Merge ~hloeung/content-cache-charm:multiple-locations into content-cache-charm:master

[Haw Loeung]

Fixed to support plain HTTP to backends, but have TLS/SSL/HTTPS at the front

client -> TLS/SSL/HTTPS -> HAProxy FE -> HTTP -> Cache -> HAProxy -> HTTP -> backends

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Nick Moffitt (nick-moffitt)]

Looks good, as overriding this to False was the thing I kept trying to do earlier today!

review: Approve

[Joel Sing (jsing)]

LGTM

review: Approve (+1)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 2496dc3bd537d16344d17b58578565556d414e02

diff --git a/reactive/content_cache.py b/reactive/content_cache.py
index f4b1609..a95aab7 100644
--- a/reactive/content_cache.py
+++ b/reactive/content_cache.py
@@ -202,14 +202,13 @@ def configure_haproxy():
                 new_cached_loc_conf['backend-check-path'] = backend_check_path
                 new_loc_conf['backend-check-path'] = backend_check_path
             new_cached_loc_conf['signed-url-hmac-key'] = loc_conf.get('signed-url-hmac-key')
-            if tls_cert_bundle_path:
+            # If 'backend-tls' is defined, pass it through.
+            if 'backend-tls' in loc_conf:
+                new_loc_conf['backend-tls'] = loc_conf.get('backend-tls')
+            # No 'backend-tls' provided so let's try work out automatically.
+            elif tls_cert_bundle_path:
                 new_cached_loc_conf['backend-tls'] = False
                 new_loc_conf['backend-tls'] = True
-            else:
-                # Support for HTTP front to HTTPS backends. This shouldn't
-                # normally be used but it's useful for testing without having
-                # to ship out TLS/SSL certificate bundles.
-                new_loc_conf['backend-tls'] = site_conf.get('backend-tls')
 
             # When we have multiple locations, we only want/need one HAProxy
             # stanza to redirect requests to the cache.
diff --git a/tests/unit/files/config_test_config.txt b/tests/unit/files/config_test_config.txt
index 12206cc..cc1a55c 100644
--- a/tests/unit/files/config_test_config.txt
+++ b/tests/unit/files/config_test_config.txt
@@ -15,7 +15,7 @@ site1.local:
 
 # Test 2: TLS/SSL as well as backends (HTTPS)
 site2.local:
-  tls-cert-bundle-path: /etc/haproxy/some-bundle.crt
+  tls-cert-bundle-path: /etc/haproxy/site2-bundle.crt
   locations:
     /:
       backend-tls: True
@@ -68,3 +68,21 @@ site5:
         - 127.0.1.11:80
       backend-path: /auth-check/
       cache-validity: '200 401 1h'
+
+# Test 6: TLS/SSL/HTTPS to backends only
+site6.local:
+  locations:
+    /:
+      backend-tls: True
+      backends:
+        - 127.0.1.10:443
+
+# Test 7: TLS/SSL frontend but plain HTTP to backend
+site7.local:
+  port: 444
+  tls-cert-bundle-path: /etc/haproxy/site7-bundle.crt
+  locations:
+    /:
+      backend-tls: False
+      backends:
+        - 127.0.1.10:80
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
index d01a271..64ae7f7 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
@@ -44,13 +44,14 @@ listen combined-80
     use_backend backend-cached-site3-local if { hdr(Host) -i site3.local }
     use_backend backend-cached-site4-local if { hdr(Host) -i site4.local }
     use_backend backend-cached-site5 if { hdr(Host) -i site5.local }
+    use_backend backend-cached-site6-local if { hdr(Host) -i site6.local }
 
 listen site1-local
     bind 127.0.0.1:8080
     default_backend backend-site1-local
 
 listen cached-site2-local
-    bind 0.0.0.0:443 ssl crt /etc/haproxy/some-bundle.crt
+    bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt
     default_backend backend-cached-site2-local
 
 listen site2-local
@@ -65,6 +66,18 @@ listen site5
     bind 127.0.0.1:8083
     default_backend backend-site5
 
+listen site6-local
+    bind 127.0.0.1:8085
+    default_backend backend-site6-local
+
+listen cached-site7-local
+    bind 0.0.0.0:444 ssl crt /etc/haproxy/site7-bundle.crt
+    default_backend backend-cached-site7-local
+
+listen site7-local
+    bind 127.0.0.1:8086
+    default_backend backend-site7-local
+
 backend backend-cached-site1-local
     option forwardfor
     option httpchk HEAD /?token=1868572800_4eb30fc94f247635f7ed445083a4783862ad58de HTTP/1.0\r\nHost:\ site1.local\r\nUser-Agent:\ haproxy/httpchk
@@ -135,3 +148,29 @@ backend backend-site5-2
     http-request set-header Host site5.local
     balance leastconn
     server server_1 127.0.1.11:80 check inter 5000 rise 2 fall 5 maxconn 16
+
+backend backend-cached-site6-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site6.local
+    balance leastconn
+    server server_1 127.0.0.1:6085 check inter 5000 rise 2 fall 5 maxconn 16
+
+backend backend-site6-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site6.local
+    balance leastconn
+    server server_1 127.0.1.10:443 check inter 5000 rise 2 fall 5 maxconn 16 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
+
+backend backend-cached-site7-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site7.local
+    balance leastconn
+    server server_1 127.0.0.1:6086 check inter 5000 rise 2 fall 5 maxconn 16
+
+backend backend-site7-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site7.local
+    balance leastconn
+    server server_1 127.0.1.10:80 check inter 5000 rise 2 fall 5 maxconn 16
diff --git a/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt b/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
index 2594f16..24b259b 100644
--- a/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
@@ -36,3 +36,15 @@ backend backend-site5-2
     http-request set-header Host site5.local
     balance leastconn
     server server_1 127.0.1.11:80 check inter 5000 rise 2 fall 5 maxconn 16
+
+backend backend-site6-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site6.local
+    balance leastconn
+    server server_1 127.0.1.10:443 check inter 5000 rise 2 fall 5 maxconn 16 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
+
+backend backend-site7-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site7.local
+    balance leastconn
+    server server_1 127.0.1.10:80 check inter 5000 rise 2 fall 5 maxconn 16
diff --git a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
index 8fd3ac2..d4c6747 100644
--- a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
@@ -5,7 +5,12 @@ listen combined-80
     use_backend backend-site3-local if { hdr(Host) -i site3.local }
     use_backend backend-site4-local if { hdr(Host) -i site4.local }
     use_backend backend-site5 if { hdr(Host) -i site5.local }
+    use_backend backend-site6-local if { hdr(Host) -i site6.local }
 
 listen site2-local
-    bind 0.0.0.0:443 ssl crt /etc/haproxy/some-bundle.crt
+    bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt
     default_backend backend-site2-local
+
+listen site7-local
+    bind 0.0.0.0:444 ssl crt /etc/haproxy/site7-bundle.crt
+    default_backend backend-site7-local
diff --git a/tests/unit/files/haproxy_config_rendered_test_output.txt b/tests/unit/files/haproxy_config_rendered_test_output.txt
index 006e385..2c6cd52 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output.txt
@@ -44,11 +44,16 @@ listen combined-80
     use_backend backend-site3-local if { hdr(Host) -i site3.local }
     use_backend backend-site4-local if { hdr(Host) -i site4.local }
     use_backend backend-site5 if { hdr(Host) -i site5.local }
+    use_backend backend-site6-local if { hdr(Host) -i site6.local }
 
 listen site2-local
-    bind 0.0.0.0:443 ssl crt /etc/haproxy/some-bundle.crt
+    bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt
     default_backend backend-site2-local
 
+listen site7-local
+    bind 0.0.0.0:444 ssl crt /etc/haproxy/site7-bundle.crt
+    default_backend backend-site7-local
+
 backend backend-site1-local
     option httpchk HEAD /?token=1868572800_4eb30fc94f247635f7ed445083a4783862ad58de HTTP/1.0\r\nHost:\ site1.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site1.local
@@ -86,3 +91,15 @@ backend backend-site5-2
     http-request set-header Host site5.local
     balance leastconn
     server server_1 127.0.1.11:80 check inter 5000 rise 2 fall 5 maxconn 16
+
+backend backend-site6-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site6.local
+    balance leastconn
+    server server_1 127.0.1.10:443 check inter 5000 rise 2 fall 5 maxconn 16 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
+
+backend backend-site7-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site7.local
+    balance leastconn
+    server server_1 127.0.1.10:80 check inter 5000 rise 2 fall 5 maxconn 16
diff --git a/tests/unit/files/nginx_config_rendered_test_output-site6.local.txt b/tests/unit/files/nginx_config_rendered_test_output-site6.local.txt
new file mode 100644
index 0000000..65b2f9c
--- /dev/null
+++ b/tests/unit/files/nginx_config_rendered_test_output-site6.local.txt
@@ -0,0 +1,22 @@
+proxy_cache_path /var/lib/nginx/proxy/site6.local use_temp_path=off levels=1:2 keys_zone=site6-cache:10m max_size=1g;
+
+server {
+    server_name site6.local;
+    listen 127.0.0.1:6085;
+
+    location / {
+        proxy_pass http://localhost:8085;
+        proxy_set_header Host "site6.local";
+        proxy_cache site6-cache;
+        proxy_cache_background_update on;
+        proxy_cache_lock on;
+        proxy_cache_min_uses 1;
+        proxy_cache_revalidate on;
+        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+        proxy_cache_valid 200 1d;
+    }
+
+
+    access_log /var/log/nginx/site6.local-access.log content_cache;
+    error_log /var/log/nginx/site6.local-error.log;
+}
diff --git a/tests/unit/files/nginx_config_rendered_test_output-site7.local.txt b/tests/unit/files/nginx_config_rendered_test_output-site7.local.txt
new file mode 100644
index 0000000..3445a5a
--- /dev/null
+++ b/tests/unit/files/nginx_config_rendered_test_output-site7.local.txt
@@ -0,0 +1,22 @@
+proxy_cache_path /var/lib/nginx/proxy/site7.local use_temp_path=off levels=1:2 keys_zone=site7-cache:10m max_size=1g;
+
+server {
+    server_name site7.local;
+    listen 127.0.0.1:6086;
+
+    location / {
+        proxy_pass http://localhost:8086;
+        proxy_set_header Host "site7.local";
+        proxy_cache site7-cache;
+        proxy_cache_background_update on;
+        proxy_cache_lock on;
+        proxy_cache_min_uses 1;
+        proxy_cache_revalidate on;
+        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+        proxy_cache_valid 200 1d;
+    }
+
+
+    access_log /var/log/nginx/site7.local-access.log content_cache;
+    error_log /var/log/nginx/site7.local-error.log;
+}
diff --git a/tests/unit/test_content_cache.py b/tests/unit/test_content_cache.py
index 87bfb0d..5228d45 100644
--- a/tests/unit/test_content_cache.py
+++ b/tests/unit/test_content_cache.py
@@ -151,7 +151,8 @@ class TestCharm(unittest.TestCase):
             content_cache.configure_nginx(self.tmpdir)
             self.assertFalse(service_start_or_restart.assert_not_called())
 
-            for site in ['site1.local', 'site2.local', 'site3.local', 'site4.local', 'site5']:
+            for site in ['site1.local', 'site2.local', 'site3.local',
+                         'site4.local', 'site5', 'site6.local', 'site7.local']:
                 with open('tests/unit/files/nginx_config_rendered_test_output-{}.txt'.format(site),
                           'r', encoding='utf-8') as f:
                     want = f.read()