Merge lp:~dpb/landscape-charm/vhost-config-relation into lp:~landscape/landscape-charm/trunk

[David Britton]

We can now link apache2 and landscape in a relation. This will allow the rather awkward step of "specify this random vhost base64 blob in a juju set command" to be removed from our instructions and bundle.yaml. It also gets us one step closer to a real bundle that can go into the charm store.

Also:
* ssl cert stored from apache
* get apache2 servername and use it to set the root_url of landscape
* some deve cleanups

In this exciting change, we can now link apache2 and landscape in a relation. This will allow the rather awkward step of "specify this random vhost base64 blob in a juju set command" to be removed from our instructions and bundle.yaml.

It also gets us one step closer to a real bundle that can go into the charm store.

Instead, landsacpe will specify it over a relation to apache2 directly. The admin is still in control of this behavior with add-relation/remove-relation, but the defaults should serve most all users well.

Major Features:

- vhost-config relation added (need latest apache2 charm to test)
- base64 blobs removed from deployer yaml.
- self-signed-SSL cert and apache "servername" auto-discovered on the same relation, cert stored in the usual place, root_url updated automatically with servername
- unit test cases
- I'm going to add an integration test case to check that the ssl cert and root url are set correctly, but maybe in a follow-on branch, I'll see.

To test:

- make lint test integration-test
- deploy and of the landscape-bundles and see if the ssl cert is passed correctly and stored on the server in the right place (landscape/0).

[Adam Collard (adam-collard)]

SQL injection vulnerabilities, see inline comments.

review: Needs Fixing

[David Britton (dpb)]

Thanks Adam, please look again, I fixed all those.

[David Britton (dpb)]

BTW, I committed r184 and tested it, and it hit a very weird error in the locking code. Not only did it hit an error, but the error was swallowed and the charm just got stuck by exiting 0 and blocking other relations.

I need to investigate not only why the change was bad, but also why it didn't get an error back to juju (exit 1)

[David Britton (dpb)]

> BTW, I committed r184 and tested it, and it hit a very weird error in the
> locking code. Not only did it hit an error, but the error was swallowed and
> the charm just got stuck by exiting 0 and blocking other relations.
>
> I need to investigate not only why the change was bad, but also why it didn't
> get an error back to juju (exit 1)

So... I've reverted that for now.

[David Britton (dpb)]

OK, remerged, and ready for a second review. Sorry, got distracted with the documentation earlier today and when I pushed it was not ready/tested.

During testing, I addressed a couple things that I noticed:

1) I added a make target to deploy from the current branch. Simplifies testing a bit.

2) I removed a couple of try/except blocks that were trapping errors in the lock_exclusive code path. That code shouldn't fail unless it legitimately *should* fail the hook. It blocks getting the lock by design, that try/execpt block was inserted chasing another bug and was never removed. It finally bit me during testing, and I figured it was time to remove it. Also added a test to check this case.

[Adam Collard (adam-collard)]

Looks good! A couple of possible cleanups inline below. Successfully deployed dense MAAS target (after fighting AMT for a bit).

review: Approve

[Andreas Hasenack (ahasenack)]

I deployed max, and all is good. I then destroyed the single apache2 unit (juju destroy-unit apache2/0), and added a new one, and as a new machine (not lxc). It got the host bohr.beretstack. I logged in, saw LDS as normal, but in the settings page, root-url was still set to the IP of the unit I destroyed.

Is this scenario something this branch should handle?

The certificate was regenerated, as expected, since it's a whole new unit, and landscape/0's /etc/ssl/certs/landscape_server_ca.crt has the updated one, which is excellent:

root@juju-machine-0-lxc-14:/etc/ssl/certs# openssl x509 -in landscape_server_ca.crt -noout -subject
subject= /CN=bohr.beretstack

AFAICT, the only thing that didn't get updated was the root-url in the landscape DB.

review: Needs Information

[Andreas Hasenack (ahasenack)]

Hmm, wait a second. The DB has the right root-url:

landscape-standalone-main=# select encode(key, 'escape') as key, encode(value, 'escape') as value from system_configuration ;
              key | value
-------------------------------+------------------------------
 landscape.system_email_sender | u17:noreply@10.1.4.61
 landscape.root_url | u24:https://bohr.beretstack/
(2 rows)

system_email_sender is still wrong, btw.

What is odd is that the landscape UI is showing the wrong root_url in the standalone-settings page. There it is https://10.1.4.61/, and I'm accessing the UI via https://bohr.beretstack/account/standalone/standalone-settings

review: Needs Information

[Andreas Hasenack (ahasenack)]

The root url in the settings page was the correct one only after I restarted the app services. This looks to be a bug in landscape code.

[David Britton (dpb)]

Finalized feedback. Also added a relation between landscape-app and apache2 (vhost-config). There may yet be more bugs with the max deployment, but will fix those in follow-ups if need be.

[Andreas Hasenack (ahasenack)]

+1

review: Approve

[🤖 Landscape Builder (landscape-builder)]

The attempt to merge lp:~davidpbritton/landscape-charm/vhost-config-relation into lp:landscape-charm/trunk failed. Below is the output from the failed tests.

trial hooks
hooks.test_hooks
  TestHooksService
    test__download_file_failure ... [OK]
    test__download_file_success ... [OK]
    test__enable_service ... [OK]
    test__enable_wrong_service ... [OK]
    test__install_license_text ... [OK]
    test__install_license_url ... [OK]
    test__replace_in_file ... [OK]
    test_amqp_relation_changed_no_hostname_password ... [OK]
    test_amqp_relation_joined ... [OK]
    test_calc_daemon_count ... [OK]
    test_config_changed ... [OK]
    test_config_changed_service_count_bare ... [OK]
    test_config_changed_service_count_labeled ... [OK]
    test_config_changed_service_count_update_haproxy ... [OK]
    test_config_changed_starts_landscape ... [OK]
    test_config_changed_without_amqp_skips_start ... [OK]
    test_config_changed_without_db_skips_start ... [OK]
    test_config_changed_zero ... [OK]
    test_data_relation_changed_creates_new_log_and_repository_paths ... [OK]
    test_data_relation_changed_error_on_mountpoint_from_subordinate ... [OK]
    test_data_relation_changed_sets_mountpoint_awaits_init ... [OK]
    test_data_relation_changed_success_no_repository_data ... [OK]
    test_data_relation_changed_success_no_repository_path ... [OK]
    test_data_relation_changed_success_with_repository_data ... [OK]
    test_db_admin_relation_changed ... [ERROR]
    test_db_admin_relation_changed_failover_state_ignore ... [OK]
    test_db_admin_relation_changed_hot_standby_state_ignore ... [OK]
    test_db_admin_relation_changed_no_config_if_db_down ... [OK]
    test_db_admin_relation_changed_no_user ... [OK]
    test_db_admin_relation_changed_not_in_allowed_units ... [OK]
    test_db_admin_relation_changed_standalone_state_ignore ... [OK]
    test_get_requested_service_count ... [OK]
    test_get_requested_services ... [OK]
    test_get_services_dict ... [OK]
    test_get_services_non_proxied ... [OK]
    test_handle_empty_license ... [OK]
    test_handle_no_license ... [OK]
    test_is_db_up_db_not_configur...

[lp:~dpb/landscape-charm/vhost-config-relation]

198. By David Britton on 2014-06-14

remove lint, fix broken test, add JUJU_ENV to -p in make integration-test

=== modified file 'Makefile'
--- Makefile	2014-06-06 19:57:27 +0000
+++ Makefile	2014-06-14 03:50:22 +0000
@@ -16,8 +16,16 @@
 		$(EXTRA_UPDATE_ARGUMENTS) \
 		apache2 postgresql juju-gui haproxy rabbitmq-server nfs
 
-integration-test: verify-juju-test config/repo-file config/license-file config/vhostssl.tmpl config/vhost.tmpl
-	juju test --set-e -p SKIP_SLOW_TESTS,DEPLOYER_TARGET,JUJU_HOME -v --timeout 3000s
+test-depends: verify-juju-test config/repo-file config/license-file config/vhostssl.tmpl config/vhost.tmpl
+
+integration-test: test-depends
+	juju test --set-e -p SKIP_SLOW_TESTS,DEPLOYER_TARGET,JUJU_HOME,JUJU_ENV -v --timeout 3000s
+
+deploy-dense-maas: test-depends
+	SKIP_TESTS=1 DEPLOYER_TARGET=landscape-dense-maas tests/01-begin
+
+deploy-max-dense-maas: test-depends
+	SKIP_TESTS=1 DEPLOYER_TARGET=landscape-max-dense-maas tests/01-begin
 
 lint:
 	flake8 --exclude=charmhelpers hooks
@@ -28,9 +36,13 @@
 clean: clean-integration-test
 
 .PHONY: lint \
+	test-depends \
+	deploy-dense-maas \
+	deploy-max-dense-maas \
 	integration-test \
 	verify-juju-test \
 	test \
 	clean \
 	clean-integration-test \
 	update-charm-revision-numbers
+	
 
=== modified file 'config/landscape-deployments.yaml'
--- config/landscape-deployments.yaml	2014-06-12 10:38:38 +0000
+++ config/landscape-deployments.yaml	2014-06-14 03:50:22 +0000
@@ -25,8 +25,6 @@
                 ssl_cert: SELFSIGNED
                 ssl_certlocation: apache2.cert
                 ssl_keylocation: apache2.key
-                vhost_https_template: include-base64://vhostssl.tmpl
-                vhost_http_template: include-base64://vhost.tmpl
 
 landscape:
     inherits: _common
@@ -53,6 +51,7 @@
     relations:
         - [landscape, rabbitmq-server]
         - [landscape, haproxy]
+        - ["landscape:vhost-config", "apache2:vhost-config"]
         - ["landscape:db-admin", "postgresql:db-admin"]
         - ["haproxy:website", "apache2:reverseproxy"]
         - [landscape-msg, rabbitmq-server]
@@ -119,6 +118,7 @@
     relations:
         - [landscape, rabbitmq-server]
         - [landscape, haproxy]
+        - ["landscape:vhost-config", "apache2:vhost-config"]
         - ["landscape:db-admin", "postgresql:db-admin"]
         - ["haproxy:website", "apache2:reverseproxy"]
         - [landscape-msg, rabbitmq-server]
@@ -130,6 +130,7 @@
         - [landscape-app, rabbitmq-server]
         - [landscape-app, haproxy]
         - ["landscape-app:db-admin", "postgresql:db-admin"]
+        - ["landscape-app:vhost-config", "apache2:vhost-config"]
 
 landscape-max-dense-maas:
     inherits: landscape-max
 
=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2014-06-09 20:33:41 +0000
+++ hooks/hooks.py	2014-06-14 03:50:22 +0000
@@ -9,15 +9,15 @@
 from lib import util
 from lib.juju import Juju
 
-from base64 import b64encode
+from base64 import b64encode, b64decode
 from configobj import ConfigObj, ConfigObjError
+from contextlib import closing
 from copy import deepcopy
 import cStringIO
 import datetime
 import grp
 import os
 import psutil
-import psycopg2
 import pwd
 import pycurl
 import re
@@ -27,6 +27,9 @@
 from subprocess import check_call, check_output, CalledProcessError, call
 
 
+SSL_CERT_LOCATION = "/etc/ssl/certs/landscape_server_ca.crt"
+
+
 def _get_installed_version(name):
     """Returns the version string of name using dpkg-query or returns None"""
     try:
@@ -95,6 +98,29 @@
             services=yaml.safe_dump(_get_services_haproxy()))
 
 
+def notify_vhost_config_relation(relation_id=None):
+    """
+    Notify the vhost-config relation.
+
+    This will mark it "ready to proceed".  If relation_id is specified
+    use that as the relation context, otherwise look up and notify all
+    vhost-config relations.
+    """
+    vhosts = []
+    with open("%s/config/vhostssl.tmpl" % ROOT, 'r') as handle:
+        vhosts.append({
+            "port": "443", "template": b64encode(handle.read())})
+    with open("%s/config/vhost.tmpl" % ROOT, 'r') as handle:
+        vhosts.append({
+            "port": "80", "template": b64encode(handle.read())})
+
+    relation_ids = [relation_id]
+    if relation_id is None:
+        relation_ids = juju.relation_ids("vhost-config")
+    for relation_id in relation_ids:
+        juju.relation_set(relation_id=relation_id, vhosts=yaml.dump(vhosts))
+
+
 def db_admin_relation_joined():
     pass
 
@@ -150,20 +176,13 @@
                     "password": password},
          "schema": {"store_user": admin, "store_password": admin_password}})
 
-    try:
-        # Name as lock so we don't try to reuse it as a database connection
-        lock = util.connect_exclusive(host, admin, admin_password)
-    except psycopg2.Error:
-        # Another unit is performing database configuration.
-        pass
-    else:
-        try:
-            util.create_user(user, password, host, admin, admin_password)
-            _create_maintenance_user(password, host, admin, admin_password)
-            check_call("setup-landscape-server")
-        finally:
-            juju.juju_log("Landscape database initialized!")
-            lock.close()
+    with closing(util.connect_exclusive(host, admin, admin_password)):
+        util.create_user(user, password, host, admin, admin_password)
+        _create_maintenance_user(password, host, admin, admin_password)
+        check_call("setup-landscape-server")
+        juju.juju_log("Landscape database initialized!")
+
+    notify_vhost_config_relation()
 
     try:
         # Handle remove-relation db-admin.  This call will fail because
@@ -316,6 +335,65 @@
         config_changed()
 
 
+def vhost_config_relation_changed():
+    """Relate to apache to configure a vhost.
+
+    This hook will supply vhost configuration as well as read simple data
+    out of apache (servername, certificate).  This data is necessary for
+    informing clients of the correct URL and cert to use when connecting
+    to the server.
+    """
+    notify_vhost_config_relation(os.environ.get("JUJU_RELATION_ID", None))
+
+    config_obj = _get_config_obj(LANDSCAPE_SERVICE_CONF)
+    try:
+        section = config_obj["stores"]
+        database = section["main"]
+        host = section["host"]
+        user = section["user"]
+        password = section["password"]
+    except KeyError:
+        juju.juju_log("Database not ready yet, deferring call")
+        sys.exit(0)
+
+    relids = juju.relation_ids("vhost-config")
+    if relids:
+        relid = relids[0]
+        apache2_unit = juju.relation_list(relid)[0]
+        apache_servername = juju.relation_get(
+            "servername", unit_name=apache2_unit, relation_id=relid)
+    else:
+        apache_servername = juju.relation_get("servername")
+
+    if not apache_servername:
+        juju.juju_log("Waiting for data from apache, deferring")
+        sys.exit(0)
+    apache_url = "https://%s/" % apache_servername
+
+    if not _is_db_up():
+        juju.juju_log("Waiting for database to become available, deferring.")
+        sys.exit(0)
+
+    with closing(util.connect_exclusive(host, user, password)):
+        juju.juju_log("Updating Landscape root_url: %s" % apache_url)
+        util.change_root_url(database, user, password, host, apache_url)
+
+    # This data may or may not be present, dependeing on if cert is self
+    # signed from apache.
+    ssl_cert = juju.relation_get(
+        "ssl_cert", unit_name=apache2_unit, relation_id=relid)
+    if ssl_cert:
+        juju.juju_log("Writing new SSL cert: %s" % SSL_CERT_LOCATION)
+        with open(SSL_CERT_LOCATION, 'w') as f:
+            f.write(str(b64decode(ssl_cert)))
+    else:
+        if os.path.exists(SSL_CERT_LOCATION):
+            os.remove(SSL_CERT_LOCATION)
+
+    # only starts services again if is_db_up and _is_amqp_up
+    config_changed()
+
+
 def config_changed():
     """Update and restart services based on config setting changes.
 
@@ -743,7 +821,8 @@
         "data-relation-changed": data_relation_changed,
         "db-admin-relation-joined": db_admin_relation_joined,
         "db-admin-relation-changed": db_admin_relation_changed,
-        "website-relation-joined": website_relation_joined}
+        "website-relation-joined": website_relation_joined,
+        "vhost-config-relation-changed": vhost_config_relation_changed}
     hook = os.path.basename(sys.argv[0])
     # If the hook is unsupported, let it raise a KeyError and exit with error.
     hooks[hook]()
 
=== modified file 'hooks/lib/util.py'
--- hooks/lib/util.py	2014-01-31 20:38:36 +0000
+++ hooks/lib/util.py	2014-06-14 03:50:22 +0000
@@ -2,8 +2,9 @@
 Utility library for juju hooks
 """
 
-from psycopg2 import connect
+from psycopg2 import connect, Error as psycopg2Error
 from juju import Juju
+from contextlib import closing
 
 juju = Juju()
 
@@ -38,7 +39,7 @@
                    password=admin_password)
     try:
         cur = conn.cursor()
-        cur.execute("SELECT usename FROM pg_user WHERE usename='%s'" % user)
+        cur.execute("SELECT usename FROM pg_user WHERE usename=%s", (user,))
         result = cur.fetchall()
         if not result:
             juju.juju_log("Creating postgres db user: %s" % user)
@@ -48,6 +49,32 @@
         conn.close()
 
 
+def change_root_url(database, user, password, host, url):
+    """Change the root url in the database."""
+    url = "u%s:%s" % (len(url), url)
+    with closing(connect(database=database, host=host,
+                         user=user, password=password)) as conn:
+        cur = conn.cursor()
+        cur.execute("SELECT encode(key, 'escape'),encode(value, 'escape') "
+                    "FROM system_configuration "
+                    "WHERE key='landscape.root_url' FOR UPDATE")
+        result = cur.fetchall()
+        if not result:
+            juju.juju_log("Setting new root_url: %s" % url)
+            cur.execute(
+                "INSERT INTO system_configuration "
+                "VALUES (decode('landscape.root_url', 'escape'), "
+                "        decode(%s, 'escape'))", (url,))
+        else:
+            juju.juju_log("Updating root_url %s => %s" % (result, url))
+            cur.execute(
+                "UPDATE system_configuration "
+                "SET key=decode('landscape.root_url', 'escape'),"
+                "    value=decode(%s, 'escape') "
+                "WHERE encode(key, 'escape')='landscape.root_url'", (url,))
+        conn.commit()
+
+
 def is_db_up(database, host, user, password):
     """
     Return True if the database relation is configured with write permission,
@@ -59,10 +86,9 @@
         # Ensure we are user with write access, to avoid hot standby dbs
         cur.execute(
             'CREATE TEMP TABLE "write_access_test_%s" (id serial PRIMARY KEY) '
-            "ON COMMIT DROP"
-            % juju.local_unit().replace("/", "_"))
-    except Exception as e:
-        juju.juju_log(str(e))
+            "ON COMMIT DROP" % juju.local_unit().replace("/", "_"))
+    except psycopg2Error as e:
+        juju.juju_log("Database not yet up: %s" % e)
         return False
     else:
         return True
 
=== modified file 'hooks/test_hooks.py'
--- hooks/test_hooks.py	2014-05-23 20:51:15 +0000
+++ hooks/test_hooks.py	2014-06-14 03:50:22 +0000
@@ -3,9 +3,11 @@
 import hooks
 import mocker
 import os
+import psycopg2
 import pycurl
 import stat
 import subprocess
+import tempfile
 import yaml
 
 
@@ -1482,6 +1484,171 @@
         baseline = (("services", yaml.safe_dump(self.all_services)),)
         self.assertEqual(baseline, hooks.juju._outgoing_relation_data)
 
+    def test_notify_vhost_config_relation_specify_id(self):
+        """
+        notify the vhost-config relation on a separate ID.
+        """
+        hooks.notify_vhost_config_relation("foo/0")
+        with open("%s/config/vhostssl.tmpl" % hooks.ROOT, 'r') as f:
+            vhostssl_template = f.read()
+        with open("%s/config/vhost.tmpl" % hooks.ROOT, 'r') as f:
+            vhost_template = f.read()
+        baseline = yaml.dump(
+            [{"port": "443", "template": base64.b64encode(vhostssl_template)},
+             {"port": "80", "template": base64.b64encode(vhost_template)}])
+        self.assertEqual(
+            (("vhosts", baseline),), hooks.juju._outgoing_relation_data)
+
+    def test_notify_vhost_config_relation(self):
+        """notify the vhost-config relation on the "current" ID."""
+        hooks.notify_vhost_config_relation()
+        with open("%s/config/vhostssl.tmpl" % hooks.ROOT, 'r') as f:
+            vhostssl_template = f.read()
+        with open("%s/config/vhost.tmpl" % hooks.ROOT, 'r') as f:
+            vhost_template = f.read()
+        baseline = yaml.dump(
+            [{"port": "443", "template": base64.b64encode(vhostssl_template)},
+             {"port": "80", "template": base64.b64encode(vhost_template)}])
+        self.assertEqual(
+            (("vhosts", baseline),), hooks.juju._outgoing_relation_data)
+
+    def test_vhost_config_relation_changed_exit_no_configuration(self):
+        """Ensure vhost_relation_changed deferrs if db is not up."""
+        self.assertRaises(SystemExit, hooks.vhost_config_relation_changed)
+        self.assertEquals(len(hooks.juju._logs), 1)
+        self.assertIn('Database not ready yet', hooks.juju._logs[0])
+
+    def test_vhost_config_relation_changed_wait_apache_servername(self):
+        """Ensure vhost_relation_changed deferrs if db is not up."""
+        _get_config_obj = self.mocker.replace(hooks._get_config_obj)
+        _get_config_obj(hooks.LANDSCAPE_SERVICE_CONF)
+        self.mocker.result({
+            "stores": {
+                "main": "database",
+                "host": "host",
+                "user": "user",
+                "password": "password"}})
+        notify_vhost = self.mocker.replace(hooks.notify_vhost_config_relation)
+        notify_vhost(None)
+        self.mocker.replay()
+        self.assertRaises(SystemExit, hooks.vhost_config_relation_changed)
+        self.assertIn('Waiting for data from apache', hooks.juju._logs[-1])
+
+    def test_vhost_config_relation_changed_fail_root_url(self):
+        """Ensure vhost_relation_changed deferrs if db is not up."""
+        _get_config_obj = self.mocker.replace(hooks._get_config_obj)
+        _get_config_obj(hooks.LANDSCAPE_SERVICE_CONF)
+        hooks.juju._incoming_relation_data += (("servername", "foobar"),)
+        self.mocker.result({
+            "stores": {
+                "main": "database",
+                "host": "host",
+                "user": "user",
+                "password": "password"}})
+        notify_vhost = self.mocker.replace(hooks.notify_vhost_config_relation)
+        notify_vhost(None)
+        is_db_up = self.mocker.replace(hooks._is_db_up)
+        is_db_up()
+        self.mocker.result(False)
+        self.mocker.replay()
+        self.assertRaises(SystemExit, hooks.vhost_config_relation_changed)
+        self.assertIn(
+            'Waiting for database to become available, deferring',
+            hooks.juju._logs[-1])
+
+    def test_vhost_config_relation_changed_fail_root_url_db_update(self):
+        """vhost_config_relation_changed should error if db update fails"""
+        _get_config_obj = self.mocker.replace(hooks._get_config_obj)
+        _get_config_obj(hooks.LANDSCAPE_SERVICE_CONF)
+        hooks.juju._incoming_relation_data += (("servername", "foobar"),)
+        self.mocker.result({
+            "stores": {
+                "main": "database",
+                "host": "host",
+                "user": "user",
+                "password": "password"}})
+        notify_vhost = self.mocker.replace(hooks.notify_vhost_config_relation)
+        notify_vhost(None)
+        is_db_up = self.mocker.replace(hooks._is_db_up)
+        is_db_up()
+        self.mocker.result(True)
+        self.mocker.replay()
+        self.assertRaises(psycopg2.Error, hooks.vhost_config_relation_changed)
+
+    def test_vhost_config_relation_changed_cert_not_provided(self):
+        """
+        Ensure vhost_relation_changed runs to completion.
+
+        Existing cert should be removed.
+        """
+        hooks.SSL_CERT_LOCATION = tempfile.NamedTemporaryFile().name
+        _get_config_obj = self.mocker.replace(hooks._get_config_obj)
+        _get_config_obj(hooks.LANDSCAPE_SERVICE_CONF)
+        hooks.juju._incoming_relation_data += (("servername", "foobar"),)
+        self.mocker.result({
+            "stores": {
+                "main": "database",
+                "host": "host",
+                "user": "user",
+                "password": "password"}})
+        notify_vhost = self.mocker.replace(hooks.notify_vhost_config_relation)
+        notify_vhost(None)
+        mock_conn = self.mocker.mock()
+        mock_conn.close()
+        connect_exclusive = self.mocker.replace(hooks.util.connect_exclusive)
+        connect_exclusive("host", "user", "password")
+        self.mocker.result(mock_conn)
+        change_root_url = self.mocker.replace(hooks.util.change_root_url)
+        change_root_url(
+            "database", "user", "password", "host", "https://foobar/")
+        config_changed = self.mocker.replace(hooks.config_changed)
+        config_changed()
+        is_db_up = self.mocker.replace(hooks._is_db_up)
+        is_db_up()
+        self.mocker.result(True)
+        self.mocker.replay()
+        hooks.vhost_config_relation_changed()
+        self.assertFalse(os.path.exists(hooks.SSL_CERT_LOCATION))
+
+    def test_vhost_config_relation_changed_ssl_cert_provided(self):
+        """
+        Ensure vhost_relation_changed runs to completion.
+
+        Cert passed in to other side of relation should be written on disk.
+        """
+        hooks.SSL_CERT_LOCATION = tempfile.NamedTemporaryFile().name
+        _get_config_obj = self.mocker.replace(hooks._get_config_obj)
+        _get_config_obj(hooks.LANDSCAPE_SERVICE_CONF)
+        hooks.juju._incoming_relation_data += (("servername", "foobar"),)
+        hooks.juju._incoming_relation_data += (
+            ("ssl_cert", base64.b64encode("foobar")),)
+        self.mocker.result({
+            "stores": {
+                "main": "database",
+                "host": "host",
+                "user": "user",
+                "password": "password"}})
+        notify_vhost = self.mocker.replace(hooks.notify_vhost_config_relation)
+        notify_vhost(None)
+        is_db_up = self.mocker.replace(hooks._is_db_up)
+        is_db_up()
+        self.mocker.result(True)
+        mock_conn = self.mocker.mock()
+        mock_conn.close()
+        connect_exclusive = self.mocker.replace(hooks.util.connect_exclusive)
+        connect_exclusive("host", "user", "password")
+        self.mocker.result(mock_conn)
+        change_root_url = self.mocker.replace(hooks.util.change_root_url)
+        change_root_url(
+            "database", "user", "password", "host", "https://foobar/")
+        config_changed = self.mocker.replace(hooks.config_changed)
+        config_changed()
+        self.mocker.replay()
+        hooks.vhost_config_relation_changed()
+        self.assertTrue(os.path.exists(hooks.SSL_CERT_LOCATION))
+        with open(hooks.SSL_CERT_LOCATION, 'r') as f:
+            self.assertEqual("foobar", f.read())
+
 
 class TestHooksUtils(TestHooks):
     def test__setup_apache(self):
 
=== added symlink 'hooks/vhost-config-relation-changed'
=== target is u'hooks.py'
=== modified file 'metadata.yaml'
--- metadata.yaml	2014-04-25 15:04:36 +0000
+++ metadata.yaml	2014-06-14 03:50:22 +0000
@@ -23,3 +23,5 @@
     optional: true
   website:
     interface: http
+  vhost-config:
+    interface: apache-vhost-config
 
=== modified file 'tests/01-begin'
--- tests/01-begin	2014-06-11 12:50:56 +0000
+++ tests/01-begin	2014-06-14 03:50:22 +0000
@@ -191,6 +191,8 @@
         self.service_name = service_name
 
 
[e-mail](
+    getenv("SKIP_TESTS", None), "Requested to skip all tests.")
 class BaseLandscapeTests(unittest.TestCase):
     """
     Base class with some commonality between all test classes.