Merge ~pjdc/ubuntu-mirror-charm/+git/ubuntu-mirror-charm:linuxcontainers into ubuntu-mirror-charm:master

[Paul Collins]

add linuxcontainers support

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Barry Price (barryprice)]

LGTM

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision c69b05c81bc8af2b1f25e38872d99f58576db775

diff --git a/config.yaml b/config.yaml
index f2b4616..2f5f38c 100644
--- a/config.yaml
+++ b/config.yaml
@@ -511,7 +511,7 @@ options:
     type: string
     description: "Root location of mirrored files for the MAAS images mirror"
   mirror_maas-images_description:
-    default: "Ubuntu Old Releases"
+    default: "MAAS images"
     type: string
     description: "A brief welcome message for the MAAS images mirror"
   mirror_maas-images_rsync_log:
@@ -563,6 +563,85 @@ options:
     description: >
       Local path of the key file to use when triggering downstream
       mirrors.  If empty, downstream mirrors are not triggered.
+  mirror_linuxcontainers_name:
+    default: "images.linuxcontainers.org"
+    type: string
+    description: >
+      FQDN of the Linux Containers image mirror.
+
+      When set to "image.linuxcontainers.org", the virtualhost will
+      redirect to the uk or us subdomain based on the source IP
+      location as determined by GeoIP.
+  mirror_linuxcontainers_aliases:
+    default: '["uk.images.linuxcontainers.org", "us.images.linuxcontainers.org"]'
+    type: string
+    description: >
+      List of Apache aliases for the Linux Containers image mirror.
+
+      When mirror_linuxcontainers_name is set to "images.linuxcontainers.org",
+      a separate virtualhost will be generated for each alias to act
+      as destinations for GeoIP-based redirects and to log traffic to
+      each alias separately.
+
+      Otherwise, these aliases will simple be declared as standard
+      Apache aliases using the ServerAlias directive.
+  mirror_linuxcontainers_path:
+    default: "/srv/ftp.root/lxc-images"
+    type: string
+    description: "Root location of mirrored files for the Linux Containers image mirror"
+  mirror_linuxcontainers_description:
+    default: "Linux Containers (LXC/LXD) Images"
+    type: string
+    description: "A brief welcome message for the Linux Containers image mirror"
+  mirror_linuxcontainers_rsync_log:
+    default: false
+    type: boolean
+    description: "Whether to log rsync requests for the Linux Containers image mirror"
+  mirror_linuxcontainers_command:
+    default: "mirror-linuxcontainers.sh"
+    type: string
+    description: "The command to use to sync the Linux Containers image mirror"
+  mirror_linuxcontainers_source_url:
+    default: "rsync://rsync.images.linuxcontainers.org/lxc-images"
+    type: string
+    description: "The URL the Linux Containers image mirror will be fetched from"
+  mirror_linuxcontainers_rsync_auth:
+    default: '{}'
+    type: string
+    description: "Optional rsync authentication details for mirror_linuxcontainers_source_url"
+  mirror_linuxcontainers_rsync_module:
+    default: "lxc-images"
+    type: string
+    description: "The name of the rsync module for this mirror role"
+  mirror_linuxcontainers_sync_time:
+    default: "ondemand"
+    type: string
+    description: "When mirror updates should be run.  Either a cron(5) format time specification or 'ondemand' for ssh triggering"
+  mirror_linuxcontainers_trigger:
+    default: ""
+    type: string
+    description: "A base64 string containing the ssh trigger public key"
+  mirror_linuxcontainers_apache_early_extra:
+    default: ""
+    type: string
+    description: "A base64 string containing apache configuration options to be included early in the config file"
+  mirror_linuxcontainers_apache_late_extra:
+    default: ""
+    type: string
+    description: "A base64 string containing apache configuration options to be included late in the config file"
+  mirror_linuxcontainers_downstream_mirrors:
+    default: ""
+    type: "string"
+    description: >
+      A space-separated list of mirrors to trigger following a sync.
+      Username defaults to the mirror_user config setting, and
+      otherwise may be specified by "user@host" syntax.
+  mirror_linuxcontainers_trigger_keyfile:
+    default: ""
+    type: "string"
+    description: >
+      Local path of the key file to use when triggering downstream
+      mirrors.  If empty, downstream mirrors are not triggered.
   mirror_old-releases_name:
     default: "old-releases.ubuntu.com"
     type: string
diff --git a/files/check-mirror.sh b/files/check-mirror.sh
index a04d177..003b48a 100755
--- a/files/check-mirror.sh
+++ b/files/check-mirror.sh
@@ -63,14 +63,17 @@ case ${role} in
         unsigned=xenial/current/SHA256SUMS
         signed=${unsigned}.gpg
         ;;
+    linuxcontainers)
+	unsigned=streams/v1/index.json
+	signed=${unsigned}.gpg
+	;;
     old-releases)
         unsigned=ubuntu/dists/warty/Release
         signed=${unsigned}.gpg
         ;;
     simple-streams)
-	# TODO(pjdc): key is not packaged; fetch from install hook?
         unsigned=juju/images/releases/streams/v1/index.json
-        signed=${unsigned}.gpg	# not used
+        signed=${unsigned}.gpg
         ;;
     maas-images)
 	# NOTE(pjdc): ephemeral-v3 is the current stuff and seems to have no fixed paths to signed files we could check
@@ -99,12 +102,18 @@ case ${role} in
     cloud-images)
         keyring_file=/usr/share/keyrings/ubuntu-cloudimage-keyring.gpg
         ;;
+    linuxcontainers)
+	keyring_file=/usr/local/share/ubuntu-mirror-charm.gpg
+	;;
     old-releases)
         keyring_file=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg
         ;;
     ubuntu-cloud-archive)
 	keyring_file=/usr/share/keyrings/ubuntu-cloud-keyring.gpg
 	;;
+    simple-streams)
+	keyring_file=/usr/local/share/ubuntu-mirror-charm.gpg
+	;;
     *)
         keyring_file=/usr/share/keyrings/ubuntu-archive-keyring.gpg
         ;;
diff --git a/files/mirror-linuxcontainers.sh b/files/mirror-linuxcontainers.sh
 new file mode 100755
index 0000000..4f0e3fb
--- /dev/null
+++ b/files/mirror-linuxcontainers.sh
@@ -0,0 +1,97 @@
+#!/bin/bash
+#
+#-------------------------------------------------------#
+# This file is Juju managed - do not make local changes #
+#-------------------------------------------------------#
+#
+# Author: Chris Stratford <[e-mail]>
+# Copyright 2014,2021 Canonical Ltd.
+#
+# Triple-pass rsync mirror for images.linuxcontainers.org
+#
+# ${role}.conf should look like:
+# DEST_DIR=/srv/ftp.root/lxc-images
+# SOURCE_URL=rsync://rsync.image.linuxcontainers.org/lxc-images
+# RSYNC_PASSWORD=secret
+
+if [ $# -lt 1 ]; then
+    myname=$(basename $0)
+    echo "Usage: ${myname} <role>"
+    exit 1
+fi
+
+role=$1
+myhostname=$(hostname)
+logfile=${HOME}/log/mirror-${role}.log
+
+# Magic to make sure things keep running in the background
+# after ssh has gone away
+if [ "$2" != "go" ]; then
+    annotate-output $0 $1 go > ${logfile} 2>&1 &
+    exit 0
+fi
+
+set -u
+
+function log {
+    echo $1
+}
+
+function fatal {
+    log $1
+    exit 1
+}
+
+if [ -f ${HOME}/mirror-config/${role}.conf ]; then
+    . ${HOME}/mirror-config/${role}.conf
+else
+    fatal "${role}.conf file missing - aborting"
+fi
+
+export RSYNC_PASSWORD
+lockfile="Archive-Update-in-Progress-${role}-${myhostname}"
+lockpath="${DEST_DIR}/${lockfile}"
+
+if lockfile -! -l 43200 -r 0 "${lockpath}"; then
+    fatal "${myhostname} is unable to start an rsync for ${role}.  Lockfile exists"
+fi
+trap "rm -f ${lockpath} > /dev/null 2>&1" exit
+
+if [ ! -d ${DEST_DIR} ]; then
+    log "${DEST_DIR} does not exist yet, trying to create it..."
+    mkdir -p ${DEST_DIR} || fatal "Creation of ${DEST_DIR} failed."
+fi
+
+if [ -n "${RSYNC_USER}" ]; then
+    url=$(echo ${SOURCE_URL}|sed -e "s,//,//${RSYNC_USER}@,")
+else
+    url=${SOURCE_URL}
+fi
+
+# If upstream is close to us and triggers us via ssh, we may start
+# syncing before it has deleted its local lock file, which then
+# becomes a "file has vanished" and non-zero exit, causing the trace
+# file to not update, which makes the mirror seem stale when it isn't.
+# Therefore, let's just:
+log "== Sleeping to allow upstream delete its lock file =="
+sleep 5
+
+
+# Here we use a three-phase sunc as per RT#126178.
+log "== Phase 1: Syncing new images from source =="
+rsync --timeout 10800 -a --include='/images/***' --exclude='*' ${SOURCE_URL} ${DEST_DIR} || fatal "Phase 1 sync from $url failed"
+
+log "== Phase 2: Syncing metadata from source =="
+rsync --timeout 10800 -a --exclude "${lockpath}" --exclude '/images/***' --delete ${SOURCE_URL} ${DEST_DIR} || fatal "Phase 2 sync from $url failed"
+
+log "== Phase 3: Removing images no longer present on source =="
+rsync --timeout 10800 -a --include='/images/***' --exclude='*' --delete ${SOURCE_URL} ${DEST_DIR} || fatal "Phase 3 sync from $url failed"
+
+if [ -n "${DOWNSTREAM_MIRRORS}" -a -n "${TRIGGER_KEYFILE}" ]; then
+    t=15m
+    log "== Triggering downstream mirrors (will give up after $t) =="
+    timeout $t ${SCRIPT_DIR}/trigger-downstream-mirrors.sh $role $TRIGGER_KEYFILE $DOWNSTREAM_MIRRORS
+fi
+
+savelog ${logfile} > /dev/null 2>&1
+rm -f ${lockpath} > /dev/null 2>&1
diff --git a/hooks/Config.py b/hooks/Config.py
index 03f840a..5f41727 100755
--- a/hooks/Config.py
+++ b/hooks/Config.py
@@ -241,6 +241,7 @@ class Config:
         return [
             "cdimage",
             "cloud-image",
+            "linuxcontainers",
             "maas-images",
             "old-releases",
             "ports",
diff --git a/hooks/hooks.py b/hooks/hooks.py
index 3c1b3b4..24a6cc8 100755
--- a/hooks/hooks.py
+++ b/hooks/hooks.py
@@ -18,6 +18,8 @@ import sys
 import types
 import yaml
 
+from glob import glob
+
 from charmhelpers.core.host import (
     adduser,
     lsb_release,
@@ -63,11 +65,13 @@ required_pkgs = [
     'apache2',
     'curl',         # for check-mirror.sh
     'devscripts',   # provides annotate-output
+    'geoip-database',
+    'libapache2-mod-geoip',
     'logrotate',
     'procmail',     # provides lockfile
     'rsync',
-    'vsftpd',
     'ubuntu-cloud-keyring',     # for check-mirror.sh
+    'vsftpd',
     'xinetd',
 ]
 
@@ -75,6 +79,7 @@ service_affecting_packages = ['apache2']
 
 apache_modules = [
     'expires',
+    'geoip',
     'headers',
     'rewrite',
 ]
@@ -82,6 +87,7 @@ apache_modules = [
 scripts_to_copy = [
     'mirror-1stage.sh',
     'mirror-2stage.sh',
+    'mirror-linuxcontainers.sh',
     'check-mirror.sh',
     'check-updates.sh',
 ]
@@ -522,8 +528,15 @@ def configure_apache(conf, hostname):  # noqa: C901
             tmpl_data["logdir"] = apache_logdir
             tmpl_data["addresses"] = role_config.get('addresses', ['*'])
             all_addresses.update(tmpl_data["addresses"])
-            tmpl_data["ports"] = [80, 443] if role_config.get('https') else [80]
-            all_ports.update(tmpl_data["ports"])
+
+            ports = [80]
+            if role_config.get('https'):
+                ports.append(443)
+                if role == 'linuxcontainers':
+                    ports.append(8443)
+            all_ports.update(ports)
+            tmpl_data["ports"] = ports
+
             file_from_template(mirror['tmpl_file'], sites_available, tmpl_data)
             ensure_symlink(sites_available, sites_enabled)
 
@@ -543,8 +556,11 @@ def configure_apache(conf, hostname):  # noqa: C901
             os.chown(mirror["path"], mirror_userinfo.pw_uid, mirror_userinfo.pw_gid)
             ensure_symlink(mirror["path"], linkdest)
 
-    # Update ports file
-    all_addresses.discard('*')  # archive.ubuntu.com must not open port 443.
+    # archive.ubuntu.com must not open port 443.  Three factors align
+    # to prevent this: 1) we do not set "addresses" or "https" in the
+    # role_map; 2) the template doesn't make non-port-80 sockets for
+    # members of "addresses"; 3) the wildcard address is discarded.
+    all_addresses.discard('*')
     file_from_template('apache-listen-ports.conf.tmpl', '/etc/apache2/ports.conf',
                        {'addresses': sorted(all_addresses), 'ports': sorted(all_ports)})
 
@@ -939,7 +955,10 @@ def configure_nrpe(conf, hostname):  # noqa: C901
             tmpl_data["hostname"] = hostname
             tmpl_data["use"] = "active-service"
             tmpl_data["nagios_hostname"] = conf.nagios_hostname()
-            tmpl_data["tracepath"] = os.path.join(mirror["path"], ".trace", mirror["base_role"] + "-" + hostname)
+            if role == "linuxcontainers":
+                tmpl_data["tracepath"] = os.path.join(mirror["path"], ".serial")
+            else:
+                tmpl_data["tracepath"] = os.path.join(mirror["path"], ".trace", mirror["base_role"] + "-" + hostname)
 
             for check, check_details in role_checks.items():
                 if check_details.get('when') and not role_config.get(check_details['when']):
@@ -1104,6 +1123,14 @@ def configure_directories(conf, hostname):
         mkdir("/srv/ftp.root")
 
 
+def configure_keyring(conf, hostname):
+    import_cmd = [
+        '/usr/bin/gpg', '--no-default-keyring', '--keyring', '/usr/local/share/ubuntu-mirror-charm.gpg', '--import']
+    keys = glob(os.path.join(charm_dir(), 'keys', '*.asc'))
+    import_cmd.extend(keys)
+    check_call(import_cmd)
+
+
 @hooks.hook("install.real")
 def install():
     conf = Config()
@@ -1134,6 +1161,7 @@ def config_changed():
     configure_nrpe(conf, hostname)
     configure_log_archiving(conf, hostname)
     configure_sysctl(conf, hostname)
+    configure_keyring(conf, hostname)
 
 
 @hooks.hook("upgrade-charm")
diff --git a/keys/juju-tools.asc b/keys/juju-tools.asc
 new file mode 100644
index 0000000..0bf2290
--- /dev/null
+++ b/keys/juju-tools.asc
@@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFJN1n8BEAC1vt2w08Y4ztJrv3maOycMezBb7iUs6DLH8hOZoqRO9EW9558W
+8CN6G4sVbC/nIhivvn/paw0gSicfYXGs5teCJL3ShrcsGkhTs+5q7UO2TVGAUPwb
+CFWCqPkCB/+CiQ/fnEAWV5c11KzMTBtQ2nfJFS8rEQfc2PJMKqd/Y+LDItOc5E5Y
+SseGT/60coyTZO0iE3mKv1osFjSJlUv/6f/ziHGgV+IowOtEeeaEz8H/oU4vHhyA
+THL/k9DSNb0I/+aI8R84OB7EqrQ/ck6B6+CTbwGwkQUBK6z/Isl3uq9MhGjsiPjy
+EfOJNTfa+knlQcedc3/2S/jTUBDxU+myga9gQ2jF4oEzb74LarpV4y1KXpsqyLwd
+8/vpNG5rTLtjZ3ZTJu7EkAra6pNK/Uxj9guIkCIGIVS1SWtsR0mCY+6TOdfJu7bt
+qOcSWkp3gaYcnCid8ecZuD8KDcxJscdYBetxCV4TLVV5CwO4MMVkxcI3zL1ORzHS
+j0W+aYzdtycHu2w8ZQwQRuFB2y5zsxE69MOoS857FzwhRctPSiwIPWH+Qo2BkNAM
+K5fVc19z9kzgtRP1+rHgBox2w+hOSZiYf0vluaG7NPUsMfVOGBFTxn1W+rb3NL/m
+hUoDPl2e2zoViEsaT2p+ATwFDN0DlQLLQxsVIbxdL6cfMQASHmADOHA6dwARAQAB
+tEtKdWp1IFRvb2xzIChDYW5vbmljYWwgSnVqdSBUb29sIEJ1aWxkZXIpIDxqdWp1
+LXRvb2xzLW5vcmVwbHlAY2Fub25pY2FsLmNvbT6JAjkEEwEKACMFAlJN1n8CGwMH
+CwkNCAwHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRA3j2KvahV9szBED/wOlDTMpevL
+bYyh+mFaeNBw/mwCdWqpwQkpIRLwxt0al1eV9KIVhu6CK1g1UMZ24H3gy5Btj5N5
+ga02xgqfQRrP4Mqv2dYZOL5p8WFuZjbow9a+e89mqqFuW6/os57cFwZ7Z3imbBDa
+aWzuzdeWLEK7PfT6rpik6ZMIpI1LGywI93abaZX8v6ouwFeQovXcS0HKt906+ElI
+oWgSh8dL2hqZ71SR/74sehkEZSYfQRLa7RJCDvA/iInXeGRuyaheQ1iTrY606aBh
++NyOgr4cG+7Sy3FIbqgBx0hxkY8LZv4L7l2IDDjgbTEGILpQ2tkykDnFY7QgEdE4
+5TzPONg9zyk91NRHqjLIm9CFt8P3rcs+MBjaxv+S45RIHQEu+ewkr6BihnPPldkN
+eSIi4Z0OTTQfAI0oDkREVFnnOHfzZ8uafHXOnhUYsovZ3YrowoiNXOWRxeOvt5cL
+XE0Gyq7n8ESe9JOCg3AZcrDX12xWX+gaSgDaD66fI5xr+A3128BLpYQTMXOpe1n9
+rfsiA8XBEFsB6+xMJBtSSPUsaWjes/aziI87fBv7FpEMagnWLqJ7xk2E2RR06B9t
+F+SoiLF3aQ0ZJFqKpDDYBO5kZkHIql0jVkuPEz5fxTOZjZE4irTZiSMdJ6xsm9AU
+axxW8e4pax116l4D2toMJPvXkA9lCZ3RIrkCDQRSTdZ/ARAA7SonLFZQrrLD93Jp
+GpgJnYha6rr3pdIm9wH5PnV9Ysgyt/aM9RVrMXzSjMRpxdV6qxK7Lbzh/V9QxpoI
+YvFIi4Yu5k0wDPSm/sowBtVI/X2WMSSvd3DUaigTFBQ1giIY3R46wqcY99RfUPJ1
+VsHFZ0mZq5GuAPSv/Ky7r9SByMDtQk+Pt8jiOIiJ8eGgKy/W0Wau8ImNqSUyj+67
+QeOCpEKTjS2gQypi6vgCtUCDfy4yHPxppARary/GDjVIAvwjdu/+0rshWcWUOwq8
+ex2ddPYQf9dGmF9CesaFknpVnkXb9pbw+qBF/CSdk6Z/ApgtXFGwWszP5/Wqq2Pd
+ilM1C80WcZVhuwk+acYztk5P5hGw0XL2nDeNg08hcDy2NEL/hA9PM2DSFpoWy1aA
+Gjt/8ICPY3SNJlfJUhMIBOK0nmHIoHGU/tX7AiuwEKyP8Qh5kp8fYoO4c59WfeKq
+e6rbttt7IEywAlY6HiLMymqC/d0nPk0Cy5bujacH2y3ahAgCwNVvo+E77J7m7Ui2
+vqzvpcW6Fla2EzbXus4nIgqEV/qX6fQXqItptKZFvZeznj0epRswkmFm7KLXD5p1
+SzkmfAujy5xQJktZKvtTKRROnX5JdBB8RT83MIJr+U4FOT3UPQYc2V1O2k4PYF9G
+g5YZtNPTvdx8dvN7qwiO7R7xenkAEQEAAYkCHwQYAQoACQUCUk3WfwIbDAAKCRA3
+j2KvahV9s4+SD/sEKOBs6YE2dhax0y/wx1AKJbkneVhxTjgCggY/rbnLm6w85xQl
+EgGycmdRq4JkBDhmzsevx+THNJicBwN9qP12Z14kM1pr7WWw9fOmshPQx5kJXYs+
+FiK6f5vHXcNiTyvC8oOGquGrDoB7SACgTr+Lkm/dNfpRn0XsApUy6vQSqChAzqkJ
+qYZCIIbHTea1DIoNhVI+VTaJ1Z5IqMM9mi43RVYeq7yyBNLwhdjEIOX9qBK4Secn
+mFz94SCz+b5titGyFiBAJzPBP/NSwM6DP2OfRhsBC6K4xDELn8Dpucb9FHqaLG75
+K3oDhTEUfTBiG3PRfc57974+V3KrkK71rMzWpQJ2IyMtxzl8qO4JYhLRSL0kMq8/
+hYlXGcNwyUUtiDPOwvG44KDVgXbrnFTVqLU6nc9k/yPD1pfommaTAWrb2tTitkGf
+zOxHnpWTP48l+6qzfEM1PUKvx3U04BZe8JCaU+JVdy6O/rLjEVjYq/vBY6EGOxa2
+C4Vs43YdFOXSa38ze0J4nFRGO8gOBP/EJyE8Nwqg7i+6VvkD+H2KbZVUXiWld+v/
+vwtaXhWd7JS+v38YZ4CijEBe69VYHpSNIz87uhVKgdkFBhoOGtf9/NEO7NYwk7/N
+qsH+JQgcphKkC+JH0Dw7Q/0e16LClkPPa21NseVGUWzS0WmS+0egtDDutg==
+=hQAI
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/keys/lxc-devel.asc b/keys/lxc-devel.asc
 new file mode 100644
index 0000000..90af404
--- /dev/null
+++ b/keys/lxc-devel.asc
@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFLQvwwBEADNVxfLfsKibZbF5v2Tct9N0gxdFViOzVd/IRDrJ6pTEAcMlWdS
+h3VM3lV0qd1WtMlqCTgcbbk6zUAYnPQ2RsagCpOlaIZqbZ8Cv4390PuVAhG2QQvt
+9YrED00unJBomsC3QuF+xg0SBpHChmFUgJxomsFuAjowdMoh8XExM2v4TEe+vm9Z
+7ohBCxkw7C5cV9cQHeC1XiGBCccRe1Ib1U7+GmPUxAtGzHUsQQ4MjE/j830dmPJw
+w/ZNauKyNqSzpBsMnEiX+8RwqYEeYtqBAw9pnA3BMSshfA5L5ORw3zYecowUWt+l
+r5lhzBq2v3LLjzjwsb4wel8L7HZnUD+1bQe0QQkxWDKlHOIsB02DCwmz3fc9bvBI
+KZwRQZ8al7HicpWc4zJPBb7U0BSHE+YwTdOffFFL7YfbRS+4yfn0JBSmtyfTPaOp
+FvHV8MES52Mam3vyXWCKXC//3EXcWhhX4ZHfkcWJtEkDf1FwupptV6HEgx2d6UTZ
+0vEK20Dx+Hzlg0mpR10SS/ltch8w1Zl2co467oTMspdnPosTrxG0p2G+s/gUA/+E
+LY8fB/heXfNSb5IB3JJ8OTI+cwqN1Aw9X4aKPQcvPGvfQ5Mz8FZ4gkV38QzzMHsr
+6eeZGUPcCctP6FVfCHO0Mzxwv2VOnTbH+k72Acni2piTwn0APd9LKilXOwARAQAB
+tDpMWEMgcHJlLWJ1aWx0IGltYWdlcyA8bHhjLWRldmVsQGxpc3RzLmxpbnV4Y29u
+dGFpbmVycy5vcmc+iQI4BBMBAgAiBQJS0L8MAhsDBgsJCAcDAgYVCAIJCgsEFgID
+AQIeAQIXgAAKCRC67/iMIvbiFtzVD/933Dv/NsyPAiwT6BFLlqtq/Tl3NxcUogDS
+Rkv1oMiIunaKZRE/pQbLJVTSbt/eC3Kz7I40juDNsFGXXhD/sQCovMc58NpTKNPR
+zs3jC5vDIW721cLOhYqITvdWN+RKDCJqxBBNJztKEv29uA0PONssKBmC/apTdB6D
+QLLy3ddO/LzxDrCtC8ePLGjeVoEelZHR3tg8QZE+oVBuL3ZC2NTg/XaLSDO4zGCg
+Jyd1IHGKhi20Q/sBLmsFifnWt5b6ovmRqwlsZXqcS+a7Z+WSmZWT9hKIR2XSzYUW
+pmlJNO4VPzHgEcaCxlw3HxQqX0Loz4R8Y91shKuJ591ZMtmyf4j6Yl9KZfLs+lZH
+iX7uazhw4miXdpCvOKe8fPLa+68JGIYPxG22l2jqPJ9FIOtpSrJX3D/i8xed5h2V
+Vd38fZBn+cH1Wqbw1Ni94/f66Rp5GzJyMoVO7A016Ek3wx920SmX4HkCSEel77pF
+gvCBZkQDiD6TNCJxjHQpxoSGo6SDEfP0FjntB0yVy0zi+Iij9F3O1bPIIuses4OQ
+FkUGJb6V0L1wXl5hOARmVtgn6klwhsLf0EsjuH9yJN2GCuaKdjAdR8J1TsjW+q4h
+DKMvYOZ99YJUE+qujz9u93tJRZTuD8pQsGRez7qrZ0LUAdd/aOjNDLWzJ8AzeQE+
+OKVNmCzO9A==
+=euOK
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/templates/apache-linuxcontainers-api.include.tmpl b/templates/apache-linuxcontainers-api.include.tmpl
 new file mode 100644
index 0000000..36cf273
--- /dev/null
+++ b/templates/apache-linuxcontainers-api.include.tmpl
@@ -0,0 +1,41 @@
+## This template does not use any Cheetah features (yet?) but for
+## consistency it is not included raw, and therefore $ is escaped.
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*\$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*\$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)\$ /meta/simplestreams\$1 [L]
diff --git a/templates/apache-linuxcontainers-tls.include.tmpl b/templates/apache-linuxcontainers-tls.include.tmpl
 new file mode 100644
index 0000000..3851d19
--- /dev/null
+++ b/templates/apache-linuxcontainers-tls.include.tmpl
@@ -0,0 +1,16 @@
+#if $port == 80
+#set $proto = 'http'
+#else if $port == 443
+#set $proto = 'https'
+#else
+#set $proto = 'https'
+#end if
+    # SSL configuration
+    SSLEngine On
+    SSLCertificateFile /etc/ssl/certs/${name}.crt
+    SSLCertificateKeyFile /etc/ssl/private/${name}.key
+    SSLCertificateChainFile /etc/ssl/certs/${name}_chain.crt
+    Header always set Strict-Transport-Security "max-age=31536000"
+    RequestHeader set X_FORWARDED_PORT "${port}"
+    RequestHeader set X_FORWARDED_PROTO "${proto}"
+
diff --git a/templates/apache-linuxcontainers.tmpl b/templates/apache-linuxcontainers.tmpl
 new file mode 100644
index 0000000..f2c9391
--- /dev/null
+++ b/templates/apache-linuxcontainers.tmpl
@@ -0,0 +1,74 @@
+#for $port in $ports
+#set global $port = $port
+#set $sockets = ' '.join(sorted(['{}:{}'.format(address, port) for address in $addresses]))
+#if $port == 80
+#set global $proto = 'http'
+#set $uk_url = 'http://uk.{}/'.format($name)
+#set $us_url = 'http://us.{}/'.format($name)
+#else if $port == 443
+#set global $proto = 'https'
+#set $uk_url = 'https://uk.{}/'.format($name)
+#set $us_url = 'https://us.{}/'.format($name)
+#else
+#set global $proto = 'https'
+#set $uk_url = 'https://uk.{}:{}/'.format($name, $port)
+#set $us_url = 'https://us.{}:{}/'.format($name, $port)
+#end if
+<VirtualHost ${sockets}>
+    ServerName ${name}
+#if $name != "images.linuxcontainers.org"
+    #for $alias in $aliases
+    ServerAlias ${alias}
+    #end for
+#end if
+    CustomLog \${APACHE_LOG_DIR}/${name}.log vhost_combined
+    DocumentRoot /srv/${name}/www
+
+    <Location />
+        Require all granted
+    </Location>
+
+#if $proto == "https"
+#include 'templates/apache-linuxcontainers-tls.include.tmpl'
+#end if
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+#if $name == "images.linuxcontainers.org"
+    # GeoIP: Redirect everything to appropriate country server
+    GeoIPEnable On
+    GeoIPDBFile /usr/share/GeoIP/GeoIP.dat
+    GeoIPDBFile /usr/share/GeoIP/GeoIPv6.dat
+
+    # Send North America, Oceania and South America to the US server
+    RewriteCond %{ENV:GEOIP_CONTINENT_CODE} ^(NA|OC|SA)\$
+    RewriteRule ^/(.*)\$ ${us_url}\$1 [R=301,L]
+    RewriteCond %{ENV:GEOIP_CONTINENT_CODE_V6} ^(NA|OC|SA)\$
+    RewriteRule ^/(.*)\$ ${us_url}\$1 [R=301,L]
+
+    # Send Africa, Antarctica, Asia, Europe, and all else to the UK server
+    RewriteRule ^/(.*)\$ ${uk_url}\$1 [R=301,L]
+#else
+#include 'templates/apache-linuxcontainers-api.include.tmpl'
+#end if
+</VirtualHost>
+
+#if $name == "images.linuxcontainers.org"
+#for $alias in $aliases
+<VirtualHost ${sockets}>
+    ServerName ${alias}
+    CustomLog \${APACHE_LOG_DIR}/${alias}.log vhost_combined
+    DocumentRoot /srv/${name}/www
+
+#if $proto == "https"
+#include 'templates/apache-linuxcontainers-tls.include.tmpl'
+#end if
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+#include 'templates/apache-linuxcontainers-api.include.tmpl'
+</VirtualHost>
+
+#end for
+#end if
+#end for
diff --git a/tests/unit/test_linuxcontainers.py b/tests/unit/test_linuxcontainers.py
 new file mode 100644
index 0000000..5a485ea
--- /dev/null
+++ b/tests/unit/test_linuxcontainers.py
@@ -0,0 +1,56 @@
+import os
+import pytest
+import unittest
+
+from Cheetah.Template import Template
+
+TEMPLATE = 'apache-linuxcontainers.tmpl'
+
+THIRDPARTY_SEARCH_LIST = {
+    'addresses': ['*'],
+    'name': 'lxd.example.net',
+    'aliases': ['uk.lxd.example.net', 'us.lxd.example.net'],
+    'ports': [80, 443],
+}
+
+LINUXCONTAINERS_SEARCH_LIST = {
+    'addresses': ['91.189.88.247',  '[2001:67c:1360:8001::33]'],
+    'name': 'images.linuxcontainers.org',
+    'aliases': ['uk.images.linuxcontainers.org', 'us.images.linuxcontainers.org'],
+    'ports': [80, 443, 8443],
+}
+
+
+class TestLinuxcontainers(unittest.TestCase):
+    def setUp(self):
+        self.addTypeEqualityFunc(str, self.assertMultiLineEqual)
+        self.maxDiff = None
+        self.testdata_dir = os.path.join(os.path.dirname(__file__), 'testdata', 'linuxcontainers')
+
+    def _template_compare(self, template, search_list, wanted_file):
+        template_file = os.path.join(os.getcwd(), template)
+        template = Template(file=template_file, searchList=search_list)
+        wanted = open(wanted_file).read()
+        self.assertEqual(str(template), wanted)
+
+    # Cheetah warns about using the Python version of NameMapper, so
+    # we ignore it here.  Matching more closely by the message doesn't
+    # seem to work, probably because it begins with a newline and
+    # Python's warnings matching code anchors the message regexp.
+    @pytest.mark.filterwarnings("ignore::UserWarning:Cheetah")
+    def test_template_linuxcontainers(self):
+        self._template_compare(
+            os.path.join(os.getcwd(), 'templates', TEMPLATE),
+            LINUXCONTAINERS_SEARCH_LIST,
+            os.path.join(self.testdata_dir, 'linuxcontainers.txt'))
+
+    # Cheetah warns about using the Python version of NameMapper, so
+    # we ignore it here.  Matching more closely by the message doesn't
+    # seem to work, probably because it begins with a newline and
+    # Python's warnings matching code anchors the message regexp.
+    @pytest.mark.filterwarnings("ignore::UserWarning:Cheetah")
+    def test_template_thirdparty(self):
+        self._template_compare(
+            os.path.join(os.getcwd(), 'templates', TEMPLATE),
+            THIRDPARTY_SEARCH_LIST,
+            os.path.join(self.testdata_dir, 'thirdparty.txt'))
diff --git a/tests/unit/testdata/linuxcontainers/linuxcontainers.txt b/tests/unit/testdata/linuxcontainers/linuxcontainers.txt
 new file mode 100644
index 0000000..1056067
--- /dev/null
+++ b/tests/unit/testdata/linuxcontainers/linuxcontainers.txt
@@ -0,0 +1,429 @@
+<VirtualHost 91.189.88.247:80 [2001:67c:1360:8001::33]:80>
+    ServerName images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    <Location />
+        Require all granted
+    </Location>
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # GeoIP: Redirect everything to appropriate country server
+    GeoIPEnable On
+    GeoIPDBFile /usr/share/GeoIP/GeoIP.dat
+    GeoIPDBFile /usr/share/GeoIP/GeoIPv6.dat
+
+    # Send North America, Oceania and South America to the US server
+    RewriteCond %{ENV:GEOIP_CONTINENT_CODE} ^(NA|OC|SA)$
+    RewriteRule ^/(.*)$ http://us.images.linuxcontainers.org/$1 [R=301,L]
+    RewriteCond %{ENV:GEOIP_CONTINENT_CODE_V6} ^(NA|OC|SA)$
+    RewriteRule ^/(.*)$ http://us.images.linuxcontainers.org/$1 [R=301,L]
+
+    # Send Africa, Antarctica, Asia, Europe, and all else to the UK server
+    RewriteRule ^/(.*)$ http://uk.images.linuxcontainers.org/$1 [R=301,L]
+</VirtualHost>
+
+<VirtualHost 91.189.88.247:80 [2001:67c:1360:8001::33]:80>
+    ServerName uk.images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/uk.images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)$ /meta/simplestreams$1 [L]
+</VirtualHost>
+
+<VirtualHost 91.189.88.247:80 [2001:67c:1360:8001::33]:80>
+    ServerName us.images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/us.images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)$ /meta/simplestreams$1 [L]
+</VirtualHost>
+
+<VirtualHost 91.189.88.247:443 [2001:67c:1360:8001::33]:443>
+    ServerName images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # SSL configuration
+    SSLEngine On
+    SSLCertificateFile /etc/ssl/certs/images.linuxcontainers.org.crt
+    SSLCertificateKeyFile /etc/ssl/private/images.linuxcontainers.org.key
+    SSLCertificateChainFile /etc/ssl/certs/images.linuxcontainers.org_chain.crt
+    Header always set Strict-Transport-Security "max-age=31536000"
+    RequestHeader set X_FORWARDED_PORT "443"
+    RequestHeader set X_FORWARDED_PROTO "https"
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # GeoIP: Redirect everything to appropriate country server
+    GeoIPEnable On
+    GeoIPDBFile /usr/share/GeoIP/GeoIP.dat
+    GeoIPDBFile /usr/share/GeoIP/GeoIPv6.dat
+
+    # Send North America, Oceania and South America to the US server
+    RewriteCond %{ENV:GEOIP_CONTINENT_CODE} ^(NA|OC|SA)$
+    RewriteRule ^/(.*)$ https://us.images.linuxcontainers.org/$1 [R=301,L]
+    RewriteCond %{ENV:GEOIP_CONTINENT_CODE_V6} ^(NA|OC|SA)$
+    RewriteRule ^/(.*)$ https://us.images.linuxcontainers.org/$1 [R=301,L]
+
+    # Send Africa, Antarctica, Asia, Europe, and all else to the UK server
+    RewriteRule ^/(.*)$ https://uk.images.linuxcontainers.org/$1 [R=301,L]
+</VirtualHost>
+
+<VirtualHost 91.189.88.247:443 [2001:67c:1360:8001::33]:443>
+    ServerName uk.images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/uk.images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    # SSL configuration
+    SSLEngine On
+    SSLCertificateFile /etc/ssl/certs/images.linuxcontainers.org.crt
+    SSLCertificateKeyFile /etc/ssl/private/images.linuxcontainers.org.key
+    SSLCertificateChainFile /etc/ssl/certs/images.linuxcontainers.org_chain.crt
+    Header always set Strict-Transport-Security "max-age=31536000"
+    RequestHeader set X_FORWARDED_PORT "443"
+    RequestHeader set X_FORWARDED_PROTO "https"
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)$ /meta/simplestreams$1 [L]
+</VirtualHost>
+
+<VirtualHost 91.189.88.247:443 [2001:67c:1360:8001::33]:443>
+    ServerName us.images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/us.images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    # SSL configuration
+    SSLEngine On
+    SSLCertificateFile /etc/ssl/certs/images.linuxcontainers.org.crt
+    SSLCertificateKeyFile /etc/ssl/private/images.linuxcontainers.org.key
+    SSLCertificateChainFile /etc/ssl/certs/images.linuxcontainers.org_chain.crt
+    Header always set Strict-Transport-Security "max-age=31536000"
+    RequestHeader set X_FORWARDED_PORT "443"
+    RequestHeader set X_FORWARDED_PROTO "https"
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)$ /meta/simplestreams$1 [L]
+</VirtualHost>
+
+<VirtualHost 91.189.88.247:8443 [2001:67c:1360:8001::33]:8443>
+    ServerName images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # SSL configuration
+    SSLEngine On
+    SSLCertificateFile /etc/ssl/certs/images.linuxcontainers.org.crt
+    SSLCertificateKeyFile /etc/ssl/private/images.linuxcontainers.org.key
+    SSLCertificateChainFile /etc/ssl/certs/images.linuxcontainers.org_chain.crt
+    Header always set Strict-Transport-Security "max-age=31536000"
+    RequestHeader set X_FORWARDED_PORT "8443"
+    RequestHeader set X_FORWARDED_PROTO "https"
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # GeoIP: Redirect everything to appropriate country server
+    GeoIPEnable On
+    GeoIPDBFile /usr/share/GeoIP/GeoIP.dat
+    GeoIPDBFile /usr/share/GeoIP/GeoIPv6.dat
+
+    # Send North America, Oceania and South America to the US server
+    RewriteCond %{ENV:GEOIP_CONTINENT_CODE} ^(NA|OC|SA)$
+    RewriteRule ^/(.*)$ https://us.images.linuxcontainers.org:8443/$1 [R=301,L]
+    RewriteCond %{ENV:GEOIP_CONTINENT_CODE_V6} ^(NA|OC|SA)$
+    RewriteRule ^/(.*)$ https://us.images.linuxcontainers.org:8443/$1 [R=301,L]
+
+    # Send Africa, Antarctica, Asia, Europe, and all else to the UK server
+    RewriteRule ^/(.*)$ https://uk.images.linuxcontainers.org:8443/$1 [R=301,L]
+</VirtualHost>
+
+<VirtualHost 91.189.88.247:8443 [2001:67c:1360:8001::33]:8443>
+    ServerName uk.images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/uk.images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    # SSL configuration
+    SSLEngine On
+    SSLCertificateFile /etc/ssl/certs/images.linuxcontainers.org.crt
+    SSLCertificateKeyFile /etc/ssl/private/images.linuxcontainers.org.key
+    SSLCertificateChainFile /etc/ssl/certs/images.linuxcontainers.org_chain.crt
+    Header always set Strict-Transport-Security "max-age=31536000"
+    RequestHeader set X_FORWARDED_PORT "8443"
+    RequestHeader set X_FORWARDED_PROTO "https"
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)$ /meta/simplestreams$1 [L]
+</VirtualHost>
+
+<VirtualHost 91.189.88.247:8443 [2001:67c:1360:8001::33]:8443>
+    ServerName us.images.linuxcontainers.org
+    CustomLog ${APACHE_LOG_DIR}/us.images.linuxcontainers.org.log vhost_combined
+    DocumentRoot /srv/images.linuxcontainers.org/www
+
+    # SSL configuration
+    SSLEngine On
+    SSLCertificateFile /etc/ssl/certs/images.linuxcontainers.org.crt
+    SSLCertificateKeyFile /etc/ssl/private/images.linuxcontainers.org.key
+    SSLCertificateChainFile /etc/ssl/certs/images.linuxcontainers.org_chain.crt
+    Header always set Strict-Transport-Security "max-age=31536000"
+    RequestHeader set X_FORWARDED_PORT "8443"
+    RequestHeader set X_FORWARDED_PROTO "https"
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)$ /meta/simplestreams$1 [L]
+</VirtualHost>
+
diff --git a/tests/unit/testdata/linuxcontainers/thirdparty.txt b/tests/unit/testdata/linuxcontainers/thirdparty.txt
 new file mode 100644
index 0000000..0b1e58d
--- /dev/null
+++ b/tests/unit/testdata/linuxcontainers/thirdparty.txt
@@ -0,0 +1,119 @@
+<VirtualHost *:80>
+    ServerName lxd.example.net
+    ServerAlias uk.lxd.example.net
+    ServerAlias us.lxd.example.net
+    CustomLog ${APACHE_LOG_DIR}/lxd.example.net.log vhost_combined
+    DocumentRoot /srv/lxd.example.net/www
+
+    <Location />
+        Require all granted
+    </Location>
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)$ /meta/simplestreams$1 [L]
+</VirtualHost>
+
+<VirtualHost *:443>
+    ServerName lxd.example.net
+    ServerAlias uk.lxd.example.net
+    ServerAlias us.lxd.example.net
+    CustomLog ${APACHE_LOG_DIR}/lxd.example.net.log vhost_combined
+    DocumentRoot /srv/lxd.example.net/www
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # SSL configuration
+    SSLEngine On
+    SSLCertificateFile /etc/ssl/certs/lxd.example.net.crt
+    SSLCertificateKeyFile /etc/ssl/private/lxd.example.net.key
+    SSLCertificateChainFile /etc/ssl/certs/lxd.example.net_chain.crt
+    Header always set Strict-Transport-Security "max-age=31536000"
+    RequestHeader set X_FORWARDED_PORT "443"
+    RequestHeader set X_FORWARDED_PROTO "https"
+
+    RewriteEngine on
+    AllowEncodedSlashes On
+
+    # LXD: Recursive queries
+    RewriteCond %{QUERY_STRING} recursion=1
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index-rec.json [L]
+
+    # LXD: Normal queries
+    RewriteRule ^/1.0.*$ /meta/lxd%{REQUEST_URI}/index.json [L]
+
+    <Location />
+        Require all granted
+    </Location>
+
+    # LXC: Allow image listing
+    <Location /images>
+        Options +Indexes
+    </Location>
+
+    # LXD: API root
+    <Location /1.0/>
+        ErrorDocument 404 /meta/lxd/404.json
+        Options -Indexes
+    </Location>
+
+    # LXD: images
+    <Location /1.0/images/>
+        ErrorDocument 404 /meta/lxd/1.0/images/404.json
+        Options +FollowSymlinks
+    </Location>
+
+    # LXD: aliases
+    <Location /1.0/images/aliases/>
+        ErrorDocument 404 /meta/lxd/404.json
+    </Location>
+
+    # LXD: downloads
+    <LocationMatch "^/1.0/images/[0-9a-f]*/export">
+        Header set Content-Type "multipart/form-data; boundary=f012e447-25dd-4f6d-8a14-105c3b27a768"
+    </LocationMatch>
+    # Simplestreams: redirect
+    RewriteRule ^/streams(.*)$ /meta/simplestreams$1 [L]
+</VirtualHost>
+