Merge ~hloeung/content-cache-charm:master into content-cache-charm:master

[Haw Loeung]

Allow specifying default site - LP:1863170

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Stuart Bishop (stub)]

This all seems good.

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision cc8cc0a95958ba26a89f2d4b56fba481669c88e8

diff --git a/lib/haproxy.py b/lib/haproxy.py
index 1d5721e..6516216 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -77,6 +77,9 @@ class HAProxyConf:
                     # We use a different flag/config here so it's only enabled
                     # on the HTTP, and not the HTTPS, stanza.
                     new['0.0.0.0:80'][site_name] = {'enable-redirect-http-to-https': True}
+                    if 'default' in config[site]:
+                        new['0.0.0.0:80'][site_name]['default'] = config[site]['default']
+
             port = config[site].get('port', default_port)
             name = '{}:{}'.format(listen_address, port)
             new.setdefault(name, {})
@@ -98,11 +101,11 @@ class HAProxyConf:
                         new[name][new_site]['port'] = port
         return new
 
-    def render_stanza_listen(self, config):
+    def render_stanza_listen(self, config):  # NOQA: C901
         listen_stanza = """
 listen {name}
 {bind_config}
-{backend_config}"""
+{backend_config}{default_backend}"""
         backend_conf = '{indent}use_backend backend-{backend} if {{ hdr(Host) -i {site_name} }}\n'
         redirect_conf = '{indent}redirect scheme https code 301 if {{ hdr(Host) -i {site_name} }} !{{ ssl_fc }}\n'
 
@@ -116,10 +119,12 @@ listen {name}
             (address, port) = utils.ip_addr_port_split(address_port)
 
             backend_config = []
+            default_backend = ''
             tls_cert_bundle_paths = []
             redirect_http_to_https = False
             for site, site_conf in config[address_port].items():
                 site_name = site_conf.get('site-name', site)
+                default_site = site_conf.get('default', False)
                 redirect_http_to_https = site_conf.get('enable-redirect-http-to-https', False)
 
                 if len(config[address_port].keys()) == 1:
@@ -138,11 +143,19 @@ listen {name}
                 # HTTP -> HTTPS redirect
                 if redirect_http_to_https:
                     backend_config.append(redirect_conf.format(site_name=site_name, indent=INDENT))
+                    if default_site:
+                        default_backend = "{indent}redirect prefix https://{site_name}\n".format(
+                            site_name=site_name, indent=INDENT
+                        )
                 else:
                     backend_name = self._generate_stanza_name(
                         site_conf.get('locations', {}).get('backend-name') or site
                     )
                     backend_config.append(backend_conf.format(backend=backend_name, site_name=site_name, indent=INDENT))
+                    if default_site:
+                        default_backend = "{indent}default_backend backend-{backend}\n".format(
+                            backend=backend_name, indent=INDENT
+                        )
 
             tls_config = ''
             if tls_cert_bundle_paths:
@@ -151,8 +164,15 @@ listen {name}
                 alpn_protos = 'h2,http/1.1'
                 tls_config = ' ssl {} alpn {}'.format(certs, alpn_protos)
 
-            if len(backend_config) == 1 and not redirect_http_to_https:
-                backend_config = ['{indent}default_backend backend-{backend}\n'.format(backend=name, indent=INDENT)]
+            if len(backend_config) == 1:
+                if redirect_http_to_https:
+                    backend_config = []
+                    default_backend = "{indent}redirect prefix https://{site_name}\n".format(
+                        site_name=site_name, indent=INDENT
+                    )
+                else:
+                    backend_config = []
+                    default_backend = "{indent}default_backend backend-{backend}\n".format(backend=name, indent=INDENT)
 
             bind_config = '{indent}bind {address_port}{tls}'.format(
                 address_port=address_port, tls=tls_config, indent=INDENT
@@ -162,7 +182,11 @@ listen {name}
                 bind_config += '\n{indent}bind :::{port}{tls}'.format(port=port, tls=tls_config, indent=INDENT)
 
             output = listen_stanza.format(
-                name=name, backend_config=''.join(backend_config), bind_config=bind_config, indent=INDENT,
+                name=name,
+                backend_config=''.join(backend_config),
+                bind_config=bind_config,
+                default_backend=default_backend,
+                indent=INDENT,
             )
             rendered_output.append(output)
 
diff --git a/reactive/content_cache.py b/reactive/content_cache.py
index e5967a8..fc6b637 100644
--- a/reactive/content_cache.py
+++ b/reactive/content_cache.py
@@ -227,6 +227,10 @@ def configure_haproxy():  # NOQA: C901 LP#1825084
         cached_site = 'cached-{}'.format(site)
         new_conf[cached_site] = {'site-name': site_conf.get('site-name') or site, 'locations': {}}
 
+        default_site = site_conf.get('default')
+        if default_site:
+            new_conf[cached_site]['default'] = default_site
+
         default_port = 80
         tls_cert_bundle_path = site_conf.get('tls-cert-bundle-path')
         if tls_cert_bundle_path:
diff --git a/tests/unit/files/config_test_config.txt b/tests/unit/files/config_test_config.txt
index fb0e4fb..25d69c9 100644
--- a/tests/unit/files/config_test_config.txt
+++ b/tests/unit/files/config_test_config.txt
@@ -12,6 +12,8 @@ site1.local:
         - X-Origin-Key: Sae6oob2aethuosh
         - X-Some-Header-1: something one two three
         - X-Some-Header-2: something:one:two:three
+  # Test multiple default sites, last one wins.
+  default: True
 
 # Test 2: TLS/SSL as well as backends (HTTPS), with custom backend-maxconn
 site2.local:
@@ -33,9 +35,12 @@ site2.local:
     /my-local-content2/:
       extra-config:
         - root /var/www/html
+  # Test default site with only a single backend.
+  default: True
 
 # Test 3: No port, just backends (HTTP), with custom cache-maxconn
 site3.local:
+  default: True
   locations:
     /:
       backends:
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
index 357f5bd..d6f703b 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
@@ -77,6 +77,7 @@ listen combined-80
     use_backend backend-cached-site5 if { hdr(Host) -i site5.local }
     use_backend backend-cached-site6-local if { hdr(Host) -i site6.local }
     use_backend backend-cached-site9-local if { hdr(Host) -i site9.local }
+    default_backend backend-cached-site3-local
 
 listen site1-local
     bind 127.0.0.1:8080
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output3.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output3.txt
index 017645d..c82bf5c 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output3.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output3.txt
@@ -70,7 +70,7 @@ listen  stats
 listen redirect-site1-local
     bind 0.0.0.0:80
     bind :::80
-    redirect scheme https code 301 if { hdr(Host) -i site1.local } !{ ssl_fc }
+    redirect prefix https://site1.local
 
 listen cached-site1-local
     bind 0.0.0.0:443 ssl crt /var/lib/haproxy/certs alpn h2,http/1.1
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
index 472b1f8..151a1d4 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
@@ -77,6 +77,7 @@ listen combined-80
     use_backend backend-cached-site5 if { hdr(Host) -i site5.local }
     use_backend backend-cached-site6-local if { hdr(Host) -i site6.local }
     use_backend backend-cached-site9-local if { hdr(Host) -i site9.local }
+    default_backend backend-cached-site3-local
 
 listen site1-local
     bind 127.0.0.1:8080
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
index ab7d065..77106e2 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
@@ -78,6 +78,7 @@ listen combined-80
     use_backend backend-cached-site5 if { hdr(Host) -i site5.local }
     use_backend backend-cached-site6-local if { hdr(Host) -i site6.local }
     use_backend backend-cached-site9-local if { hdr(Host) -i site9.local }
+    default_backend backend-cached-site3-local
 
 listen site1-local
     bind 127.0.0.1:8080
diff --git a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
index c86468b..6a0b4a4 100644
--- a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
@@ -9,6 +9,7 @@ listen combined-80
     use_backend backend-site5 if { hdr(Host) -i site5.local }
     use_backend backend-site6-local if { hdr(Host) -i site6.local }
     use_backend backend-site9-local if { hdr(Host) -i site9.local }
+    default_backend backend-site3-local
 
 listen site2-local
     bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt alpn h2,http/1.1
diff --git a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output2.txt b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output2.txt
index b84b56e..2e12427 100644
--- a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output2.txt
+++ b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output2.txt
@@ -2,7 +2,7 @@
 listen redirect-site1-local
     bind 0.0.0.0:80
     bind :::80
-    redirect scheme https code 301 if { hdr(Host) -i site1.local } !{ ssl_fc }
+    redirect prefix https://site1.local
 
 listen site1-local
     bind 0.0.0.0:443 ssl crt /var/lib/haproxy/certs alpn h2,http/1.1
diff --git a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output3.txt b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output3.txt
 new file mode 100644
index 0000000..e2614b3
--- /dev/null
+++ b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output3.txt
@@ -0,0 +1,14 @@
+
+listen combined-80
+    bind 0.0.0.0:80
+    bind :::80
+    redirect scheme https code 301 if { hdr(Host) -i site1.local } !{ ssl_fc }
+    redirect scheme https code 301 if { hdr(Host) -i site2.local } !{ ssl_fc }
+    redirect prefix https://site2.local
+
+listen combined-443
+    bind 0.0.0.0:443 ssl crt /var/lib/haproxy/certs alpn h2,http/1.1
+    bind :::443 ssl crt /var/lib/haproxy/certs alpn h2,http/1.1
+    use_backend backend-site1-local if { hdr(Host) -i site1.local }
+    use_backend backend-site2-local if { hdr(Host) -i site2.local }
+    default_backend backend-site2-local
diff --git a/tests/unit/files/haproxy_config_rendered_test_output.txt b/tests/unit/files/haproxy_config_rendered_test_output.txt
index 7e9dff0..8b98792 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output.txt
@@ -78,6 +78,7 @@ listen combined-80
     use_backend backend-site5 if { hdr(Host) -i site5.local }
     use_backend backend-site6-local if { hdr(Host) -i site6.local }
     use_backend backend-site9-local if { hdr(Host) -i site9.local }
+    default_backend backend-site3-local
 
 listen site2-local
     bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt alpn h2,http/1.1
diff --git a/tests/unit/files/haproxy_config_rendered_test_output2.txt b/tests/unit/files/haproxy_config_rendered_test_output2.txt
index d9ee515..d0efd57 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output2.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output2.txt
@@ -78,6 +78,7 @@ listen combined-80
     use_backend backend-site5 if { hdr(Host) -i site5.local }
     use_backend backend-site6-local if { hdr(Host) -i site6.local }
     use_backend backend-site9-local if { hdr(Host) -i site9.local }
+    default_backend backend-site3-local
 
 listen site2-local
     bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt alpn h2,http/1.1
diff --git a/tests/unit/test_haproxy.py b/tests/unit/test_haproxy.py
index cac29ca..9fc9604 100644
--- a/tests/unit/test_haproxy.py
+++ b/tests/unit/test_haproxy.py
@@ -104,6 +104,30 @@ class TestLibHAProxy(unittest.TestCase):
             want = f.read()
         self.assertEqual(''.join(haproxy.render_stanza_listen(config)), want)
 
+    def test_haproxy_config_rendered_listen_stanzas_redirect_default_site(self):
+        haproxy = HAProxy.HAProxyConf(self.tmpdir)
+        config = {
+            'site1.local': {
+                'locations': {'/': {'backends': ['192.168.1.1:8080']}},
+                'port': 443,
+                'redirect-http-to-https': True,
+                'site-name': 'site1.local',
+                'tls-cert-bundle-path': '/var/lib/haproxy/certs',
+            },
+            'site2.local': {
+                'default': True,
+                'locations': {'/': {'backends': ['192.168.1.1:8080']}},
+                'port': 443,
+                'redirect-http-to-https': True,
+                'site-name': 'site2.local',
+                'tls-cert-bundle-path': '/var/lib/haproxy/certs',
+            },
+        }
+        output = 'tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output3.txt'
+        with open(output, 'r', encoding='utf-8') as f:
+            want = f.read()
+        self.assertEqual(''.join(haproxy.render_stanza_listen(config)), want)
+
     @freezegun.freeze_time("2019-03-22", tz_offset=0)
     def test_haproxy_config_rendered_backend_stanzas(self):
         haproxy = HAProxy.HAProxyConf(self.tmpdir)