Merge lp:~ce-infrastructure/capomastro/capomastro-apache-1385220 into lp:~ubuntuone-hackers/capomastro/charm

[Caio Begotti]

This change makes it possible to have Capomastro sitting behind another Apache server, from the charms store, acting like an exposed proxy. This is the first step to get SSO in Capomastro without needing to change its authentication codo right now.

Also, this is another requirement for production by IS: not to expose your own web server, and use a supported one via charming.

SSL support is still pending because we need a review of it all by IS and their advices on that.

[lp:~ce-infrastructure/capomastro/capomastro-apache-1385220]

55. By Caio Begotti on 2014-11-07

this does not belong here, forgotten leftover, even in the wrong place as openid_provider is a setting from config.yaml

[Caio Begotti (caio1982)]

I couldn't get SSO support on time for this merge request but since it's not a requirement for #1385220 I'll keep investigating how SSO could be attached to this in parallel, this merge request stands on its own anyway.

[Daniel Manrique (roadmr)]

Looks OK, can't think of anything wrong with it... actually I can't really think much right now, but this is very close to what I got working, so I agree with these changes.

Main point is the all-services thingy, which is good in this MR.

review: Approve

=== modified file 'README'
--- README	2014-11-05 11:27:44 +0000
+++ README	2014-11-07 10:33:56 +0000
@@ -72,13 +72,19 @@
 operational. This will affect Django's default security of the app because of a
 more (securely) flexible ALLOWED_HOSTS being used instead.
 
-Setup and deploy:
+Initial setup:
 
 $ export JUJU_REPOSITORY=${PWD}/charms
 $ juju bootstrap
 
+Deploy the infrastructure charms:
+
+$ juju deploy cs:apache2
 $ juju deploy cs:postgresql
 $ juju deploy cs:rabbitmq-server
+
+Now you can deploy charms used by Capomastro:
+
 $ juju deploy local:trusty/jenkins --constraints="mem=10G cpu-cores=10 root-disk=100G"
 $ juju deploy local:trusty/capomastro
 
@@ -94,21 +100,30 @@
 
 Stop and start again this Jenkins unit to get the changes active.
 
-Expose and connect the services:
-
-$ juju expose postgresql
-$ juju expose rabbitmq-server
-$ juju expose jenkins
-$ juju expose capomastro
+Now connect the service charms:
 
 $ juju add-relation postgresql:db capomastro
 $ juju add-relation rabbitmq-server capomastro
 $ juju add-relation jenkins capomastro
 
+Finally connect Capomastro to its Apache proxy:
+
+$ juju set apache2 enable_modules="proxy proxy_http proxy_connect rewrite headers ssl"
+$ juju set apache2 vhost_http_template="$(base64 < templates/http_virtualhost.tmpl)"
+$ juju add-relation apache2:reverseproxy capomastro:website
+
 If monitoring charms were deployed before:
 
 $ juju add-relation nrpe-external-master capomastro
 
+Expose the Apache proxy with OpenID, then open its IP/hostname in your browser:
+
+$ juju expose apache2
+
+If you need to make the Jenkins artifacts available (most probably), also run:
+
+$ juju expose jenkins
+
 Post-deployment configuration
 -----------------------------
 

=== added file 'hooks/website-relation-changed'
--- hooks/website-relation-changed	1970-01-01 00:00:00 +0000
+++ hooks/website-relation-changed	2014-11-07 10:33:56 +0000
@@ -0,0 +1,6 @@
+#!/bin/sh -xev
+
+. inc/common
+
+relation-set port=${port} hostname=${private_address}
+relation-set all_services="  - {service_name: capomastro, service_port: ${port}}"

=== modified file 'hooks/website-relation-joined'
--- hooks/website-relation-joined	2014-09-30 20:03:23 +0000
+++ hooks/website-relation-joined	1970-01-01 00:00:00 +0000
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-relation-set port=$(config-get port) hostname=$(unit-get private-address)

=== target is u'website-relation-changed'
=== added file 'templates/http_virtualhost.tmpl'
--- templates/http_virtualhost.tmpl	1970-01-01 00:00:00 +0000
+++ templates/http_virtualhost.tmpl	2014-11-07 10:33:56 +0000
@@ -0,0 +1,39 @@
+# This file is Juju managed
+# 
+# Some bits taken from https://github.com/battlemidget/juju-apache-gunicorn-django
+# 
+# {{ servername }} comes from the apache charm config.yaml
+# {{ capomastro }} from the all_services variable set
+
+# <VirtualHost *:80>
+#     ServerName  {{ servername }}
+#     Redirect permanent / https://{{ servername }}/
+# </VirtualHost>
+
+<VirtualHost *:80>
+    ServerName {{ servername }}
+
+    CustomLog /var/log/apache2/capomastro.access-log combined
+    ErrorLog /var/log/apache2/capomastro.error-log
+
+    # SSLEngine on
+    # SSLCertificateFile /etc/ssl/certs/ssl-cert-cts.pem
+    # SSLCertificateKeyFile /etc/ssl/private/ssl-cert-cts.key
+    # 
+    # This ensures Django is seeing the HTTPS protocol
+    # and prefixing all URLs with HTTPS
+    # 
+    # RequestHeader set X-FORWARDED-SSL "on"
+    # RequestHeader set X-FORWARDED_PROTO "https"
+    
+    ProxyRequests off
+    ProxyPreserveHost on
+
+    <Proxy *>
+        Order Allow,Deny
+        Allow from All
+    </Proxy>
+
+    ProxyPass / http://{{ capomastro }}/
+    ProxyPassReverse / http://{{ capomastro }}/
+</VirtualHost>