Merge ~hloeung/content-cache-charm:haproxy-config into content-cache-charm:master

[Haw Loeung]

Added support for DNS SRV / server templates - LP:1871256

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Barry Price (barryprice)]

I wasn't familiar with haproxy's SRV support, consider adding a comment (or comments) linking to the docs. I think we'd want to explicitly explain that in config.yaml too.

Otherwise LGTM

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 1c438f4b91fe77b3e2826a5c4efc5b2a03d35b60

diff --git a/lib/haproxy.py b/lib/haproxy.py
index 09a7809..a2b9419 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -261,17 +261,24 @@ backend backend-{name}
 
                 backend_confs = []
                 count = 0
-                for backend in loc_conf.get('backends'):
+                for backend_flags in loc_conf.get('backends'):
+                    flags = backend_flags.split()
+                    backend = flags.pop(0)
+
                     count += 1
+                    name = 'server server_{}'.format(count)
+
+                    for flag in flags:
+                        if flag == 'srv':
+                            name = 'server-template server_ {}'.format(flags[flags.index(flag) + 1])
 
-                    name = 'server_{}'.format(count)
                     use_resolvers = ''
                     try:
                         utils.ip_addr_port_split(backend)
                     except utils.InvalidAddressPortError:
                         use_resolvers = ' resolvers dns init-addr none'
                     backend_confs.append(
-                        '{indent}server {name} {backend}{use_resolvers} check inter {inter_time} '
+                        '{indent}{name} {backend}{use_resolvers} check inter {inter_time} '
                         'rise {rise_count} fall {fall_count} maxconn {maxconn}{tls}'.format(
                             name=name,
                             backend=backend,
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_srv_template.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_srv_template.txt
new file mode 100644
index 0000000..8c24f8d
--- /dev/null
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_srv_template.txt
@@ -0,0 +1,99 @@
+global
+	nbthread 4
+	maxconn 16384
+	log /dev/log	local0
+	log /dev/log	local1 notice
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
+	stats timeout 30s
+	server-state-file /run/haproxy/saved-server-state
+	user haproxy
+	group haproxy
+	daemon
+
+	# LP#1874386: Work around lingering HAProxy processes as per LP:1874386
+	# and kill them off.
+	hard-stop-after 15m
+
+	# Default SSL material locations
+	ca-base /etc/ssl/certs
+	crt-base /etc/ssl/private
+
+	# Default ciphers to use on SSL-enabled listening sockets.
+	# For more information, see ciphers(1SSL). This list is from:
+	#  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
+	# An alternative list with additional directives can be obtained from
+	#  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
+	ssl-default-bind-ciphers ECDHE+AESGCM:ECDHE+AES256:ECDHE+AES128:!SSLv3:!TLSv1
+	ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
+	# We'll eventually disable DHE (LP#1825321), but for now, bump DH params
+	tune.ssl.default-dh-param 2048
+
+	# Increase the SSL/TLS session cache from the default 20k. But
+	# rather than hardcode values, let's just set it to match
+	# global_max_connections (which by default is calculated using
+	# num. of CPU cores and num. of configured sites). Each entry
+	# requires ~200 bytes so on a host with say 32 CPUs, 10 sites,
+	# each with 2000 max conns will only consume around 122 Mbytes
+	# (32 * 10 * 2000 * 200), which is not much.
+	tune.ssl.cachesize 16384
+
+defaults
+	log	global
+	maxconn 8192
+	mode	http
+	option	httplog
+	option	dontlognull
+	timeout connect 5s
+	timeout client  50s
+	timeout server  50s
+	errorfile 400 /etc/haproxy/errors/400.http
+	errorfile 403 /etc/haproxy/errors/403.http
+	errorfile 408 /etc/haproxy/errors/408.http
+	errorfile 500 /etc/haproxy/errors/500.http
+	errorfile 502 /etc/haproxy/errors/502.http
+	errorfile 503 /etc/haproxy/errors/503.http
+	errorfile 504 /etc/haproxy/errors/504.http
+	load-server-state-from-file global
+
+resolvers dns
+	nameserver dns1 127.0.0.53:53
+	resolve_retries 3
+	timeout resolve 3s
+	timeout retry   3s
+	accepted_payload_size 8192
+
+listen  stats
+	bind 127.0.0.1:10000
+	acl allowed_cidr src 127.0.0.0/8
+	http-request deny unless allowed_cidr
+
+	mode http
+	stats enable
+	stats uri /
+	stats realm Haproxy\ Statistics
+	stats auth haproxy:biometricsarenotsecret
+	stats refresh 3
+
+
+listen cached-site1-local
+    bind 0.0.0.0:80
+    bind :::80
+    default_backend backend-cached-site1-local
+
+listen site1-local
+    bind 127.0.0.1:8080
+    default_backend backend-site1-local
+
+backend backend-cached-site1-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site1.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site1.local
+    balance leastconn
+    server server_1 127.0.0.1:6080 check inter 2s rise 2 fall 60 maxconn 2048
+
+backend backend-site1-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site1.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site1.local
+    balance leastconn
+    server-template server_ 4 _http._tcp.uk.archive.ubuntu.com:80 resolvers dns init-addr none check inter 5s rise 2 fall 5 maxconn 2048
diff --git a/tests/unit/test_content_cache.py b/tests/unit/test_content_cache.py
index d0c6cd5..34a5f2c 100644
--- a/tests/unit/test_content_cache.py
+++ b/tests/unit/test_content_cache.py
@@ -467,6 +467,29 @@ site1.local:
     @mock.patch('charms.reactive.set_flag')
     @mock.patch('lib.haproxy.HAProxyConf.save_server_state')
     @mock.patch('reactive.content_cache.update_logrotate')
+    def test_configure_haproxy_sites_srv(self, logrotation, save_s_state, set_flag, opened_ports):
+        config = '''
+site1.local:
+  locations:
+    /:
+      backends: ['_http._tcp.uk.archive.ubuntu.com:80 srv 4']
+'''
+        self.mock_config.return_value = {'haproxy_hard_stop_after': '15m', 'max_connections': 8192, 'sites': config}
+        with mock.patch('lib.haproxy.HAProxyConf.conf_file', new_callable=mock.PropertyMock) as mock_conf_file:
+            mock_conf_file.return_value = os.path.join(self.tmpdir, 'haproxy.cfg')
+            content_cache.configure_haproxy()
+
+            with open('tests/unit/files/content_cache_rendered_haproxy_test_output_srv_template.txt', 'r', encoding='utf-8') as f:
+                want = f.read()
+            with open(os.path.join(self.tmpdir, 'haproxy.cfg'), 'r', encoding='utf-8') as f:
+                got = f.read()
+            self.assertEqual(got, want)
+
+    @freezegun.freeze_time("2019-03-22", tz_offset=0)
+    @mock.patch('charmhelpers.core.hookenv.opened_ports')
+    @mock.patch('charms.reactive.set_flag')
+    @mock.patch('lib.haproxy.HAProxyConf.save_server_state')
+    @mock.patch('reactive.content_cache.update_logrotate')
     def test_configure_haproxy_sites_auto_maxconns(self, logrotation, save_s_state, set_flag, opened_ports):
         with open('tests/unit/files/config_test_config.txt', 'r', encoding='utf-8') as f:
             config = f.read()