Merge ~hloeung/content-cache-charm:master into content-cache-charm:master

[Haw Loeung]

Fix default site being a redirect

HAProxy processes redirects before any backend configs (use_backend or
default_backend). With this, the 'use_backend' line in the example
below is never used:

| listen combined-80
| bind 0.0.0.0:80
| bind :::80
| redirect scheme https code 301 if { hdr(Host) -i site1.local } !{ ssl_fc }
| use_backend backend-site2-http if { hdr(Host) -i site2.local }
| redirect prefix https://site3.local

So any requests for site2.local will always hit the redirect
prefix. Instead, we need to create a new backend with the redirect
rule like so:

| listen combined-80
| bind 0.0.0.0:80
| bind :::80
| redirect scheme https code 301 if { hdr(Host) -i site1.local } !{ ssl_fc }
| use_backend backend-site2-http if { hdr(Host) -i site2.local }
| default backend-default-site
|
| backend backend-default-site
| redirect prefix https://site3.local

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Tom Haddon (mthaddon)]

Is there any risk of collision here since you've got a function called render_stanza_listen that was previously only rendering listen stanzas but can now potentially also render a "backend" stanza in this case?

review: Needs Information

[Tom Haddon (mthaddon)]

I think it's okay, because the render_stanza_backend is always rendering them as `backend backend-{name}` whereas this is using `backend default-redirect-site-{port}`.

[Tom Haddon (mthaddon)]

LGTM, thx

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 687d6d03ad15df2a82145e9744a202f11ec3d3f3

diff --git a/lib/haproxy.py b/lib/haproxy.py
index bc77f62..15088f5 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -181,6 +181,17 @@ listen {name}
             if address == '0.0.0.0':
                 bind_config += '\n{indent}bind :::{port}{tls}'.format(port=port, tls=tls_config, indent=INDENT)
 
+            # Redirects are always processed before use_backends so we
+            # need to convert default redirect sites to a backend.
+            if len(backend_config) > 1 and default_backend.startswith("{indent}redirect prefix".format(indent=INDENT)):
+                backend_name = self._generate_stanza_name("default-redirect-{}".format(name), exclude=stanza_names)
+                output = "backend {}\n".format(backend_name) + default_backend
+                default_backend = "{indent}default_backend {backend_name}\n".format(
+                    backend_name=backend_name, indent=INDENT
+                )
+                rendered_output.append(output)
+                stanza_names.append(backend_name)
+
             output = listen_stanza.format(
                 name=name,
                 backend_config=''.join(backend_config),
diff --git a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output3.txt b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output3.txt
index e2614b3..d7d3110 100644
--- a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output3.txt
+++ b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output3.txt
@@ -1,10 +1,12 @@
+backend default-redirect-combined-80
+    redirect prefix https://site2.local
 
 listen combined-80
     bind 0.0.0.0:80
     bind :::80
     redirect scheme https code 301 if { hdr(Host) -i site1.local } !{ ssl_fc }
     redirect scheme https code 301 if { hdr(Host) -i site2.local } !{ ssl_fc }
-    redirect prefix https://site2.local
+    default_backend default-redirect-combined-80
 
 listen combined-443
     bind 0.0.0.0:443 ssl crt /var/lib/haproxy/certs alpn h2,http/1.1