Merge lp:~blake-rouse/maas/maas-charms-initial into lp:~maas-committers/maas/maas-charms

[Blake Rouse]

Initial commit.

[lp:~blake-rouse/maas/maas-charms-initial]

2. By Blake Rouse on 2016-04-21

Add copyright on python files.

[Blake Rouse (blake-rouse)]

review: Approve

=== added file '.bzrignore'
--- .bzrignore	1970-01-01 00:00:00 +0000
+++ .bzrignore	2016-04-21 20:17:50 +0000
@@ -0,0 +1,2 @@
+deps/
+xenial/

=== added file 'LICENSE'
--- LICENSE	1970-01-01 00:00:00 +0000
+++ LICENSE	2016-04-21 20:17:50 +0000
@@ -0,0 +1,676 @@
+MAAS charms is Copyright 2016 Canonical Ltd.
+
+Canonical Ltd ("Canonical") distributes the MAAS charms source code
+under the GNU Affero General Public License, version 3 ("AGPLv3").
+The full text of this licence is given below.
+
+Third-party copyright in this distribution is noted where applicable.
+
+All rights not expressly granted are reserved.
+
+=========================================================================
+
+                   GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+                 (http://www.gnu.org/licenses/agpl.html)
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<http://www.gnu.org/licenses/>.
+
+=========================================================================

=== added file 'Makefile'
--- Makefile	1970-01-01 00:00:00 +0000
+++ Makefile	2016-04-21 20:17:50 +0000
@@ -0,0 +1,26 @@
+# `charm build` needs the paths to INTERFACES and LAYERS.
+export INTERFACE_PATH := $(CURDIR)/interfaces
+export LAYER_PATH := $(CURDIR)/layers
+
+all: build
+
+install-dependencies:
+	sudo DEBIAN_FRONTEND=noninteractive apt-get -y \
+		--no-install-recommends install charm-tools
+
+build: maas-region maas-rack
+
+
+maas-region:
+	charm build -s xenial maas-region -o .
+
+maas-rack:
+	charm build -s xenial maas-rack -o .
+
+test: build test-maas-region test-maas-rack
+
+test-maas-region:
+	charm proof xenial/maas-region
+
+test-maas-rack:
+	charm proof xenial/maas-rack

=== added file 'README'
--- README	1970-01-01 00:00:00 +0000
+++ README	2016-04-21 20:17:50 +0000
@@ -0,0 +1,34 @@
+.. -*- mode: rst -*-
+
+********************************
+MAAS (Metal as a Service) Charms
+********************************
+
+Juju charms that allow deploying both the MAAS region controller and
+MAAS rack controller.
+
+The MAAS region controller is the main communication point for MAAS.
+Users and tools communicate over the API and UI frontend to control
+machines and devices. The following services are installed and
+setup with the maas-region charm:
+
+  * bind9
+  * haproxy
+  * keepalived (only with vip config is set)
+  * maas-proxy
+  * maas-regiond
+
+The MAAS rack controller is where BMC's for machines are controller
+where the machines PXE boot, download images, and contact for DHCP.
+The following services are installed and setup with the maas-rack
+charm:
+
+  * maas-dhcpd
+  * maas-dhcpd6
+  * maas-rackd
+  * tgtd
+
+For more information see `MAAS`_.
+
+.. _MAAS: https://maas.io/
+

=== added directory 'interfaces'
=== added directory 'interfaces/maas-region-ha'
=== added file 'interfaces/maas-region-ha/interface.yaml'
--- interfaces/maas-region-ha/interface.yaml	1970-01-01 00:00:00 +0000
+++ interfaces/maas-region-ha/interface.yaml	2016-04-21 20:17:50 +0000
@@ -0,0 +1,4 @@
+name: maas-region-ha
+summary: Interface used by MAAS region units
+version: 1
+maintainer: "MAAS Maintainers <[e-mail]>"

=== added file 'interfaces/maas-region-ha/peers.py'
--- interfaces/maas-region-ha/peers.py	1970-01-01 00:00:00 +0000
+++ interfaces/maas-region-ha/peers.py	2016-04-21 20:17:50 +0000
@@ -0,0 +1,37 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from subprocess import CalledProcessError
+
+from charms.reactive import (
+    hook,
+    RelationBase,
+    scopes,
+)
+
+
+class MAASRegionPeers(RelationBase):
+    scope = scopes.UNIT
+
+    @hook('{peers:maas-region-ha}-relation-joined')
+    def joined(self):
+        conv = self.conversation()
+        conv.remove_state('{relation_name}.departed')
+        conv.set_state('{relation_name}.joined')
+
+    @hook('{peers:maas-region-ha}-relation-departed')
+    def departed(self):
+        conv = self.conversation()
+        conv.remove_state('{relation_name}.joined')
+        conv.set_state('{relation_name}.departed')
+
+    def get_units(self):
+        try:
+            return {
+                conv.scope: conv.get_remote('private-address')
+                for conv in self.conversations()
+            }
+        except CalledProcessError:
+            # Possible that when remove the service that self.conversations
+            # raises this exception.
+            return {}

=== added directory 'interfaces/maas-rpc'
=== added file 'interfaces/maas-rpc/interface.yaml'
--- interfaces/maas-rpc/interface.yaml	1970-01-01 00:00:00 +0000
+++ interfaces/maas-rpc/interface.yaml	2016-04-21 20:17:50 +0000
@@ -0,0 +1,4 @@
+name: maas-rpc
+summary: Interface used by for maas-rack can connect to maas-region.
+version: 1
+maintainer: "MAAS Maintainers <[e-mail]>"

=== added file 'interfaces/maas-rpc/provides.py'
--- interfaces/maas-rpc/provides.py	1970-01-01 00:00:00 +0000
+++ interfaces/maas-rpc/provides.py	2016-04-21 20:17:50 +0000
@@ -0,0 +1,32 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from charms.reactive import RelationBase
+from charms.reactive import scopes
+from charms.reactive import hook
+from charms.reactive import not_unless
+
+
+class MAASRPC(RelationBase):
+    scope = scopes.GLOBAL
+
+    @hook('{provides:maas-rpc}-relation-{changed,joined}')
+    def changed_joined(self):
+        self.set_state('{relation_name}.rpc.requested')
+
+    @hook('{provides:maas-rpc}-relation-{departed,broken}')
+    def departed_broken(self):
+        self.remove_state('{relation_name}.rpc.requested')
+
+    @not_unless('{provides:maas-rpc}.rpc.requested')
+    def set_connection_info(self, maas_url, secret):
+        """
+        Set the connection information.
+
+        :param str maas_url: The MAAS URL the rack controller should use to
+            connect.
+        :param str secret: The secret that should be used to authenticate
+            the RPC connection.
+        """
+        self.set_remote(maas_url=maas_url, secret=secret)
+        self.remove_state('{relation_name}.rpc.requested')

=== added file 'interfaces/maas-rpc/requires.py'
--- interfaces/maas-rpc/requires.py	1970-01-01 00:00:00 +0000
+++ interfaces/maas-rpc/requires.py	2016-04-21 20:17:50 +0000
@@ -0,0 +1,23 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from charms.reactive import RelationBase
+from charms.reactive import hook
+from charms.reactive import scopes
+
+
+class MAASRPCClient(RelationBase):
+    scope = scopes.GLOBAL
+
+    # These remote data fields will be automatically mapped to accessors
+    # with a basic documentation string provided.
+    auto_accessors = ['maas_url', 'secret']
+
+    @hook('{requires:maas-rpc}-relation-{changed,joined}')
+    def changed_joined(self):
+        if all([self.maas_url(), self.secret()]):
+            self.set_state('{relation_name}.rpc.available')
+
+    @hook('{provides:maas-rpc}-relation-{departed,broken}')
+    def departed_broken(self):
+        self.remove_state('{relation_name}.rpc.available')

=== added directory 'layers'
=== added directory 'layers/maas-rack'
=== added file 'layers/maas-rack/config.yaml'
--- layers/maas-rack/config.yaml	1970-01-01 00:00:00 +0000
+++ layers/maas-rack/config.yaml	2016-04-21 20:17:50 +0000
@@ -0,0 +1,7 @@
+options:
+  ppa:
+    type: string
+    default: ''
+    description: |
+      PPA to added before installing MAAS. This needs to be set before during
+      deployment. Changing after initial deployment has no affect.

=== added file 'layers/maas-rack/icon.svg'
--- layers/maas-rack/icon.svg	1970-01-01 00:00:00 +0000
+++ layers/maas-rack/icon.svg	2016-04-21 20:17:50 +0000
@@ -0,0 +1,1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="354.331" height="354.331"><g><path d="M326.627 176.777c0 82.76-67.09 149.85-149.85 149.85-82.76 0-149.85-67.09-149.85-149.85 0-82.76 67.09-149.85 149.85-149.85 82.76 0 149.85 67.09 149.85 149.85z" opacity=".597" fill="#333" fill-opacity="0"/><path d="M237.057 181.242c0 46.758-26.955 84.663-60.205 84.663S116.647 228 116.647 181.242c0-46.758 26.955-84.663 60.205-84.663s60.205 37.904 60.205 84.662z" opacity=".597" fill="#dd4814" fill-opacity="0"/><path d="M267.786 221.692c0 15.413-25.13 27.907-56.128 27.907-31 0-56.13-12.495-56.13-27.908 0-15.413 25.13-27.908 56.13-27.908 31 0 56.128 12.495 56.128 27.908z" opacity=".597" fill="#dd4814" fill-opacity="0"/><path d="M321.81 176.228c0 79.71-64.618 144.328-144.328 144.328-79.71 0-144.328-64.618-144.328-144.328 0-79.71 64.618-144.328 144.328-144.328 79.71 0 144.328 64.618 144.328 144.328z" fill="#dd4814"/><g fill="#fff" stroke="#fff" stroke-width=".798"><path d="M164.915 229.485c-18.342.033-50.34.346-63.057 2.305-6.876 1.09-6.34 5.642-6.54 9.397v.067c.2 3.756-.336 8.31 6.54 9.398 16.935 2.61 68.054 2.305 75.58 2.304h.055c7.525 0 58.644.305 75.58-2.304 6.875-1.09 6.368-5.642 6.567-9.398-.21-3.767.348-8.37-6.568-9.464-16.935-2.61-68.054-2.305-75.58-2.305-1.858 0-6.463-.01-12.577 0z"/><path d="M164.915 99.493c-18.342.033-50.34.346-63.057 2.305-6.876 1.09-6.34 5.642-6.54 9.397v.067c.2 3.755-.336 8.308 6.54 9.397 16.935 2.608 68.054 2.305 75.58 2.304h.055c7.525 0 58.644.304 75.58-2.305 6.875-1.09 6.368-5.643 6.567-9.398-.21-3.767.348-8.37-6.568-9.464-16.935-2.61-68.054-2.306-75.58-2.305-1.858 0-6.463-.01-12.577 0z"/><path d="M164.915 186.155c-18.342.032-50.34.345-63.057 2.304-6.876 1.088-6.34 5.64-6.54 9.396v.069c.2 3.755-.336 8.308 6.54 9.397 16.935 2.61 68.054 2.306 75.58 2.305h.055c7.525 0 58.644.305 75.58-2.304 6.875-1.088 6.368-5.64 6.567-9.396-.21-3.768.348-8.37-6.568-9.465-16.935-2.61-68.054-2.306-75.58-2.305-1.858 0-6.463-.01-12.577 0z"/><path d="M164.915 142.824c-18.342.032-50.34.346-63.057 2.304-6.876 1.09-6.34 5.642-6.54 9.398v.068c.2 3.755-.336 8.308 6.54 9.397 16.935 2.61 68.054 2.305 75.58 2.305h.055c7.525 0 58.644.304 75.58-2.305 6.875-1.09 6.368-5.642 6.567-9.397-.21-3.768.348-8.37-6.568-9.465-16.935-2.608-68.054-2.305-75.58-2.304-1.858 0-6.463-.01-12.577 0z"/></g></g></svg>
\ No newline at end of file

=== added file 'layers/maas-rack/layer.yaml'
--- layers/maas-rack/layer.yaml	1970-01-01 00:00:00 +0000
+++ layers/maas-rack/layer.yaml	2016-04-21 20:17:50 +0000
@@ -0,0 +1,5 @@
+includes: [
+    'layer:basic',
+    'interface:maas-rpc',
+]
+repo: https://code.launchpad.net/~maas-committers/maas/maas-charms

=== added file 'layers/maas-rack/metadata.yaml'
--- layers/maas-rack/metadata.yaml	1970-01-01 00:00:00 +0000
+++ layers/maas-rack/metadata.yaml	2016-04-21 20:17:50 +0000
@@ -0,0 +1,12 @@
+name: maas-rack
+summary: Rack controller for MAAS.
+maintainer: MAAS Maintainers <[e-mail]>
+description: |
+  MAAS runs a software-defined data centre - it turns a collection of physical
+  servers and switches into a bare metal cloud with full open source IP address
+  management (IPAM) and instant provisioning on demand.
+tags:
+  - network
+requires:
+  rpc:
+    interface: maas-rpc

=== added directory 'layers/maas-rack/reactive'
=== added file 'layers/maas-rack/reactive/rack.py'
--- layers/maas-rack/reactive/rack.py	1970-01-01 00:00:00 +0000
+++ layers/maas-rack/reactive/rack.py	2016-04-21 20:17:50 +0000
@@ -0,0 +1,154 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+import os
+from subprocess import (
+    check_call,
+    check_output,
+)
+
+from charmhelpers import fetch
+from charmhelpers.core import (
+    hookenv,
+    host,
+    unitdata,
+)
+from charms.reactive import (
+    hook,
+    when,
+    when_not,
+)
+
+
+# Presistent unit data.
+unit_db = unitdata.kv()
+
+
+# Ports to mark as open when in ready state.
+ports = [
+    # DHCP
+    (67, 'UDP'),
+    (68, 'UDP'),
+    # TFTP
+    (69, 'TCP'),
+    (69, 'UDP'),
+    # HTTP
+    (5248, 'TCP'),
+    # ISCSI
+    (860, 'TCP'),
+    (3260, 'TCP'),
+]
+
+
+def open_ports():
+    """Tells Juju about the open ports."""
+    ports_opened = unit_db.get('ports_opened', False)
+    if ports_opened:
+        return
+    for port, protocol in ports:
+        hookenv.open_port(port, protocol)
+    unit_db.set('ports_opened', True)
+
+
+def close_ports():
+    """Removes opened ports from Juju."""
+    ports_opened = unit_db.get('ports_opened', False)
+    if not ports_opened:
+        return
+    for port, protocol in ports:
+        hookenv.close_port(port, protocol)
+    unit_db.unset('ports_opened')
+
+
+@hook('install')
+def install_rack():
+    # Place in maintenance.
+    hookenv.status_set('maintenance', '')
+
+    # Add the ppa source if provided in config.
+    ppa_source = hookenv.config('ppa')
+    if ppa_source:
+        hookenv.status_set('maintenance', 'Enabling PPA')
+        fetch.add_source(ppa_source)
+
+    # Update the sources and install the required packages.
+    hookenv.status_set('maintenance', 'Installing packages')
+    fetch.apt_update()
+    fetch.apt_install([
+        'maas-dhcp',
+        'maas-rack-controller'])
+
+    # Possible re-install remove rackd.conf.
+    if os.path.exists('/etc/maas/rackd.conf'):
+        os.remove('/etc/maas/rackd.conf')
+
+    # Install should have rackd off.
+    host.service_stop('maas-rackd')
+
+
+@when('rpc.rpc.available')
+def update_rackd_config(rpc):
+    maas_url = unit_db.get('maas_url')
+    rpc_maas_url = rpc.maas_url()
+    if rpc_maas_url is None:
+        rpc_maas_url = ''
+    if maas_url is None or maas_url != rpc_maas_url:
+        hookenv.status_set('maintenance', 'Writing maas_url into rackd.conf')
+        check_call(['maas-rack', 'config', '--region-url', rpc_maas_url])
+        unit_db.set('maas_url', rpc_maas_url)
+    secret = unit_db.get('secret')
+    rpc_secret = rpc.secret()
+    if rpc_secret is None:
+        rpc_secret = ''
+    if secret is None or secret != rpc_secret:
+        hookenv.status_set('maintenance', 'Writing secret into /var/lib/maas/')
+        check_output(
+            ['maas-rack', 'install-shared-secret'],
+            input=rpc_secret.encode('ascii'))
+        unit_db.set('secret', rpc_secret)
+    if rpc_maas_url:
+        # Valid maas_url then we are running.
+        if not host.service_running('maas-rackd'):
+            host.service_restart('maas-rackd')
+        else:
+            # maas-rackd will acutally pick this up automatically and does not
+            # needs to be reloaded or restarted.
+            pass
+        open_ports()
+        unit_db.set('running', True)
+        update_status()
+    else:
+        # Invalid maas_url so we are no longer running.
+        stop_rackd()
+
+
+@when_not('rpc.rpc.available')
+def stop_rackd():
+    hookenv.status_set('waiting', 'Waiting on relation to maas-region')
+    host.service_stop('maas-rackd')
+    close_ports()
+    unit_db.unset('running')
+
+
+@hook('update-status')
+def update_status():
+    """Called by Juju to update the status of the service."""
+    # Only update the status if running. The reset of the time the other hooks
+    # set the correct state.
+    running = unit_db.get('running', False)
+    if running:
+        # Keep rackd running.
+        if not host.service_running('maas-rackd'):
+            host.service_restart('maas-rackd')
+
+        # Update status using the dhcpd services.
+        dhcpd_running = host.service_running('maas-dhcpd')
+        dhcpd6_running = host.service_running('maas-dhcpd6')
+        if dhcpd_running and dhcpd6_running:
+            hookenv.status_set('active', 'Providing DHCPv4 and DHCPv6')
+        elif dhcpd_running:
+            hookenv.status_set('active', 'Providing DHCPv4')
+        elif dhcpd6_running:
+            hookenv.status_set('active', 'Providing DHCPv6')
+        else:
+            hookenv.status_set('active', 'Ready')

=== added directory 'layers/maas-region'
=== added file 'layers/maas-region/config.yaml'
--- layers/maas-region/config.yaml	1970-01-01 00:00:00 +0000
+++ layers/maas-region/config.yaml	2016-04-21 20:17:50 +0000
@@ -0,0 +1,150 @@
+options:
+  ppa:
+    type: string
+    default: ''
+    description: |
+      PPA to added before installing MAAS. This needs to be set before during
+      deployment. Changing after initial deployment has no affect.
+  dbname:
+    type: string
+    default: maas
+    description: Name of the database to use when related to PostgreSQL.
+  maas-url:
+    type: string
+    default: ''
+    description: |
+      URL that rack controllers connect get RPC information and deploying
+      machines use for metadata, APT proxy, and DNS.
+      .
+      It is recommended to leave this unset. In a multi unit deployment the
+      maas_url in the regiond.conf will be set to the leader unit for the
+      service unless this is set to override that value.
+  vip:
+    type: string
+    default: ''
+    description: |
+      IP address deploying machines will use to access their metadata,
+      proxy, and DNS. (Recommended in multi unit deployments; overrides the
+      maas-url config.)
+      .
+      The virtual IP address will be placed on the primary maas-region unit for
+      deploying machines to communicate to for metadata, APT proxy, and DNS.
+      .
+      For metadata and APT proxy this will be the load balancer on the
+      maas-region unit balancing the requests to all active maas-region units.
+      DNS will only be resolved the primary maas-region unit.
+      .
+      Keepalived is used to keep the virtual IP address on the primary unit.
+  admin-username:
+    type: string
+    default: admin
+    description: Username for the initial admin user.
+  admin-email:
+    type: string
+    default: noreply@maas
+    description: Email for the initial admin user.
+  admin-password:
+    type: string
+    default: ''
+    description: |
+      Password for the initial admin user. If not set admin user will not be
+      created.
+  maas-name:
+    type: string
+    default: juju-maas
+    description: Name to identify this MAAS deployment.
+  main-archive:
+    type: string
+    default: http://archive.ubuntu.com/ubuntu
+    description: |
+      Ubuntu archive used by machines to retrieve packages for Intel
+      architectures.
+  ports-archive:
+    type: string
+    default: http://ports.ubuntu.com/ubuntu-ports
+    description: |
+      Ubuntu archive used by machines to retrieve packages for non-Intel
+      architectures.
+  enable-http-proxy:
+    type: boolean
+    default: True
+    description: |
+      Enable the use of an APT and HTTP/HTTPS proxy.
+      .
+      Provision machines to use the built-in HTTP proxy (or user specified
+      proxy) for APT. MAAS also uses the proxy for downloading boot images.
+  http-proxy:
+    type: string
+    default: ''
+    description: |
+      Proxy for APT and HTTP/HTTPS.
+      .
+      This will be passed onto provisioned machines to use as a proxy for APT
+      traffic. MAAS also uses the proxy for downloading boot images. If no
+      URL is provided, the built-in MAAS proxy will be used.
+  upstream-dns:
+    type: string
+    default: ''
+    description: |
+      Upstream DNS used to resolve domains not managed by this MAAS
+      (space-separated IP addresses).
+  dnssec-validation:
+    type: string
+    default: auto
+    description: |
+      Enable DNSSEC validation of upstream zones.
+      .
+      Only used when MAAS is running its own DNS server. This value is used as
+      the value of 'dnssec_validation' in the DNS server config.
+  ntp-server:
+    type: string
+    default: ntp.ubuntu.com
+    description: |
+      Address of NTP server for machines.
+      .
+      NTP server address passed to machines via a DHCP response.
+  default-storage-layout:
+    type: string
+    default: flat
+    description: |
+      Storage layout that is applied to a machine when it is commissioned.
+      (Supports: flat, vlm, or bcache).
+  enable-disk-erasing-on-release:
+    type: boolean
+    default: False
+    description: |
+      Erase machines' disks prior to releasing.
+  curtin-verbose:
+    type: boolean
+    default: False
+    description: |
+      Turn on curtin verbose logging when a machine is being deployed.
+      Installation log for the deployed or failed deployed machine will contain
+      detailed log information to aid in bug reporting and development.
+  haproxy-stats-enabled:
+    type: boolean
+    default: False
+    description: Enable the stats endpoint on the haproxy.
+  haproxy-stats-uri:
+    type: string
+    default: '/haproxy?stats'
+    description: URI for the stats endpoint.
+  haproxy-stats-auth:
+    type: string
+    default: 'ubuntu:ubuntu'
+    description: |
+      HTTP authentication to access the stats endpoint.
+      .
+      Accepts a multiple user password combinations. Each user password
+      combination should be seperated by a ';'. Example:
+      .
+        ubuntu:ubuntu;ubuntu1:ubuntu1
+      .
+      Setting to an empty string will result in no authentication.
+  keepalived-router-id:
+    type: int
+    default: 50
+    description: |
+      Virtual router ID to use for the keepalived configuration. This needs
+      to be unique for the entire network where the deployment exists. (Only
+      used when a VIP is set.)

=== added file 'layers/maas-region/icon.svg'
--- layers/maas-region/icon.svg	1970-01-01 00:00:00 +0000
+++ layers/maas-region/icon.svg	2016-04-21 20:17:50 +0000
@@ -0,0 +1,1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="354.331" height="354.331"><g><path d="M326.627 176.777c0 82.76-67.09 149.85-149.85 149.85-82.76 0-149.85-67.09-149.85-149.85 0-82.76 67.09-149.85 149.85-149.85 82.76 0 149.85 67.09 149.85 149.85z" opacity=".597" fill="#333" fill-opacity="0"/><path d="M237.057 181.242c0 46.758-26.955 84.663-60.205 84.663S116.647 228 116.647 181.242c0-46.758 26.955-84.663 60.205-84.663s60.205 37.904 60.205 84.662z" opacity=".597" fill="#dd4814" fill-opacity="0"/><path d="M267.786 221.692c0 15.413-25.13 27.907-56.128 27.907-31 0-56.13-12.495-56.13-27.908 0-15.413 25.13-27.908 56.13-27.908 31 0 56.128 12.495 56.128 27.908z" opacity=".597" fill="#dd4814" fill-opacity="0"/><path d="M321.81 176.228c0 79.71-64.618 144.328-144.328 144.328-79.71 0-144.328-64.618-144.328-144.328 0-79.71 64.618-144.328 144.328-144.328 79.71 0 144.328 64.618 144.328 144.328z" fill="#dd4814"/><g fill="#fff" stroke="#fff" stroke-width=".798"><path d="M164.915 229.485c-18.342.033-50.34.346-63.057 2.305-6.876 1.09-6.34 5.642-6.54 9.397v.067c.2 3.756-.336 8.31 6.54 9.398 16.935 2.61 68.054 2.305 75.58 2.304h.055c7.525 0 58.644.305 75.58-2.304 6.875-1.09 6.368-5.642 6.567-9.398-.21-3.767.348-8.37-6.568-9.464-16.935-2.61-68.054-2.305-75.58-2.305-1.858 0-6.463-.01-12.577 0z"/><path d="M164.915 99.493c-18.342.033-50.34.346-63.057 2.305-6.876 1.09-6.34 5.642-6.54 9.397v.067c.2 3.755-.336 8.308 6.54 9.397 16.935 2.608 68.054 2.305 75.58 2.304h.055c7.525 0 58.644.304 75.58-2.305 6.875-1.09 6.368-5.643 6.567-9.398-.21-3.767.348-8.37-6.568-9.464-16.935-2.61-68.054-2.306-75.58-2.305-1.858 0-6.463-.01-12.577 0z"/><path d="M164.915 186.155c-18.342.032-50.34.345-63.057 2.304-6.876 1.088-6.34 5.64-6.54 9.396v.069c.2 3.755-.336 8.308 6.54 9.397 16.935 2.61 68.054 2.306 75.58 2.305h.055c7.525 0 58.644.305 75.58-2.304 6.875-1.088 6.368-5.64 6.567-9.396-.21-3.768.348-8.37-6.568-9.465-16.935-2.61-68.054-2.306-75.58-2.305-1.858 0-6.463-.01-12.577 0z"/><path d="M164.915 142.824c-18.342.032-50.34.346-63.057 2.304-6.876 1.09-6.34 5.642-6.54 9.398v.068c.2 3.755-.336 8.308 6.54 9.397 16.935 2.61 68.054 2.305 75.58 2.305h.055c7.525 0 58.644.304 75.58-2.305 6.875-1.09 6.368-5.642 6.567-9.397-.21-3.768.348-8.37-6.568-9.465-16.935-2.608-68.054-2.305-75.58-2.304-1.858 0-6.463-.01-12.577 0z"/></g></g></svg>
\ No newline at end of file

=== added file 'layers/maas-region/layer.yaml'
--- layers/maas-region/layer.yaml	1970-01-01 00:00:00 +0000
+++ layers/maas-region/layer.yaml	2016-04-21 20:17:50 +0000
@@ -0,0 +1,8 @@
+includes: [
+    'layer:basic',
+    'layer:leadership',
+    'interface:maas-region-ha',
+    'interface:maas-rpc',
+    'interface:pgsql',
+]
+repo: https://code.launchpad.net/~maas-committers/maas/maas-charms

=== added file 'layers/maas-region/metadata.yaml'
--- layers/maas-region/metadata.yaml	1970-01-01 00:00:00 +0000
+++ layers/maas-region/metadata.yaml	2016-04-21 20:17:50 +0000
@@ -0,0 +1,18 @@
+name: maas-region
+summary: Region controller for MAAS.
+maintainer: MAAS Maintainers <[e-mail]>
+description: |
+  MAAS runs a software-defined data centre - it turns a collection of physical
+  servers and switches into a bare metal cloud with full open source IP address
+  management (IPAM) and instant provisioning on demand.
+tags:
+  - network
+peers:
+  ha:
+    interface: maas-region-ha
+provides:
+  rpc:
+    interface: maas-rpc
+requires:
+  db:
+    interface: pgsql

=== added directory 'layers/maas-region/reactive'
=== added file 'layers/maas-region/reactive/region.py'
--- layers/maas-region/reactive/region.py	1970-01-01 00:00:00 +0000
+++ layers/maas-region/reactive/region.py	2016-04-21 20:17:50 +0000
@@ -0,0 +1,737 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+import ipaddress
+import json
+import os
+from functools import partial
+from subprocess import (
+    CalledProcessError,
+    check_call,
+    check_output,
+)
+import yaml
+
+from charmhelpers import fetch
+from charmhelpers.core import (
+    hookenv,
+    host,
+    sysctl,
+    templating,
+    unitdata,
+)
+from charms import leadership
+from charms.reactive import (
+    hook,
+    when,
+    when_any,
+    when_not,
+    when_file_changed,
+    set_state,
+    remove_state,
+)
+
+
+# Presistent unit data.
+unit_db = unitdata.kv()
+
+# Global config options
+global_configs = [
+    ('maas-name', 'maas_name', 'string'),
+    ('main-archive', 'main_archive', 'string'),
+    ('ports-archive', 'ports_archive', 'string'),
+    ('enable-http-proxy', 'enable_http_proxy', 'boolean'),
+    ('http-proxy', 'http_proxy', 'string'),
+    ('upstream-dns', 'upstream_dns', 'string'),
+    ('dnssec-validation', 'dnssec_validation', 'string'),
+    ('ntp-server', 'ntp_server', 'string'),
+    ('default-storage-layout', 'default_storage_layout', 'string'),
+    (
+     'enable-disk-erasing-on-release',
+     'enable_disk_erasing_on_release', 'boolean'),
+    ('curtin-verbose', 'curtin_verbose', 'boolean'),
+]
+
+# Ports to mark as open when in ready state.
+ports = [
+    # DNS
+    (53, 'TCP'),
+    (53, 'UDP'),
+    # API and WebUI
+    (80, 'TCP'),
+    # RPC
+    (5250, 'TCP'),
+    (5251, 'TCP'),
+    (5252, 'TCP'),
+    (5253, 'TCP'),
+    # Proxy
+    (8000, 'TCP'),
+]
+
+
+def is_valid_ip(ip):
+    """Return True if `ip` is valid."""
+    try:
+        ipaddress.ip_address(ip)
+    except ValueError:
+        return False
+    else:
+        return True
+
+
+def get_ip_version(ip):
+    """Return the IP version of the `ip`."""
+    return ipaddress.ip_address(ip).version
+
+
+def allows_ip_nonlocal_bind(ip_version):
+    """Return True if `ip_nonlocal_bind` for the IP version is allowed."""
+    with open('/proc/sys/net/ipv%d/ip_nonlocal_bind' % ip_version, 'r') as fp:
+        return int(fp.read().strip()) == 1
+
+
+def is_in_container():
+    """Return True if running in container."""
+    try:
+        check_call(['systemd-detect-virt', '-c', '-q'])
+    except CalledProcessError:
+        return False
+    else:
+        return True
+
+
+def get_filtered_ip_addr():
+    """Return filtered ip addr information."""
+    # python3-maas-provisioningserver will be installed before this function
+    # is called.
+    from provisioningserver.utils.ipaddr import get_ip_addr
+    return {
+        name: ipaddr
+        for name, ipaddr in get_ip_addr().items()
+        if (ipaddr['type'] not in ['loopback', 'ipip'] and
+            not ipaddr['type'].startswith('unknown-'))
+    }
+
+
+def get_interface_for_ip(ip_address):
+    """Return the name of the interface that has a subnet that `ip_address`
+    belongs."""
+    ip_version = get_ip_version(ip_address)
+    ip_address = ipaddress.ip_address(ip_address)
+    inet = "inet"
+    if ip_version == 6:
+        inet = "inet6"
+    ipaddr_info = get_filtered_ip_addr()
+    for name, ipaddr in ipaddr_info.items():
+        for address in ipaddr.get(inet, []):
+            if ip_address in ipaddress.ip_network(address, strict=False):
+                hookenv.log(
+                    "Found interface %s for VIP %s." % (name, ip_address))
+                return name
+    sorted_interfaces = sorted(ipaddr_info.keys())
+    if len(sorted_interfaces) > 0:
+        hookenv.log(
+            "Unable to find specific interface for VIP %s; "
+            "selected %s instead." % (ip_address, sorted_interfaces[0]))
+        return sorted_interfaces[0]
+    else:
+        raise ValueError(
+            "Unable to identify interface for VIP %s." % ip_address)
+
+
+def unit_has_ip(ip_address):
+    """Return True if the unit has the `ip_address` on any interface."""
+    ip_version = get_ip_version(ip_address)
+    ip_address = ipaddress.ip_address(ip_address)
+    inet = "inet"
+    if ip_version == 6:
+        inet = "inet6"
+    ipaddr_info = get_filtered_ip_addr()
+    for name, ipaddr in ipaddr_info.items():
+        for address in ipaddr.get(inet, []):
+            if '/' in address:
+                address = address.split('/')[0]
+            if ip_address == ipaddress.ip_address(address):
+                return True
+    return False
+
+
+def lsmod():
+    """Return a list of loaded kernel modules."""
+    output = check_output(['lsmod']).decode('utf-8')
+    return [
+        line.split()[0]
+        for line in output.splitlines()
+    ]
+
+
+def is_module_loaded(module):
+    """Return True if module is loaded."""
+    modules = lsmod()
+    return module in modules
+
+
+def is_blocked_by_missing_module(module):
+    """Check if blocked by the fact 'ip_vs' module is not loaded and also
+    running in a container."""
+    return not is_module_loaded(module) and is_in_container()
+
+
+def get_regiond_config_value(name):
+    """Return the configuration value for `name`."""
+    arg_name = name.replace('_', '-')
+    conf_settings = json.loads(
+        check_output([
+            'maas-region', 'local_config_get',
+            '--json', '--%s' % arg_name]).decode('ascii'))
+    return conf_settings.get(name)
+
+
+def regiond_ready_to_run():
+    """Return True if database_pass set in regiond.conf."""
+    dbpass = get_regiond_config_value('database_pass')
+    return (
+        dbpass is not None and
+        len(dbpass) > 0 and
+        not dbpass.isspace())
+
+
+def get_maas_secret():
+    """Return the MAAS secret value."""
+    with open('/var/lib/maas/secret', 'r') as fp:
+        return fp.read().strip()
+
+
+def get_apikey():
+    """Return the API key for the admin user."""
+    apikey = leadership.leader_get('apikey')
+    if not apikey:
+        apikey = check_output([
+            'maas-region', 'apikey',
+            '--username', leadership.leader_get('admin_username')])
+        apikey = apikey.decode('ascii').strip()
+        leadership.leader_set(apikey=apikey)
+    return apikey
+
+
+def update_config_value(charm_name, maas_name, value_type="string"):
+    """Update the global config values."""
+    if not hookenv.is_leader():
+        # Only the leader updates config values.
+        return
+    admin_username = leadership.leader_get('admin_username')
+    if not admin_username:
+        # Value can only be set once an administrator has been created.
+        return
+
+    # Ensure logged into API.
+    check_call([
+        'maas', 'login', 'juju-admin',
+        'http://localhost:5240/MAAS', get_apikey()])
+
+    # Get the current value.
+    result = check_output([
+        'maas', 'juju-admin', 'maas', 'get-config', 'name=%s' % maas_name])
+    result = result.decode("utf-8")
+    if value_type == "boolean":
+        if result == "true":
+            result = True
+        else:
+            result = False
+
+    # Update the value if its different.
+    new_value = hookenv.config(charm_name)
+    if result != new_value:
+        check_call([
+            'maas', 'juju-admin', 'maas',
+            'set-config', 'name=%s' % maas_name, 'value=%s' % new_value])
+
+
+def set_all_global_configs():
+    """Set all global configs.
+
+    Called after the administrator is first created.
+    """
+    hookenv.status_set('maintenance', 'Setting all global config options')
+    for charm_name, maas_name, value_type in global_configs:
+        update_config_value(charm_name, maas_name, value_type)
+
+
+def update_admin(old_username, username, email, password):
+    env = os.environ.copy()
+    env['DJANGO_SETTINGS_MODULE'] = 'maas.settings'
+    env['PYTHONPATH'] = '/usr/share/maas'
+    check_call([
+        'python3', 'scripts/update_user.py',
+        '--old-username', old_username,
+        '--username', username,
+        '--email', email,
+        '--password', password], env=env)
+
+
+def is_vip_valid():
+    vip = hookenv.config('vip')
+    if not vip:
+        return True
+    elif is_valid_ip(vip):
+        ip_version = get_ip_version(vip)
+        if is_blocked_by_missing_module('ip_vs'):
+            hookenv.status_set(
+                'blocked',
+                'Kernel module ip_vs is not loaded and cannot be loaded when '
+                'in a container')
+            return False
+        else:
+            return True
+    else:
+        hookenv.status_set(
+            'blocked', 'Config vip invalid; not valid IP address')
+        host.service_stop('maas-regiond')
+        close_ports()
+        return False
+
+
+def open_ports():
+    """Tells Juju about the open ports."""
+    ports_opened = unit_db.get('ports_opened', False)
+    if ports_opened:
+        return
+    for port, protocol in ports:
+        hookenv.open_port(port, protocol)
+    unit_db.set('ports_opened', True)
+
+
+def close_ports():
+    """Removes opened ports from Juju."""
+    ports_opened = unit_db.get('ports_opened', False)
+    if not ports_opened:
+        return
+    for port, protocol in ports:
+        hookenv.close_port(port, protocol)
+    unit_db.unset('ports_opened')
+
+
+@hook('install')
+def install_region():
+    # Place in maintenance.
+    hookenv.status_set('maintenance', '')
+
+    # Add the ppa source if provided in config.
+    ppa_source = hookenv.config('ppa')
+    if ppa_source:
+        hookenv.status_set('maintenance', 'Enabling PPA')
+        fetch.add_source(ppa_source)
+
+    # Update the sources and install the required packages.
+    hookenv.status_set('maintenance', 'Installing packages')
+    fetch.apt_update()
+    fetch.apt_install([
+        'haproxy',
+        'maas-cli',
+        'maas-dns',
+        'maas-region-api'])
+
+    # Stop and disable apache2. Charm uses haproxy.
+    # maas-region-api should not depend on apache2.
+    host.service_stop('apache2')
+    host.service('disable', 'apache2')
+
+    # Possible re-install remove regiond.conf.
+    if os.path.exists('/etc/maas/regiond.conf'):
+        os.remove('/etc/maas/regiond.conf')
+
+    # Install should have regiond off.
+    host.service_stop('maas-regiond')
+
+    # Configure haproxy.
+    configure_haproxy()
+
+
+@hook('config-changed')
+def update_global_configs():
+    config = hookenv.config()
+    for charm_name, maas_name, value_type in global_configs:
+        if config.changed(charm_name):
+            update_config_value(charm_name, maas_name, value_type)
+
+
+@hook('db-relation-joined')
+def db_joined(pgsql):
+    # psql layer does not handle departing correctly. We set
+    # db_joined so the write_db_config is not skipped.
+    unit_db.set('db_joined', True)
+    hookenv.status_set('waiting', 'Requesting database from PostgreSQL')
+    pgsql.change_database_name(hookenv.config('dbname'))
+
+
+@hook('db-relation-departed')
+def db_departed(pgsql):
+    # psql layer does not handle departing correctly. We clear
+    # db_joined so the write_db_config is skipped.
+    unit_db.unset('db_joined')
+    unit_db.unset('dbhost')
+    unit_db.unset('dbdb')
+    unit_db.unset('dbuser')
+    unit_db.unset('dbpass')
+    check_call([
+        'maas-region', 'local_config_set',
+        '--database-host', '',
+        '--database-name', '',
+        '--database-user', '',
+        '--database-pass', '',
+        ])
+    close_ports()
+    host.service_stop('maas-regiond')
+    hookenv.status_set('waiting', 'Waiting on relation to PostgreSQL')
+
+
+@when_any('config.changed.maas-url', 'config.changed.vip')
+def write_maas_url():
+    hookenv.status_set('maintenance', 'Writing maas_url into regiond.conf')
+    vip = hookenv.config('vip')
+    maas_url = hookenv.config('maas-url')
+    if vip:
+        if not is_valid_ip(vip):
+            url = ''
+        else:
+            url = 'http://%s/MAAS' % vip
+    elif maas_url:
+        url = maas_url
+    else:
+        url = 'http://localhost/MAAS'
+    check_call([
+        'maas-region', 'local_config_set',
+        '--maas-url', url,
+        ])
+    start_regiond_when_ready()
+
+
+@when_not('db.database.available')
+def missing_postgresql():
+    close_ports()
+    host.service_stop('maas-regiond')
+    hookenv.status_set('waiting', 'Waiting on relation to PostgreSQL')
+
+
+@when('db.database.available')
+def write_db_config(pgsql):
+    # Do nothing if not db joined.
+    if not unit_db.get('db_joined', False):
+        return
+
+    # Update the database configuration only if any of the configuration
+    # values have changed. Nothing needs to be done if nothing has changed.
+    dbhost = pgsql.host()
+    dbdb = pgsql.database()
+    dbuser = pgsql.user()
+    dbpass = pgsql.password()
+    has_changed = (
+        unit_db.get('dbhost') != dbhost or
+        unit_db.get('dbdb') != dbdb or
+        unit_db.get('dbuser') != dbuser or
+        unit_db.get('dbpass') != dbpass)
+    if has_changed:
+        unit_db.set('dbhost', dbhost)
+        unit_db.set('dbdb', dbdb)
+        unit_db.set('dbuser', dbuser)
+        unit_db.set('dbpass', dbpass)
+        hookenv.status_set(
+            'maintenance', 'Writing db configuration into regiond.conf')
+
+        check_call([
+            'maas-region', 'local_config_set',
+            '--database-host', dbhost if dbhost else '',
+            '--database-name', dbdb if dbdb else '',
+            '--database-user', dbuser if dbuser else '',
+            '--database-pass', dbpass if dbpass else '',
+            ])
+        if all([dbhost, dbdb, dbuser, dbpass]):
+            start_regiond_when_ready()
+        else:
+            host.service_stop('maas-regiond')
+            hookenv.status_set('waiting', 'Waiting on relation to PostgreSQL')
+
+
+@when_any(
+    'config.changed.haproxy-stats-enabled',
+    'config.changed.haproxy-stats-uri',
+    'config.changed.haproxy-stats-auth')
+def configure_haproxy():
+    """Write /etc/haproxy/haproxy.conf and reload haproxy."""
+    ha_units = unit_db.get('ha_units')
+    if ha_units is None:
+        ha_units = {}
+    templating.render('haproxy.cfg', '/etc/haproxy/haproxy.cfg', {
+        'stats_enabled': hookenv.config('haproxy-stats-enabled'),
+        'stats_uri': hookenv.config('haproxy-stats-uri'),
+        'stats_auth': hookenv.config('haproxy-stats-auth'),
+        'unit_name': hookenv.local_unit(),
+        'unit_address': hookenv.unit_private_ip(),
+        'ha_units': ha_units,
+    })
+
+
+@when_any(
+    'config.changed.admin-username',
+    'config.changed.admin-email',
+    'config.changed.admin-password')
+def configure_admin_user():
+    """Configure administrator user."""
+    if hookenv.is_leader():
+        username = hookenv.config('admin-username')
+        email = hookenv.config('admin-email')
+        password = hookenv.config('admin-password')
+        if username and email and password:
+            admin_username = leadership.leader_get('admin_username')
+            if admin_username:
+                # Change the admin username, email, and password.
+                hookenv.status_set('maintenance', 'Leader: updating admin')
+                update_admin(admin_username, username, email, password)
+                leadership.leader_set(admin_username=username)
+            else:
+                # Create the admin user.
+                hookenv.status_set('maintenance', 'Leader: creating admin')
+                check_call([
+                    'maas-region', 'createadmin',
+                    '--username', username,
+                    '--email', email,
+                    '--password', password,
+                ])
+                leadership.leader_set(admin_username=username)
+
+            # Update the state.
+            update_state()
+
+
+@when('ha.joined')
+def ha_unit_joined(ha):
+    unit_db.set('ha_units', ha.get_units())
+    configure_haproxy()
+
+
+@when('ha.departed')
+def ha_unit_departed(ha):
+    unit_db.set('ha_units', ha.get_units())
+    configure_haproxy()
+
+
+@when('leadership.changed.running_migrations')
+@when_file_changed('/etc/maas/regiond.conf')
+def start_regiond_when_ready():
+    # Prevent regiond from running if vip is invalid.
+    if not is_vip_valid():
+        return
+
+    # Only start regiond if migrations are not running and regiond
+    # is ready to run.
+    running_migrations = leadership.leader_get('running_migrations')
+    running_migrations = running_migrations == 'True'
+    if running_migrations:
+        if not hookenv.is_leader():
+            hookenv.status_set(
+                'waiting', 'Waiting for leader to finish migrations')
+            host.service_stop('maas-regiond')
+    elif regiond_ready_to_run():
+        if hookenv.is_leader():
+            # Leader of the service and run migrations if needed.
+            migrations_ran = leadership.leader_get('migrations_ran')
+            migrations_ran = migrations_ran == 'True'
+            if not migrations_ran:
+                # XXX 2016-04-18 blake_r: Should detect if a new version of
+                # MAAS requires migrations to be ran again.
+                hookenv.status_set('maintenance', 'Leader: running migrations')
+                host.service_stop('maas-regiond')
+                leadership.leader_set(running_migrations='True')
+                check_call(['maas-region', 'dbupgrade'])
+                leadership.leader_set(
+                    running_migrations='', migrations_ran='True')
+        else:
+            # Not the leader and migrations aren't being run, regiond
+            # can start.
+            hookenv.status_set('maintenance', 'Restarting regiond')
+
+        # Update any RPC relations with the new maas_url.
+        maas_url = get_regiond_config_value('maas_url')
+        if maas_url and maas_url != unit_db.get('rpc_maas_url', None):
+            send_maas_url = maas_url
+            if maas_url == "http://localhost/MAAS" and hookenv.is_leader():
+                # MAAS url on the region is set to localhost so we tell the
+                # rack to connect over the private address.
+                send_maas_url = "http://%s/MAAS" % hookenv.unit_private_ip()
+            for relation_id in hookenv.relation_ids('rpc'):
+                hookenv.relation_set(relation_id, {'maas_url': send_maas_url})
+            unit_db.set('rpc_maas_url', maas_url)
+
+        # Restart regiond so its has the latest configuration.
+        host.service_restart('maas-regiond')
+        update_state()
+
+
+@when_file_changed('/etc/haproxy/haproxy.conf')
+def reload_haproxy():
+    if host.service_running('haproxy'):
+        hookenv.status_set(
+            'maintenance', 'Reloading haproxy')
+        host.service_reload('haproxy')
+    else:
+        hookenv.status_set(
+            'maintenance', 'Starting haproxy')
+        host.service_restart('haproxy')
+    update_state()
+
+
+@when_any(
+    'config.changed.vip',
+    'leadership.changed.admin_username')
+def update_state():
+    # If VIP is set it needs to be correct before doing anything else.
+    if not is_vip_valid():
+        close_ports()
+        return
+
+    # We need to have a working haproxy and regiond before going forward.
+    running_migrations = leadership.leader_get('running_migrations')
+    running_migrations = running_migrations == 'True'
+    if (running_migrations or
+            not regiond_ready_to_run() or
+            not host.service_running('maas-regiond') or
+            not host.service_running('haproxy')):
+        close_ports()
+        return
+
+    # The DNS options need to be migrated before continuing.
+    dns_migrated = unit_db.get('dns_migrated', False)
+    if not dns_migrated:
+        hookenv.status_set('maintenance', 'Migrating DNS options')
+        check_call([
+            'maas-region', 'edit_named_options',
+            '--migrate-conflicting-options'])
+        host.service_restart('bind9')
+        unit_db.set('dns_migrated', True)
+
+    # Make sure that administrator user has been created.
+    admin_username = leadership.leader_get('admin_username')
+    if not admin_username:
+        if hookenv.is_leader():
+            hookenv.status_set(
+                'blocked', 'Missing admin config')
+        else:
+            hookenv.status_set(
+                'waiting', 'Waiting for leader to configure admin account')
+        return
+
+    # Set all global configs if never done.
+    if hookenv.is_leader():
+        set_global_configs = leadership.leader_get('set_global_configs')
+        set_global_configs = set_global_configs == 'True'
+        if not set_global_configs:
+            set_all_global_configs()
+            leadership.leader_set(set_global_configs='True')
+
+    # Mark that the ports are open.
+    open_ports()
+
+    # If not VIP is set then the leader unit is the primary.
+    vip = hookenv.config('vip')
+    if vip:
+        # Determine leader by looking for VIP.
+        if unit_has_ip(vip):
+            hookenv.status_set(
+                'active', 'Primary DNS and balancing HTTP (VIP: %s)' % vip)
+        else:
+            hookenv.status_set('active', 'Secondary DNS and balancing HTTP')
+    else:
+        # Leader is determined by Juju.
+        if hookenv.is_leader():
+            hookenv.status_set('active', 'Primary DNS and balancing HTTP')
+        else:
+            hookenv.status_set('active', 'Secondary DNS and balancing HTTP')
+
+
+@when_any(
+    'config.changed.vip',
+    'config.changed.keepalived-router-id',
+    'leadership.changed.keepalived_pass')
+def update_vip_config():
+    vip = hookenv.config('vip')
+    if vip:
+        # If VIP is invalid and keepalived was running stop it and remove
+        # the configuration.
+        if not is_vip_valid() and unit_db.get('keepalived_running', False):
+            host.service_stop('keepalived')
+            if os.path.exists('/etc/keepalived/keepalived.conf'):
+                os.remove('/etc/keepalived/keepalived.conf')
+            return
+
+        # Using VIP configuration; setup keepalived.
+        keepalived_installed = unit_db.get('keepalived_installed', False)
+        if not keepalived_installed:
+            # Check to see if keepalived needs to be installed.
+            packages = fetch.filter_installed_packages(['keepalived'])
+            if len(packages) > 0:
+                fetch.apt_update()
+                fetch.apt_install(packages)
+            unit_db.set('keepalived_installed', True)
+
+        # Load the ip_vs module if needed.
+        module_loaded = False
+        if not is_module_loaded('ip_vs') and not is_in_container():
+            check_call(['modprobe', 'ip_vs'])
+            module_loaded = True
+
+        # Enable ip_nonlocal_bind if needed.
+        ip_version = get_ip_version(vip)
+        if not allows_ip_nonlocal_bind(ip_version):
+            sysctl.create(yaml.dump({
+                "net.ipv%s.ip_nonlocal_bind" % ip_version: 1
+            }), "/etc/sysctl.d/50-maas-region-nonlocal.conf")
+            host.service_start("procps")
+
+        # Get the keepalived password.
+        keepalived_pass = leadership.leader_get('keepalived_pass')
+        if not keepalived_pass:
+            if hookenv.is_leader():
+                keepalived_pass = host.pwgen()
+                leadership.leader_set(keepalived_pass=keepalived_pass)
+            else:
+                hookenv.status_set(
+                    'waiting',
+                    'Waiting on leader for keepalived authentication password')
+                return
+
+        # Get the interface that should be used for the VIP.
+        interface = get_interface_for_ip(vip)
+
+        # Write the keepalived.conf.
+        templating.render(
+            'keepalived.conf', '/etc/keepalived/keepalived.conf', {
+                'interface': interface,
+                'priority': hookenv.local_unit().split('/')[1],
+                'virtual_router_id': hookenv.config('keepalived-router-id'),
+                'auth_pass': keepalived_pass,
+                'vip': vip,
+            })
+
+        # Restart keepalived if stopped or the kernel module was loaded,
+        # otherwise just reload the config.
+        if host.service_running('keepalived') and not module_loaded:
+            host.service_reload('keepalived')
+        else:
+            host.service_restart('keepalived')
+        unit_db.set('keepalived_running', True)
+
+    elif unit_db.get('keepalived_running', False):
+        # Keepalived is running stop it and remove the config.
+        host.service_stop('keepalived')
+        os.remove('/etc/keepalived/keepalived.conf')
+
+    update_state()
+
+
+@when('rpc.rpc.requested')
+def rpc_requested(rpc):
+    if regiond_ready_to_run():
+        maas_url = get_regiond_config_value('maas_url')
+        unit_db.set('rpc_maas_url', maas_url)
+        rpc.set_connection_info(
+            maas_url, get_maas_secret())

=== added directory 'layers/maas-region/scripts'
=== added file 'layers/maas-region/scripts/update_user.py'
--- layers/maas-region/scripts/update_user.py	1970-01-01 00:00:00 +0000
+++ layers/maas-region/scripts/update_user.py	2016-04-21 20:17:50 +0000
@@ -0,0 +1,26 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+import argparse
+import os
+
+from django.contrib.auth.models import User
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--old-username', required=True)
+    parser.add_argument('--username', required=True)
+    parser.add_argument('--password', required=True)
+    parser.add_argument('--email', required=True)
+
+    args = parser.parse_args()
+    user = User.objects.get(username=args.old_username)
+    user.username = args.username
+    user.email = args.email
+    user.set_password(args.password)
+    user.save()
+
+
+if __name__ == "__main__":
+    main()

=== added directory 'layers/maas-region/templates'
=== added file 'layers/maas-region/templates/haproxy.cfg'
--- layers/maas-region/templates/haproxy.cfg	1970-01-01 00:00:00 +0000
+++ layers/maas-region/templates/haproxy.cfg	2016-04-21 20:17:50 +0000
@@ -0,0 +1,70 @@
+global
+	log /dev/log	local0
+	log /dev/log	local1 notice
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin
+	stats timeout 30s
+	user haproxy
+	group haproxy
+	daemon
+
+	# Default SSL material locations
+	ca-base /etc/ssl/certs
+	crt-base /etc/ssl/private
+
+	# Default ciphers to use on SSL-enabled listening sockets.
+	# For more information, see ciphers(1SSL). This list is from:
+	#  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
+	ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
+	ssl-default-bind-options no-sslv3
+
+defaults
+	log	global
+	mode	http
+	option	httplog
+	option	dontlognull
+	retries 3
+	option  redispatch
+	option  http-server-close
+	timeout connect 5000
+	timeout client  50000
+	timeout server  50000
+	errorfile 400 /etc/haproxy/errors/400.http
+	errorfile 403 /etc/haproxy/errors/403.http
+	errorfile 408 /etc/haproxy/errors/408.http
+	errorfile 500 /etc/haproxy/errors/500.http
+	errorfile 502 /etc/haproxy/errors/502.http
+	errorfile 503 /etc/haproxy/errors/503.http
+	errorfile 504 /etc/haproxy/errors/504.http
+
+frontend maas
+    bind *:80
+    default_backend maas
+    {% if stats_enabled -%}
+    stats enable
+    stats uri {{ stats_uri }}
+    stats realm Haproxy\ Statistics
+    {% for auth in stats_auth.split(';') -%}
+    stats auth {{ auth }}
+    {%- endfor %}
+    {%- endif %}
+
+backend maas
+    timeout server 30s
+    balance roundrobin
+    server {{unit_name.replace('/', '-')}} {{unit_address}}:5240 check
+    {% for ha_name, ha_address in ha_units.items() -%}
+    server {{ha_name.replace('/', '-')}} {{ha_address}}:5240 check
+    {%- endfor %}
+
+frontend maas-proxy
+    bind *:8000
+    default_backend maas-proxy
+
+backend maas-proxy
+    timeout server 30s
+    balance roundrobin
+    server {{unit_name.replace('/', '-')}} {{unit_address}}:5240 check
+    {% for ha_name, ha_address in ha_units.items() -%}
+    server {{ha_name.replace('/', '-')}} {{ha_address}}:5240 check
+    {% endfor %}

=== added file 'layers/maas-region/templates/keepalived.conf'
--- layers/maas-region/templates/keepalived.conf	1970-01-01 00:00:00 +0000
+++ layers/maas-region/templates/keepalived.conf	2016-04-21 20:17:50 +0000
@@ -0,0 +1,30 @@
+vrrp_script chk_haproxy {
+    script "killall -0 haproxy"
+    interval 2
+}
+
+vrrp_script chk_named {
+    script "killall -0 named"
+    interval 2
+}
+
+vrrp_instance maas_region {
+    state MASTER
+    interface {{ interface }}
+    priority {{ priority }}
+    virtual_router_id {{ virtual_router_id }}
+
+    authentication {
+        auth_type PASS
+        auth_pass {{ auth_pass }}
+    }
+
+    track_script {
+        chk_haproxy
+        chk_named
+    }
+
+    virtual_ipaddress {
+        {{ vip }}
+    }
+}