Merge lp:~sidnei/charms/precise/squid-reverseproxy/trunk into lp:charms/squid-reverseproxy

[Sidnei da Silva]

- If there's a query string in the check path, use a GET instead of HEAD request
- If cache_size_mb is set to 0, only disable disk cache but still leave memory cache.
- Expose 'via' config setting, default to on.

- If there's a query string in the check path, use a GET instead of HEAD request
- If cache_size_mb is set to 0, only disable disk cache but still leave memory cache.
- Expose 'via' config setting, default to on.

[lp:~sidnei/charms/precise/squid-reverseproxy/trunk]

44. By Sidnei da Silva on 2013-12-10

Merge from alexlist's https support branch

45. By Sidnei da Silva on 2013-12-10

- Merge from trunk

[David Lawson (deej)]

review: Approve

=== modified file 'README.md'
--- README.md	2013-02-15 07:00:58 +0000
+++ README.md	2013-12-10 20:23:01 +0000
@@ -63,6 +63,19 @@
 The options that can be configured in config.yaml should be self-explanatory.
 If not, please file a bug against this charm.
 
+## HTTPS Reverse Proxying
+
+Assuming you have a squid3 deb compiled with --enable-ssl, you can setup a
+single https reverse proxy.
+
+An example of this would be:
+
+    juju set squid-reverseproxy enable_https=true ssl_key="$(base64 < /path/to/cert.key)" ssl_cert="$(base64 < /path/to/cert.crt)"
+
+This should enable https access to the default website.
+
+A current implementation limitation is that it doesn't support multiple https vhosts.
+
 ## Monitoring
 
 This charm provides relations that support monitoring via Nagios using 
 
=== modified file 'config.yaml'
--- config.yaml	2013-10-29 16:56:23 +0000
+++ config.yaml	2013-12-10 20:23:01 +0000
@@ -5,8 +5,36 @@
     description: Squid listening port.
   port_options:
     type: string
-    default: accel vhost
+    default: 'accel vhost'
     description: Squid listening port options
+  enable_https:
+    type: boolean
+    default: false
+    description: Enable https access for squid, requires a squid compiled with --enable-ssl, certificate and private key
+  https_port:
+    type: int
+    default: 443
+    description: Squid https listening port
+  https_options:
+    type: string
+    default: 'accel vhost'
+    description: Options for https port
+  ssl_keyfile:
+    type: string
+    default: '/etc/squid3/ssl/cert.key'
+    description: File path to ssl key file inside deployed units
+  ssl_certfile:
+    type: string
+    default: '/etc/squid3/ssl/cert.crt'
+    description: File path to ssl cert file inside deployed units
+  ssl_key:
+    type: string
+    default: ''
+    description: Base64 encoded ssl key file
+  ssl_cert:
+    type: string
+    default: ''
+    description: Base64 encoded ssl cert file
   log_format:
     type: string
     default: '%>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh'
@@ -22,11 +50,13 @@
   cache_mem_mb:
     type: int
     default: 256
-    description: Maximum size of in-memory object cache (MB). Should be smaller than cache_size_mb.
+    description: >
+      Maximum size of in-memory object cache (MB). Should be smaller than
+      cache_size_mb. Set to zero to disable caching completely.
   cache_size_mb:
     type: int
     default: 512
-    description: Maximum size of the on-disk object cache (MB). Set to zero to disable caching.
+    description: Maximum size of the on-disk object cache (MB). Set to zero to disable disk caching.
   cache_dir:
     type: string
     default: '/var/spool/squid3'
 
=== added directory 'exec.d'
=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2013-10-29 17:37:20 +0000
+++ hooks/hooks.py	2013-12-10 20:23:01 +0000
@@ -256,6 +256,26 @@
     write_squid3_config('\n'.join(
         (l.strip() for l in str(template).splitlines())))
 
+    # If we have https, write out ssl key and cert file
+    if config_data.get('enable_https'):
+        from base64 import b64decode
+        if config_data.get('ssl_key') is not None:
+            ssl_keyfile = config_data['ssl_keyfile']
+            ssl_keyfile_dir = os.path.dirname(os.path.realpath(ssl_keyfile))
+            if not os.path.exists(ssl_keyfile_dir):
+                os.makedirs(ssl_keyfile_dir)
+            ssl_key = config_data['ssl_key']
+            with open(ssl_keyfile, 'w') as ssl_key_path:
+                ssl_key_path.write(str(b64decode(ssl_key)))
+        if config_data.get('ssl_cert') is not None:
+            ssl_certfile = config_data['ssl_certfile']
+            ssl_certfile_dir = os.path.dirname(ssl_certfile)
+            if not os.path.exists(ssl_certfile_dir):
+                os.makedirs(ssl_certfile_dir)
+            ssl_cert = config_data['ssl_cert']
+            with open(ssl_certfile, 'w') as ssl_cert_path:
+                ssl_cert_path.write(str(b64decode(ssl_cert)))
+
 
 def write_squid3_config(contents):
     with open(default_squid3_config, 'w') as squid3_config:
@@ -321,7 +341,8 @@
     for service in config_services:
         path = service.get('nrpe_check_path')
         if path is not None:
-            command = 'check_http -I 127.0.0.1 -p 3128 --method=HEAD '
+            method = "GET" if "?" in path else "HEAD"
+            command = 'check_http -I 127.0.0.1 -p 3128 --method=%s ' % method
             service_name = service['service_name']
             if conf.get('x_balancer_name_allowed'):
                 command += ("-u http://localhost%s "
 
=== modified file 'hooks/tests/test_helpers.py'
--- hooks/tests/test_helpers.py	2013-10-29 16:56:23 +0000
+++ hooks/tests/test_helpers.py	2013-12-10 20:23:01 +0000
@@ -5,7 +5,7 @@
 from os.path import dirname
 
 from testtools import TestCase
-from testtools.matchers import AfterPreprocessing, Contains
+from testtools.matchers import AfterPreprocessing, Contains, Not
 from mock import patch
 
 import hooks
@@ -27,6 +27,14 @@
                     Contains(normalize_whitespace(chunk))))
         return side_effect
 
+    def _assert_not_contents(self, *expected):
+        def side_effect(got):
+            for chunk in expected:
+                self.assertThat(got, AfterPreprocessing(
+                    normalize_whitespace,
+                    Not(Contains(normalize_whitespace(chunk)))))
+        return side_effect
+
     def _apply_patch(self, name):
         p = patch(name)
         mocked_name = p.start()
@@ -47,6 +55,7 @@
         self.config_get.return_value = Serializable({
             "refresh_patterns": "",
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
             "via": "on",
@@ -66,6 +75,7 @@
         self.config_get.return_value = Serializable({
             "refresh_patterns": "",
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
             "via": "off",
@@ -84,6 +94,7 @@
                 {"http://www.ubuntu.com":
                  {"min": 0, "percent": 20, "max": 60}}),
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -101,6 +112,7 @@
                 {"http://www.ubuntu.com":
                  {"min": 0, "percent": 20, "max": 60}}),
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -120,6 +132,7 @@
                   "options": ["override-lastmod",
                               "reload-into-ims"]}}),
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -141,6 +154,7 @@
                   "options": ["override-lastmod",
                               "reload-into-ims"]}}),
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -157,6 +171,7 @@
         self.config_get.return_value = Serializable({
             "refresh_patterns": "",
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -191,6 +206,7 @@
         self.config_get.return_value = Serializable({
             "refresh_patterns": "",
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -231,6 +247,7 @@
         self.config_get.return_value = Serializable({
             "refresh_patterns": "",
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -252,6 +269,7 @@
         self.config_get.return_value = Serializable({
             "refresh_patterns": "",
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
             "x_balancer_name_allowed": True,
@@ -279,6 +297,7 @@
         self.config_get.return_value = Serializable({
             "refresh_patterns": "",
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
             "x_balancer_name_allowed": True,
@@ -326,6 +345,7 @@
             "enable_forward_proxy": True,
             "refresh_patterns": "",
             "cache_size_mb": 1024,
+            "cache_mem_mb": 256,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -376,10 +396,28 @@
             )
         hooks.construct_squid3_config()
 
+    def test_squid_config_disk_cache_disabled(self):
+        self.config_get.return_value = Serializable({
+            "refresh_patterns": "",
+            "cache_size_mb": 0,
+            "cache_mem_mb": 256,
+            "cache_dir": "/var/run/squid3",
+            "target_objs_per_dir": 16,
+            "avg_obj_size_kb": 4,
+        })
+        self.get_reverse_sites.return_value = None
+        self.write_squid3_config.side_effect = self._assert_not_contents(
+            """
+            cache_dir aufs
+            """,
+            )
+        hooks.construct_squid3_config()
+
     def test_squid_config_cache_disabled(self):
         self.config_get.return_value = Serializable({
             "refresh_patterns": "",
             "cache_size_mb": 0,
+            "cache_mem_mb": 0,
             "target_objs_per_dir": 1024,
             "avg_obj_size_kb": 1024,
         })
@@ -391,6 +429,60 @@
             )
         hooks.construct_squid3_config()
 
+        self.write_squid3_config.side_effect = self._assert_not_contents(
+            """
+            cache_mem
+            """,
+            )
+        hooks.construct_squid3_config()
+
+    def test_no_https(self):
+        self.config_get.return_value = Serializable({
+            "port": 3128,
+            "port_options": "accel vhost",
+            "enable_https": False,
+            "refresh_patterns": "",
+            "cache_size_mb": 0,
+            "cache_mem_mb": 0,
+            "target_objs_per_dir": 1024,
+            "avg_obj_size_kb": 1024,
+        })
+        self.get_reverse_sites.return_value = None
+        self.write_squid3_config.side_effect = self._assert_contents(
+            """
+            http_port 3128 accel vhost
+            """,
+            )
+        hooks.construct_squid3_config()
+
+        self.write_squid3_config.side_effect = self._assert_not_contents(
+            """
+            https_port
+            """,
+            )
+        hooks.construct_squid3_config()
+
+    def test_with_https(self):
+        self.config_get.return_value = Serializable({
+            "enable_https": True,
+            "https_port": 443,
+            "https_options": "accel vhost",
+            "ssl_certfile": "/path/to/cert",
+            "ssl_keyfile": "/path/to/key",
+            "refresh_patterns": "",
+            "cache_size_mb": 0,
+            "cache_mem_mb": 0,
+            "target_objs_per_dir": 1024,
+            "avg_obj_size_kb": 1024,
+        })
+        self.get_reverse_sites.return_value = None
+        self.write_squid3_config.side_effect = self._assert_contents(
+            """
+            https_port 443 accel vhost cert=/path/to/cert key=/path/to/key
+            """,
+            )
+        hooks.construct_squid3_config()
+
 
 class HelpersTest(TestCase):
     def test_gets_config(self):
 
=== modified file 'hooks/tests/test_nrpe_hooks.py'
--- hooks/tests/test_nrpe_hooks.py	2013-08-22 02:22:04 +0000
+++ hooks/tests/test_nrpe_hooks.py	2013-12-10 20:23:01 +0000
@@ -255,6 +255,28 @@
              call().__enter__().write(expected)],
             any_order=True)
 
+    def test_update_nrpe_with_services_GET_if_query_string_in_path(self):
+        services = ('- {nrpe_check_path: "/?path=foo.jpg", '
+                    'service_name: foo_com}\n')
+        config = {
+            'nagios_context': 'test',
+            'services': services,
+        }
+        self.patched['config'].return_value = Serializable(config)
+        self.patched['exists'].return_value = True
+
+        self.assertEqual(None, hooks.update_nrpe_checks())
+
+        self.check_call_counts(config=1, getpwnam=1, getgrnam=1,
+                               exists=5, open=4, listdir=2)
+        expected = ('command[check_squid-foo_com]=/check_http '
+                    '-I 127.0.0.1 -p 3128 --method=GET '
+                    '-u http://foo_com/?path=foo.jpg\n')
+        self.patched['open'].assert_has_calls(
+            [call('/etc/nagios/nrpe.d/check_squid-foo_com.cfg', 'w'),
+             call().__enter__().write(expected)],
+            any_order=True)
+
     def test_update_nrpe_restarts_service(self):
         config = {
             'nagios_context': 'test',
 
=== modified file 'templates/main_config.template'
--- templates/main_config.template	2013-10-29 17:37:20 +0000
+++ templates/main_config.template	2013-12-10 20:23:01 +0000
@@ -1,4 +1,7 @@
 http_port {{ config.port }} {{ config.port_options }}
+{% if config.enable_https -%}
+https_port {{ config.https_port }} {{ config.https_options }} cert={{ config.ssl_certfile }} key={{ config.ssl_keyfile }}
+{% endif -%}
 
 acl manager proto cache_object
 acl localhost src 127.0.0.1/32
@@ -28,8 +31,12 @@
 
 coredump_dir {{ config.cache_dir }}
 maximum_object_size {{ config.max_obj_size_kb }} KB
+
 {% if config.cache_size_mb > 0 -%}
 cache_dir aufs {{ config.cache_dir }} {{ config.cache_size_mb }} {{ config.cache_l1 }} {{ config.cache_l2 }}
+{% endif -%}
+
+{% if config.cache_mem_mb > 0 -%}
 cache_mem {{ config.cache_mem_mb }} MB
 {% else -%}
 cache deny all
@@ -39,6 +46,9 @@
 log_mime_hdrs on
 
 acl accel_ports myport {{ config.port }}
+{% if config.enable_https -%}
+acl accel_ports myport {{ config.https_port }}
+{% endif -%}
 
 {% for rp in refresh_patterns.keys() -%}
 refresh_pattern {{ rp }} {{ refresh_patterns[rp]['min'] }} {{ refresh_patterns[rp]['percent'] }}% {{ refresh_patterns[rp]['max'] }} {{ ' '.join(refresh_patterns[rp]['options']) }}