Merge lp:~bjornt/maas/peer_proxy into lp:~maas-committers/maas/trunk

[Björn Tillenius]

Add support for using the http proxy as a peer proxy.

If use_peer_proxy is True in the settings, the built-in http proxy will
be configured to use the specified http proxy as a cache peer. So that
machines will go through the built-in proxy, which in turn will go
through the external http proxy to download packages.

It's possible to configure use_peer_proxy via the API for now. The UI
will come later.

Add support for using the http proxy as a peer proxy.

If use_peer_proxy is True in the settings, the built-in http proxy will
be configured to use the specified http proxy as a cache peer. So that
machines will go through the built-in proxy, which in turn will go
through the external http proxy to download packages.

It's possible to configure use_peer_proxy via the API for now. The UI
will come later.

[Mike Pontillo (mpontillo)]

Does this fix bug #1276945? If so, can you link the bug?

Other than that, looks good to me. Nice that you updated the trigger, too; sometimes that's overlooked and it causes problems.

review: Approve

[Björn Tillenius (bjornt)]

Ah, yes, it does fixes that bug. I didn't know about it, but I have linked it now.

[Mike Pontillo (mpontillo)]

Thanks. I can't tell how you linked the bug; can you be sure to link it from a bzr commit, if you didn't already? (such as by doing 'bzr commit --unchanged -m "Link bug." --fixes lp:1276945 && bzr push') That way "Fix Committed" on the bug will automatically be set when it lands.

Oh, also consider adding the second paragraph in your description to the commit message.

[MAAS Lander (maas-lander)]

The attempt to merge lp:~bjornt/maas/peer_proxy into lp:maas failed. Below is the output from the failed tests.

Hit:1 http://security.ubuntu.com/ubuntu xenial-security InRelease
Hit:2 http://archive.ubuntu.com/ubuntu xenial InRelease
Get:3 http://archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]
Get:4 http://archive.ubuntu.com/ubuntu xenial-backports InRelease [102 kB]
Fetched 204 kB in 1s (173 kB/s)
Reading package lists...
sudo DEBIAN_FRONTEND=noninteractive apt-get -y \
    --no-install-recommends install apache2 archdetect-deb authbind avahi-utils bash bind9 bind9utils build-essential bzr bzr-builddeb chromium-browser chromium-chromedriver curl daemontools debhelper dh-apport dh-systemd distro-info dnsutils firefox freeipmi-tools git gjs ipython isc-dhcp-common isc-dhcp-server libjs-angularjs libjs-jquery libjs-jquery-hotkeys libjs-yui3-full libjs-yui3-min libnss-wrapper libpq-dev make nodejs-legacy npm postgresql psmisc pxelinux python3-all python3-apt python3-attr python3-bson python3-convoy python3-crochet python3-cssselect python3-curtin python3-dev python3-distro-info python3-django python3-django-nose python3-django-piston3 python3-dnspython python3-docutils python3-formencode python3-hivex python3-httplib2 python3-jinja2 python3-jsonschema python3-lxml python3-netaddr python3-netifaces python3-novaclient python3-oauth python3-oauthlib python3-openssl python3-paramiko python3-petname python3-pexpect python3-psycopg2 python3-pyinotify python3-pyparsing python3-pyvmomi python3-requests python3-seamicroclient python3-setuptools python3-simplestreams python3-sphinx python3-tempita python3-twisted python3-txtftp python3-tz python3-yaml python3-zope.interface python-bson python-crochet python-django python-django-piston python-djorm-ext-pgarray python-formencode python-lxml python-netaddr python-netifaces python-pocket-lint python-psycopg2 python-simplejson python-tempita python-twisted python-yaml socat syslinux-common tgt ubuntu-cloudimage-keyring wget xvfb
Reading package lists...
Building dependency tree...
Reading state information...
authbind is already the newest version (2.1.1+nmu1).
avahi-utils is already the newest version (0.6.32~rc+dfsg-1ubuntu2).
build-essential is already the newest version (12.1ubuntu2).
debhelper is already the newest version (9.20160115ubuntu3).
distro-info is already the newest version (0.14build1).
libjs-angularjs is already the newest version (1.2.28-1ubuntu2).
libjs-jquery is already the newest version (1.11.3+dfsg-4).
libjs-yui3-full is already the newest version (3.5.1-1ubuntu3).
libjs-yui3-min is already the newest version (3.5.1-1ubuntu3).
make is already the newest version (4.1-6).
postgresql is already the newest version (9.5+173).
psmisc is already the newest version (22.21-2.1build1).
pxelinux is already the newest version (3:6.03+dfsg-11ubuntu1).
python-formencode is already the newest version (1.3.0-0ubuntu5).
python-lxml is already the newest version (3.5.0-1build1).
python-netaddr is already the newest version (0.7.18-1).
python-netifaces is already the newest version (0.10.4-0.1build2).
python-psycopg2 is already the newest version (2.6.1-1build2).
python-simplejson is already ...

=== modified file 'src/maasserver/api/tests/test_maas.py'
--- src/maasserver/api/tests/test_maas.py	2017-02-17 14:23:04 +0000
+++ src/maasserver/api/tests/test_maas.py	2017-06-16 13:49:45 +0000
@@ -281,3 +281,14 @@
         self.assertThat(
             PackageRepository.get_ports_archive().url,
             Equals(ports_archive))
+
+    def test_set_config_use_peer_proxy(self):
+        self.become_admin()
+        response = self.client.post(
+            reverse('maas_handler'), {
+                "op": "set_config",
+                "name": "use_peer_proxy",
+                "value": True,
+            })
+        self.assertEqual(http.client.OK, response.status_code)
+        self.assertTrue(Config.objects.get_config("use_peer_proxy"))

=== modified file 'src/maasserver/compose_preseed.py'
--- src/maasserver/compose_preseed.py	2017-06-15 16:04:10 +0000
+++ src/maasserver/compose_preseed.py	2017-06-16 13:49:45 +0000
@@ -37,7 +37,8 @@
         http_proxy = Config.objects.get_config("http_proxy")
         if http_proxy is not None:
             http_proxy = http_proxy.strip()
-        if http_proxy:
+        use_peer_proxy = Config.objects.get_config("use_peer_proxy")
+        if http_proxy and not use_peer_proxy:
             return http_proxy
         else:
             return compose_URL(

=== modified file 'src/maasserver/forms/settings.py'
--- src/maasserver/forms/settings.py	2017-04-24 16:47:00 +0000
+++ src/maasserver/forms/settings.py	2017-06-16 13:49:45 +0000
@@ -225,6 +225,18 @@
                 "downloading boot images.")
         }
     },
+    'use_peer_proxy': {
+        'default': False,
+        'form': forms.BooleanField,
+        'form_kwargs': {
+            'label': "Use the built-in proxy with an external proxy as a peer",
+            'required': False,
+            'help_text': (
+                "If enable_http_proxy is set, the built-in proxy will be "
+                "configured to use http_proxy as a peer proxy. The deployed "
+                "machines will be configured to use the built-in proxy.")
+        }
+    },
     'http_proxy': {
         'default': None,
         'form': forms.URLField,

=== modified file 'src/maasserver/models/config.py'
--- src/maasserver/models/config.py	2017-04-07 21:52:35 +0000
+++ src/maasserver/models/config.py	2017-06-16 13:49:45 +0000
@@ -69,6 +69,7 @@
         'default_osystem': DEFAULT_OS.name,
         'default_distro_series': DEFAULT_OS.get_default_release(),
         'enable_http_proxy': True,
+        'use_peer_proxy': False,
         'http_proxy': None,
         'upstream_dns': None,
         'dnssec_validation': "auto",

=== modified file 'src/maasserver/proxyconfig.py'
--- src/maasserver/proxyconfig.py	2017-05-02 19:00:58 +0000
+++ src/maasserver/proxyconfig.py	2017-06-16 13:49:45 +0000
@@ -13,8 +13,10 @@
 import os
 import socket
 import sys
+from urllib.parse import urlparse
 
 from django.conf import settings
+from maasserver.models import Config
 from maasserver.models.subnet import Subnet
 from maasserver.service_monitor import service_monitor
 from maasserver.utils.orm import transactional
@@ -67,6 +69,10 @@
     def write_config():
         allowed_subnets = Subnet.objects.filter(allow_proxy=True)
         cidrs = [subnet.cidr for subnet in allowed_subnets]
+
+        http_proxy = Config.objects.get_config("http_proxy")
+        upstream_proxy_enabled = (
+            Config.objects.get_config("use_peer_proxy") and http_proxy)
         context = {
             'allowed': allowed_subnets,
             'modified': str(datetime.date.today()),
@@ -76,7 +82,18 @@
             'snap_path': snappy.get_snap_path(),
             'snap_data_path': snappy.get_snap_data_path(),
             'snap_common_path': snappy.get_snap_common_path(),
+            'upstream_peer_proxy': upstream_proxy_enabled,
         }
+
+        proxy_enabled = Config.objects.get_config("enable_http_proxy")
+        if proxy_enabled and upstream_proxy_enabled:
+            http_proxy_hostname = urlparse(http_proxy).hostname
+            http_proxy_port = urlparse(http_proxy).port
+            context.update({
+                'upstream_proxy_address': http_proxy_hostname,
+                'upstream_proxy_port': http_proxy_port,
+            })
+
         template_path = locate_template('proxy', MAAS_PROXY_CONF_TEMPLATE)
         template = tempita.Template.from_filename(
             template_path, encoding="UTF-8")

=== modified file 'src/maasserver/service_monitor.py'
--- src/maasserver/service_monitor.py	2016-10-18 16:57:31 +0000
+++ src/maasserver/service_monitor.py	2017-06-16 13:49:45 +0000
@@ -52,7 +52,8 @@
             # Avoid recursive import.
             from maasserver import proxyconfig
             if (Config.objects.get_config("enable_http_proxy") and
-                    Config.objects.get_config("http_proxy")):
+                    Config.objects.get_config("http_proxy") and
+                    not Config.objects.get_config("use_peer_proxy")):
                 return (SERVICE_STATE.OFF,
                         "disabled, alternate proxy is configured in settings.")
             elif proxyconfig.is_config_present() is False:

=== modified file 'src/maasserver/tests/test_compose_preseed.py'
--- src/maasserver/tests/test_compose_preseed.py	2017-06-15 16:04:10 +0000
+++ src/maasserver/tests/test_compose_preseed.py	2017-06-16 13:49:45 +0000
@@ -51,26 +51,37 @@
             rack='2001:db8::1',
             result='http://[2001:db8::1]:8000/',
             enable=True,
+            use_peer_proxy=False,
             http_proxy='')),
         ("ipv4", dict(
             rack='10.0.1.1',
             result='http://10.0.1.1:8000/',
             enable=True,
-            http_proxy='')),
-        ("name", dict(
-            rack='example.com',
-            result='http://example.com:8000/',
-            enable=True,
-            http_proxy='')),
-        ("override", dict(
-            rack='wrong.com',
-            result='http://example.com:111/',
-            enable=True,
-            http_proxy='http://example.com:111/')),
+            use_peer_proxy=False,
+            http_proxy='')),
+        ("builtin", dict(
+            rack='region.example.com',
+            result='http://region.example.com:8000/',
+            enable=True,
+            use_peer_proxy=False,
+            http_proxy='')),
+        ("external", dict(
+            rack='region.example.com',
+            result='http://proxy.example.com:111/',
+            enable=True,
+            use_peer_proxy=False,
+            http_proxy='http://proxy.example.com:111/')),
+        ("peer-proxy", dict(
+            rack='region.example.com',
+            result='http://region.example.com:8000/',
+            enable=True,
+            use_peer_proxy=True,
+            http_proxy='http://proxy.example.com:111/')),
         ("disabled", dict(
             rack='example.com',
             result=None,
             enable=False,
+            use_peer_proxy=False,
             http_proxy='')),
     )
 
@@ -89,6 +100,7 @@
             interface=True, status=NODE_STATUS.COMMISSIONING)
         Config.objects.set_config("enable_http_proxy", self.enable)
         Config.objects.set_config("http_proxy", self.http_proxy)
+        Config.objects.set_config("use_peer_proxy", self.use_peer_proxy)
         actual = get_apt_proxy(node.get_boot_rack_controller())
         self.assertEqual(self.result, actual)
 

=== modified file 'src/maasserver/tests/test_preseed.py'
--- src/maasserver/tests/test_preseed.py	2017-04-26 19:02:50 +0000
+++ src/maasserver/tests/test_preseed.py	2017-06-16 13:49:45 +0000
@@ -34,6 +34,7 @@
     BootResource,
     Config,
     PackageRepository,
+    signals,
 )
 from maasserver.preseed import (
     compose_curtin_archive_config,
@@ -1658,6 +1659,12 @@
     These tests check that the preseed templates render and 'look right'.
     """
 
+    def setUp(self):
+        super().setUp()
+        # We don't want to test that the bootsources get updated.
+        self.addCleanup(signals.bootsources.signals.enable)
+        signals.bootsources.signals.disable()
+
     def assertSystemInfo(self, config):
         self.assertThat(config, ContainsDict({
             'system_info': MatchesDict({
@@ -1747,6 +1754,35 @@
         self.assertAptConfig(preseed, apt_proxy)
         self.assertSystemInfo(preseed)
 
+    def test_get_enlist_userdata_no_proxy(self):
+        Config.objects.set_config('enable_http_proxy', False)
+        Config.objects.set_config('http_proxy', 'http://example.com:3128')
+        preseed = yaml.safe_load(get_enlist_userdata())
+        self.assertIsNone(preseed['apt_proxy'])
+        self.assertNotIn('proxy', preseed['apt'])
+
+    def test_get_enlist_userdata_use_builtin_proxy(self):
+        Config.objects.set_config('enable_http_proxy', True)
+        Config.objects.set_config('http_proxy', '')
+        preseed = yaml.safe_load(get_enlist_userdata())
+        self.assertEqual('http://localhost:8000/', preseed['apt_proxy'])
+        self.assertEqual('http://localhost:8000/', preseed['apt']['proxy'])
+
+    def test_get_enlist_userdata_use_external_proxy(self):
+        Config.objects.set_config('enable_http_proxy', True)
+        Config.objects.set_config('http_proxy', 'http://example.com:3128/')
+        preseed = yaml.safe_load(get_enlist_userdata())
+        self.assertEqual('http://example.com:3128/', preseed['apt_proxy'])
+        self.assertEqual('http://example.com:3128/', preseed['apt']['proxy'])
+
+    def test_get_enlist_userdata_use_peer_proxy(self):
+        Config.objects.set_config('enable_http_proxy', True)
+        Config.objects.set_config('use_peer_proxy', True)
+        Config.objects.set_config('http_proxy', 'http://example.com:3128/')
+        preseed = yaml.safe_load(get_enlist_userdata())
+        self.assertEqual('http://localhost:8000/', preseed['apt_proxy'])
+        self.assertEqual('http://localhost:8000/', preseed['apt']['proxy'])
+
     def test_get_preseed_returns_commissioning_preseed(self):
         node = factory.make_Node_with_Interface_on_Subnet(
             primary_rack=self.rpc_rack_controller,

=== modified file 'src/maasserver/tests/test_proxyconfig.py'
--- src/maasserver/tests/test_proxyconfig.py	2017-05-02 18:42:35 +0000
+++ src/maasserver/tests/test_proxyconfig.py	2017-06-16 13:49:45 +0000
@@ -6,11 +6,13 @@
 __all__ = []
 
 import os
+from pathlib import Path
 
 from crochet import wait_for
 from django.conf import settings
 from fixtures import EnvironmentVariableFixture
 from maasserver import proxyconfig
+from maasserver.models import Config
 from maasserver.testing.factory import factory
 from maasserver.testing.testcase import (
     MAASServerTestCase,
@@ -58,6 +60,7 @@
     def setUp(self):
         super(TestProxyUpdateConfig, self).setUp()
         self.tmpdir = self.make_dir()
+        self.proxy_path = Path(self.tmpdir) / proxyconfig.MAAS_PROXY_CONF_NAME
         self.service_monitor = self.patch(proxyconfig, "service_monitor")
         self.useFixture(
             EnvironmentVariableFixture('MAAS_PROXY_CONFIG_DIR', self.tmpdir))
@@ -86,6 +89,71 @@
 
     @wait_for_reactor
     @inlineCallbacks
+    def test__with_use_peer_proxy_with_http_proxy(self):
+        self.patch(settings, "PROXY_CONNECT", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "enable_http_proxy", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "use_peer_proxy", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "http_proxy", "http://example.com:8000/")
+        yield deferToDatabase(self.make_subnet, allow_proxy=False)
+        yield deferToDatabase(self.make_subnet)
+        yield proxyconfig.proxy_update_config(reload_proxy=False)
+        cache_peer_line = (
+            "cache_peer example.com parent 8000 0 no-query default")
+        with self.proxy_path.open() as proxy_file:
+            lines = [line.strip() for line in proxy_file.readlines()]
+            self.assertIn('never_direct allow all', lines)
+            self.assertIn(cache_peer_line, lines)
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test__with_use_peer_proxy_without_http_proxy(self):
+        self.patch(settings, "PROXY_CONNECT", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "enable_http_proxy", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "use_peer_proxy", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "http_proxy", "")
+        yield deferToDatabase(self.make_subnet, allow_proxy=False)
+        yield deferToDatabase(self.make_subnet)
+        yield proxyconfig.proxy_update_config(reload_proxy=False)
+        with self.proxy_path.open() as proxy_file:
+            lines = [line.strip() for line in proxy_file.readlines()]
+            self.assertNotIn('never_direct allow all', lines)
+            self.assertNotIn('cache_peer', lines)
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test__without_use_peer_proxy(self):
+        self.patch(settings, "PROXY_CONNECT", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "enable_http_proxy", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "use_peer_proxy", False)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "http_proxy", "http://example.com:8000/")
+        yield deferToDatabase(self.make_subnet, allow_proxy=False)
+        yield deferToDatabase(self.make_subnet)
+        yield proxyconfig.proxy_update_config(reload_proxy=False)
+        with self.proxy_path.open() as proxy_file:
+            lines = [line.strip() for line in proxy_file.readlines()]
+            self.assertNotIn('never_direct allow all', lines)
+            self.assertNotIn('cache_peer', lines)
+
+    @wait_for_reactor
+    @inlineCallbacks
     def test__calls_reloadService(self):
         self.patch(settings, "PROXY_CONNECT", True)
         yield deferToDatabase(self.make_subnet)

=== modified file 'src/maasserver/tests/test_service_monitor.py'
--- src/maasserver/tests/test_service_monitor.py	2017-01-28 00:51:47 +0000
+++ src/maasserver/tests/test_service_monitor.py	2017-06-16 13:49:45 +0000
@@ -131,3 +131,24 @@
             (SERVICE_STATE.OFF,
              'disabled, alternate proxy is configured in settings.'),
             expected_state)
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test_getExpectedState_returns_on_for_proxy_on_and_set_peer_proxy(self):
+        # Disable boot source cache signals.
+        self.addCleanup(bootsources.signals.enable)
+        bootsources.signals.disable()
+
+        service = self.make_proxy_service()
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "enable_http_proxy", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "use_peer_proxy", True)
+        yield deferToDatabase(
+            transactional(Config.objects.set_config),
+            "http_proxy", factory.make_url())
+        self.patch(proxyconfig, "is_config_present").return_value = True
+        expected_state = yield maybeDeferred(service.getExpectedState)
+        self.assertEqual((SERVICE_STATE.ON, None), expected_state)

=== modified file 'src/maasserver/triggers/system.py'
--- src/maasserver/triggers/system.py	2017-05-05 15:30:51 +0000
+++ src/maasserver/triggers/system.py	2017-06-16 13:49:45 +0000
@@ -1050,6 +1050,38 @@
     """)
 
 
+# Triggered when the proxy settings are updated.
+PEER_PROXY_CONFIG_INSERT = dedent("""\
+    CREATE OR REPLACE FUNCTION sys_proxy_config_use_peer_proxy_insert()
+    RETURNS trigger as $$
+    BEGIN
+      IF (NEW.name = 'enable_proxy' OR
+          NEW.name = 'use_peer_proxy' OR
+          NEW.name = 'http_proxy') THEN
+        PERFORM pg_notify('sys_proxy', '');
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql;
+    """)
+
+
+# Triggered when the proxy settings are updated.
+PEER_PROXY_CONFIG_UPDATE = dedent("""\
+    CREATE OR REPLACE FUNCTION sys_proxy_config_use_peer_proxy_update()
+    RETURNS trigger as $$
+    BEGIN
+      IF (NEW.name = 'enable_proxy' OR
+          NEW.name = 'use_peer_proxy' OR
+          NEW.name = 'http_proxy') THEN
+        PERFORM pg_notify('sys_proxy', '');
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql;
+    """)
+
+
 def render_sys_dns_procedure(proc_name, on_delete=False):
     """Render a database procedure that creates a new DNS publication.
 
@@ -1338,3 +1370,13 @@
     register_trigger(
         "maasserver_subnet",
         "sys_proxy_subnet_delete", "delete")
+
+    # - Config/http_proxy (when use_peer_proxy)
+    register_procedure(PEER_PROXY_CONFIG_INSERT)
+    register_trigger(
+        "maasserver_config", "sys_proxy_config_use_peer_proxy_insert",
+        "insert")
+    register_procedure(PEER_PROXY_CONFIG_UPDATE)
+    register_trigger(
+        "maasserver_config", "sys_proxy_config_use_peer_proxy_update",
+        "update")

=== modified file 'src/maasserver/triggers/testing.py'
--- src/maasserver/triggers/testing.py	2017-05-05 14:47:35 +0000
+++ src/maasserver/triggers/testing.py	2017-06-16 13:49:45 +0000
@@ -19,6 +19,7 @@
     Pod,
 )
 from maasserver.models.cacheset import CacheSet
+from maasserver.models.config import Config
 from maasserver.models.dhcpsnippet import DHCPSnippet
 from maasserver.models.dnsdata import DNSData
 from maasserver.models.dnspublication import DNSPublication
@@ -751,6 +752,19 @@
     def reload_object(self, obj):
         return reload_object(obj)
 
+    @transactional
+    def create_config(self, name, value):
+        config, freshly_created = Config.objects.get_or_create(
+            name=name, defaults=dict(value=value))
+        assert freshly_created, "Config already created."
+        return config
+
+    @transactional
+    def set_config(self, name, value):
+        config = Config.objects.get(name=name)
+        config.value = value
+        config.save()
+
 
 class DNSHelpersMixin:
     """Helper to get the zone serial and to assert it was incremented."""

=== modified file 'src/maasserver/triggers/tests/test_init.py'
--- src/maasserver/triggers/tests/test_init.py	2017-04-17 17:04:50 +0000
+++ src/maasserver/triggers/tests/test_init.py	2017-06-16 13:49:45 +0000
@@ -123,6 +123,8 @@
         "config_config_create_notify",
         "config_config_delete_notify",
         "config_config_update_notify",
+        "config_sys_proxy_config_use_peer_proxy_insert",
+        "config_sys_proxy_config_use_peer_proxy_update",
         "dhcpsnippet_dhcpsnippet_create_notify",
         "dhcpsnippet_dhcpsnippet_delete_notify",
         "dhcpsnippet_dhcpsnippet_update_notify",

=== modified file 'src/maasserver/triggers/tests/test_system_listener.py'
--- src/maasserver/triggers/tests/test_system_listener.py	2017-05-05 15:11:21 +0000
+++ src/maasserver/triggers/tests/test_system_listener.py	2017-06-16 13:49:45 +0000
@@ -3713,7 +3713,7 @@
                 % (json.dumps(kms_host_old), json.dumps(kms_host_new))))
 
 
-class TestProxySubnetListener(
+class TestProxyListener(
         MAASTransactionServerTestCase, TransactionalHelpersMixin):
     """End-to-end test for the proxy triggers code."""
 
@@ -3787,3 +3787,99 @@
             yield dv.get(timeout=2)
         finally:
             yield listener.stopService()
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test_sends_message_for_config_insert_enable_proxy(self):
+        yield deferToDatabase(register_system_triggers)
+        dv = DeferredValue()
+        listener = self.make_listener_without_delay()
+        listener.register(
+            "sys_proxy", lambda *args: dv.set(args))
+        yield listener.startService()
+        try:
+            yield deferToDatabase(self.create_config, "enable_proxy", True)
+            yield dv.get(timeout=2)
+        finally:
+            yield listener.stopService()
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test_sends_message_for_config_insert_use_peer_proxy(self):
+        yield deferToDatabase(register_system_triggers)
+        dv = DeferredValue()
+        listener = self.make_listener_without_delay()
+        listener.register(
+            "sys_proxy", lambda *args: dv.set(args))
+        yield listener.startService()
+        try:
+            yield deferToDatabase(self.create_config, "use_peer_proxy", True)
+            yield dv.get(timeout=2)
+        finally:
+            yield listener.stopService()
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test_sends_message_for_config_insert_http_proxy(self):
+        yield deferToDatabase(register_system_triggers)
+        dv = DeferredValue()
+        listener = self.make_listener_without_delay()
+        listener.register(
+            "sys_proxy", lambda *args: dv.set(args))
+        yield listener.startService()
+        try:
+            yield deferToDatabase(
+                self.create_config, "http_proxy", "http://proxy.example.com")
+            yield dv.get(timeout=2)
+        finally:
+            yield listener.stopService()
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test_sends_message_for_config_update_enable_proxy(self):
+        yield deferToDatabase(register_system_triggers)
+        yield deferToDatabase(self.create_config, "enable_proxy", True)
+        dv = DeferredValue()
+        listener = self.make_listener_without_delay()
+        listener.register(
+            "sys_proxy", lambda *args: dv.set(args))
+        yield listener.startService()
+        try:
+            yield deferToDatabase(self.set_config, "enable_proxy", False)
+            yield dv.get(timeout=2)
+        finally:
+            yield listener.stopService()
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test_sends_message_for_config_update_use_peer_proxy(self):
+        yield deferToDatabase(register_system_triggers)
+        yield deferToDatabase(self.create_config, "use_peer_proxy", True)
+        dv = DeferredValue()
+        listener = self.make_listener_without_delay()
+        listener.register(
+            "sys_proxy", lambda *args: dv.set(args))
+        yield listener.startService()
+        try:
+            yield deferToDatabase(self.set_config, "use_peer_proxy", False)
+            yield dv.get(timeout=2)
+        finally:
+            yield listener.stopService()
+
+    @wait_for_reactor
+    @inlineCallbacks
+    def test_sends_message_for_config_update_http_proxy(self):
+        yield deferToDatabase(register_system_triggers)
+        yield deferToDatabase(
+            self.create_config, "http_proxy", "http://proxy1.example.com")
+        dv = DeferredValue()
+        listener = self.make_listener_without_delay()
+        listener.register(
+            "sys_proxy", lambda *args: dv.set(args))
+        yield listener.startService()
+        try:
+            yield deferToDatabase(
+                self.set_config, "http_proxy", "http://proxy2.example.com")
+            yield dv.get(timeout=2)
+        finally:
+            yield listener.stopService()

=== modified file 'src/provisioningserver/templates/proxy/maas-proxy.conf.template'
--- src/provisioningserver/templates/proxy/maas-proxy.conf.template	2017-05-12 16:23:16 +0000
+++ src/provisioningserver/templates/proxy/maas-proxy.conf.template	2017-06-16 13:49:45 +0000
@@ -57,3 +57,7 @@
 cache_log /var/log/maas/proxy/cache.log
 cache_store_log /var/log/maas/proxy/store.log
 {{endif}}
+{{if upstream_peer_proxy}}
+cache_peer {{upstream_proxy_address}} parent {{upstream_proxy_port}} 0 no-query default
+never_direct allow all
+{{endif}}

=== modified file 'src/provisioningserver/utils/service_monitor.py'
--- src/provisioningserver/utils/service_monitor.py	2017-02-17 14:23:04 +0000
+++ src/provisioningserver/utils/service_monitor.py	2017-06-16 13:49:45 +0000
@@ -299,17 +299,19 @@
 
     @asynchronous
     @inlineCallbacks
-    def restartService(self, name):
+    def restartService(self, name, if_on=False):
         """Restart service.
 
         Service will only be restarted if its expected state is ON.
         `ServiceNotOnError` will be raised if restart is called and the
-        services expected state is not ON.
+        services expected state is not ON, except if if_on is True.
         """
         service = self.getServiceByName(name)
         expected_state, _ = yield maybeDeferred(service.getExpectedState)
         _check_service_state_expected(expected_state)
         if expected_state != SERVICE_STATE.ON:
+            if if_on:
+                return
             raise ServiceNotOnError(
                 "Service '%s' is not expected to be on, unable to restart." % (
                     service.service_name))

=== modified file 'src/provisioningserver/utils/tests/test_service_monitor.py'
--- src/provisioningserver/utils/tests/test_service_monitor.py	2017-02-17 14:23:04 +0000
+++ src/provisioningserver/utils/tests/test_service_monitor.py	2017-06-16 13:49:45 +0000
@@ -378,6 +378,13 @@
             yield service_monitor.reloadService(fake_service.name)
 
     @inlineCallbacks
+    def test__reloadService_returns_when_if_on(self):
+        fake_service = make_fake_service(SERVICE_STATE.OFF)
+        service_monitor = self.make_service_monitor([fake_service])
+        yield service_monitor.restartService(fake_service.name, if_on=True)
+        # No exception expected.
+
+    @inlineCallbacks
     def test__reloadService_calls_ensureService_then_reloads(self):
         fake_service = make_fake_service(SERVICE_STATE.ON)
         service_monitor = self.make_service_monitor([fake_service])