Merge lp:~lamont/maas/create-maas-proxy.conf-packaging into lp:~maas-maintainers/maas/packaging

[LaMont Jones]

Packaging changes for maas-proxy lockdown.

Packaging changes for maas-proxy lockdown.

[LaMont Jones (lamont)]

This requires the corresponding branch in trunk. See https://code.launchpad.net/~lamont/maas/create-maas-proxy.conf/+merge/290154

[Andres Rodriguez (andreserl)]

lgtm! Just one remark!

review: Approve

[LaMont Jones (lamont)]

Updated.

[MAAS Lander (maas-lander)]

Attempt to merge into lp:~maas-maintainers/maas/packaging failed due to conflicts:

text conflict in debian/changelog

=== modified file 'debian/changelog'
--- debian/changelog	2016-04-01 13:23:48 +0000
+++ debian/changelog	2016-04-01 20:05:40 +0000
@@ -7,6 +7,8 @@
     and ownership (LP: #1563799 , LP: #1563779)
   * Improve the way how removals clean the system (LP: #1563337)
   * Reflect new names and website for systemd units (LP: #1563807)
+  * maas-proxy now uses a custom-built config, instead of a boilerplate.
+    LP: #1379567
 
  -- Andres Rodriguez <[e-mail]>  Mon, 28 Mar 2016 16:47:58 -0400
 

=== modified file 'debian/extras/maas-proxy-common.sh'
--- debian/extras/maas-proxy-common.sh	2015-08-13 09:01:57 +0000
+++ debian/extras/maas-proxy-common.sh	2016-04-01 20:05:40 +0000
@@ -16,6 +16,6 @@
    chown -R proxy:proxy /var/log/maas/proxy
   fi
   if [ ! -d /var/cache/maas-proxy/00 ]; then
-   $SQUID -z -N -f /usr/share/maas/maas-proxy.conf
+   $SQUID -z -N -f /var/lib/maas/maas-proxy.conf
   fi
 }

=== removed file 'debian/extras/maas-proxy.conf'
--- debian/extras/maas-proxy.conf	2015-07-15 16:14:39 +0000
+++ debian/extras/maas-proxy.conf	1970-01-01 00:00:00 +0000
@@ -1,40 +0,0 @@
-# Inspired by UDS's conference proxy
-
-acl maas_proxy_manager proto cache_object
-acl localhost src 127.0.0.1/32 ::1
-acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
-acl localnet src all # TODO: We should auto-generate this with the networks MAAS manages/knows about.
-acl SSL_ports port 443
-acl Safe_ports port 80          # http
-acl Safe_ports port 21          # ftp
-acl Safe_ports port 443         # https
-acl Safe_ports port 1025-65535  # unregistered ports
-acl CONNECT method CONNECT
-http_access allow maas_proxy_manager localhost
-http_access deny maas_proxy_manager
-http_access deny !Safe_ports
-http_access deny CONNECT !SSL_ports
-http_access allow localnet
-http_access allow localhost
-http_access deny all
-http_port 3128 transparent
-http_port 8000
-coredump_dir /var/spool/maas-proxy
-refresh_pattern ^ftp:           1440    20%     10080
-refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
-refresh_pattern \/Release(|\.gpg)$                        0    0%    0 refresh-ims
-refresh_pattern \/InRelease$                              0    0%    0 refresh-ims
-refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$   0    0%    0 refresh-ims
-refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$     0    0%    0 refresh-ims
-refresh_pattern .               0       20%     4320
-forwarded_for delete
-visible_hostname maas.proxy # TODO: This should be autogenerated by a template.
-cache_mem 512 MB
-minimum_object_size 0 MB
-maximum_object_size 1024 MB
-maximum_object_size_in_memory 100 MB
-cache_dir aufs /var/spool/maas-proxy 40000 16 256
-# use different logs
-cache_access_log /var/log/maas/proxy/access.log
-cache_log /var/log/maas/proxy/cache.log
-cache_store_log /var/log/maas/proxy/store.log

=== modified file 'debian/maas-proxy.dirs'
--- debian/maas-proxy.dirs	2014-09-12 19:10:04 +0000
+++ debian/maas-proxy.dirs	2016-04-01 20:05:40 +0000
@@ -1,1 +1,2 @@
 var/log/maas/proxy
+var/lib/maas

=== modified file 'debian/maas-proxy.install'
--- debian/maas-proxy.install	2016-02-10 15:56:10 +0000
+++ debian/maas-proxy.install	2016-04-01 20:05:40 +0000
@@ -1,2 +1,1 @@
-debian/extras/maas-proxy.conf usr/share/maas/
 debian/extras/maas-proxy-common.sh usr/share/maas/

=== modified file 'debian/maas-proxy.logrotate'
--- debian/maas-proxy.logrotate	2015-08-13 09:01:57 +0000
+++ debian/maas-proxy.logrotate	2016-04-01 20:05:40 +0000
@@ -19,6 +19,6 @@
       exit 1
   fi
 
-  test ! -e /var/run/maas-proxy.pid || $SQUID -f /usr/share/maas/maas-proxy.conf -k rotate
+  test ! -e /var/run/maas-proxy.pid || $SQUID -f /var/lib/maas/maas-proxy.conf -k rotate
  endscript
 }

=== modified file 'debian/maas-proxy.maas-proxy.service'
--- debian/maas-proxy.maas-proxy.service	2015-08-13 09:01:57 +0000
+++ debian/maas-proxy.maas-proxy.service	2016-04-01 20:05:40 +0000
@@ -2,14 +2,14 @@
 Description=MAAS Proxy
 Requires=network-online.target
 After=network-online.target
-ConditionPathExists=/usr/share/maas/maas-proxy.conf
+ConditionPathExists=/var/lib/maas/maas-proxy.conf
 
 [Service]
 ExecStartPre=/bin/mkdir -p /run/maas/proxy
 ExecStartPre=/bin/sh -ec '\
     . /usr/share/maas/maas-proxy-common.sh; \
     pre_start'
-ExecStart=/usr/sbin/squid3 -N -f /usr/share/maas/maas-proxy.conf
+ExecStart=/usr/sbin/squid3 -N -f /var/lib/maas/maas-proxy.conf
 
 [Install]
 WantedBy=multi-user.target

=== modified file 'debian/maas-proxy.postinst'
--- debian/maas-proxy.postinst	2015-11-25 17:34:18 +0000
+++ debian/maas-proxy.postinst	2016-04-01 20:05:40 +0000
@@ -4,19 +4,23 @@
 
 if [ "$1" = "configure" ]
 then
-    # Stop the squid3 instance that came with the isc-dhcp-server package.
+    # Stop the squid3 instance that came with the squid3 package.
     # We run our own squid3 instances.
-    systemctl stop squid3 >/dev/null || true
-    systemctl disable squid3 >/dev/null || true
+    # Handle both versions of the name, for safety.
+    for SQUID in squid squid3; do
+        systemctl stop ${SQUID} >/dev/null 2>&1 || true
+        systemctl disable ${SQUID} >/dev/null 2>&1 || true
+    done
 
     # Ensure log folder is created.
     mkdir -p /var/log/maas/proxy
     chown -R proxy:proxy /var/log/maas/proxy
 
-    # Move maas-proxy.conf if we are upgrading from an earlier
-    # version that used to ship maas-proxy.conf in /etc/maas.
+    # maas-proxy.conf is now generated by MAAS itself and if we are
+    # upgrading from an earlier  version that used to ship maas-proxy.conf
+    # in /etc/maas, it is safe to remove
     if [ -f /etc/maas/maas-proxy.conf ]; then
-        mv /etc/maas/maas-proxy.conf /usr/share/maas/
+        rm /etc/maas/maas-proxy.conf
     fi
 
 fi

=== modified file 'debian/maas-proxy.postrm'
--- debian/maas-proxy.postrm	2015-08-13 09:01:57 +0000
+++ debian/maas-proxy.postrm	2016-04-01 20:05:40 +0000
@@ -6,7 +6,7 @@
     rm -rf /var/cache/maas-proxy
     rm -rf /var/log/maas/proxy
     rm -rf /var/spool/maas-proxy
-    rm -rf /usr/share/maas/maas-proxy.conf
+    rm -rf /var/lib/maas/maas-proxy.conf
 fi
 
 #DEBHELPER#