Merge ~hloeung/ubuntu-mirror-charm:master into ubuntu-mirror-charm:master

[Haw Loeung]

Allow limiting rsync connections by source/IP (via systemd sockets)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Joel Sing (jsing)]

LGTM, see minor comments inline.

review: Approve (+1)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision e21885a114a20cac4d7d81499c22775cc9f00a2c

diff --git a/config.yaml b/config.yaml
index 8a5039e..d5ce15e 100644
--- a/config.yaml
+++ b/config.yaml
@@ -431,6 +431,10 @@ options:
     default: 65
     type: int
     description: "Maximum number of rsync connections allowed"
+  rsync_max_connections_per_source:
+    default: 5
+    type: int
+    description: "Maximum number of rsync connections allowed per source/IP"
   rsync_motdfile:
     default: "/etc/rsyncd/motd"
     type: string
diff --git a/files/rsyncd-systemd.service b/files/rsyncd-systemd.service
 new file mode 100644
index 0000000..8ef2ff6
--- /dev/null
+++ b/files/rsyncd-systemd.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=fast remote file copy program daemon
+ConditionPathExists=/etc/rsyncd.conf
+
+[Service]
+ExecStart=/usr/bin/rsync --daemon
+StandardInput=socket
+
+[Install]
+WantedBy=multi-user.target
diff --git a/hooks/Config.py b/hooks/Config.py
index eb77b87..2543be7 100755
--- a/hooks/Config.py
+++ b/hooks/Config.py
@@ -247,6 +247,9 @@ class Config:
     def rsync_max_connections(self):
         return int(config("rsync_max_connections"))
 
+    def rsync_max_connections_per_source(self):
+        return int(config("rsync_max_connections_per_source"))
+
     def rsync_motd(self):
         try:
             motd = str(base64.b64decode(config("rsync_motd")))
diff --git a/hooks/hooks.py b/hooks/hooks.py
index 6c9870b..0b80434 100755
--- a/hooks/hooks.py
+++ b/hooks/hooks.py
@@ -262,6 +262,7 @@ def configure_rsync_server(conf, hostname):
 
     roles = conf.roles()
     if hostname not in roles:
+        log("CHARM: hostname {} not found in role_map - not configuring rsync".format(hostname))
         return
 
     targets = {}
@@ -279,6 +280,7 @@ def configure_rsync_server(conf, hostname):
     motdfile = conf.rsync_motdfile()
     tmpl_data = {}
     tmpl_data["max_connections"] = conf.rsync_max_connections()
+    tmpl_data["max_connections_per_source"] = conf.rsync_max_connections_per_source()
     tmpl_data["motdfile"] = motdfile
     tmpl_data["logdir"] = conf.logdir("rsync")
     tmpl_data["targets"] = targets
@@ -303,8 +305,19 @@ def configure_rsync_server(conf, hostname):
     # Need to tell systemd to enable rsync and then start it
     # but only in 15.04 or greater per https://wiki.ubuntu.com/SystemdForUpstartUsers
     if float(platform.linux_distribution()[1]) >= 15.04:
-        check_call('systemctl enable rsync'.split())
-        check_call('systemctl start rsync'.split())
+        # We disable rsync and run rsync over systemd sockets to allow limiting
+        # connections per source/IP
+        check_call('systemctl disable rsync'.split())
+        check_call('systemctl stop rsync'.split())
+
+        log("CHARM: Installing rsyncd system socket service files")
+        src = os.path.join(charm_dir(), "files", "rsyncd-systemd.service")
+        shutil.copyfile(src, "/etc/systemd/system/rsyncd@.service")
+        file_from_template("rsyncd-systemd-socket.tmpl", "/etc/systemd/system/rsyncd.socket", tmpl_data)
+        log("CHARM: Starting up / reloading rsyncd.socket")
+        check_call('systemctl daemon-reload'.split())
+        check_call('systemctl enable rsyncd.socket'.split())
+        check_call('systemctl start rsyncd.socket'.split())
 
     log("CHARM: Finished configuring rsync server")
 
diff --git a/templates/rsyncd-systemd-socket.tmpl b/templates/rsyncd-systemd-socket.tmpl
 new file mode 100644
index 0000000..33c8676
--- /dev/null
+++ b/templates/rsyncd-systemd-socket.tmpl
@@ -0,0 +1,12 @@
+[Unit]
+Description=fast remote file copy program daemon (Rsync Server Socket)
+Conflicts=rsyncd.service
+
+[Socket]
+ListenStream=873
+Accept=yes
+MaxConnections=${max_connections}
+MaxConnectionsPerSource=${max_connections_per_source}
+
+[Install]
+WantedBy=sockets.target