Merge branch 'master' into occi

f4f72d6b · Cédric de Saint Martin · d2562e4b · c7d16ba5 · f4f72d6b · f4f72d6b
Commit f4f72d6b authored Mar 05, 2012 by Cédric de Saint Martin
35 changed files
--- a/CHANGES.txt
+++ b/CHANGES.txt
 Changes
 =======

-0.39 (unreleased)
+0.40.1 (2012-03-01)
 -----------------

- * No changes yet.
+ * Fix manifest to include files needed for apache. [Cedric de Saint Martin]
+
+0.40 (2012-03-01)
+-----------------
+
+ * apache_frontend initial release. [Cedric de Saint Martin]
+ 
+0.39 (2012-02-20)
+-----------------
+
+ * seleniumrunner initial release. [Cedric de Saint Martin]

 0.38 (2011-12-05)
 -----------------
@@ -190,9 +200,10 @@ Changes
 -----------------

 * Add PHPMyAdmin software release used in SlapOS tutorials
-   [Cedric de Saint Martin]
+ [Cedric de Saint Martin]
 * Add slaprunner software release [Cedric de Saint Martin]

+
 0.9 (2011-06-24)
 ----------------


--- a/MANIFEST.in
+++ b/MANIFEST.in
 include CHANGES.txt
 include slapos/recipe/generic_zope/template/site.zcml
+include slapos/recipe/apache_frontend/template/notfound.html
 recursive-include slapos/recipe *.in
 recursive-include slapos/recipe *.bin
 recursive-include slapos/recipe README.*.txt
--- a/component/apache/buildout.cfg
+++ b/component/apache/buildout.cfg
@@ -13,23 +13,13 @@ extends =
  ../sqlite3/buildout.cfg
  ../zlib/buildout.cfg

-[apache-CVE-2011-3368.patch]
-recipe = hexagonit.recipe.download
-md5sum = 1ad598213480ddfc239ce6359b7b2c0b
-url = http://www.apache.org/dist/httpd/patches/apply_to_2.2.21/CVE-2011-3368.patch
-filename = ${:_buildout_section_name_}
-download-only = true
-
 [apache]
 # inspired on http://old.aclark.net/team/aclark/blog/a-lamp-buildout-for-wordpress-and-other-php-apps/
 recipe = hexagonit.recipe.cmmi
 depends =
  ${gdbm:version}
-url = http://mir2.ovh.net/ftp.apache.org/dist//httpd/httpd-2.2.21.tar.bz2
-md5sum = 1696ae62cd879ab1d4dd9ff021a470f2
-patches =
-  ${apache-CVE-2011-3368.patch:location}/${apache-CVE-2011-3368.patch:filename}
-patch-options = -p1
+url = http://mir2.ovh.net/ftp.apache.org/dist//httpd/httpd-2.2.22.tar.bz2
+md5sum = 9fe3093194c8a57f085ff7c3fc43715f
 configure-options = --disable-static
                    --enable-authn-alias
                    --enable-bucketeer

--- a/component/binutils/buildout.cfg
+++ b/component/binutils/buildout.cfg
+[buildout]
+parts =
+  binutils
+
+[binutils]
+recipe = hexagonit.recipe.cmmi
+url = http://ftp.gnu.org/gnu/binutils/binutils-2.21.1.tar.bz2
+md5sum = bde820eac53fa3a8d8696667418557ad
--- a/component/ca-certificates/buildout.cfg
+++ b/component/ca-certificates/buildout.cfg
@@ -14,7 +14,7 @@ download-only = true

 [ca-certificates]
 recipe = hexagonit.recipe.cmmi
-version = 20111211
+version = 20120212
 url = ftp://ftp.free.fr/mirrors/ftp.debian.org/pool/main/c/ca-certificates/ca-certificates_${:version}.tar.gz
 patches =
  ${ca-certificates-sbin-dir.patch:location}/${ca-certificates-sbin-dir.patch:filename}

--- a/component/cloudooo/buildout.cfg
+++ b/component/cloudooo/buildout.cfg
 [buildout]
-software_home = ${:directory}
-
 extends =
-  ../profiles/versions-common.cfg
-  ../profiles/software-definition.cfg
-  ../profiles/common.cfg
-  ../xpdf/buildout.cfg
-  ../imagemagick/buildout.cfg
-  ../file/buildout.cfg
-  ../pdftk/buildout.cfg
-  ../ffmpeg/buildout.cfg
-  ../python-2.6/buildout.cfg
-  ../libreoffice-bin/buildout.cfg
  ../lxml-python/buildout.cfg

-python = software_definition
-versions = versions
 parts =
-  instance_template
  cloudooo
-  imagemagick
-  instance-egg
-  libreoffice-bin
-  file
-  xpdf
-  pdftk
-  ffmpeg
-  python2.6
-  bootstrap2.6

-cloudooo-packages = 
-  cloudooo.handler.ooo
-  cloudooo.handler.pdf
-  cloudooo.handler.ffmpeg
-  cloudooo.handler.imagemagick
-  cloudooo
+sources = sources

+[sources]
+# Include information related to official cloudooo source code.
+cloudooo = git http://git.erp5.org/repos/cloudooo.git

-[instance-egg]
-recipe = zc.recipe.egg
+[lxml-python]
 python = python2.6
-eggs = 
-  erp5.recipe.cloudoooinstance
-  z3c.recipe.mkdir
-  ${buildout:cloudooo-packages}
-

 [cloudooo]
 recipe = zc.recipe.egg
 python = python2.6
-interpreter = pycloudoo
-scripts = 
 eggs =
  ${lxml-python:egg}
-  collective.recipe.supervisor
-  plone.recipe.command
-  erp5.extension.sectionextender
-  supervisor
-  ${buildout:cloudooo-packages}
-
-[software_definition]
-software_home = ${buildout:directory}
-executable = ${python2.6:executable}
+  cloudooo
+  PasteScript
+scripts =
+  paster=cloudooo_paster
--- a/component/dropbear/buildout.cfg
+++ b/component/dropbear/buildout.cfg
@@ -32,6 +32,13 @@ url = ${:_profile_base_location_}/${:filename}
 filename = no-shell-checking.patch
 download-only = true

+[dropbear-static_build_fix.patch]
+recipe = hexagonit.recipe.download
+md5sum = 6e0ccc1949dfa31b4bc3951b9bb6472e
+url = ${:_profile_base_location_}/${:filename}
+filename = dropbear-0.53.1-static_build_fix.patch
+download-only = true
+
 [dropbear]
 recipe = hexagonit.recipe.cmmi
 md5sum = 0284ea239083f04c8b874e08e1aca243
@@ -52,6 +59,7 @@ patches=
  ${dropbear-userspace-patch:location}/${dropbear-userspace-patch:filename}
  ${dropbear-ipv6-patch:location}/${dropbear-ipv6-patch:filename}
  ${dropbear-no-shell-check-patch:location}/${dropbear-no-shell-check-patch:filename}
+  ${dropbear-static_build_fix.patch:location}/${dropbear-static_build_fix.patch:filename}

 patch-options=
  -p1
--- a/component/dropbear/dropbear-0.53.1-static_build_fix.patch
+++ b/component/dropbear/dropbear-0.53.1-static_build_fix.patch
+--- a/Makefile.in	2012-02-13 18:01:23.505279581 +0100
+++ b/Makefile.in	2012-02-13 18:04:17.070140233 +0100
+@@ -77,7 +77,7 @@
+ INSTALL=@INSTALL@
+ CPPFLAGS=@CPPFLAGS@
+ CFLAGS+=-I. -I$(srcdir) $(CPPFLAGS) @CFLAGS@
+-LIBS+=@LIBS@
+LIBS+=@CRYPTLIB@ @LIBS@
+ LDFLAGS=@LDFLAGS@
+ 
+ EXEEXT=@EXEEXT@
--- a/component/slapos/buildout.cfg
+++ b/component/slapos/buildout.cfg
@@ -123,14 +123,14 @@ hexagonit.recipe.cmmi = 1.5.0
 lxml = 2.3.3
 meld3 = 0.6.8
 netaddr = 0.7.6
-slapos.core = 0.22
+slapos.core = 0.23
 slapos.libnetworkcache = 0.12
 xml-marshaller = 0.9.7
 z3c.recipe.scripts = 1.0.1 
 zc.recipe.egg = 1.3.2

 # Required by:
-# slapos.core==0.22
+# slapos.core==0.23
 Flask = 0.8

 # Required by:
@@ -138,11 +138,11 @@ Flask = 0.8
 hexagonit.recipe.download = 1.5.0

 # Required by:
-# slapos.core==0.22
+# slapos.core==0.23
 netifaces = 0.8

 # Required by:
-# slapos.core==0.22
+# slapos.core==0.23
 # slapos.libnetworkcache==0.12
 # supervisor==3.0a12
 # zc.buildout==1.6.0-dev-SlapOS-004
@@ -150,9 +150,9 @@ netifaces = 0.8
 setuptools = 0.6c12dev-r88846

 # Required by:
-# slapos.core==0.22
+# slapos.core==0.23
 supervisor = 3.0a12

 # Required by:
-# slapos.core==0.22
+# slapos.core==0.23
 zope.interface = 3.8.0
--- a/setup.py
+++ b/setup.py
@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 import glob
 import os

-version = '0.39-dev'
+version = '0.40.1'
 name = 'slapos.cookbook'
 long_description = open("README.txt").read() + "\n" + \
    open("CHANGES.txt").read() + "\n"
@@ -40,6 +40,7 @@ setup(name=name,
      zip_safe=True,
      entry_points={
        'zc.buildout': [
+          'apache.frontend = slapos.recipe.apache_frontend:Recipe',
          'apachephp = slapos.recipe.apachephp:Recipe',
          'apacheproxy = slapos.recipe.apacheproxy:Recipe',
          'apache.zope.backend = slapos.recipe.apache_zope_backend:Recipe',

--- a/slapos/recipe/README.apache_frontend.txt
+++ b/slapos/recipe/README.apache_frontend.txt
+apache_frontend
+==========
+
+Frontend using Apache, allowing to rewrite and proxy URLs like myinstance.myfrontenddomainname.com to real IP/URL of myinstance.
\ No newline at end of file
--- a/slapos/recipe/README.helloworld.txt
+++ b/slapos/recipe/README.helloworld.txt
-helloworld
-==========
-
-It only installs a dummy wrapper saying "Hello World!" and sends to the master an "HelloWorld" parameter.
--- a/slapos/recipe/apache_frontend/__init__.py
+++ b/slapos/recipe/apache_frontend/__init__.py
+##############################################################################
+#
+# Copyright (c) 2010 Vifib SARL and Contributors. All Rights Reserved.
+#
+# WARNING: This program as such is intended to be used by professional
+# programmers who take the whole responsibility of assessing all potential
+# consequences resulting from its eventual inadequacies and bugs
+# End users who are looking for a ready-to-use solution with commercial
+# guarantees and support are strongly adviced to contract a Free Software
+# Service Company
+#
+# This program is Free Software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 3
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+#
+##############################################################################
+from slapos.recipe.librecipe import BaseSlapRecipe
+import os
+import pkg_resources
+import hashlib
+import sys
+import zc.buildout
+import zc.recipe.egg
+import ConfigParser
+import re
+
+
+class Recipe(BaseSlapRecipe):
+
+  def getTemplateFilename(self, template_name):
+    return pkg_resources.resource_filename(__name__,
+        'template/%s' % template_name)
+
+  def _install(self):
+    self.path_list = []
+    self.requirements, self.ws = self.egg.working_set()
+
+    # self.cron_d is a directory, where cron jobs can be registered
+    self.cron_d = self.installCrond()
+    self.logrotate_d, self.logrotate_backup = self.installLogrotate()
+    self.killpidfromfile = zc.buildout.easy_install.scripts(
+        [('killpidfromfile', 'slapos.recipe.erp5.killpidfromfile',
+          'killpidfromfile')], self.ws, sys.executable, self.bin_directory)[0]
+
+    self.path_list.append(self.killpidfromfile)
+
+    frontend_port_number = self.parameter_dict.get("port", 4443)
+    frontend_domain_name = self.parameter_dict.get("domain",
+        "host.vifib.net")
+
+    base_varnish_port = 26009
+    slave_instance_list = self.parameter_dict.get("slave_instance_list", [])
+    rewrite_rule_list = []
+    slave_dict = {}
+    service_dict = {}
+    if frontend_port_number is 443:
+      base_url = "%s/" % frontend_domain_name
+    else:
+      base_url = "%s:%s/" % (frontend_domain_name, frontend_port_number)
+    for slave_instance in slave_instance_list:
+      url = slave_instance.get("url")
+      if url is None:
+        continue
+      reference = slave_instance.get("slave_reference")
+      subdomain = reference.replace("-", "").lower()
+      slave_dict[reference] = "https://%s.%s" % (subdomain, base_url)
+
+      enable_cache = slave_instance.get("enable_cache", "")
+      if enable_cache.upper() in ('1', 'TRUE'):
+        # Varnish should use stunnel to connect to the backend
+        base_varnish_control_port = base_varnish_port
+        base_varnish_port += 1
+        # Use regex
+        host_regex = "((\[\w*|[0-9]+\.)(\:|)).*(\]|\.[0-9]+)"
+        slave_host = re.search(host_regex, url).group(0)
+        port_regex = "\w+(\/|)$"
+        matcher = re.search(port_regex, url)
+        if matcher is not None:
+          slave_port = matcher.group(0)
+          slave_port = slave_port.replace("/", "")
+        elif url.startswith("https://"):
+          slave_port = 443
+        else:
+          slave_port = 80
+        service_name = "varnish_%s" % reference
+        varnish_ip = self.getLocalIPv4Address()
+        stunnel_port = base_varnish_port + 1
+        self.installVarnishCache(service_name,
+          ip=varnish_ip,
+          port=base_varnish_port,
+          control_port=base_varnish_control_port,
+          backend_host=varnish_ip,
+          backend_port=stunnel_port,
+          size="1G")
+        service_dict[service_name] = dict(public_ip=varnish_ip,
+            public_port=stunnel_port,
+            private_ip=slave_host.replace("[", "").replace("]", ""),
+            private_port=slave_port)
+        rewrite_rule_list.append("%s.%s http://%s:%s" % \
+            (reference.replace("-", ""), frontend_domain_name,
+            varnish_ip, base_varnish_port))
+        base_varnish_port += 2
+      else:
+        rewrite_rule_list.append("%s.%s %s" % (subdomain, frontend_domain_name,
+            url))
+
+    valid_certificate_str = self.parameter_dict.get("domain_ssl_ca_cert")
+    valid_key_str = self.parameter_dict.get("domain_ssl_ca_key")
+
+    if valid_certificate_str is None and valid_key_str is None:
+      ca_conf = self.installCertificateAuthority()
+      key, certificate = self.requestCertificate(frontend_domain_name)
+    else:
+      ca_conf = self.installValidCertificateAuthority(
+          frontend_domain_name, valid_certificate_str, valid_key_str)
+      key = ca_conf.pop("key")
+      certificate = ca_conf.pop("certificate")
+
+    if service_dict != {}:
+      if valid_certificate_str is not None and valid_key_str is not None:
+        self.installCertificateAuthority()
+        stunnel_key, stunnel_certificate = \
+            self.requestCertificate(frontend_domain_name)
+      else:
+        stunnel_key, stunnet_certificate = key, certificate
+      self.installStunnel(service_dict,
+        stunnel_certificate, stunnel_key,
+        ca_conf["ca_crl"],
+        ca_conf["certificate_authority_path"])
+
+    apache_parameter_dict = self.installFrontendApache(
+        ip_list=["[%s]" % self.getGlobalIPv6Address(),
+                 self.getLocalIPv4Address()],
+        port=frontend_port_number,
+        name=frontend_domain_name,
+        rewrite_rule_list=rewrite_rule_list,
+        key=key, certificate=certificate)
+
+    for reference, url in slave_dict.iteritems():
+      self.setConnectionDict(dict(site_url=url), reference)
+
+    self.setConnectionDict(
+      dict(site_url=apache_parameter_dict["site_url"],
+           domain_ipv6_address=self.getGlobalIPv6Address(),
+           domain_ipv4_address=self.getLocalIPv4Address()))
+    return self.path_list
+
+  def installLogrotate(self):
+    """Installs logortate main configuration file and registers its to cron"""
+    logrotate_d = os.path.abspath(os.path.join(self.etc_directory,
+      'logrotate.d'))
+    self._createDirectory(logrotate_d)
+    logrotate_backup = self.createBackupDirectory('logrotate')
+    logrotate_conf = self.createConfigurationFile("logrotate.conf",
+        "include %s" % logrotate_d)
+    logrotate_cron = os.path.join(self.cron_d, 'logrotate')
+    state_file = os.path.join(self.data_root_directory, 'logrotate.status')
+    open(logrotate_cron, 'w').write('0 0 * * * %s -s %s %s' %
+        (self.options['logrotate_binary'], state_file, logrotate_conf))
+    self.path_list.extend([logrotate_d, logrotate_conf, logrotate_cron])
+    return logrotate_d, logrotate_backup
+
+  def registerLogRotation(self, name, log_file_list, postrotate_script):
+    """Register new log rotation requirement"""
+    open(os.path.join(self.logrotate_d, name), 'w').write(
+        self.substituteTemplate(self.getTemplateFilename(
+          'logrotate_entry.in'),
+          dict(file_list=' '.join(['"'+q+'"' for q in log_file_list]),
+            postrotate=postrotate_script, olddir=self.logrotate_backup)))
+
+  def requestCertificate(self, name):
+    hash = hashlib.sha512(name).hexdigest()
+    key = os.path.join(self.ca_private, hash + self.ca_key_ext)
+    certificate = os.path.join(self.ca_certs, hash + self.ca_crt_ext)
+    parser = ConfigParser.RawConfigParser()
+    parser.add_section('certificate')
+    parser.set('certificate', 'name', name)
+    parser.set('certificate', 'key_file', key)
+    parser.set('certificate', 'certificate_file', certificate)
+    parser.write(open(os.path.join(self.ca_request_dir, hash), 'w'))
+    return key, certificate
+
+  def installCrond(self):
+   timestamps = self.createDataDirectory('cronstamps')
+   cron_output = os.path.join(self.log_directory, 'cron-output')
+   self._createDirectory(cron_output)
+   catcher = zc.buildout.easy_install.scripts([('catchcron',
+     __name__ + '.catdatefile', 'catdatefile')], self.ws, sys.executable,
+     self.bin_directory, arguments=[cron_output])[0]
+   self.path_list.append(catcher)
+   cron_d = os.path.join(self.etc_directory, 'cron.d')
+   crontabs = os.path.join(self.etc_directory, 'crontabs')
+   self._createDirectory(cron_d)
+   self._createDirectory(crontabs)
+   wrapper = zc.buildout.easy_install.scripts([('crond',
+     'slapos.recipe.librecipe.execute', 'execute')], self.ws, sys.executable,
+     self.wrapper_directory, arguments=[
+       self.options['dcrond_binary'].strip(), '-s', cron_d, '-c', crontabs,
+       '-t', timestamps, '-f', '-l', '5', '-M', catcher]
+     )[0]
+   self.path_list.append(wrapper)
+   return cron_d
+
+  def installValidCertificateAuthority(self, domain_name, certificate, key):
+    ca_dir = os.path.join(self.data_root_directory, 'ca')
+    ca_private = os.path.join(ca_dir, 'private')
+    ca_certs = os.path.join(ca_dir, 'certs')
+    ca_crl = os.path.join(ca_dir, 'crl')
+    self._createDirectory(ca_dir)
+    for path in (ca_private, ca_certs, ca_crl):
+      self._createDirectory(path)
+    key_path = os.path.join(ca_private, domain_name + ".key")
+    certificate_path = os.path.join(ca_certs, domain_name + ".crt")
+    self._writeFile(key_path, key)
+    self._writeFile(certificate_path, certificate)
+    return dict(certificate_authority_path=ca_dir,
+        ca_crl=ca_crl,
+        certificate=certificate_path,
+        key=key_path)
+
+  def installCertificateAuthority(self, ca_country_code='XX',
+      ca_email='xx@example.com', ca_state='State', ca_city='City',
+      ca_company='Company'):
+    backup_path = self.createBackupDirectory('ca')
+    self.ca_dir = os.path.join(self.data_root_directory, 'ca')
+    self._createDirectory(self.ca_dir)
+    self.ca_request_dir = os.path.join(self.ca_dir, 'requests')
+    self._createDirectory(self.ca_request_dir)
+    config = dict(ca_dir=self.ca_dir, request_dir=self.ca_request_dir)
+    self.ca_private = os.path.join(self.ca_dir, 'private')
+    self.ca_certs = os.path.join(self.ca_dir, 'certs')
+    self.ca_crl = os.path.join(self.ca_dir, 'crl')
+    self.ca_newcerts = os.path.join(self.ca_dir, 'newcerts')
+    self.ca_key_ext = '.key'
+    self.ca_crt_ext = '.crt'
+    for d in [self.ca_private, self.ca_crl, self.ca_newcerts, self.ca_certs]:
+      self._createDirectory(d)
+    for f in ['crlnumber', 'serial']:
+      if not os.path.exists(os.path.join(self.ca_dir, f)):
+        open(os.path.join(self.ca_dir, f), 'w').write('01')
+    if not os.path.exists(os.path.join(self.ca_dir, 'index.txt')):
+      open(os.path.join(self.ca_dir, 'index.txt'), 'w').write('')
+    openssl_configuration = os.path.join(self.ca_dir, 'openssl.cnf')
+    config.update(
+        working_directory=self.ca_dir,
+        country_code=ca_country_code,
+        state=ca_state,
+        city=ca_city,
+        company=ca_company,
+        email_address=ca_email,
+    )
+    self._writeFile(openssl_configuration, pkg_resources.resource_string(
+      __name__, 'template/openssl.cnf.ca.in') % config)
+    self.path_list.extend(zc.buildout.easy_install.scripts([
+      ('certificate_authority', __name__ + '.certificate_authority',
+         'runCertificateAuthority')],
+        self.ws, sys.executable, self.wrapper_directory, arguments=[dict(
+          openssl_configuration=openssl_configuration,
+          openssl_binary=self.options['openssl_binary'],
+          certificate=os.path.join(self.ca_dir, 'cacert.pem'),
+          key=os.path.join(self.ca_private, 'cakey.pem'),
+          crl=os.path.join(self.ca_crl),
+          request_dir=self.ca_request_dir
+          )]))
+
+    # configure backup
+    backup_cron = os.path.join(self.cron_d, 'ca_rdiff_backup')
+    open(backup_cron, 'w').write(
+        '''0 0 * * * %(rdiff_backup)s %(source)s %(destination)s'''%dict(
+          rdiff_backup=self.options['rdiff_backup_binary'],
+          source=self.ca_dir,
+          destination=backup_path))
+    self.path_list.append(backup_cron)
+
+    return dict(
+      ca_certificate=os.path.join(config['ca_dir'], 'cacert.pem'),
+      ca_crl=os.path.join(config['ca_dir'], 'crl'),
+      certificate_authority_path=config['ca_dir']
+    )
+
+  def _getApacheConfigurationDict(self, name, ip_list, port):
+    apache_conf = dict()
+    apache_conf['server_name'] = name
+    apache_conf['pid_file'] = os.path.join(self.run_directory,
+        name + '.pid')
+    apache_conf['lock_file'] = os.path.join(self.run_directory,
+        name + '.lock')
+    apache_conf['document_root'] = os.path.join(self.data_root_directory,
+        'htdocs')
+    apache_conf['ip_list'] = ip_list
+    apache_conf['port'] = port
+    apache_conf['server_admin'] = 'admin@'
+    apache_conf['error_log'] = os.path.join(self.log_directory,
+        name + '-error.log')
+    apache_conf['access_log'] = os.path.join(self.log_directory,
+        name + '-access.log')
+    self.registerLogRotation(name, [apache_conf['error_log'],
+      apache_conf['access_log']], self.killpidfromfile + ' ' +
+      apache_conf['pid_file'] + ' SIGUSR1')
+    return apache_conf
+
+  def installVarnishCache(self, name, ip, port, control_port, backend_host,
+                                backend_port, size="1G"):
+    """
+      Install a varnish daemon for a certain address
+    """
+    directory = self.createDataDirectory(name)
+    varnish_config = dict(
+      directory=directory,
+      pid = "%s/varnish.pid" % directory,
+      port="%s:%s" % (ip, port),
+      varnishd_binary=self.options["varnishd_binary"],
+      control_port="%s:%s" % (ip, control_port),
+      storage="file,%s/storage.bin,%s" % (directory, size))
+
+    config_file = self.createConfigurationFile("%s.conf" % name,
+      self.substituteTemplate(self.getTemplateFilename('varnish.vcl.in'),
+        dict(backend_host=backend_host, backend_port=backend_port)))
+
+    varnish_argument_list = [varnish_config['varnishd_binary'].strip(),
+        "-F", "-n", directory, "-P", varnish_config["pid"], "-p",
+        "cc_command=exec %s " % self.options["gcc_binary"] +\
+            "-fpic -shared -o %o %s",
+        "-f", config_file,
+        "-a", varnish_config["port"], "-T", varnish_config["control_port"],
+        "-s", varnish_config["storage"]]
+    environment = dict(PATH=self.options["binutils_directory"])
+    wrapper = zc.buildout.easy_install.scripts([(name,
+      'slapos.recipe.librecipe.execute', 'executee')], self.ws,
+      sys.executable, self.wrapper_directory, arguments=[varnish_argument_list,
+      environment])[0]
+    self.path_list.append(wrapper)
+
+    return varnish_config
+
+  def installStunnel(self, service_dict, certificate,
+      key, ca_crl, ca_path):
+    """Installs stunnel
+      service_dict =
+        { name: (public_ip, private_ip, public_port, private_port),}
+    """
+    template_filename = self.getTemplateFilename('stunnel.conf.in')
+    template_entry_filename = self.getTemplateFilename('stunnel.conf.entry.in')
+
+    log = os.path.join(self.log_directory, 'stunnel.log')
+    pid_file = os.path.join(self.run_directory, 'stunnel.pid')
+    stunnel_conf = dict(
+        pid_file=pid_file,
+        log=log,
+        cert = certificate,
+        key = key,
+        ca_crl = ca_crl,
+        ca_path = ca_path,
+        entry_str=''
+    )
+    entry_list = []
+    for name, parameter_dict in service_dict.iteritems():
+      parameter_dict["name"] = name
+      entry_str = self.substituteTemplate(template_entry_filename,
+          parameter_dict)
+      entry_list.append(entry_str)
+
+    stunnel_conf["entry_str"] = "\n".join(entry_list)
+    stunnel_conf_path = self.createConfigurationFile("stunnel.conf",
+        self.substituteTemplate(template_filename,
+          stunnel_conf))
+    wrapper = zc.buildout.easy_install.scripts([('stunnel',
+      'slapos.recipe.librecipe.execute', 'execute_wait')], self.ws,
+      sys.executable, self.wrapper_directory, arguments=[
+        [self.options['stunnel_binary'].strip(), stunnel_conf_path],
+        [certificate, key]]
+      )[0]
+    self.path_list.append(wrapper)
+    return stunnel_conf
+
+  def installFrontendApache(self, ip_list, port, key, certificate, name,
+                            rewrite_rule_list=[], rewrite_rule_zope_list=[],
+                            access_control_string=None):
+    # Create htdocs, populate it with default 404 document
+    htdocs_location = os.path.join(self.data_root_directory, 'htdocs')
+    self._createDirectory(htdocs_location)
+    notfound_file_location = os.path.join(htdocs_location, 'notfound.html')
+    notfound_template_file_location = self.getTemplateFilename(
+        'notfound.html')
+    notfound_file_content = open(notfound_template_file_location, 'r').read()
+    self._writeFile(notfound_file_location, notfound_file_content)
+
+    # Create configuration file and rewritemaps
+    apachemap_name = "apachemap.txt"
+    # XXX-Cedric : implement zope specific rewrites list. Current apachemap is
+    #              generic and does not use VirtualHost Monster.
+    apachemapzope_name = "apachemapzope.txt"
+    self.createConfigurationFile(apachemap_name, "\n".join(rewrite_rule_list))
+    self.createConfigurationFile(apachemapzope_name,
+        "\n".join(rewrite_rule_zope_list))
+    apache_conf = self._getApacheConfigurationDict(name, ip_list, port)
+    apache_conf['ssl_snippet'] = self.substituteTemplate(
+        self.getTemplateFilename('apache.ssl-snippet.conf.in'),
+        dict(login_certificate=certificate, login_key=key))
+
+    apache_conf["listen"] = "\n".join(["Listen %s:%s" % (ip, port) for ip in ip_list])
+
+    path = self.substituteTemplate(
+        self.getTemplateFilename('apache.conf.path-protected.in'),
+        dict(path='/', access_control_string='none'))
+
+    apache_conf.update(**dict(
+      path_enable=path,
+      apachemap_path=os.path.join(self.etc_directory, apachemap_name),
+      apachemapzope_path=os.path.join(self.etc_directory, apachemapzope_name),
+      apache_domain=name,
+      port=port,
+    ))
+
+    apache_conf_string = self.substituteTemplate(
+          self.getTemplateFilename('apache.conf.in'), apache_conf)
+
+    apache_config_file = self.createConfigurationFile('apache_frontend.conf',
+        apache_conf_string)
+
+
+    self.path_list.append(apache_config_file)
+    self.path_list.extend(zc.buildout.easy_install.scripts([(
+      name, 'slapos.recipe.erp5.apache', 'runApache')], self.ws,
+          sys.executable, self.wrapper_directory, arguments=[
+            dict(
+              required_path_list=[key, certificate],
+              binary=self.options['httpd_binary'],
+              config=apache_config_file)
+          ]))
+
+    return dict(site_url="https://%s:%s/" % (name, port))
--- a/slapos/recipe/apache_frontend/certificate_authority.py
+++ b/slapos/recipe/apache_frontend/certificate_authority.py
+import os
+import subprocess
+import time
+import ConfigParser
+import uuid
+
+
+def popenCommunicate(command_list, input=None):
+  subprocess_kw = dict(stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+  if input is not None:
+    subprocess_kw.update(stdin=subprocess.PIPE)
+  popen = subprocess.Popen(command_list, **subprocess_kw)
+  result = popen.communicate(input)[0]
+  if popen.returncode is None:
+    popen.kill()
+  if popen.returncode != 0:
+    raise ValueError('Issue during calling %r, result was:\n%s' % (
+      command_list, result))
+  return result
+
+
+class CertificateAuthority:
+  def __init__(self, key, certificate, openssl_binary,
+      openssl_configuration, request_dir):
+    self.key = key
+    self.certificate = certificate
+    self.openssl_binary = openssl_binary
+    self.openssl_configuration = openssl_configuration
+    self.request_dir = request_dir
+
+  def checkAuthority(self):
+    file_list = [ self.key, self.certificate ]
+    ca_ready = True
+    for f in file_list:
+      if not os.path.exists(f):
+        ca_ready = False
+        break
+    if ca_ready:
+      return
+    for f in file_list:
+      if os.path.exists(f):
+        os.unlink(f)
+    try:
+      # no CA, let us create new one
+      popenCommunicate([self.openssl_binary, 'req', '-nodes', '-config',
+          self.openssl_configuration, '-new', '-x509', '-extensions', 'v3_ca',
+          '-keyout', self.key, '-out', self.certificate, '-days', '10950'],
+          # Authority name will be random, so no instance has the same issuer
+          'Certificate Authority %s\n' % uuid.uuid1())
+    except:
+      try:
+        for f in file_list:
+          if os.path.exists(f):
+            os.unlink(f)
+      except:
+        # do not raise during cleanup
+        pass
+      raise
+
+  def _checkCertificate(self, common_name, key, certificate):
+    file_list = [key, certificate]
+    ready = True
+    for f in file_list:
+      if not os.path.exists(f):
+        ready = False
+        break
+    if ready:
+      return False
+    for f in file_list:
+      if os.path.exists(f):
+        os.unlink(f)
+    csr = certificate + '.csr'
+    try:
+      popenCommunicate([self.openssl_binary, 'req', '-config',
+        self.openssl_configuration, '-nodes', '-new', '-keyout',
+        key, '-out', csr, '-days', '3650'],
+        common_name + '\n')
+      try:
+        popenCommunicate([self.openssl_binary, 'ca', '-batch', '-config',
+          self.openssl_configuration, '-out', certificate,
+          '-infiles', csr])
+      finally:
+        if os.path.exists(csr):
+          os.unlink(csr)
+    except:
+      try:
+        for f in file_list:
+          if os.path.exists(f):
+            os.unlink(f)
+      except:
+        # do not raise during cleanup
+        pass
+      raise
+    else:
+      return True
+
+  def checkRequestDir(self):
+    for request_file in os.listdir(self.request_dir):
+      parser = ConfigParser.RawConfigParser()
+      parser.readfp(open(os.path.join(self.request_dir, request_file), 'r'))
+      if self._checkCertificate(parser.get('certificate', 'name'),
+          parser.get('certificate', 'key_file'), parser.get('certificate',
+            'certificate_file')):
+        print 'Created certificate %r' % parser.get('certificate', 'name')
+
+def runCertificateAuthority(args):
+  ca_conf = args[0]
+  ca = CertificateAuthority(ca_conf['key'], ca_conf['certificate'],
+      ca_conf['openssl_binary'], ca_conf['openssl_configuration'],
+      ca_conf['request_dir'])
+  while True:
+    ca.checkAuthority()
+    ca.checkRequestDir()
+    time.sleep(60)
--- a/slapos/recipe/apache_frontend/template/apache.conf.in
+++ b/slapos/recipe/apache_frontend/template/apache.conf.in
+# Apache configuration file for Zope
+# Automatically generated
+
+# Basic server configuration
+PidFile "%(pid_file)s"
+LockFile "%(lock_file)s"
+ServerName %(server_name)s
+DocumentRoot %(document_root)s
+
+%(listen)s
+
+ServerAdmin %(server_admin)s
+DefaultType text/plain
+TypesConfig conf/mime.types
+AddType application/x-compress .Z
+AddType application/x-gzip .gz .tgz
+
+# As backend is trusting REMOTE_USER header unset it always
+RequestHeader unset REMOTE_USER
+
+# SSL Configuration
+%(ssl_snippet)s
+
+# Log configuration
+ErrorLog "%(error_log)s"
+LogLevel warn
+LogFormat "%%h %%{REMOTE_USER}i %%l %%u %%t \"%%r\" %%>s %%b \"%%{Referer}i\" \"%%{User-Agent}i\"" combined
+LogFormat "%%h %%{REMOTE_USER}i %%l %%u %%t \"%%r\" %%>s %%b" common
+CustomLog "%(access_log)s" common
+
+# Directory protection
+<Directory />
+    Options FollowSymLinks
+    AllowOverride None
+    Order deny,allow
+    Deny from all
+</Directory>
+
+%(path_enable)s
+
+# Rewrite part
+RewriteEngine On
+
+# Define the two rewritemaps : one for zope, one generic
+RewriteMap apachemapzope txt:%(apachemapzope_path)s
+RewriteMap apachemapgeneric txt:%(apachemap_path)s
+
+# First, we check if we have a zope backend server
+# If so, let's use Virtual Host Daemon rewrite
+#RewriteCond ${apachemapzope:%%{SERVER_NAME}} >""
+#RewriteRule ^/(\w+)($|/.*) ${apachemapzope:$1}/VirtualHostBase/https/%(apache_domain)s:%(port)s/VirtualHostRoot/_vh_$1$2 [L,P]
+
+# If we have generic backend server, let's rewrite without virtual host daemon
+RewriteCond ${apachemapgeneric:%%{SERVER_NAME}} >""
+RewriteRule ^/(.*)$ ${apachemapgeneric:%%{SERVER_NAME}}/$1 [L,P]
+
+# If nothing exist : put a nice error
+ErrorDocument 404 /notfound.html
+
+# List of modules
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule log_config_module modules/mod_log_config.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule version_module modules/mod_version.so
+LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
+LoadModule ssl_module modules/mod_ssl.so
+LoadModule mime_module modules/mod_mime.so
+LoadModule dav_module modules/mod_dav.so
+LoadModule dav_fs_module modules/mod_dav_fs.so
+LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule headers_module modules/mod_headers.so
+LoadModule antiloris_module modules/mod_antiloris.so
--- a/slapos/recipe/apache_frontend/template/apache.conf.path-protected.in
+++ b/slapos/recipe/apache_frontend/template/apache.conf.path-protected.in
+# Path protected
+<Location %(path)s>
+  Order Deny,Allow
+  Allow from %(access_control_string)s
+</Location>
--- a/slapos/recipe/apache_frontend/template/apache.location-snippet.conf.in
+++ b/slapos/recipe/apache_frontend/template/apache.location-snippet.conf.in
+<Location %(location)s>
+  Order Deny,Allow
+  Deny from all
+  Allow from %(allow_string)s
+</Location>
--- a/slapos/recipe/apache_frontend/template/apache.ssl-snippet.conf.in
+++ b/slapos/recipe/apache_frontend/template/apache.ssl-snippet.conf.in
+SSLEngine on
+SSLProxyEngine on
+SSLCertificateFile %(login_certificate)s
+SSLCertificateKeyFile %(login_key)s
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
--- a/slapos/recipe/apache_frontend/template/logrotate_entry.in
+++ b/slapos/recipe/apache_frontend/template/logrotate_entry.in
+%(file_list)s {
+  daily
+  dateext
+  rotate 30
+  compress
+  notifempty
+  sharedscripts
+  create
+  postrotate
+    %(postrotate)s
+  endscript
+  olddir %(olddir)s
+}
--- a/slapos/recipe/apache_frontend/template/notfound.html
+++ b/slapos/recipe/apache_frontend/template/notfound.html
+<html>
+<head>
+  <title>Instance not found</title>
+</head>
+<body>
+<h1>This instance has not been found.</h1>
+<p>If this error persists, please check your instance URL and status on SlapOS Master.</p>
+</body>
+</html>
--- a/slapos/recipe/apache_frontend/template/openssl.cnf.ca.in
+++ b/slapos/recipe/apache_frontend/template/openssl.cnf.ca.in
+#
+# OpenSSL example configuration file.
+# This is mostly being used for generation of certificate requests.
+#
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+
+# Extra OBJECT IDENTIFIER info:
+#oid_file		= $ENV::HOME/.oid
+oid_section		= new_oids
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		= 
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+# Policies used by the TSA examples.
+tsa_policy1 = 1.2.3.4.1
+tsa_policy2 = 1.2.3.4.5.6
+tsa_policy3 = 1.2.3.4.5.7
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= %(working_directory)s		# Where everything is kept
+certs		= $dir/certs		# Where the issued certs are kept
+crl_dir		= $dir/crl		# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+#unique_subject	= no			# Set to 'no' to allow creation of
+					# several ctificates with same subject.
+new_certs_dir	= $dir/newcerts		# default place for new certs.
+
+certificate	= $dir/cacert.pem 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crlnumber	= $dir/crlnumber	# the current crl number
+					# must be commented out to leave a V1 CRL
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/private/cakey.pem # The private key
+RANDFILE	= $dir/private/.rand	# private random number file
+
+x509_extensions	= usr_cert		# The extentions to add to the cert
+
+# Comment out the following two lines for the "traditional"
+# (and highly broken) format.
+name_opt 	= ca_default		# Subject Name options
+cert_opt 	= ca_default		# Certificate field options
+
+# Extension copying option: use with caution.
+# copy_extensions = copy
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crlnumber must also be commented out to leave a V1 CRL.
+# crl_extensions	= crl_ext
+
+default_days	= 3650			# how long to certify for
+default_crl_days= 30			# how long before next CRL
+default_md	= default		# use public key default MD
+preserve	= no			# keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_match
+
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+####################################################################
+[ req ]
+default_bits		= 2048
+default_md		= sha1
+default_keyfile 	= privkey.pem
+distinguished_name	= req_distinguished_name
+#attributes		= req_attributes
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options. 
+# default: PrintableString, T61String, BMPString.
+# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
+# utf8only: only UTF8Strings (PKIX recommendation after 2004).
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
+string_mask = utf8only
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_value		= %(country_code)s
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_value	= %(state)s
+
+localityName			= Locality Name (eg, city)
+localityName_value		= %(city)s
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_value	= %(company)s
+
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+
+commonName			= Common Name (eg, your name or your server\'s hostname)
+commonName_max			= 64
+
+emailAddress			= Email Address
+emailAddress_value = %(email_address)s
+emailAddress_max		= 64
+
+# SET-ex3			= SET extension number 3
+
+#[ req_attributes ]
+#challengePassword		= A challenge password
+#challengePassword_min		= 4
+#challengePassword_max		= 20
+#
+#unstructuredName		= An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+# This is required for TSA certificates.
+# extendedKeyUsage = critical,timeStamping
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Some might want this also
+# nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always
+
+[ proxy_cert_ext ]
+# These extensions should be added when creating a proxy certificate
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+# This really needs to be in place for it to be a proxy certificate.
+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
+
+####################################################################
+[ tsa ]
+
+default_tsa = tsa_config1	# the default TSA section
+
+[ tsa_config1 ]
+
+# These are used by the TSA reply generation only.
+dir		= /etc/pki/tls		# TSA root directory
+serial		= $dir/tsaserial	# The current serial number (mandatory)
+crypto_device	= builtin		# OpenSSL engine to use for signing
+signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
+					# (optional)
+certs		= $dir/cacert.pem	# Certificate chain to include in reply
+					# (optional)
+signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
+
+default_policy	= tsa_policy1		# Policy if request did not specify it
+					# (optional)
+other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
+digests		= md5, sha1		# Acceptable message digests (mandatory)
+accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
+clock_precision_digits  = 0	# number of digits after dot. (optional)
+ordering		= yes	# Is ordering defined for timestamps?
+				# (optional, default: no)
+tsa_name		= yes	# Must the TSA name be included in the reply?
+				# (optional, default: no)
+ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
+				# (optional, default: no)
--- a/slapos/recipe/apache_frontend/template/stunnel.conf.entry.in
+++ b/slapos/recipe/apache_frontend/template/stunnel.conf.entry.in
+[%(name)s]
+accept = %(public_ip)s:%(public_port)s
+connect = %(private_ip)s:%(private_port)s
--- a/slapos/recipe/apache_frontend/template/stunnel.conf.in
+++ b/slapos/recipe/apache_frontend/template/stunnel.conf.in
+foreground = yes
+output = %(log)s
+pid = %(pid_file)s
+syslog = no
+client = yes
+CApath = %(ca_path)s
+key = %(key)s
+CRLpath = %(ca_crl)s
+cert = %(cert)s
+sslVersion = SSLv3
+socket = l:TCP_NODELAY=1
+socket = r:TCP_NODELAY=1
+
+%(entry_str)s
--- a/slapos/recipe/apache_frontend/template/varnish.vcl.in
+++ b/slapos/recipe/apache_frontend/template/varnish.vcl.in
+# This is a basic VCL configuration file for varnish.  See the vcl(7)
+# man page for details on VCL syntax and semantics.
+# 
+# Default backend definition.  Set this to point to your content
+# server.
+# 
+backend default {
+    .host = "%(backend_host)s";
+    .port = "%(backend_port)s";
+    .probe = { 
+        .url = "/";
+        .timeout = 10s;
+        .interval = 10s;
+        .window = 4;
+        .threshold = 3;
+    }
+}
+# 
+# Below is a commented-out copy of the default VCL logic.  If you
+# redefine any of these subroutines, the built-in logic will be
+# appended to your code.
+# 
+# sub vcl_recv {
+#     if (req.http.x-forwarded-for) {
+#   set req.http.X-Forwarded-For =
+#       req.http.X-Forwarded-For ", " client.ip;
+#     } else {
+#   set req.http.X-Forwarded-For = client.ip;
+#     }
+#     if (req.request != "GET" &&
+#       req.request != "HEAD" &&
+#       req.request != "PUT" &&
+#       req.request != "POST" &&
+#       req.request != "TRACE" &&
+#       req.request != "OPTIONS" &&
+#       req.request != "DELETE") {
+#         /* Non-RFC2616 or CONNECT which is weird. */
+#         return (pipe);
+#     }
+#     if (req.request != "GET" && req.request != "HEAD") {
+#         /* We only deal with GET and HEAD by default */
+#         return (pass);
+#     }
+#     if (req.http.Authorization || req.http.Cookie) {
+#         /* Not cacheable by default */
+#         return (pass);
+#     }
+#     return (lookup);
+# }
+sub vcl_recv {
+    if (req.http.cache-control ~ "no-cache") {
+        purge_url(req.url);
+    }
+
+    if (req.url ~ "\.(css|js|ico)$") {
+        unset req.http.cookie;
+    }
+
+    # remove bogus cookies
+    if (req.http.Cookie) {
+        set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__utm.=[^;]+;? *", "\1");
+        set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__ac_name=\x22\x22;? *", "\1");
+        set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__ac=\x22Og.3D.3D\x22;? *", "\1");
+    }
+    if (req.http.Cookie == "") {
+        remove req.http.Cookie;
+    }
+
+    if (req.http.x-forwarded-for) {
+  set req.http.X-Forwarded-For =
+      req.http.X-Forwarded-For ", " client.ip;
+    } else {
+  set req.http.X-Forwarded-For = client.ip;
+    }
+    if (req.request != "GET" &&
+      req.request != "HEAD" &&
+      req.request != "PUT" &&
+      req.request != "POST" &&
+      req.request != "TRACE" &&
+      req.request != "OPTIONS" &&
+      req.request != "DELETE") {
+        /* Non-RFC2616 or CONNECT which is weird. */
+        return (pipe);
+    }
+    if (req.request != "GET" && req.request != "HEAD") {
+        /* We only deal with GET and HEAD by default */
+        return (pass);
+    }
+    if (req.http.Authorization) {
+        /* Not cacheable by default */
+        return (pass);
+    }
+    if (req.http.Cookie && req.http.Cookie ~ "(^|; ) *__ac=") {
+        /* Not cacheable for authorised users,
+     but KM images are cacheable */
+  if (!(req.url ~ "/km_img/.*\.(png|gif)$")) {
+    return (pass);
+  }
+    }
+    # XXX login form can defer based on __ac_name cookie value
+    if (req.url ~ "/(login_form|WebSite_viewLoginDialog)($|\?)") {
+        return (pass);
+    }
+    if (req.backend.healthy) {
+        set req.grace = 1h;
+    } else {
+        set req.grace = 1w;
+    }
+    return (lookup);
+}
+# 
+# sub vcl_pipe {
+#     # Note that only the first request to the backend will have
+#     # X-Forwarded-For set.  If you use X-Forwarded-For and want to
+#     # have it set for all requests, make sure to have:
+#     # set req.http.connection = "close";
+#     # here.  It is not set by default as it might break some broken web
+#     # applications, like IIS with NTLM authentication.
+#     return (pipe);
+# }
+# 
+# sub vcl_pass {
+#     return (pass);
+# }
+# 
+# sub vcl_hash {
+#     set req.hash += req.url;
+#     if (req.http.host) {
+#         set req.hash += req.http.host;
+#     } else {
+#         set req.hash += server.ip;
+#     }
+#     return (hash);
+# }
+# 
+# sub vcl_hit {
+#     if (!obj.cacheable) {
+#         return (pass);
+#     }
+#     return (deliver);
+# }
+# 
+# sub vcl_miss {
+#     return (fetch);
+# }
+# 
+# sub vcl_fetch {
+#     if (!beresp.cacheable) {
+#         return (pass);
+#     }
+#     if (beresp.http.Set-Cookie) {
+#         return (pass);
+#     }
+#     return (deliver);
+# }
+sub vcl_fetch {
+    # we only cache 200 (OK) and 304 (Not Modified) responses.
+    if (beresp.status != 200 && beresp.status != 304) {
+        set beresp.cacheable = false;
+    }
+
+    if (beresp.http.cache-control ~ "no-cache") {
+        set beresp.cacheable = false;
+    }
+
+    if (!beresp.cacheable) {
+        unset beresp.http.expires;
+        set beresp.http.cache-control = "no-cache";
+        return (pass);
+    }
+
+    # we don't care haproxy's cookie.
+    if (beresp.http.Set-Cookie && beresp.http.Set-Cookie !~ "^SERVERID=[^;]+; path=/$") {
+        return (pass);
+    }
+
+    if (req.url ~ "\.(css|js|ico)$") {
+        unset beresp.http.set-cookie;
+        set beresp.http.cache-control = regsub(beresp.http.cache-control, "^", "public,");
+        set beresp.http.cache-control = regsub(beresp.http.cache-control, ",$", "");
+    }
+
+    # remove some headers added by caching policy manager to avoid
+    # '304 Not Modified' in case of login <-> logout switching.
+    if (beresp.http.content-type ~ "^text/html") {
+  unset beresp.http.last-modified;
+    }
+
+    if (beresp.cacheable) {
+        /* Remove Expires from backend, it's not long enough */
+        unset beresp.http.expires;
+        /* Set the clients TTL on this object */
+        set beresp.http.cache-control = "max-age = 900";
+        /* Set how long Varnish will keep it */
+        set beresp.ttl = 1w;
+        /* marker for vcl_deliver to reset Age: */
+        set beresp.http.magicmarker = "1";
+    }
+
+    set beresp.grace = 1w;
+
+    return (deliver);
+}
+# 
+# sub vcl_deliver {
+#     return (deliver);
+# }
+sub vcl_deliver {
+    if (resp.http.magicmarker) {
+        /* Remove the magic marker */
+        unset resp.http.magicmarker;
+        /* By definition we have a fresh object */
+        set resp.http.age = "0";
+    }
+    if (obj.hits > 0) {
+        set resp.http.X-Cache = obj.hits;
+    } else {
+      set resp.http.X-Cache = "MISS";
+    }
+    return (deliver);
+}
+
+# 
+# sub vcl_error {
+#     set obj.http.Content-Type = "text/html; charset=utf-8";
+#     synthetic {"
+# <?xml version="1.0" encoding="utf-8"?>
+# <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+#  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+# <html>
+#   <head>
+#     <title>"} obj.status " " obj.response {"</title>
+#   </head>
+#   <body>
+#     <h1>Error "} obj.status " " obj.response {"</h1>
+#     <p>"} obj.response {"</p>
+#     <h3>Guru Meditation:</h3>
+#     <p>XID: "} req.xid {"</p>
+#     <hr>
+#     <p>Varnish cache server</p>
+#   </body>
+# </html>
+# "};
+#     return (deliver);
+# }
--- a/slapos/recipe/helloworld.py
+++ b/slapos/recipe/helloworld.py
-##############################################################################
-#
-# Copyright (c) 2010 Vifib SARL and Contributors. All Rights Reserved.
-#
-# WARNING: This program as such is intended to be used by professional
-# programmers who take the whole responsibility of assessing all potential
-# consequences resulting from its eventual inadequacies and bugs
-# End users who are looking for a ready-to-use solution with commercial
-# guarantees and support are strongly adviced to contract a Free Software
-# Service Company
-#
-# This program is Free Software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License
-# as published by the Free Software Foundation; either version 3
-# of the License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-#
-##############################################################################
-from slapos.recipe.librecipe import BaseSlapRecipe
-
-class Recipe(BaseSlapRecipe):
-
-  def _install(self):
-    parameter_dict = self.computer_partition.getInstanceParameterDict()
-    dummy_wrapper = self.createRunningWrapper('dummy', """#!/bin/sh
-while [ true ]
-do
-   sleep 10
-   echo "Hello World!"
-done""")
-
-    self.computer_partition.setConnectionDict(dict(
-      hello_world="Hello World!",
-      ))
-    return [dummy_wrapper]
-    
\ No newline at end of file
--- a/slapos/recipe/pulse2/__init__.py
+++ b/slapos/recipe/pulse2/__init__.py
@@ -267,7 +267,7 @@ class Recipe(BaseSlapRecipe):
        memcached_ip=config['memcached_ip'],
        memcached_port=config['memcached_port'])
  
-    def createHtdocs(self, source, document_root):
+  def createHtdocs(self, source, document_root):
    source = self.options['source'].strip()
    document_root = self.createDataDirectory('htdocs')
    for p in os.listdir(document_root):

--- a/software/apache-frontend/instance.cfg
+++ b/software/apache-frontend/instance.cfg
+[buildout]
+parts =
+  instance
+
+eggs-directory = ${buildout:eggs-directory}
+develop-eggs-directory = ${buildout:develop-eggs-directory}
+
+[instance]
+recipe = ${instance-recipe:egg}:${instance-recipe:module}
+httpd_binary = ${apache:location}/bin/httpd
+logrotate_binary = ${logrotate:location}/usr/sbin/logrotate
+openssl_binary = ${openssl:location}/bin/openssl
+dcrond_binary = ${dcron:location}/sbin/crond
+varnishd_binary = ${varnish-2.1:location}/sbin/varnishd
+stunnel_binary = ${stunnel:location}/bin/stunnel
+rdiff_backup_binary = ${buildout:bin-directory}/rdiff-backup
+gcc_binary = ${gcc-java-minimal:location}/bin/gcc
+binutils_directory = ${binutils:location}/bin/
--- a/software/apache-frontend/software.cfg
+++ b/software/apache-frontend/software.cfg
+[buildout]
+versions = versions
+
+extends =
+  ../../component/binutils/buildout.cfg
+  ../../component/gcc/buildout.cfg
+  ../../component/lxml-python/buildout.cfg
+  ../../component/apache/buildout.cfg
+  ../../component/stunnel/buildout.cfg
+  ../../component/varnish/buildout.cfg
+  ../../component/dcron/buildout.cfg
+  ../../component/logrotate/buildout.cfg
+  ../../component/rdiff-backup/buildout.cfg
+  ../../stack/slapos.cfg
+
+parts =
+  template
+  binutils
+  gcc-java-minimal
+  apache
+  apache-antiloris
+
+  stunnel
+  varnish-2.1
+
+  dcron
+  logrotate
+  rdiff-backup
+
+# Buildoutish
+  eggs
+  instance-recipe-egg
+
+[instance-recipe]
+# Note: In case if specific instantiation recipe is used this is the place to
+# put its name
+egg = slapos.cookbook
+module = apache.frontend
+
+[instance-recipe-egg]
+recipe = zc.recipe.egg
+eggs = ${instance-recipe:egg}
+
+[eggs]
+recipe = zc.recipe.egg
+eggs =
+  ${lxml-python:egg}
+
+[template]
+# Default template for apache instance.
+recipe = slapos.recipe.template
+url = ${:_profile_base_location_}/instance.cfg
+md5sum = 17180caef7d1c477fbb037d28b705e8b
+output = ${buildout:directory}/template.cfg
+mode = 0644
+
+[versions]
+# Use SlapOS patched zc.buildout
+zc.buildout = 1.6.0-dev-SlapOS-004
+Jinja2 = 2.6
+Werkzeug = 0.8.3
+buildout-versions = 1.7
+hexagonit.recipe.cmmi = 1.5.0
+meld3 = 0.6.8
+rdiff-backup = 1.0.5
+slapos.recipe.template = 2.2
+slapos.cookbook = 0.40.1
+
+# Required by:
+# slapos.core==0.23
+Flask = 0.8
+
+# Required by:
+# slapos.cookbook==0.40.1
+PyXML = 0.8.4
+
+# Required by:
+# hexagonit.recipe.cmmi==1.5.0
+hexagonit.recipe.download = 1.5.0
+
+# Required by:
+# slapos.cookbook==0.40.1
+inotifyx = 0.2.0
+
+# Required by:
+# slapos.cookbook==0.40.1
+# slapos.core==0.23
+# xml-marshaller==0.9.7
+lxml = 2.3.3
+
+# Required by:
+# slapos.cookbook==0.40.1
+netaddr = 0.7.6
+
+# Required by:
+# slapos.core==0.23
+netifaces = 0.8
+
+# Required by:
+# slapos.cookbook==0.40.1
+# slapos.core==0.23
+# zc.buildout==1.6.0-dev-SlapOS-004
+# zc.recipe.egg==1.3.2
+setuptools = 0.6c12dev-r88846
+
+# Required by:
+# slapos.cookbook==0.40.1
+slapos.core = 0.23
+
+# Required by:
+# slapos.core==0.23
+supervisor = 3.0a12
+
+# Required by:
+# slapos.cookbook==0.40.1
+xml-marshaller = 0.9.7
+
+# Required by:
+# slapos.cookbook==0.40.1
+zc.recipe.egg = 1.3.2
+
+# Required by:
+# slapos.core==0.23
+zope.interface = 3.8.0
+
+[networkcache]
+# Cedric de Saint Martin signature certificate
+signature-certificate-list =
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAO4V/jiMoICoMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMjMyMCAXDTEyMDIxNjExMTAyM1oYDzIxMTIwMTIzMTExMDIzWjAT
+  MREwDwYDVQQDDAhDT01QLTIzMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  wi/3Z8W9pUiegUXIk/AiFDQ0UJ4JFAwjqr+HSRUirlUsHHT+8DzH/hfcTDX1I5BB
+  D1ADk+ydXjMm3OZrQcXjn29OUfM5C+g+oqeMnYQImN0DDQIOcUyr7AJc4xhvuXQ1
+  P2pJ5NOd3tbd0kexETa1LVhR6EgBC25LyRBRae76qosCAwEAAaNQME4wHQYDVR0O
+  BBYEFMDmW9aFy1sKTfCpcRkYnP6zUd1cMB8GA1UdIwQYMBaAFMDmW9aFy1sKTfCp
+  cRkYnP6zUd1cMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAskbFizHr
+  b6d3iIyN+wffxz/V9epbKIZVEGJd/6LrTdLiUfJPec7FaxVCWNyKBlCpINBM7cEV
+  Gn9t8mdVQflNqOlAMkOlUv1ZugCt9rXYQOV7rrEYJBWirn43BOMn9Flp2nibblby
+  If1a2ZoqHRxoNo2yTmm7TSYRORWVS+vvfjY=
+  -----END CERTIFICATE-----
--- a/software/cloudooo/development.cfg
+++ b/software/cloudooo/development.cfg
+[buildout]
+extends = software.cfg
+auto-checkout = cloudooo
--- a/software/helloworld/instance.cfg
+++ b/software/helloworld/instance.cfg
-[buildout]
-parts =
-  dummy
-
-eggs-directory = ${buildout:eggs-directory}
-develop-eggs-directory = ${buildout:develop-eggs-directory}
-
-[dummy]
-recipe = slapos.recipe.dummy
--- a/software/helloworld/software.cfg
+++ b/software/helloworld/software.cfg
-[buildout]
-
-extensions +=
-  mr.developer
-# activates mr.developer
-auto-checkout = *
-versions = versions
-
-find-links += http://www.nexedi.org/static/packages/source/slapos.buildout/
-
-parts =
-  template
-  eggs
-
-unzip = true
-
-[sources]
-# XXX-Cedric : either publish the egg or use mr.developer properly, but DELETE
-# This repository and use slapos.recipe.helloworld.
-slapos.recipe.dummy = git git://github.com/WaterCooled/slapos.recipe.dummy.git
-
-[versions]	
-zc.buildout = 1.5.3-dev-SlapOS-001
-
-[template]
-recipe = slapos.recipe.template
-url = ${:_profile_base_location_}/instance.cfg
-output = ${buildout:directory}/template.cfg
-mode = 0644
-
-[eggs]
-recipe = zc.recipe.egg
-#eggs = slapos.recipe.helloworld
-eggs = slapos.recipe.dummy
--- a/software/slaprunner/software.cfg
+++ b/software/slaprunner/software.cfg
@@ -3,25 +3,18 @@ extensions =
  buildout-versions

 extends =
+  ../../stack/slapos.cfg
  ../../stack/flask.cfg
  ../../stack/shacache-client.cfg
  ../../component/dropbear/buildout.cfg
  ../../component/git/buildout.cfg

-develop = 
-  ${:parts-directory}/slapos.cookbook
-
 parts =
  template
-  slapos.cookbook
-  check-local-eggs
  eggs
  instance-recipe-egg
  dropbear

-find-links +=
-  http://www.nexedi.org/static/packages/source/slapos.buildout/
-
 versions = versions

 [instance-recipe]
@@ -40,69 +33,66 @@ output = ${buildout:directory}/template.cfg
 mode = 0644
 md5sum = cd69efd5c3a7e9adca7387b9a401590a

-[slapos.cookbook]
-# use official egg from pypi when it is released
-recipe = plone.recipe.command
-stop-on-error = true
-commit = ce891b5070073d4dac9e21b089b8e662c7a9e0bd
-repository = http://git.erp5.org/repos/slapos.git
-location = ${buildout:parts-directory}/${:_buildout_section_name_}
-git-binary = ${git:location}/bin/git
-command = export GIT_SSL_NO_VERIFY=true; (${:git-binary} clone --quiet ${:repository} ${:location} && cd ${:location} && ${:git-binary} reset --hard ${:commit}) || (rm -fr ${:location}; exit 1)
-update-command =
-
-[check-local-eggs]
-recipe = plone.recipe.command
-stop-on-error = true
-update-command = ${:command}
-command = grep parts ${buildout:develop-eggs-directory}/slapos.cookbook.egg-link
-depends = ${instance-recipe:egg}
-
 [eggs]
 eggs +=
  slapos.libnetworkcache
  slapos.toolbox
  slapos.core

+[networkcache]
+# signature certificates of the following uploaders.
+#   Cedric de Saint Martin
+signature-certificate-list =
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAO4V/jiMoICoMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMjMyMCAXDTEyMDIxNjExMTAyM1oYDzIxMTIwMTIzMTExMDIzWjAT
+  MREwDwYDVQQDDAhDT01QLTIzMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  wi/3Z8W9pUiegUXIk/AiFDQ0UJ4JFAwjqr+HSRUirlUsHHT+8DzH/hfcTDX1I5BB
+  D1ADk+ydXjMm3OZrQcXjn29OUfM5C+g+oqeMnYQImN0DDQIOcUyr7AJc4xhvuXQ1
+  P2pJ5NOd3tbd0kexETa1LVhR6EgBC25LyRBRae76qosCAwEAAaNQME4wHQYDVR0O
+  BBYEFMDmW9aFy1sKTfCpcRkYnP6zUd1cMB8GA1UdIwQYMBaAFMDmW9aFy1sKTfCp
+  cRkYnP6zUd1cMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAskbFizHr
+  b6d3iIyN+wffxz/V9epbKIZVEGJd/6LrTdLiUfJPec7FaxVCWNyKBlCpINBM7cEV
+  Gn9t8mdVQflNqOlAMkOlUv1ZugCt9rXYQOV7rrEYJBWirn43BOMn9Flp2nibblby
+  If1a2ZoqHRxoNo2yTmm7TSYRORWVS+vvfjY=
+  -----END CERTIFICATE-----
+
 [versions]
 # Use SlapOS patched zc.buildout
 zc.buildout = 1.6.0-dev-SlapOS-003
-
-# Pinned to old version (2.4 does not compile well everywhere)
-pycrypto = 2.3
-
 Jinja2 = 2.6
-Werkzeug = 0.8.2
-apache-libcloud = 0.7.1
+Werkzeug = 0.8.3
+apache-libcloud = 0.8.0
 async = 0.6.1
 buildout-versions = 1.7
 gitdb = 0.5.4
 hexagonit.recipe.cmmi = 1.5.0
 meld3 = 0.6.8
-plone.recipe.command = 1.1 
-slapos.libnetworkcache = 0.11
+pycrypto = 2.5
+slapos.cookbook = 0.39
+slapos.libnetworkcache = 0.12
 slapos.recipe.template = 2.2
-slapos.toolbox = 0.16
+slapos.toolbox = 0.18
 smmap = 0.8.2

 # Required by:
-# slapos.core==0.21
+# slapos.core==0.22
 Flask = 0.8

 # Required by:
-# slapos.toolbox==0.16
+# slapos.toolbox==0.18
 GitPython = 0.3.2.RC1

 # Required by:
-# slapos.cookbook==0.39-dev
+# slapos.cookbook==0.39
 PyXML = 0.8.4

 # Required by:
-# slapos.toolbox==0.16
+# slapos.toolbox==0.18
 atomize = 0.1.1

 # Required by:
-# slapos.toolbox==0.16
+# slapos.toolbox==0.18
 feedparser = 5.1

 # Required by:
@@ -110,36 +100,36 @@ feedparser = 5.1
 hexagonit.recipe.download = 1.5.0

 # Required by:
-# slapos.cookbook==0.39-dev
+# slapos.cookbook==0.39
 inotifyx = 0.2.0

 # Required by:
-# slapos.cookbook==0.39-dev
-# slapos.core==0.21
+# slapos.cookbook==0.39
+# slapos.core==0.22
 # xml-marshaller==0.9.7
 lxml = 2.3.3

 # Required by:
-# slapos.cookbook==0.39-dev
+# slapos.cookbook==0.39
 netaddr = 0.7.6

 # Required by:
-# slapos.core==0.21
-netifaces = 0.6
+# slapos.core==0.22
+netifaces = 0.8

 # Required by:
-# slapos.toolbox==0.16
+# slapos.toolbox==0.18
 paramiko = 1.7.7.1

 # Required by:
-# slapos.toolbox==0.16
+# slapos.toolbox==0.18
 psutil = 0.4.1

 # Required by:
-# slapos.cookbook==0.39-dev
-# slapos.core==0.21
-# slapos.libnetworkcache==0.11
-# slapos.toolbox==0.16
+# slapos.cookbook==0.39
+# slapos.core==0.22
+# slapos.libnetworkcache==0.12
+# slapos.toolbox==0.18
 # supervisor==3.0a12
 # zc.buildout==1.6.0-dev-SlapOS-003
 # zc.recipe.egg==1.3.2
@@ -147,21 +137,21 @@ psutil = 0.4.1
 setuptools = 0.6c12dev-r88846

 # Required by:
-# slapos.cookbook==0.39-dev
-slapos.core = 0.21
+# slapos.cookbook==0.39
+slapos.core = 0.22

 # Required by:
-# slapos.core==0.21
+# slapos.core==0.22
 supervisor = 3.0a12

 # Required by:
-# slapos.cookbook==0.39-dev
+# slapos.cookbook==0.39
 xml-marshaller = 0.9.7

 # Required by:
-# slapos.cookbook==0.39-dev
+# slapos.cookbook==0.39
 zc.recipe.egg = 1.3.2

 # Required by:
-# slapos.core==0.21
+# slapos.core==0.22
 zope.interface = 3.8.0
--- a/stack/cloudooo.cfg
+++ b/stack/cloudooo.cfg
@@ -20,6 +20,7 @@ extends =
  ../component/pdftk/buildout.cfg
  ../component/ffmpeg/buildout.cfg
  ../component/file/buildout.cfg
+  ../component/cloudooo/buildout.cfg

 versions = versions

@@ -64,19 +65,6 @@ python = python2.6
 version = 2
 section = python2.7

-[lxml-python]
-python = python2.6
-
-[cloudooo]
-recipe = zc.recipe.egg
-python = python2.6
-eggs =
-  ${lxml-python:egg}
-  cloudooo
-  PasteScript
-scripts =
-  paster=cloudooo_paster
-
 [versions]
 # Use SlapOS patched zc.buildout
 zc.buildout = 1.5.3-dev-SlapOS-001
--- a/stack/lamp.cfg
+++ b/stack/lamp.cfg
@@ -13,6 +13,7 @@ allow-hosts =
  dist.repoze.org
  effbot.org
  github.com
+  launchpad.net
  peak.telecommunity.com
  psutil.googlecode.com
  www.dabeaz.com

--- a/stack/slapos.cfg
+++ b/stack/slapos.cfg
+# This stack list all parameters used in every Software Release or other stack.
+# Software Releases or Stacks can safely extend this stack.
+
+[buildout]
+# Generate list of automatically chosen eggs version
+extensions +=
+  buildout-versions
+
+# Use shacache
+extends =
+  shacache-client.cfg
+  
+# Separate from site eggs
+allowed-eggs-from-site-packages =
+include-site-packages = false
+exec-sitecustomize = false
+
+# Add location for modified non-official slapos.buildout
+find-links +=
+  http://www.nexedi.org/static/packages/source/slapos.buildout/
+
+# Use only quite well working sites.
+allow-hosts +=
+  *.nexedi.org
+  *.python.org
+  *.sourceforge.net
+  alastairs-place.net
+  dist.repoze.org
+  effbot.org
+  github.com
+  peak.telecommunity.com
+  psutil.googlecode.com
+  www.dabeaz.com
+  www.owlfish.com
+  launchpad.net
+
+# XXX: Workaround of SlapOS limitation
+# Unzippig of eggs is required, as SlapOS do not yet provide nicely working
+# development / fast switching environment for whole software
+unzip = true