NEO: hack to deploy SSL certs via instance parameters

software/neoppod/instance-neo-admin.cfg.in

@@ -10,7 +10,7 @@ wrapper = ${directory:etc_run}/neoadmin
 logfile = ${directory:log}/neoadmin.log
 ip = ${publish:ip}
 port = ${publish:port-admin}
-ssl = {{ dumps(slapparameter_dict['ssl']) }}
+ssl = {{ dumps(bool(slapparameter_dict['ssl'])) }}
 cluster = {{ dumps(slapparameter_dict['cluster']) }}
 masters = ${publish:masters}
 

software/neoppod/instance-neo-input-schema.json

@@ -36,10 +36,19 @@
       "type": "object"
     },
     "ssl": {
-      "description": "Enable SSL. All nodes look for 3 files in ~/etc: ca.crt, neo.crt, neo.key. Waiting that SlapOS provides a way to manage certificates, the user must deploy them manually.",
+      "description": "Enable SSL. All nodes look for 3 files in ~/etc: ca.crt, neo.crt, neo.key. Waiting that SlapOS provides a way to manage certificates, the user must deploy them manually, or use the temporary _ca/_cert/_key parameters.",
       "default": true,
       "type": "boolean"
     },
+    "_ca": {
+      "type": "string"
+    },
+    "_cert": {
+      "type": "string"
+    },
+    "_key": {
+      "type": "string"
+    },
     "node-list": {
       "description": "List of dictionaries containing parameters for each node.",
       "items": {

software/neoppod/instance-neo-master.cfg.in

@@ -10,7 +10,7 @@ wrapper = ${directory:etc_run}/neomaster
 logfile = ${directory:log}/neomaster.log
 ip = ${publish:ip}
 port = ${publish:port-master}
-ssl = {{ dumps(slapparameter_dict['ssl']) }}
+ssl = {{ dumps(bool(slapparameter_dict['ssl'])) }}
 cluster = {{ dumps(slapparameter_dict['cluster']) }}
 partitions = {{ slapparameter_dict['partitions'] }}
 replicas = {{ slapparameter_dict['replicas'] }}

software/neoppod/instance-neo-storage-mysql.cfg.in

@@ -61,11 +61,26 @@ masters = {{ ' '.join(sorted(master_list)) }}
 admins = {{ ' '.join(sorted(admin_list)) }}
 {%- endif %}
 
+{#- Hack to deploy SSL certs via instance parameters #}
+{%- for name, pem in zip(('ca.crt', 'neo.crt', 'neo.key'),
+                        slapparameter_dict['ssl']) %}
+{%-   if pem %}
+
+[{{ section(name) }}]
+recipe = slapos.recipe.template:jinja2
+rendered = ${directory:etc}/{{name}}
+template = inline:{{'{{'}}pem}}
+context = key pem :pem
+pem = {{dumps(pem)}}
+{%-   endif %}
+{%- endfor %}
+{#- endhack #}
+
 [neo-storage]
 recipe = slapos.cookbook:neoppod.storage
 binary = {{ bin_directory }}/neostorage
 ip = ${publish:ip}
-ssl = {{ dumps(slapparameter_dict['ssl']) }}
+ssl = {{ dumps(bool(slapparameter_dict['ssl'])) }}
 cluster = {{ dumps(slapparameter_dict['cluster']) }}
 masters = ${publish:masters}
 database-adapter = MySQL

software/neoppod/root-common.cfg.in

@@ -42,7 +42,11 @@ config-cluster = {{ parameter_dict['cluster'] }}
 {% set replicas = parameter_dict.get('replicas', 0) -%}
 config-partitions = {{ dumps(parameter_dict.get('partitions', 12)) }}
 config-replicas = {{ dumps(replicas) }}
-config-ssl = {{ dumps(parameter_dict.get('ssl', 1)) }}
+config-ssl = {{ dumps((
+  parameter_dict.get('_ca'),
+  parameter_dict.get('_cert'),
+  parameter_dict.get('_key'),
+  ) if parameter_dict.get('ssl', 1) else ()) }}
 config-upstream-cluster = {{ dumps(parameter_dict.get('upstream-cluster', '')) }}
 config-upstream-masters = {{ dumps(parameter_dict.get('upstream-masters', '')) }}
 software-type = {{ software_type }}

software/neoppod/software-common.cfg

@@ -74,19 +74,19 @@ context =
 
 [root-common]
 <= download-base-neo
-md5sum = 88c34cfa913b89b2ed4c69168965cf84
+md5sum = f3259726bd5d824c569dc7db6b7d26a0
 
 [instance-neo-admin]
 <= download-base-neo
-md5sum = 7bbe0285e499f011dad68825a2264cad
+md5sum = f030a25d320f2edf0186b69bfa521228
 
 [instance-neo-master]
 <= download-base-neo
-md5sum = 0cf303254855c3e1a8e3819004bee70f
+md5sum = 82f3f76f54ee9db355966a7ada61f56e
 
 [instance-neo-storage-mysql]
 <= download-base-neo
-md5sum = 0b62b63540d1bd1a2802f44aff5d1a57
+md5sum = 84b1150ce30ec827485f9c17debd6b44
 
 [template-neo-my-cnf]
 <= download-base-neo

stack/erp5/buildout.cfg

@@ -316,7 +316,7 @@ rendered = ${monitor-template-dummy:target}
 [template-erp5]
 <= download-base
 filename = instance-erp5.cfg.in
-md5sum = e8348f675195f25cf4212b72cb8a907b
+md5sum = 78c2db733e72c4197a90e8be1ff15098
 
 [template-zeo]
 <= download-base
@@ -326,7 +326,7 @@ md5sum = 9670cf63099e2c520017a23defff51a4
 [template-zope]
 <= download-base
 filename = instance-zope.cfg.in
-md5sum = bf997f8bd9cacea96a514589bd7578a9
+md5sum = f11c877cf2fd9b03aa2687cec017a87b
 link-binary =
   ${aspell:location}/bin/aspell
   ${dmtx-utils:location}/bin/dmtxwrite

stack/erp5/instance-erp5.cfg.in

@@ -64,9 +64,10 @@ connection-url = smtp://127.0.0.2:0/
 {%     do neo.append(server_dict.get('cluster')) -%}
 {%     do server_dict.update(cluster='${publish-early:neo-cluster}') -%}
 {{     root_common.request_neo(server_dict, 'zodb-neo', 'neo-') }}
-{%     if not server_dict.get('ssl', 1) -%}
-{%       do zodb_dict[name].setdefault('storage-dict', {}).update(ssl=0) -%}
-{%     endif -%}
+{%     set client_dict = zodb_dict[name].setdefault('storage-dict', {}) -%}
+{%     for k in 'ssl', '_ca', '_cert', '_key' -%}
+{%       do k in server_dict and client_dict.setdefault(k, server_dict[k]) -%}
+{%     endfor -%}
 {%   else -%}
 {{     assert(server_type == 'zeo', server_type) -}}
 {# BBB: for compatibility, keep 'zodb' as partition_reference for ZEO -#}

stack/erp5/instance-zope.cfg.in

@@ -175,6 +175,27 @@ context = section parameter_dict preload-userhosts-runzope-parameter
 template = {{ parameter_dict['runzope-userhosts-preloaded-template'] }}
 mode = 755
 
+{# Hack to deploy SSL certs via instance parameters -#}
+{% for zodb in zodb_dict.itervalues() -%}
+{%   set storage_dict = zodb.setdefault('storage-dict', {}) -%}
+{%   if zodb['type'] == 'neo' and storage_dict.get('ssl', 1) -%}
+{%     for k, v in (('_ca', 'ca.crt'),
+                    ('_cert', 'neo.crt'),
+                    ('_key', 'neo.key')) -%}
+{%       if k in storage_dict -%}
+[{{ section('neo-ssl-' + k[1:]) }}]
+recipe = slapos.recipe.template:jinja2
+rendered = ${directory:etc}/{{v}}
+template = inline:{{'{{'}}pem}}
+context = key pem :pem
+pem = {{dumps(storage_dict.pop(k))}}
+
+{%       endif -%}
+{%     endfor -%}
+{%   endif -%}
+{% endfor -%}
+{# endhack -#}
+
 [zope-base]
 recipe = slapos.cookbook:generic.zope.zeo.client
 inituser = ${directory:instance}/inituser