port} ]] ; then
+      juju-log "Disabling HTTPS reverse proxy for $CHARM $port_map."
+      a2dissite ${CHARM}_${ext_port} | grep -v "To activate the new configuration" &&
+        http_restart=1
+    fi
+  done
+  if [[ -n "$http_restart" ]] ; then
+    service apache2 restart
+  fi
+}
+
+
+##########################################################################
+# Description: Ensures HTTPS is either enabled or disabled for given port
+# mapping.
+# Parameters:  Variable number of proxy port mappings as
+# $internal:$external.
+# Returns: 0 if HTTPS reverse proxy is in place, 1 if it is not.
+##########################################################################
+setup_https() {
+  # configure https via apache reverse proxying either
+  # using certs provided by config or keystone.
+  [[ -z "$CHARM" ]] &&
+    error_out "setup_https(): CHARM not set."
+  if ! https ; then
+    disable_https $@
+  else
+    enable_https $@
+  fi
+}
+
+##########################################################################
+# Description: Determine correct API server listening port based on
+# existence of HTTPS reverse proxy and/or haproxy.
+# Paremeters: The standard public port for given service.
+# Returns: The correct listening port for API service.
+##########################################################################
+determine_api_port() {
+  local public_port="$1"
+  local i=0
+  ( [[ -n "$(peer_units)" ]] || is_clustered >/dev/null 2>&1 ) && i=$[$i + 1]
+  https >/dev/null 2>&1 && i=$[$i + 1]
+  echo $[$public_port - $[$i * 10]]
+}
+
+##########################################################################
+# Description: Determine correct proxy listening port based on public IP +
+# existence of HTTPS reverse proxy.
+# Paremeters: The standard public port for given service.
+# Returns: The correct listening port for haproxy service public address.
+##########################################################################
+determine_haproxy_port() {
+  local public_port="$1"
+  local i=0
+  https >/dev/null 2>&1 && i=$[$i + 1]
+  echo $[$public_port - $[$i * 10]]
 }
 
 ##########################################################################