Merge ~pwlars/revcache/+git/revcache-charm:ssl-support into ~canonical-hw-cert/revcache/+git/revcache-charm:master

[Paul Larson]

Just noticed I had submitted this against the revcache branch rather than the charm branch originally. Here's the right one.

This adds support for https to revcache, and works with or without chain certificates. It will only configure it for https if you have specified all of the necessary certificate/key files. Otherwise it will configure it for http.

I've tested this locally on my machine, and it does seem to work both with and without ssl certs specified.

[Paul Larson (pwlars)]

I'd like to go ahead and land this and try deployment in production. Self-approving since it's not yet a production service, so if necessary, we can continue to fix/modify as needed with no ill effects

review: Approve

diff --git a/metadata.yaml b/metadata.yaml
index c84b059..5697c5f 100644
--- a/metadata.yaml
+++ b/metadata.yaml
@@ -8,3 +8,16 @@ tags:
 requires:
   db:
     interface: redis
+resources:
+  ssl_certificate:
+    type: file
+    filename: revcache.crt
+    description: SSL Certificate File
+  ssl_chain:
+    type: file
+    filename: revcache-chain.crt
+    description: SSL Certificate Chain File
+  ssl_key:
+    type: file
+    filename: revcache.key
+    description: SSL Key File
diff --git a/playbooks/revcache.yaml b/playbooks/revcache.yaml
index 74066fe..c540ff3 100644
--- a/playbooks/revcache.yaml
+++ b/playbooks/revcache.yaml
@@ -2,6 +2,8 @@
 - hosts: all
   vars:
     - service_dir: "/srv/revcache"
+    - ssl_cert_location: ""
+    - ssl_key_location: ""
   tasks:
     - name: set final status
       shell: status-set active ready
@@ -83,12 +85,55 @@
       tags:
         - install
 
+    - name: Get SSL Certificate File
+      shell: resource-get ssl_certificate || echo -n ""
+      register: ssl_certificate
+      tags:
+        - config-changed
+
+    - name: Get SSL Certificate Chain File
+      shell: resource-get ssl_chain || echo -n ""
+      register: ssl_chain
+      tags:
+        - config-changed
+
+    - name: Get SSL Certificate File
+      shell: resource-get ssl_key || echo -n ""
+      register: ssl_key
+      tags:
+        - config-changed
+
+    - name: Copy SSL Key
+      when: ssl_key.stdout != ""
+      copy:
+        src={{ ssl_key.stdout }}
+        dest=/etc/ssl/private/revcache.key
+      tags:
+        - config-changed
+
+    - name: Copy SSL certificate
+      when: ssl_certificate.stdout != ""
+      shell: cat {{ ssl_certificate.stdout }} {{ ssl_chain.stdout }} > /etc/ssl/certs/revcache.crt
+      tags:
+        - config-changed
+
     - name: Copy nginx site config file
+      when: ssl_key.stdout == "" and 
+            ssl_certificate.stdout == ""
       copy:
         src: "{{ charm_dir }}/templates/revcache-vhost.conf"
         dest: "/etc/nginx/sites-enabled/revcache"
       tags:
-        - install
+        - config-changed
+
+    - name: Copy nginx site config file
+      when: ssl_key.stdout != "" and 
+            ssl_certificate.stdout != ""
+      copy:
+        src: "{{ charm_dir }}/templates/revcache-vhost-https.conf"
+        dest: "/etc/nginx/sites-enabled/revcache"
+      tags:
+        - config-changed
 
     - name: Start revcache
       service:
diff --git a/templates/revcache-vhost-https.conf b/templates/revcache-vhost-https.conf
new file mode 100644
index 0000000..9bb269b
--- /dev/null
+++ b/templates/revcache-vhost-https.conf
@@ -0,0 +1,14 @@
+server {
+    listen 443 ssl;
+    server_name localhost;
+    ssl_certificate /etc/ssl/certs/revcache.crt;
+    ssl_certificate_key /etc/ssl/private/revcache.key;
+    location / {
+        include proxy_params;
+        proxy_pass http://localhost:8000;
+    }
+    location /basic_status {
+        stub_status;
+    }
+    error_log /var/log/revcache-nginx-error.log warn;
+}