Merge lp:~ack/landscape-charm/block-metrics-through-haproxy into lp:~landscape/landscape-charm/trunk

[Alberto Donato]

Change the haproxy configuration to prevent access to the /metrics endpoint on the landscape unit.

Change the haproxy configuration to prevent access to the /metrics endpoint on the landscape unit.

Testing instructions:

- CHARM_BRANCH='lp:~ack/landscape-charm/block-metrics-through-haproxy' make stage-landscape-charm
- deploy
- accesssing https://<url>/metrics should give a 403 error

[🤖 Landscape Builder (landscape-builder)]

review: Abstain (executing tests)

[🤖 Landscape Builder (landscape-builder)]

Command: make ci-test
Result: Success
Revno: 386
Branch: lp:~ack/landscape-charm/block-metrics-through-haproxy
Jenkins: https://ci.lscape.net/job/latch-test-xenial/3640/

review: Approve (test results)

[Adam Collard (adam-collard)]

LGTM, +1

review: Approve

[Francis Ginther (fginther)]

As this endpoint is only exposed on hosted deployments, this is sufficient to block it via the haproxy. So +1 on the change.

If/When we want to expose this for OPL deployments, we should have a way to turn it off for customers not wishing to expose this data unauthenticated. Probably worth a bug unless we already have some other way of tracking this.

review: Approve

[Alberto Donato (ack)]

> As this endpoint is only exposed on hosted deployments, this is sufficient to
> block it via the haproxy. So +1 on the change.
>
> If/When we want to expose this for OPL deployments, we should have a way to
> turn it off for customers not wishing to expose this data unauthenticated.
> Probably worth a bug unless we already have some other way of tracking this.

On OPL deployments we would tell the user to deploy prometheus in the model, and expose it.
There's no need to expose metrics through haproxy (and it's actually bad because it would prevent prometheus from scraping endpoints individually, which is a problem for unit metrics).

=== removed directory 'config'
=== removed file 'config/vhost.tmpl'
--- config/vhost.tmpl	2014-01-21 18:06:37 +0000
+++ config/vhost.tmpl	1970-01-01 00:00:00 +0000
@@ -1,66 +0,0 @@
-<VirtualHost *:80>
-    ServerName {{ servername }}
-    ServerAdmin webmaster@%{SERVER_NAME}
-    DocumentRoot /var/www
-
-    ErrorLog /var/log/apache2/vhost_http_error.log
-    CustomLog /var/log/apache2/vhost_http_access.log combined
-
-    # Set a Via header in outbound requests to the proxy, so proxied apps can
-    # know who the actual client is
-    ProxyVia on
-    ProxyTimeout 10
-
-    <Location "/">
-        Options -Indexes
-        Order allow,deny
-        Allow from all
-    </Location>
-    <Location "/r">
-        FileETag none
-        ExpiresActive on
-        ExpiresDefault "access plus 10 years"
-        Header append Cache-Control "public"
-    </Location>
-    <Location "/repository">
-        Options +Indexes
-    </Location>
-
-    <Files "*.woff">
-        FileETag None
-        Header append Cache-Control "max-age=2592000,public"
-        Header unset Last-Modified
-    </Files>
-
-    RewriteEngine On
-
-    # Pings can always go unencrypted
-    RewriteRule ^/ping$ http://{{ haproxy_pingserver }}/ping [P,L]
-
-    RewriteRule ^/r/([^/]+)/(.*) /$2
-
-    # bug #685958
-    # Map the internal lowercase function so we can use it below.
-    RewriteMap lowercase int:tolower
-    # Only lookup skin name in cookie value for the favicon.
-    RewriteCond %{REQUEST_URI} ^/favicon.ico$
-    # If there's a 'skin' selected in the cookie...
-    RewriteCond %{HTTP_COOKIE} skin=([^;\ ]+) [OR]
-    # Else, use the default skin.
-    RewriteCond manx ^(.+)$
-    # If the skin name is a valid one...
-    RewriteCond ${lowercase:%1} ^(manx|hokan)$
-    # Then rewrite the url to be relative to the specified skin.
-    RewriteRule ^/(.*) /static/skin/%1/$1
-
-    # The following resources are remote and fine to go over http
-    RewriteRule ^/(static.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(repository.*) http://{{ haproxy_static }}/$1 [P,L]
-
-    # local resources, don't redirect anywhere not even to switch to https
-    RewriteCond %{REQUEST_URI} !/server-status
-    RewriteCond %{REQUEST_URI} !/icons
-    RewriteCond %{REQUEST_URI} !/robots.txt
-    # Everything else needs to go over https
-    RewriteRule ^/(.*) https://{{ servername }}/$1 [R=permanent]
-</VirtualHost>

=== removed file 'config/vhost.tmpl.legacy'
--- config/vhost.tmpl.legacy	2015-01-16 10:18:47 +0000
+++ config/vhost.tmpl.legacy	1970-01-01 00:00:00 +0000
@@ -1,66 +0,0 @@
-<VirtualHost *:80>
-    ServerName {{ servername }}
-    ServerAdmin webmaster@%{SERVER_NAME}
-    DocumentRoot /var/www
-
-    ErrorLog /var/log/apache2/vhost_http_error.log
-    CustomLog /var/log/apache2/vhost_http_access.log combined
-
-    # Set a Via header in outbound requests to the proxy, so proxied apps can
-    # know who the actual client is
-    ProxyVia on
-    ProxyTimeout 10
-
-    <Location "/">
-        Options -Indexes
-        Order allow,deny
-        Allow from all
-    </Location>
-    <Location "/r">
-        FileETag none
-        ExpiresActive on
-        ExpiresDefault "access plus 10 years"
-        Header append Cache-Control "public"
-    </Location>
-    <Location "/repository">
-        Options +Indexes
-    </Location>
-
-    <Files "*.woff">
-        FileETag None
-        Header append Cache-Control "max-age=2592000,public"
-        Header unset Last-Modified
-    </Files>
-
-    RewriteEngine On
-
-    # Pings can always go unencrypted
-    RewriteRule ^/ping$ http://{{ haproxy_pingserver }}/ping [P,L]
-
-    RewriteRule ^/r/([^/]+)/(.*) /$2
-
-    # bug #685958
-    # Map the internal lowercase function so we can use it below.
-    RewriteMap lowercase int:tolower
-    # Only lookup skin name in cookie value for the favicon.
-    RewriteCond %{REQUEST_URI} ^/favicon.ico$
-    # If there's a 'skin' selected in the cookie...
-    RewriteCond %{HTTP_COOKIE} skin=([^;\ ]+) [OR]
-    # Else, use the default skin.
-    RewriteCond manx ^(.+)$
-    # If the skin name is a valid one...
-    RewriteCond ${lowercase:%1} ^(manx|hokan)$
-    # Then rewrite the url to be relative to the specified skin.
-    RewriteRule ^/(.*) /static/skin/%1/$1
-
-    # The following resources are remote and fine to go over http
-    RewriteRule ^/(static.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(repository.*) http://{{ haproxy_static }}/$1 [P,L]
-
-    # local resources, don't redirect anywhere not even to switch to https
-    RewriteCond %{REQUEST_URI} !/server-status
-    RewriteCond %{REQUEST_URI} !/icons
-    RewriteCond %{REQUEST_URI} !/robots.txt
-    # Everything else needs to go over https
-    RewriteRule ^/(.*) https://{{ servername }}/$1 [R=permanent]
-</VirtualHost>

=== removed file 'config/vhostssl.tmpl'
--- config/vhostssl.tmpl	2015-01-12 15:08:18 +0000
+++ config/vhostssl.tmpl	1970-01-01 00:00:00 +0000
@@ -1,62 +0,0 @@
-<VirtualHost *:443>
-    ServerName {{ servername }}
-    ServerAdmin webmaster@%{SERVER_NAME}
-    DocumentRoot /var/www
-
-    ErrorLog /var/log/apache2/vhost_error.log
-    CustomLog /var/log/apache2/vhost_access.log combined
-
-    SSLEngine On
-    SSLProxyEngine On
-    SSLProtocol all -SSLv3 -SSLv2
-    SSLCertificateFile /etc/ssl/certs/apache2.cert
-    SSLCertificateKeyFile /etc/ssl/private/apache2.key
-
-    <Files "*.woff">
-        FileETag None
-        Header append Cache-Control "max-age=2592000,public"
-        Header unset Last-Modified
-    </Files>
-
-    ProxyRequests off
-
-    ProxyPreserveHost On
-    ProxyPassReverse / http://{{ haproxy_static }}/
-
-    RewriteEngine On
-
-    RewriteRule ^/.*\+\+.* / [F]
-    RewriteRule ^/r/([^/]+)/(.*) /$2
-
-    # bug #685958
-    # Map the internal lowercase function so we can use it below.
-    RewriteMap lowercase int:tolower
-    # Only lookup skin name in cookie value for the favicon.
-    RewriteCond %{REQUEST_URI} ^/favicon.ico$
-    # If there's a 'skin' selected in the cookie...
-    RewriteCond %{HTTP_COOKIE} skin=([^;\ ]+) [OR]
-    # Else, use the default skin.
-    RewriteCond manx ^(.+)$
-    # If the skin name is a valid one...
-    RewriteCond ${lowercase:%1} ^(manx|hokan)$
-    # Then rewrite the url to be relative to the specified skin.
-    RewriteRule ^/(.*) /static/skin/%1/$1
-
-    RewriteRule ^/message-system http://{{ haproxy_msgserver }}/++vh++https:%{SERVER_NAME}:443/++/ [P,L]
-    RewriteRule ^/ajax http://{{ haproxy_asyncfrontend }}/ [P,L]
-    RewriteRule ^/combo http://{{ haproxy_comboloader }}/ [P,L]
-    RewriteRule ^/api http://{{ haproxy_apiserver }}/ [P,L]
-    RewriteRule ^/attachment/(.*) http://{{ haproxy_msgserver }}/attachment/$1 [P,L]
-    RewriteRule ^/upload/(.*) http://{{ haproxy_packageupload }}/$1 [P,L]
-    RewriteRule ^/(static.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(offline.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(config.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(hash-id-databases.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(repository.*) http://{{ haproxy_static }}/$1 [P,L]
-    # The rest goes to the application server, with a few exceptions
-    RewriteCond %{REQUEST_URI} !/icons
-    RewriteCond %{REQUEST_URI} !/robots.txt
-    RewriteCond %{REQUEST_URI} !/server-status
-    RewriteRule ^/(.*) http://{{ haproxy_appserver }}/++vh++https:%{SERVER_NAME}:443/++/$1 [P]
-
-</VirtualHost>

=== removed file 'config/vhostssl.tmpl.legacy'
--- config/vhostssl.tmpl.legacy	2015-01-16 10:18:47 +0000
+++ config/vhostssl.tmpl.legacy	1970-01-01 00:00:00 +0000
@@ -1,61 +0,0 @@
-<VirtualHost *:443>
-    ServerName {{ servername }}
-    ServerAdmin webmaster@%{SERVER_NAME}
-    DocumentRoot /var/www
-
-    ErrorLog /var/log/apache2/vhost_error.log
-    CustomLog /var/log/apache2/vhost_access.log combined
-
-    SSLEngine On
-    SSLProxyEngine On
-    SSLProtocol all -SSLv3 -SSLv2
-    SSLCertificateFile /etc/ssl/certs/apache2.cert
-    SSLCertificateKeyFile /etc/ssl/private/apache2.key
-
-    <Files "*.woff">
-        FileETag None
-        Header append Cache-Control "max-age=2592000,public"
-        Header unset Last-Modified
-    </Files>
-
-    ProxyRequests off
-
-    ProxyPreserveHost On
-    ProxyPassReverse / http://{{ haproxy_static }}/
-
-    RewriteEngine On
-
-    RewriteRule ^/.*\+\+.* / [F]
-    RewriteRule ^/r/([^/]+)/(.*) /$2
-
-    # bug #685958
-    # Map the internal lowercase function so we can use it below.
-    RewriteMap lowercase int:tolower
-    # Only lookup skin name in cookie value for the favicon.
-    RewriteCond %{REQUEST_URI} ^/favicon.ico$
-    # If there's a 'skin' selected in the cookie...
-    RewriteCond %{HTTP_COOKIE} skin=([^;\ ]+) [OR]
-    # Else, use the default skin.
-    RewriteCond manx ^(.+)$
-    # If the skin name is a valid one...
-    RewriteCond ${lowercase:%1} ^(manx|hokan)$
-    # Then rewrite the url to be relative to the specified skin.
-    RewriteRule ^/(.*) /static/skin/%1/$1
-
-    RewriteRule ^/message-system http://{{ haproxy_msgserver }}/++vh++https:%{SERVER_NAME}:443/++/ [P,L]
-    RewriteRule ^/ajax http://{{ haproxy_asyncfrontend }}/ [P,L]
-    RewriteRule ^/combo http://{{ haproxy_comboloader }}/ [P,L]
-    RewriteRule ^/api http://{{ haproxy_apiserver }}/ [P,L]
-    RewriteRule ^/attachment/(.*) http://{{ haproxy_msgserver }}/attachment/$1 [P,L]
-    RewriteRule ^/upload/(.*) http://{{ haproxy_packageupload }}/$1 [P,L]
-    RewriteRule ^/(static.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(config.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(hash-id-databases.*) http://{{ haproxy_static }}/$1 [P,L]
-    RewriteRule ^/(repository.*) http://{{ haproxy_static }}/$1 [P,L]
-    # The rest goes to the application server, with a few exceptions
-    RewriteCond %{REQUEST_URI} !/icons
-    RewriteCond %{REQUEST_URI} !/robots.txt
-    RewriteCond %{REQUEST_URI} !/server-status
-    RewriteRule ^/(.*) http://{{ haproxy_appserver }}/++vh++https:%{SERVER_NAME}:443/++/$1 [P]
-
-</VirtualHost>

=== modified file 'lib/relations/haproxy.py'
--- lib/relations/haproxy.py	2017-02-28 08:50:43 +0000
+++ lib/relations/haproxy.py	2017-03-20 12:16:50 +0000
@@ -42,6 +42,8 @@
         "acl message path_beg -i /message-system",
         "acl attachment path_beg -i /attachment",
         "acl api path_beg -i /api",
+        "acl prometheus_metrics path_beg -i /metrics",
+        "http-request deny if prometheus_metrics",
         "use_backend landscape-message if message",
         "use_backend landscape-message if attachment",
         "use_backend landscape-api if api",

=== modified file 'lib/relations/tests/test_haproxy.py'
--- lib/relations/tests/test_haproxy.py	2017-02-27 09:47:31 +0000
+++ lib/relations/tests/test_haproxy.py	2017-03-20 12:16:50 +0000
@@ -106,6 +106,8 @@
                  "acl message path_beg -i /message-system",
                  "acl attachment path_beg -i /attachment",
                  "acl api path_beg -i /api",
+                 "acl prometheus_metrics path_beg -i /metrics",
+                 "http-request deny if prometheus_metrics",
                  "use_backend landscape-message if message",
                  "use_backend landscape-message if attachment",
                  "use_backend landscape-api if api"],
@@ -430,6 +432,8 @@
                 "acl message path_beg -i /message-system",
                 "acl attachment path_beg -i /attachment",
                 "acl api path_beg -i /api",
+                "acl prometheus_metrics path_beg -i /metrics",
+                "http-request deny if prometheus_metrics",
                 "use_backend landscape-message if message",
                 "use_backend landscape-message if attachment",
                 "use_backend landscape-api if api",
@@ -485,6 +489,8 @@
                 "acl message path_beg -i /message-system",
                 "acl attachment path_beg -i /attachment",
                 "acl api path_beg -i /api",
+                "acl prometheus_metrics path_beg -i /metrics",
+                "http-request deny if prometheus_metrics",
                 "use_backend landscape-message if message",
                 "use_backend landscape-message if attachment",
                 "use_backend landscape-api if api",