Merge lp:~juju-gui/charms/precise/juju-gui/trunk into lp:~charmers/charms/precise/juju-gui/trunk

[Gary Poster]

- Add support for Firefox and self-signed certs
- Add support to help us integrate the charm into CI tests
- Address problem with newer charmhelpers incompatibility

- Add support for Firefox and self-signed certs
- Add support to help us integrate the charm into CI tests
- Address problem with newer charmhelpers incompatibility

mgz fixed the last problem separately and differently in https://code.launchpad.net/~gz/charms/precise/juju-gui/install_log_error_1152631/+merge/152421

[lp:~juju-gui/charms/precise/juju-gui/trunk]

34. By Gary Poster on 2013-03-13

add support for socket_protocol so that the websocket address can be generated dynamically in the browser for greater deployment flexibility (such as canonistack), while maintaining backwards compatibility with earlier GUI releases. Note that, as of this writing, you need to use lp:juju-gui (trunk) to make this dynamic addressing work.
add ability to deploy insecurely (http/ws), in order to facilitate CI tests
add tests for new functionality
update documentation
speed up default deployment by only getting staging dependencies when needed, and only getting build dependencies when needed (bug 1117896). On EC2, this speeds up the default deployment (from release) by about 2.5 minutes.
work around backward incompatibility in update to charmhelpers' log function.
increase timeout for tests to make them pass more often

[Mark Mims (mark-mims)]

It appears that these changes get reviewed before they land in lp:~juju-gui/charms/precise/juju-gui/trunk so I'm rubber-stamping this.

This team is a perfect example of a "charm team", and once we verify the process works, we'll make lp:~juju-gui/charms/precise/juju-gui/trunk the "official" lp:charms/juju-gui branch. Then reviews won't block on ~charmers... Anyone in ~juju-gui (or ~charmers) can review/merge/push.

review: Approve

[Mark Mims (mark-mims)]

https://bazaar.launchpad.net/~juju-gui/juju-gui/trunk/view/head:/docs/process.rst

=== modified file 'HACKING.md'
--- HACKING.md	2013-01-11 17:56:35 +0000
+++ HACKING.md	2013-03-13 22:47:20 +0000
@@ -16,7 +16,7 @@
 
 You'll also need some dependencies and developer basics.
 
-    sudo apt-get install bzr autoconf libtool python-charmhelpers
+    sudo apt-get install bzr autoconf libtool python-charmhelpers xvfb
 
 Next, you need the bzr branch.  We work from
 [lp:~juju-gui/charms/precise/juju-gui/trunk](https://code.launchpad.net/~juju-gui/charms/precise/juju-gui/trunk).
@@ -29,7 +29,7 @@
 locally.  The files may be installed globally, or into your home directory (as
 here):
 
-    sudo apt-get install autoconf libtool python-charmhelpers
+    sudo apt-get install autoconf libtool python-charmhelpers python-tempita
     bzr branch lp:~jimbaker/juju-jitsu/unit-test jitsu-unit-test
     cd jitsu-unit-test
     autoreconf
 
=== modified file 'README.md'
--- README.md	2013-01-24 16:37:54 +0000
+++ README.md	2013-03-13 22:47:20 +0000
@@ -6,8 +6,7 @@
 
 The Juju GUI supports recent releases of Chrome and Chromium.  Recent Firefox
 releases are also supported, but regressions may occur until the completion of
-upcoming continuous integration work.  Internet Explorer 10 will be supported
-soon.
+upcoming continuous integration work.
 
 ## Demo/Staging Server ##
 
@@ -50,7 +49,6 @@
             open-ports:
             - 80/tcp
             - 443/tcp
-            - 8080/tcp
             public-address: ec2-www-xxx-yyy-zzz.compute-1.amazonaws.com
 
 That tells me I can go to the public-address in my browser via HTTPS
@@ -58,10 +56,8 @@
 start configuring the rest of Juju with the GUI.  You should see a similar
 web address.  Accessing the GUI via HTTP will redirect to using HTTPS.
 
-Note that currently, when using Firefox with self-signed certificates, you need
-to first manually add a TLS certificate exception for the Juju API port
-(default is 8080, see `juju-api-port` in `config.yaml`), and only then do the
-same for the main Juju GUI HTTPS connection on port 443.
+By default, the deployment uses self-signed certificates. The browser will ask
+you to accept a security exception once.
 
 You will see a login form with the username fixed to "admin".  The password is
 the same as your Juju environment's `admin-secret`, found in
 
=== modified file 'config.yaml'
--- config.yaml	2013-01-23 16:41:38 +0000
+++ config.yaml	2013-03-13 22:47:20 +0000
@@ -17,11 +17,6 @@
       The Juju API Bazaar branch (implementing the websocket server).
     type: string
     default: lp:~hazmat/juju/rapi-rollup
-  juju-api-port:
-    description: |
-      The port used by the websocket server.
-    type: int
-    default: 8080
   staging:
     description: |
       Connect the Juju GUI to the staging backend
@@ -78,3 +73,17 @@
       to mutate the environment.
     type: boolean
     default: false
+  serve-tests:
+    description: |
+      Whether or not the GUI unit tests are exposed. If this option is enabled,
+      unit tests can be run in the browser by visiting the URL
+      "https://[Juju GUI address]/test/".
+    type: boolean
+    default: false
+  secure:
+    description: |
+      In order to run the GUI over a non secure connection (HTTP) set this flag
+      to false. Do not set this property unless you understand and accept the
+      risks.
+    type: boolean
+    default: true
 
=== modified file 'config/config.js.template'
--- config/config.js.template	2013-01-16 10:53:11 +0000
+++ config/config.js.template	2013-03-13 22:47:20 +0000
@@ -1,14 +1,18 @@
 var juju_config = {
-  consoleEnabled: %(console_enabled)s,
+  consoleEnabled: {{console_enabled}},
   serverRouting: false,
   html5: true,
   container: '#main',
   viewContainer: '#main',
   transitions: false,
   charm_store_url: 'https://jujucharms.com/',
-  socket_url: 'wss://%(address)s:%(port)s/ws',
-  user: %(user)s,
-  password: %(password)s,
-  readOnly: %(readonly)s,
-  login_help: %(login_help)s
+  // socket_url is only honored in older versions of the GUI.
+  socket_url: '{{raw_protocol}}://{{address}}/ws',
+  // socket_protocol is used instead by newer versions of the GUI to
+  // dynamically generate the websocket address.
+  socket_protocol: {{protocol}},
+  user: {{user}},
+  password: {{password}},
+  readOnly: {{readonly}},
+  login_help: {{login_help}}
 };
 
=== added file 'config/haproxy.cfg.template'
--- config/haproxy.cfg.template	1970-01-01 00:00:00 +0000
+++ config/haproxy.cfg.template	2013-03-13 22:47:20 +0000
@@ -0,0 +1,42 @@
+global
+    maxconn 4096
+    user haproxy
+    group haproxy
+    daemon
+    # Set the base path for the WebSocket TLS certificate.
+    ca-base {{ssl_cert_path}}
+    # Set the base path for the HTTPS TLS certificate.
+    crt-base {{ssl_cert_path}}
+
+defaults
+    log global
+    maxconn 4096
+    mode http
+    option http-server-close
+    timeout connect 5s
+    timeout client 30s
+    timeout server 30s
+    # Set a long timeout for WebSocket connections.
+    timeout tunnel 8h
+
+backend juju
+    # The Juju WebSocket backend.
+    # Re-encrypt outgoing connections.
+    server ws1 127.0.0.1:{{api_port}} ssl ca-file {{api_pem}} verify required check-ssl inter 500ms
+
+backend web
+    # Web traffic.
+    server web1 127.0.0.1:{{web_port}} check inter 500ms
+
+frontend public
+    # Redirect all HTTP traffic to HTTPS.
+    bind :80
+    {{if secure}}
+    redirect scheme https if !{ ssl_fc }
+    {{endif}}
+    # Handle HTTPS.
+    bind :443 ssl crt {{web_pem}}
+    # Send WebSocket connections to the Juju backend.
+    use_backend juju if { path /ws }
+    # Send everything else to the web server.
+    default_backend web
 
=== added file 'config/haproxy.conf'
--- config/haproxy.conf	1970-01-01 00:00:00 +0000
+++ config/haproxy.conf	2013-03-13 22:47:20 +0000
@@ -0,0 +1,22 @@
+description "HAProxy"
+author "Canonical"
+
+start on (filesystem and net-device-up IFACE=lo)
+stop on runlevel [!2345]
+
+env CONF=/etc/haproxy/haproxy.cfg
+env DAEMON=/usr/sbin/haproxy
+
+expect fork
+respawn
+respawn limit 10 5
+
+pre-start script
+    # Test configuration, exit if errors are found.
+    $DAEMON -c -f $CONF
+    if [ $? -ne 0 ]
+        then exit $?
+    fi
+end script
+
+exec $DAEMON -f $CONF
 
=== modified file 'config/juju-api-agent.conf.template'
--- config/juju-api-agent.conf.template	2013-01-03 15:02:38 +0000
+++ config/juju-api-agent.conf.template	2013-03-13 22:47:20 +0000
@@ -4,11 +4,11 @@
 start on runlevel [2345]
 stop on runlevel [!2345]
 
-env PYTHONPATH=%(juju_dir)s:$PYTHONPATH
-env JUJU_ZOOKEEPER=%(zookeeper)s
+env PYTHONPATH={{juju_dir}}:$PYTHONPATH
+env JUJU_ZOOKEEPER={{zookeeper}}
 
 # Use --nodaemon so that upstart can correctly retrieve the process ID.
-exec /usr/bin/python -m juju.agents.api --nodaemon --port %(port)s \
+exec /usr/bin/python -m juju.agents.api --nodaemon --port {{port}} \
     --logfile /var/log/juju/api-agent.log \
     --session-file /var/run/juju/api-agent.zksession \
-    --secure --keys %(keys)s
+    --secure --keys {{keys}}
 
=== modified file 'config/juju-api-improv.conf.template'
--- config/juju-api-improv.conf.template	2013-01-03 15:02:38 +0000
+++ config/juju-api-improv.conf.template	2013-03-13 22:47:20 +0000
@@ -5,8 +5,8 @@
 stop on runlevel [!2345]
 
 setuid ubuntu
-env PYTHONPATH=%(juju_dir)s:$PYTHONPATH
+env PYTHONPATH={{juju_dir}}:$PYTHONPATH
 
-exec /usr/bin/python %(juju_dir)s/improv.py --port %(port)s \
-    -f %(juju_dir)s/%(staging_env)s.json \
-    --secure --keys %(keys)s
+exec /usr/bin/python {{juju_dir}}/improv.py --port {{port}} \
+    -f {{juju_dir}}/{{staging_env}}.json \
+    --secure --keys {{keys}}
 
=== renamed file 'config/nginx.conf.template' => 'config/nginx-site.template'
--- config/nginx.conf.template	2013-01-03 14:17:21 +0000
+++ config/nginx-site.template	2013-03-13 22:47:20 +0000
@@ -1,29 +1,33 @@
 server {
-    listen 80;
-    server_name _;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 default_server ssl;
-    server_name _;
-    root %(server_root)s;
+    listen 127.0.0.1:{{port}} default_server;
+    server_name _;
+    root {{server_root}};
     index index.html;
-    ssl_certificate %(ssl_cert_path)s/juju.crt;
-    ssl_certificate_key %(ssl_cert_path)s/juju.key;
 
     # Serve static assets.
     location ^~ /juju-ui/ {
-        root %(server_root)s;
+        root {{server_root}};
     }
     location = /favicon.ico {
         expires 10d;
-        root %(server_root)s;
+        root {{server_root}};
     }
     location = /index.html {
-        root %(server_root)s;
+        root {{server_root}};
     }
 
+    {{if serve_tests}}
+        # Serve unit tests.
+        location ^~ /test/ {
+            alias {{tests_root}};
+        }
+    {{else}}
+        # Redirect to site root so that the test URL does not directly
+        # reference the manifest file. This avoids automatically adding the URL
+        # to the application cache.
+        rewrite ^/test/ $scheme://$host/ redirect;
+    {{endif}}
+
     # Fall through to the single-page app for all other URLs.
     location ~ / {
         rewrite .* /index.html last;
 
=== renamed file 'config/juju-gui.conf.template' => 'config/nginx.conf'
--- config/juju-gui.conf.template	2012-12-12 13:23:56 +0000
+++ config/nginx.conf	2013-03-13 22:47:20 +0000
@@ -1,4 +1,4 @@
-description "Juju GUI"
+description "nginx"
 author "Canonical"
 # Original author: George Shammas <[e-mail]>.
 # See http://wiki.nginx.org/Upstart.
 
=== modified file 'hooks/config-changed'
--- hooks/config-changed	2013-01-23 16:41:38 +0000
+++ hooks/config-changed	2013-03-13 22:47:20 +0000
@@ -4,14 +4,11 @@
 # Copyright 2012 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
-from subprocess import CalledProcessError
 import sys
 
 from charmhelpers import (
     get_config,
     log,
-    log_entry,
-    log_exit,
     service_control,
     STOP,
 )
@@ -25,8 +22,11 @@
     config_json,
     fetch_api,
     fetch_gui,
-    GUI,
+    get_staging_dependencies,
+    HAPROXY,
     IMPROV,
+    log_hook,
+    NGINX,
     save_or_create_certificates,
     setup_gui,
     start_agent,
@@ -40,7 +40,6 @@
     log('Updating configuration.')
 
     added_or_changed = diff.added_or_changed
-    juju_api_port = config.get('juju-api-port')
     in_staging = config.get('staging')
 
     # The juju_gui_source_changed and juju_api_branch_changed variables
@@ -70,14 +69,15 @@
 
     # Handle changes to the improv server configuration.
     if in_staging:
-        staging_properties = set(
-            ['staging', 'staging-environment', 'juju-api-port'])
+        staging_properties = set(['staging', 'staging-environment'])
         staging_changed = added_or_changed & staging_properties
         if staging_changed or ssl_changed or juju_api_branch_changed:
             if 'staging' in added_or_changed:
                 # 'staging' went from False to True, so the agent server is
                 # running and must be stopped.
                 current_api = AGENT
+                # We need to make sure we have staging dependencies.
+                get_staging_dependencies()
             else:
                 # Only staging parameters changed, so the existing staging
                 # server must be stopped and later restarted.
@@ -86,13 +86,12 @@
             service_control(current_api, STOP)
             # Now the improv server can be cleanly started.
             log('Starting or restarting staging.')
-            start_improv(juju_api_port, config.get('staging-environment'),
+            start_improv(config.get('staging-environment'),
                          config['ssl-cert-path'])
     else:
-        agent_properties = set(['juju-api-port', 'staging'])
-        agent_changed = added_or_changed & agent_properties
+        agent_changed = 'staging' in added_or_changed
         if agent_changed or ssl_changed or juju_api_branch_changed:
-            if 'staging' in added_or_changed:
+            if agent_changed:
                 # If 'staging' transitions to False we need to stop the backend
                 # and start the agent.
                 current_api = IMPROV
@@ -102,22 +101,26 @@
                 current_api = AGENT
             service_control(current_api, STOP)
             log('Starting or restarting Juju API agent.')
-            start_agent(juju_api_port, config['ssl-cert-path'])
+            start_agent(config['ssl-cert-path'])
 
     # Handle changes to the juju-gui configuration.
     gui_properties = set([
-        'juju-api-port', 'juju-gui-console-enabled', 'login-help', 'read-only',
-        'staging'])
+        'juju-gui-console-enabled', 'login-help', 'read-only', 'serve-tests',
+        'staging', 'secure'])
     gui_changed = added_or_changed & gui_properties
     if gui_changed or ssl_changed or juju_gui_source_changed:
         with su('root'):
-            service_control(GUI, STOP)
+            service_control(HAPROXY, STOP)
+            service_control(NGINX, STOP)
         console_enabled = config.get('juju-gui-console-enabled')
         login_help = config['login-help']
         readonly = config['read-only']
+        serve_tests = config['serve-tests']
         ssl_cert_path = config['ssl-cert-path']
-        start_gui(juju_api_port, console_enabled, login_help, readonly,
-                  in_staging, ssl_cert_path)
+        secure = config['secure']
+        start_gui(
+            console_enabled, login_help, readonly, in_staging, ssl_cert_path,
+            serve_tests, secure=secure)
 
 
 def main():
@@ -133,12 +136,5 @@
 
 
 if __name__ == '__main__':
-    log_entry()
-    try:
+    with log_hook():
         main()
-    except CalledProcessError as e:
-        log('Exception caught:')
-        log(e.output)
-        raise
-    finally:
-        log_exit()
 
=== modified file 'hooks/install'
--- hooks/install	2013-01-23 16:11:16 +0000
+++ hooks/install	2013-03-13 22:47:20 +0000
@@ -1,10 +1,10 @@
 #!/usr/bin/env python2
 # -*- python -*-
 
-from subprocess import (
-    CalledProcessError,
-    check_call,
-)
+import os
+import shutil
+from subprocess import check_call
+
 
 # If the user's environment has "juju-origin: ppa" set, they will
 # automatically have access to python-charmhelpers and python-shelltoolbox.
@@ -14,17 +14,20 @@
 import bootstrap_utils
 bootstrap_utils.install_extra_repositories('ppa:juju/pkgs')
 
-# python-shelltoolbox is installed as a dependency of python-charmhelpers.
-check_call(['apt-get', 'install', '-y', 'python-charmhelpers'])
-
-
-# These modules depend on charmhelpers and shelltoolbox being installed so they
+# Python dependencies must be installed here so that the charm can import and
+# use required libraries.
+PYTHON_DEPENDENCIES = (
+    'python-charmhelpers', 'python-launchpadlib', 'python-shelltoolbox',
+    'python-tempita',
+)
+check_call(('apt-get', 'install', '-y') + PYTHON_DEPENDENCIES)
+
+
+# These modules depend on the Python dependencies above being installed so they
 # must not be imported until those packages are available.
 from charmhelpers import (
     get_config,
     log,
-    log_entry,
-    log_exit,
 )
 from shelltoolbox import (
     apt_get_install,
@@ -36,27 +39,41 @@
     config_json,
     fetch_api,
     fetch_gui,
+    log_hook,
+    get_staging_dependencies,
     save_or_create_certificates,
     setup_gui,
     setup_nginx,
 )
 
 
+CONFIG_FILES = ('haproxy.conf', 'nginx.conf')
+REPOSITORIES = ('ppa:juju-gui/ppa',)
 DEB_DEPENDENCIES = (
-    'bzr', 'curl', 'imagemagick', 'make', 'nginx', 'nodejs', 'npm', 'openssl',
-    'python-launchpadlib', 'zookeeper',
+    'curl', 'haproxy', 'nginx', 'openssl',
 )
 
 
 def get_dependencies():
+    """Install deb dependencies."""
     log('Installing dependencies.')
-    cmd_log(install_extra_repositories('ppa:chris-lea/node.js'))
+    cmd_log(install_extra_repositories(*REPOSITORIES))
     cmd_log(apt_get_install(*DEB_DEPENDENCIES))
 
 
+def setup_services():
+    """Set up haproxy and nginx upstart configuration files."""
+    log('Setting up haproxy and nginx start up scripts.')
+    source_dir = os.path.join(os.path.dirname(__file__),  '..', 'config')
+    for config_file in CONFIG_FILES:
+        shutil.copy(os.path.join(source_dir, config_file), '/etc/init/')
+
+
 def main():
     config = get_config()
     get_dependencies()
+    if config.get('staging'):
+        get_staging_dependencies()
     release_tarball = fetch_gui(
         config['juju-gui-source'], config['command-log-file'])
     setup_gui(release_tarball)
@@ -65,16 +82,10 @@
         config['ssl-cert-path'], config.get('ssl-cert-contents'),
         config.get('ssl-key-contents'))
     fetch_api(config['juju-api-branch'])
+    setup_services()
     config_json.set(config)
 
 
 if __name__ == '__main__':
-    log_entry()
-    try:
+    with log_hook():
         main()
-    except CalledProcessError as e:
-        log('Exception caught:')
-        log(e.output)
-        raise
-    finally:
-        log_exit()
 
=== modified file 'hooks/start'
--- hooks/start	2013-01-23 16:41:38 +0000
+++ hooks/start	2013-03-13 22:47:20 +0000
@@ -4,47 +4,38 @@
 from charmhelpers import (
     get_config,
     log,
-    log_entry,
-    log_exit,
     open_port,
 )
 
 from utils import (
+    log_hook,
     start_agent,
     start_gui,
     start_improv,
 )
 
 
-def open_ports(juju_api_port):
-    """Expose Juju GUI web server and websocket server ports."""
+def open_ports():
+    """Expose Juju GUI web server (HTTP and HTTPS) ports."""
     log('Exposing services.')
-    # Open the Juju GUI web server HTTP and HTTPS ports.
     open_port(80)
     open_port(443)
-    # Open the Juju websocket server port.
-    open_port(juju_api_port)
 
 
 def main():
     config = get_config()
-    juju_api_port = config['juju-api-port']
     staging = config.get('staging')
-    start_gui(
-        juju_api_port, config['juju-gui-console-enabled'],
-        config['login-help'], config['read-only'], staging,
-        config['ssl-cert-path'])
     if staging:
-        start_improv(juju_api_port, config['staging-environment'],
-                     config['ssl-cert-path'])
+        start_improv(config['staging-environment'], config['ssl-cert-path'])
     else:
-        start_agent(juju_api_port, config['ssl-cert-path'])
-    open_ports(juju_api_port)
+        start_agent(config['ssl-cert-path'])
+    start_gui(
+        config['juju-gui-console-enabled'], config['login-help'],
+        config['read-only'], staging, config['ssl-cert-path'],
+        config['serve-tests'], secure=config['secure'])
+    open_ports()
 
 
 if __name__ == '__main__':
-    log_entry()
-    try:
+    with log_hook():
         main()
-    finally:
-        log_exit()
 
=== modified file 'hooks/stop'
--- hooks/stop	2012-12-19 09:57:45 +0000
+++ hooks/stop	2013-03-13 22:47:20 +0000
@@ -1,14 +1,13 @@
 #!/usr/bin/env python2
 #-*- python -*-
 
-from charmhelpers import (
-    get_config,
-    log_entry,
-    log_exit,
+from charmhelpers import get_config
+
+from utils import (
+    log_hook,
+    stop,
 )
 
-from utils import stop
-
 
 def main():
     config = get_config()
@@ -16,8 +15,5 @@
 
 
 if __name__ == '__main__':
-    log_entry()
-    try:
+    with log_hook():
         main()
-    finally:
-        log_exit()
 
=== modified file 'hooks/utils.py'
--- hooks/utils.py	2013-01-23 16:41:38 +0000
+++ hooks/utils.py	2013-03-13 22:47:20 +0000
@@ -2,6 +2,7 @@
 
 __all__ = [
     'AGENT',
+    'API_PORT',
     'bzr_checkout',
     'cmd_log',
     'CURRENT_DIR',
@@ -9,11 +10,16 @@
     'fetch_gui',
     'first_path_in_dir',
     'get_release_file_url',
+    'get_staging_dependencies',
     'get_zookeeper_address',
-    'GUI',
+    'HAPROXY',
     'IMPROV',
     'JUJU_DIR',
     'JUJU_GUI_DIR',
+    'JUJU_GUI_SITE',
+    'JUJU_PEM',
+    'log_hook',
+    'NGINX',
     'parse_source',
     'render_to_file',
     'save_or_create_certificates',
@@ -23,18 +29,26 @@
     'start_gui',
     'start_improv',
     'stop',
+    'WEB_PORT',
 ]
 
+from contextlib import contextmanager
 import json
 import os
 import logging
+import shutil
+from subprocess import CalledProcessError
 import tempfile
+import tempita
 
 from launchpadlib.launchpad import Launchpad
 from shelltoolbox import (
+    apt_get_install,
     command,
     environ,
+    install_extra_repositories,
     run,
+    script_name,
     search_file,
     Serializer,
     su,
@@ -51,11 +65,25 @@
 
 AGENT = 'juju-api-agent'
 IMPROV = 'juju-api-improv'
-GUI = 'juju-gui'
+HAPROXY = 'haproxy'
+NGINX = 'nginx'
+
+API_PORT = 8080
+WEB_PORT = 8000
+
 CURRENT_DIR = os.getcwd()
 JUJU_DIR = os.path.join(CURRENT_DIR, 'juju')
 JUJU_GUI_DIR = os.path.join(CURRENT_DIR, 'juju-gui')
 JUJU_GUI_SITE = '/etc/nginx/sites-available/juju-gui'
+JUJU_PEM = 'juju.includes-private-key.pem'
+BUILD_REPOSITORIES = ('ppa:chris-lea/node.js',)
+DEB_BUILD_DEPENDENCIES = (
+    'bzr', 'imagemagick', 'make',  'nodejs', 'npm',
+)
+DEB_STAGE_DEPENDENCIES = (
+    'zookeeper',
+)
+
 
 # Store the configuration from on invocation to the next.
 config_json = Serializer('/tmp/config.json')
@@ -63,6 +91,19 @@
 bzr_checkout = command('bzr', 'co', '--lightweight')
 
 
+def _get_build_dependencies():
+    """Install deb dependencies for building."""
+    log('Installing build dependencies.')
+    cmd_log(install_extra_repositories(*BUILD_REPOSITORIES))
+    cmd_log(apt_get_install(*DEB_BUILD_DEPENDENCIES))
+
+
+def get_staging_dependencies():
+    """Install deb dependencies for the stage (improv) environment."""
+    log('Installing stage dependencies.')
+    cmd_log(apt_get_install(*DEB_STAGE_DEPENDENCIES))
+
+
 def first_path_in_dir(directory):
     """Return the full path of the first file/dir in *directory*."""
     return os.path.join(directory, os.listdir(directory)[0])
@@ -118,6 +159,25 @@
     return line.split('=')[1].strip('"')
 
 
+@contextmanager
+def log_hook():
+    """Log when an hook starts and stops its execution.
+
+    Also log to stdout possible CalledProcessError exceptions raised executing
+    the hook.
+    """
+    script = script_name()
+    log(">>> Entering {}".format(script))
+    try:
+        yield
+    except CalledProcessError as err:
+        log('Exception caught:')
+        log(err.output)
+        raise
+    finally:
+        log("<<< Exiting {}".format(script))
+
+
 def parse_source(source):
     """Parse the ``juju-gui-source`` option.
 
@@ -138,19 +198,21 @@
     return 'stable', source
 
 
-def render_to_file(template, context, destination):
-    """Render the given *template* into *destination* using *context*.
+def render_to_file(template_name, context, destination):
+    """Render the given *template_name* into *destination* using *context*.
 
-    The arguments *template* is the name or path of the template file: it may
-    be either a path relative to ``../config`` or an absolute path.
+    The tempita template language is used to render contents
+    (see http://pythonpaste.org/tempita/).
+    The argument *template_name* is the name or path of the template file:
+    it may be either a path relative to ``../config`` or an absolute path.
     The argument *destination* is a file path.
     The argument *context* is a dict-like object.
     """
     template_path = os.path.join(
-        os.path.dirname(__file__), '..', 'config', template)
-    contents = open(template_path).read()
+        os.path.dirname(__file__), '..', 'config', template_name)
+    template = tempita.Template.from_filename(template_path)
     with open(destination, 'w') as stream:
-        stream.write(contents % context)
+        stream.write(template.substitute(context))
 
 
 results_log = None
@@ -165,7 +227,7 @@
         filename=config['command-log-file'],
         level=logging.INFO,
         format="%(asctime)s: %(name)s@%(levelname)s %(message)s")
-    results_log = logging.getLogger(GUI)
+    results_log = logging.getLogger('juju-gui')
 
 
 def cmd_log(results):
@@ -179,15 +241,15 @@
     results_log.info('\n' + results)
 
 
-def start_improv(juju_api_port, staging_env, ssl_cert_path,
+def start_improv(staging_env, ssl_cert_path,
                  config_path='/etc/init/juju-api-improv.conf'):
     """Start a simulated juju environment using ``improv.py``."""
     log('Setting up staging start up script.')
     context = {
         'juju_dir': JUJU_DIR,
-        'port': juju_api_port,
+        'keys': ssl_cert_path,
+        'port': API_PORT,
         'staging_env': staging_env,
-        'keys': ssl_cert_path,
     }
     render_to_file('juju-api-improv.conf.template', context, config_path)
     log('Starting the staging backend.')
@@ -195,8 +257,7 @@
         service_control(IMPROV, START)
 
 
-def start_agent(juju_api_port, ssl_cert_path,
-                config_path='/etc/init/juju-api-agent.conf'):
+def start_agent(ssl_cert_path, config_path='/etc/init/juju-api-agent.conf'):
     """Start the Juju agent and connect to the current environment."""
     # Retrieve the Zookeeper address from the start up script.
     unit_dir = os.path.realpath(os.path.join(CURRENT_DIR, '..'))
@@ -205,9 +266,9 @@
     log('Setting up API agent start up script.')
     context = {
         'juju_dir': JUJU_DIR,
-        'port': juju_api_port,
+        'keys': ssl_cert_path,
+        'port': API_PORT,
         'zookeeper': zookeeper,
-        'keys': ssl_cert_path,
     }
     render_to_file('juju-api-agent.conf.template', context, config_path)
     log('Starting API agent.')
@@ -216,26 +277,37 @@
 
 
 def start_gui(
-        juju_api_port, console_enabled, login_help, readonly, in_staging,
-        ssl_cert_path, config_path='/etc/init/juju-gui.conf',
-        nginx_path=JUJU_GUI_SITE, config_js_path=None):
+        console_enabled, login_help, readonly, in_staging, ssl_cert_path,
+        serve_tests, haproxy_path='/etc/haproxy/haproxy.cfg',
+        nginx_path=JUJU_GUI_SITE, config_js_path=None, secure=True):
     """Set up and start the Juju GUI server."""
     with su('root'):
         run('chown', '-R', 'ubuntu:', JUJU_GUI_DIR)
-    build_dir = JUJU_GUI_DIR + '/build-'
-    build_dir += 'debug' if in_staging else 'prod'
-    log('Setting up Juju GUI start up script.')
-    render_to_file('juju-gui.conf.template', {}, config_path)
+    # XXX 2013-02-05 frankban bug=1116320:
+        # External insecure resources are still loaded when testing in the
+        # debug environment. For now, switch to the production environment if
+        # the charm is configured to serve tests.
+    if in_staging and not serve_tests:
+        build_dirname = 'build-debug'
+    else:
+        build_dirname = 'build-prod'
+    build_dir = os.path.join(JUJU_GUI_DIR, build_dirname)
     log('Generating the Juju GUI configuration file.')
     user, password = ('admin', 'admin') if in_staging else (None, None)
+    if secure:
+        protocol = 'wss'
+    else:
+        log('Running in insecure mode! Port 80 will serve unencrypted.')
+        protocol = 'ws'
     context = {
+        'raw_protocol': protocol,
         'address': unit_get('public-address'),
         'console_enabled': json.dumps(console_enabled),
         'login_help': json.dumps(login_help),
         'password': json.dumps(password),
-        'port': juju_api_port,
         'readonly': json.dumps(readonly),
         'user': json.dumps(user),
+        'protocol': json.dumps(protocol)
     }
     if config_js_path is None:
         config_js_path = os.path.join(
@@ -243,21 +315,37 @@
     render_to_file('config.js.template', context, config_js_path)
     log('Generating the nginx site configuration file.')
     context = {
+        'port': WEB_PORT,
+        'serve_tests': serve_tests,
         'server_root': build_dir,
-        'ssl_cert_path': ssl_cert_path.rstrip('/'),
-    }
-    render_to_file('nginx.conf.template', context, nginx_path)
+        'tests_root': os.path.join(JUJU_GUI_DIR, 'test', ''),
+    }
+    render_to_file('nginx-site.template', context, nginx_path)
+    log('Generating haproxy configuration file.')
+    context = {
+        'api_pem': JUJU_PEM,
+        'api_port': API_PORT,
+        'ssl_cert_path': ssl_cert_path,
+        # Use the same certificate for both HTTPS and Websocket connections.
+        # In the long term, we want separate certs to be used here.
+        'web_pem': JUJU_PEM,
+        'web_port': WEB_PORT,
+        'secure': secure
+    }
+    render_to_file('haproxy.cfg.template', context, haproxy_path)
     log('Starting Juju GUI.')
     with su('root'):
         # Start the Juju GUI.
-        service_control(GUI, START)
+        service_control(NGINX, START)
+        service_control(HAPROXY, START)
 
 
 def stop(in_staging):
     """Stop the Juju API agent."""
     with su('root'):
         log('Stopping Juju GUI.')
-        service_control(GUI, STOP)
+        service_control(HAPROXY, STOP)
+        service_control(NGINX, STOP)
         if in_staging:
             log('Stopping the staging backend.')
             service_control(IMPROV, STOP)
@@ -271,6 +359,9 @@
     # Retrieve a Juju GUI release.
     origin, version_or_branch = parse_source(juju_gui_source)
     if origin == 'branch':
+        # Make sure we have the dependencies necessary for us to actually make
+        # a build.
+        _get_build_dependencies()
         # Create a release starting from a branch.
         juju_gui_source_dir = os.path.join(CURRENT_DIR, 'juju-gui-source')
         log('Retrieving Juju GUI source checkout from %s.' % version_or_branch)
@@ -279,7 +370,7 @@
         log('Preparing a Juju GUI release.')
         logdir = os.path.dirname(logpath)
         fd, name = tempfile.mkstemp(prefix='make-distfile-', dir=logdir)
-        log('Output from "make distfile" sent to', name)
+        log('Output from "make distfile" sent to %s' % name)
         with environ(NO_BZR='1'):
             run('make', '-C', juju_gui_source_dir, 'distfile',
                 stdout=fd, stderr=fd)
@@ -338,6 +429,9 @@
 
     If both *ssl_cert_contents* and *ssl_key_contents* are provided, use them
     as certificates; otherwise, generate them.
+
+    Also create a pem file, suitable for use in the haproxy configuration,
+    concatenating the key and the certificate files.
     """
     crt_path = os.path.join(ssl_cert_path, 'juju.crt')
     key_path = os.path.join(ssl_cert_path, 'juju.key')
@@ -358,3 +452,10 @@
             # These are arbitrary test values for the certificate.
             '/C=GB/ST=Juju/L=GUI/O=Ubuntu/CN=juju.ubuntu.com',
             '-keyout', key_path, '-out', crt_path))
+    # Generate the pem file.
+    pem_path = os.path.join(ssl_cert_path, JUJU_PEM)
+    if os.path.exists(pem_path):
+        os.remove(pem_path)
+    with open(pem_path, 'w') as pem_file:
+        shutil.copyfileobj(open(key_path), pem_file)
+        shutil.copyfileobj(open(crt_path), pem_file)
 
=== modified file 'revision'
--- revision	2013-01-23 16:41:57 +0000
+++ revision	2013-03-13 22:47:20 +0000
@@ -1,1 +1,1 @@
-25
+29
 
=== modified file 'tests/deploy.test'
--- tests/deploy.test	2013-01-22 11:40:17 +0000
+++ tests/deploy.test	2013-03-13 22:47:20 +0000
@@ -6,7 +6,6 @@
 import urlparse
 
 from charmhelpers import make_charm_config_file
-from selenium.common import exceptions
 from selenium.webdriver import Firefox
 from selenium.webdriver.support import ui
 from shelltoolbox import command
@@ -33,16 +32,15 @@
         # Create a Selenium browser instance.
         selenium = self.selenium = Firefox()
         self.addCleanup(selenium.quit)
-        self.wait = ui.WebDriverWait(selenium, 20)
 
     def tearDown(self):
         juju('destroy-service', self.charm)
 
     def assertEnvironmentIsConnected(self):
         """Assert the GUI environment is connected to the Juju API agent."""
-        def connected(driver):
-            return driver.execute_script('return app.env.get("connected");')
-        self.wait.until(connected, 'Environment not connected.')
+        self.wait_for_script(
+            'return app.env.get("connected");',
+            error='Environment not connected.')
 
     def make_config_file(self, options=None):
         """Create a charm config file adding, if required, the Juju GUI source.
@@ -59,6 +57,19 @@
             options.setdefault('juju-gui-source', JUJU_GUI_SOURCE)
         return make_charm_config_file({self.charm: options})
 
+    def handle_browser_warning(self):
+        """Overstep the browser warning dialog if required."""
+        self.wait_for_script(
+            'return window.isBrowserSupported',
+            error='Function isBrowserSupported not found.')
+        script = 'return window.isBrowserSupported(navigator.userAgent)'
+        supported = self.selenium.execute_script(script)
+        if not supported:
+            continue_button = self.wait_for_css_selector(
+                '#browser-warning input',
+                error='Browser warning dialog not found.')
+            continue_button.click()
+
     def navigate_to(self, hostname, path='/'):
         """Load a page using the current Selenium driver.
 
@@ -72,16 +83,41 @@
         def page_ready(driver):
             driver.get(url)
             return driver.title == 'Juju Admin'
-        self.wait.until(page_ready, 'Juju GUI not found.')
+        self.wait_for(page_ready, error='Juju GUI not found.')
+
+    def wait_for(self, condition, error=None, timeout=20):
+        """Wait for condition to be True.
+
+        The argument condition is a callable accepting a driver object.
+        Fail printing the provided error if timeout is exceeded.
+        Otherwise, return the value returned by the condition call.
+        """
+        wait = ui.WebDriverWait(self.selenium, timeout)
+        return wait.until(condition, error)
+
+    def wait_for_css_selector(self, selector, error=None, timeout=20):
+        """Wait until the provided CSS selector is found.
+
+        Fail printing the provided error if timeout is exceeded.
+        Otherwise, return the value returned by the script.
+        """
+        condition = lambda driver: driver.find_elements_by_css_selector(
+            selector)
+        elements = self.wait_for(condition, error=error, timeout=timeout)
+        return elements[0]
+
+    def wait_for_script(self, script, error=None, timeout=20):
+        """Wait for the given JavaScript snippet to return a True value.
+
+        Fail printing the provided error if timeout is exceeded.
+        Otherwise, return the value returned by the script.
+        """
+        condition = lambda driver: driver.execute_script(script)
+        return self.wait_for(condition, error=error, timeout=timeout)
 
     def login(self, password):
         """Log in to access the Juju GUI using the provided *password*."""
-        def form_displayed(driver):
-            try:
-                return driver.find_element_by_css_selector('form')
-            except exceptions.NoSuchElementException:
-                return False
-        form = self.wait.until(form_displayed, 'Login form not found.')
+        form = self.wait_for_css_selector('form', 'Login form not found.')
         passwd = form.find_element_by_css_selector('input[type=password]')
         passwd.send_keys(password)
         submit = form.find_element_by_css_selector('input[type=submit]')
@@ -91,7 +127,7 @@
         """Return the set of services' names displayed in the current page."""
         def services_found(driver):
             return driver.find_elements_by_css_selector('.service .name')
-        services = self.wait.until(services_found, 'Services not displayed.')
+        services = self.wait_for(services_found, 'Services not displayed.')
         return set([element.text for element in services])
 
     def stop_services(self, hostname, services):
@@ -129,30 +165,21 @@
         hostname = self.deploy()
         # XXX 2012-11-29 frankban bug=872264: see *stop_services* above.
         self.addCleanup(
-            self.stop_services, hostname, ['juju-api-agent', 'juju-gui'])
-        self.navigate_to(hostname)
-        self.assertEnvironmentIsConnected()
-
-    def test_customized_api_port(self):
-        # It is possible to customize the port used by the websocket server.
-        api_port = 8081
-        hostname = self.deploy({'juju-api-port': api_port})
-        # XXX 2012-11-29 frankban bug=872264: see *stop_services* above.
-        self.addCleanup(
-            self.stop_services, hostname, ['juju-api-agent', 'juju-gui'])
-        self.navigate_to(hostname)
-        self.assertEnvironmentIsConnected()
-        ws_url = self.selenium.execute_script(
-            'return app.env.get("socket_url");')
-        self.assertIn(str(api_port), ws_url)
+            self.stop_services,
+            hostname, ['haproxy', 'nginx', 'juju-api-agent'])
+        self.navigate_to(hostname)
+        self.handle_browser_warning()
+        self.assertEnvironmentIsConnected()
 
     def test_staging(self):
         # Ensure the Juju GUI and improv services are correctly set up.
         hostname = self.deploy({'staging': 'true'})
         # XXX 2012-11-29 frankban bug=872264: see *stop_services* above.
         self.addCleanup(
-            self.stop_services, hostname, ['juju-api-improv', 'juju-gui'])
+            self.stop_services,
+            hostname, ['haproxy', 'nginx', 'juju-api-improv'])
         self.navigate_to(hostname)
+        self.handle_browser_warning()
         self.assertEnvironmentIsConnected()
         # The staging environment contains five deployed services.
         self.assertSetEqual(set(STAGING_SERVICES), self.get_service_names())
@@ -162,8 +189,10 @@
         hostname = self.deploy({'juju-gui-source': JUJU_GUI_TEST_BRANCH})
         # XXX 2012-11-29 frankban bug=872264: see *stop_services* above.
         self.addCleanup(
-            self.stop_services, hostname, ['juju-api-agent', 'juju-gui'])
+            self.stop_services,
+            hostname, ['haproxy', 'nginx', 'juju-api-agent'])
         self.navigate_to(hostname)
+        self.handle_browser_warning()
         self.assertEnvironmentIsConnected()
 
 
@@ -192,8 +221,10 @@
         hostname = self.deploy_to()
         # XXX 2012-11-29 frankban bug=872264: see *stop_services* above.
         self.addCleanup(
-            self.stop_services, hostname, ['juju-api-agent', 'juju-gui'])
+            self.stop_services,
+            hostname, ['haproxy', 'nginx', 'juju-api-agent'])
         self.navigate_to(hostname)
+        self.handle_browser_warning()
         self.assertEnvironmentIsConnected()
 
 
 
=== modified file 'tests/test_utils.py'
--- tests/test_utils.py	2013-01-23 16:41:38 +0000
+++ tests/test_utils.py	2013-03-13 22:47:20 +0000
@@ -4,16 +4,23 @@
 import os
 import shutil
 from simplejson import dumps
+from subprocess import CalledProcessError
 import tempfile
+import tempita
 import unittest
 
 import charmhelpers
+
 from utils import (
     _get_by_attr,
+    API_PORT,
     cmd_log,
     first_path_in_dir,
     get_release_file_url,
     get_zookeeper_address,
+    JUJU_GUI_DIR,
+    JUJU_PEM,
+    log_hook,
     parse_source,
     render_to_file,
     save_or_create_certificates,
@@ -21,6 +28,7 @@
     start_gui,
     start_improv,
     stop,
+    WEB_PORT,
 )
 # Import the whole utils package for monkey patching.
 import utils
@@ -261,6 +269,49 @@
         self.assertEqual(self.zookeeper_address, address)
 
 
+class LogHookTest(unittest.TestCase):
+
+    def setUp(self):
+        # Monkeypatch the charmhelpers log function.
+        self.output = []
+        self.original = utils.log
+        utils.log = self.output.append
+
+    def tearDown(self):
+        # Restore the original charmhelpers log function.
+        utils.log = self.original
+
+    def test_logging(self):
+        # The function emits log messages on entering and exiting the hook.
+        with log_hook():
+            self.output.append('executing hook')
+        self.assertEqual(3, len(self.output))
+        enter_message, executing_message, exit_message = self.output
+        self.assertIn('>>> Entering', enter_message)
+        self.assertEqual('executing hook', executing_message)
+        self.assertIn('<<< Exiting', exit_message)
+
+    def test_subprocess_error(self):
+        # If a CalledProcessError exception is raised, the command output is
+        # logged.
+        with self.assertRaises(CalledProcessError) as cm:
+            with log_hook():
+                raise CalledProcessError(2, 'command', 'output')
+        exception = cm.exception
+        self.assertIsInstance(exception, CalledProcessError)
+        self.assertEqual(2, exception.returncode)
+        self.assertEqual('output', self.output[-2])
+
+    def test_error(self):
+        # Possible errors are re-raised by the context manager.
+        with self.assertRaises(TypeError) as cm:
+            with log_hook():
+                raise TypeError
+        exception = cm.exception
+        self.assertIsInstance(exception, TypeError)
+        self.assertIn('<<< Exiting', self.output[-1])
+
+
 class ParseSourceTest(unittest.TestCase):
 
     def test_latest_stable_release(self):
@@ -295,9 +346,9 @@
     def setUp(self):
         self.destination_file = tempfile.NamedTemporaryFile()
         self.addCleanup(self.destination_file.close)
-        self.template_contents = '%(foo)s, %(bar)s'
+        self.template = tempita.Template('{{foo}}, {{bar}}')
         with tempfile.NamedTemporaryFile(delete=False) as template_file:
-            template_file.write(self.template_contents)
+            template_file.write(self.template.content)
             self.template_path = template_file.name
         self.addCleanup(os.remove, self.template_path)
 
@@ -305,7 +356,7 @@
         # Ensure the template is correctly rendered using the given context.
         context = {'foo': 'spam', 'bar': 'eggs'}
         render_to_file(self.template_path, context, self.destination_file.name)
-        expected = self.template_contents % context
+        expected = self.template.substitute(context)
         self.assertEqual(expected, self.destination_file.read())
 
 
@@ -331,6 +382,12 @@
         self.assertIn('mycert', open(self.cert_file).read())
         self.assertIn('mykey', open(self.key_file).read())
 
+    def test_pem_file(self):
+        # Ensure the pem file is created concatenating the key and cert files.
+        save_or_create_certificates(self.cert_path, 'Certificate', 'Key')
+        pem_file = os.path.join(self.cert_path, JUJU_PEM)
+        self.assertEqual('KeyCertificate', open(pem_file).read())
+
 
 class CmdLogTest(unittest.TestCase):
     def setUp(self):
@@ -401,12 +458,11 @@
         charmhelpers.command = self.command
 
     def test_start_improv(self):
-        port = '1234'
         staging_env = 'large'
-        start_improv(port, staging_env, self.ssl_cert_path,
-            self.destination_file.name)
+        start_improv(
+            staging_env, self.ssl_cert_path, self.destination_file.name)
         conf = self.destination_file.read()
-        self.assertTrue('--port %s' % port in conf)
+        self.assertTrue('--port %s' % API_PORT in conf)
         self.assertTrue(staging_env + '.json' in conf)
         self.assertTrue(self.ssl_cert_path in conf)
         self.assertEqual(self.svc_ctl_call_count, 1)
@@ -414,10 +470,9 @@
         self.assertEqual(self.actions, [charmhelpers.START])
 
     def test_start_agent(self):
-        port = '1234'
-        start_agent(port, self.ssl_cert_path, self.destination_file.name)
+        start_agent(self.ssl_cert_path, self.destination_file.name)
         conf = self.destination_file.read()
-        self.assertTrue('--port %s' % port in conf)
+        self.assertTrue('--port %s' % API_PORT in conf)
         self.assertTrue('JUJU_ZOOKEEPER=%s' % self.fake_zk_address in conf)
         self.assertTrue(self.ssl_cert_path in conf)
         self.assertEqual(self.svc_ctl_call_count, 1)
@@ -425,41 +480,71 @@
         self.assertEqual(self.actions, [charmhelpers.START])
 
     def test_start_gui(self):
-        port = '1234'
+        config_js_file = self.destination_file
+        haproxy_file = tempfile.NamedTemporaryFile()
+        self.addCleanup(haproxy_file.close)
         nginx_file = tempfile.NamedTemporaryFile()
         self.addCleanup(nginx_file.close)
-        config_js_file = tempfile.NamedTemporaryFile()
-        self.addCleanup(config_js_file.close)
+        ssl_cert_path = '/tmp/certificates/'
         start_gui(
-            port, False, 'This is login help.', True, True,
-            '/tmp/certificates/', self.destination_file.name, nginx_file.name,
-            config_js_file.name)
-        conf = self.destination_file.read()
-        self.assertTrue('/usr/sbin/nginx' in conf)
+            False, 'This is login help.', True, True, ssl_cert_path, True,
+            haproxy_path=haproxy_file.name, nginx_path=nginx_file.name,
+            config_js_path=config_js_file.name)
+        self.assertEqual(self.svc_ctl_call_count, 2)
+        self.assertEqual(self.service_names, ['nginx', 'haproxy'])
+        self.assertEqual(self.actions, [charmhelpers.START] * 2)
+        haproxy_conf = haproxy_file.read()
+        self.assertIn('ca-base {0}'.format(ssl_cert_path), haproxy_conf)
+        self.assertIn('crt-base {0}'.format(ssl_cert_path), haproxy_conf)
+        self.assertIn('ws1 127.0.0.1:{0}'.format(API_PORT), haproxy_conf)
+        self.assertIn('web1 127.0.0.1:{0}'.format(WEB_PORT), haproxy_conf)
+        self.assertIn('ca-file {0}'.format(JUJU_PEM), haproxy_conf)
+        self.assertIn('crt {0}'.format(JUJU_PEM), haproxy_conf)
+        self.assertIn('redirect scheme https', haproxy_conf)
         js_conf = config_js_file.read()
+        self.assertIn('consoleEnabled: false', js_conf)
         self.assertIn('user: "admin"', js_conf)
         self.assertIn('password: "admin"', js_conf)
         self.assertIn('login_help: "This is login help."', js_conf)
         self.assertIn('readOnly: true', js_conf)
+        self.assertIn("socket_url: 'wss://", js_conf)
+        self.assertIn('socket_protocol: "wss"', js_conf)
         nginx_conf = nginx_file.read()
-        self.assertTrue('juju-gui/build-debug' in nginx_conf)
-        self.assertIn('/tmp/certificates/juju.crt', nginx_conf)
-        self.assertIn('/tmp/certificates/juju.key', nginx_conf)
-        self.assertEqual(self.svc_ctl_call_count, 1)
-        self.assertEqual(self.service_names, ['juju-gui'])
-        self.assertEqual(self.actions, [charmhelpers.START])
+        self.assertIn('juju-gui/build-', nginx_conf)
+        self.assertIn('listen 127.0.0.1:{0}'.format(WEB_PORT), nginx_conf)
+        self.assertIn('alias {0}/test/;'.format(JUJU_GUI_DIR), nginx_conf)
+
+    def test_start_gui_insecure(self):
+        config_js_file = self.destination_file
+        haproxy_file = tempfile.NamedTemporaryFile()
+        self.addCleanup(haproxy_file.close)
+        nginx_file = tempfile.NamedTemporaryFile()
+        self.addCleanup(nginx_file.close)
+        ssl_cert_path = '/tmp/certificates/'
+        start_gui(
+            False, 'This is login help.', True, True, ssl_cert_path, True,
+            haproxy_path=haproxy_file.name, nginx_path=nginx_file.name,
+            config_js_path=config_js_file.name, secure=False)
+        js_conf = config_js_file.read()
+        self.assertIn("socket_url: 'ws://", js_conf)
+        self.assertIn('socket_protocol: "ws"', js_conf)
+        haproxy_conf = haproxy_file.read()
+        # The insecure approach eliminates the https redirect.
+        self.assertNotIn('redirect scheme https', haproxy_conf)
 
     def test_stop_staging(self):
         stop(True)
-        self.assertEqual(self.svc_ctl_call_count, 2)
-        self.assertEqual(self.service_names, ['juju-gui', 'juju-api-improv'])
-        self.assertEqual(self.actions, [charmhelpers.STOP, charmhelpers.STOP])
+        self.assertEqual(self.svc_ctl_call_count, 3)
+        self.assertEqual(
+            self.service_names, ['haproxy', 'nginx', 'juju-api-improv'])
+        self.assertEqual(self.actions, [charmhelpers.STOP] * 3)
 
     def test_stop_production(self):
         stop(False)
-        self.assertEqual(self.svc_ctl_call_count, 2)
-        self.assertEqual(self.service_names, ['juju-gui', 'juju-api-agent'])
-        self.assertEqual(self.actions, [charmhelpers.STOP, charmhelpers.STOP])
+        self.assertEqual(self.svc_ctl_call_count, 3)
+        self.assertEqual(
+            self.service_names, ['haproxy', 'nginx', 'juju-api-agent'])
+        self.assertEqual(self.actions, [charmhelpers.STOP] * 3)
 
 
 if __name__ == '__main__':