Commit b28ee875 authored by Łukasz Nowak's avatar Łukasz Nowak

software/rapid-cdn: Clean up in cluster parameters

Change how defaults are handled in the cluster:

 * master instance handles all defaults for all nodes
   * it is the one place with all defaults
   * depending on parameter style default is global for the cluster or can be
     specified per node with -frontend-config-<i>-parameter
 * kedifa and frontend nodes need everything to be passed, in order to
   simplify the request
 * configuration. defaults are dropped, as their scope is too large - they are
   not only defaulting the value on the master, but on each requested node
   which leads to extreme complexity of parameter passing
parent c26a5c6d
......@@ -14,7 +14,7 @@
# not need these here).
[template]
filename = instance.cfg.in
md5sum = 9dae117a84d28d2aa77d4dec6ca9d78f
md5sum = 9f8c238ce61029792ff84c681c580c0e
[profile-common]
filename = instance-common.cfg.in
......@@ -22,11 +22,11 @@ md5sum = 5784bea3bd608913769ff9a8afcccb68
[profile-frontend]
filename = instance-frontend.cfg.in
md5sum = 2f1a60c9679bec1fbae0c5e7e2aed718
md5sum = cbdb70c2e93479e5ff0d868997f4adc6
[profile-master]
filename = instance-master.cfg.in
md5sum = b225c7776cb4345f2b348b92d062bc1b
md5sum = 4fba521777b81e7abfe8d6f80b429c9f
[profile-slave-list]
filename = instance-slave-list.cfg.in
......@@ -102,7 +102,7 @@ md5sum = e82ccdb0b26552a1c88ff523d8fae24a
[profile-kedifa]
filename = instance-kedifa.cfg.in
md5sum = 51dea33c9c80ca791dba611466e051d9
md5sum = d6e28c1bdc971134b8de1b5b3e50c3b6
[template-frontend-haproxy-rsyslogd-conf]
_update_hash_filename_ = templates/frontend-haproxy-rsyslogd.conf.in
......
{% import "caucase" as caucase with context %}
{%- set TRUE_VALUES = ['y', 'yes', '1', 'true'] -%}
{%- set HTTP3_PORT = instance_parameter_dict.get('configuration.http3-port', '443') %}
{%- if instance_parameter_dict.get('configuration.enable-http3', 'false').lower() in TRUE_VALUES %}
{%- set HTTP3_PORT = instance_parameter_dict['configuration']['http3-port'] %}
{%- if instance_parameter_dict['configuration']['enable-http3'].lower() in TRUE_VALUES %}
{%- set FRONTEND_HTTP3 = True %}
{%- else %}
{%- set FRONTEND_HTTP3 = False %}
......@@ -234,7 +234,7 @@ command =
-new -newkey rsa:2048 -sha256 \
-nodes -x509 -days 36500 \
-keyout ${:certificate} \
-subj "/CN=Fallback certificate/OU={{ instance_parameter_dict['configuration.frontend-name'] }}" \
-subj "/CN=Fallback certificate/OU={{ instance_parameter_dict['configuration']['frontend-name'] }}" \
-out ${:certificate}'
[jinja2-template-base]
......@@ -326,7 +326,7 @@ crl = ${:d}/crl.pem
[backend-client-login-csr]
recipe = plone.recipe.command
organization = {{ instance_parameter_dict['configuration']['cluster-identification'] }}
organizational_unit = {{ instance_parameter_dict['configuration.frontend-name'] }}
organizational_unit = {{ instance_parameter_dict['configuration']['frontend-name'] }}
command =
{% if instance_parameter_dict['configuration']['backend-client-caucase-url'] %}
if [ ! -f ${:template-csr} ] && [ ! -f ${:key} ] ; then
......@@ -364,7 +364,7 @@ filename = instance-slave-list.cfg
master_key_download_url = {{ dumps(instance_parameter_dict['configuration']['master-key-download-url']) }}
software_type = single-custom-personal
organization = {{ instance_parameter_dict['configuration']['cluster-identification'] }}
organizational-unit = {{ instance_parameter_dict['configuration.frontend-name'] }}
organizational-unit = {{ instance_parameter_dict['configuration']['frontend-name'] }}
backend-client-caucase-url = {{ instance_parameter_dict['configuration']['backend-client-caucase-url'] }}
url-ready-file = ${directory:var}/url-ready.txt
http3-enable = {{ FRONTEND_HTTP3 }}
......@@ -815,7 +815,7 @@ statistic-certificate = ${self-signed-ip-access:certificate}
statistic-port = ${configuration:backend-haproxy-statistic-port}
statistic-username = ${monitor-instance-parameter:username}
statistic-password = ${monitor-htpasswd:passwd}
statistic-identification = {{ instance_parameter_dict['configuration.frontend-name'] + ' @ ' + instance_parameter_dict['configuration']['cluster-identification'] }}
statistic-identification = {{ instance_parameter_dict['configuration']['frontend-name'] + ' @ ' + instance_parameter_dict['configuration']['cluster-identification'] }}
statistic-frontend-secure_access = ${backend-haproxy-statistic-frontend:connection-secure_access}
version-hash = ${version-hash:value}
node-id = ${frontend-node-id:value}
......@@ -957,8 +957,8 @@ hash-existing-files = ${buildout:directory}/software_release/buildout.cfg
# Note: Workaround for monitor stack, which uses monitor-httpd-port parameter
# directly, and in our case it can come from the network, thus resulting
# with need to strip !py!'u'
monitor-httpd-port = {{ instance_parameter_dict['configuration.monitor-httpd-port'] | int }}
password = {{ instance_parameter_dict['configuration.monitor-password'] | string }}
monitor-httpd-port = {{ instance_parameter_dict['configuration']['monitor-httpd-port'] | int }}
password = {{ instance_parameter_dict['configuration']['monitor-password'] | string }}
[monitor-conf-parameters]
private-path-list +=
......@@ -998,20 +998,20 @@ config-url = ${configuration:re6st-verification-url}
[slave-introspection-frontend]
<= slap-connection
recipe = slapos.cookbook:requestoptional
name = Slave Introspection Frontend {{ instance_parameter_dict['configuration.frontend-name'] }}
name = Slave Introspection Frontend {{ instance_parameter_dict['configuration']['frontend-name'] }}
software-url = http://git.erp5.org/gitweb/slapos.git/blob_plain/HEAD:/software/apache-frontend/software.cfg
shared = true
config-url = https://[${slap-configuration:ipv6-random}]:{{ instance_parameter_dict['configuration.slave-introspection-https-port'] }}/
config-url = https://[${slap-configuration:ipv6-random}]:{{ instance_parameter_dict['configuration']['slave-introspection-https-port'] }}/
config-https-only = true
return = secure_access
[backend-haproxy-statistic-frontend]
<= slap-connection
recipe = slapos.cookbook:requestoptional
name = Backend Haproxy Statistic Frontend {{ instance_parameter_dict['configuration.frontend-name'] }}
name = Backend Haproxy Statistic Frontend {{ instance_parameter_dict['configuration']['frontend-name'] }}
software-url = http://git.erp5.org/gitweb/slapos.git/blob_plain/HEAD:/software/apache-frontend/software.cfg
shared = true
config-url = https://[${slap-configuration:ipv6-random}]:{{ instance_parameter_dict['configuration.backend-haproxy-statistic-port'] }}/
config-url = https://[${slap-configuration:ipv6-random}]:{{ instance_parameter_dict['configuration']['backend-haproxy-statistic-port'] }}/
config-https-only = true
return = domain secure_access
......@@ -1118,10 +1118,8 @@ config-filename = ${logrotate-setup-validate:state-file}
config-state = empty
[configuration]
{%- for key, value in instance_parameter_dict.items() -%}
{%- if key.startswith('configuration.') %}
{{ key.replace('configuration.', '') }} = {{ dumps(value) }}
{%- endif -%}
{% for key, value in instance_parameter_dict['configuration'].items() %}
{{ key }} = {{ dumps(value) }}
{%- endfor %}
[instance-parameter-section]
......
......@@ -25,14 +25,14 @@ parts =
# Note: Workaround for monitor stack, which uses monitor-httpd-port parameter
# directly, and in our case it can come from the network, thus resulting
# with need to strip !py!'u'
monitor-httpd-port = {{ instance_parameter_dict['configuration.monitor-httpd-port'] | int }}
password = {{ instance_parameter_dict['configuration.monitor-password'] | string }}
monitor-httpd-port = {{ instance_parameter_dict['configuration']['monitor-httpd-port'] | int }}
password = {{ instance_parameter_dict['configuration']['monitor-password'] | string }}
[caucased]
hash-existing-files = ${buildout:directory}/software_release/buildout.cfg
{% set caucase_host = '[' ~ instance_parameter_dict['ipv6-random'] ~ ']' %}
{% set caucase_netloc = caucase_host ~ ':' ~ instance_parameter_dict['configuration.caucase_port'] -%}
{% set caucase_netloc = caucase_host ~ ':' ~ instance_parameter_dict['configuration']['caucase_port'] -%}
{% set caucase_url = 'http://' ~ caucase_netloc -%}
{{ caucase.caucased(
prefix='caucased',
......@@ -198,7 +198,7 @@ context =
[kedifa-config]
ip = {{ instance_parameter_dict['ipv6-random'] }}
port = {{ instance_parameter_dict['configuration.kedifa_port'] }}
port = {{ instance_parameter_dict['configuration']['kedifa_port'] }}
db = ${directory:kedifa}/kedifa.sqlite
certificate = ${directory:etc-kedifa}/certificate.pem
key = ${:certificate}
......@@ -230,7 +230,7 @@ config-ca-cert-file = ${kedifa-config:ca-certificate}
<= logrotate-entry-base
name = kedifa
log = ${kedifa-config:logfile}
rotate-num = {{ instance_parameter_dict['configuration.rotate-num'] | int }}
rotate-num = {{ instance_parameter_dict['configuration']['rotate-num'] | int }}
delaycompress =
[kedifa]
......
......@@ -27,20 +27,18 @@
{%- do GOOD_CIPHER_LIST.append(value) %}
{%- endfor %}
{#- Allow to pass only some parameters to frontend nodes #}
{%- set FRONTEND_NODE_PASSED_KEY_LIST = [
'plain_http_port',
'port',
'apache-certificate',
'apache-key',
'domain',
'enable-http2-by-default',
're6st-verification-url',
'backend-connect-timeout',
'backend-connect-retries',
'ciphers',
'request-timeout',
'authenticate-to-backend',
]
{%- set FRONTEND_PARAMETER_DICT = {
'apache-certificate': instance_parameter_dict['configuration'].get('apache-certificate', ''),
'apache-key': instance_parameter_dict['configuration'].get('apache-key', ''),
'authenticate-to-backend': instance_parameter_dict['configuration'].get('authenticate-to-backend', 'False'),
'backend-connect-retries': instance_parameter_dict['configuration'].get('backend-connect-retries', '3'),
'backend-connect-timeout': instance_parameter_dict['configuration'].get('backend-connect-timeout', '5'),
'ciphers': instance_parameter_dict['configuration'].get('ciphers', 'ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA'),
'domain': instance_parameter_dict['configuration'].get('domain', 'example.org'),
'enable-http2-by-default': instance_parameter_dict['configuration'].get('enable-http2-by-default', 'true'),
're6st-verification-url': instance_parameter_dict['configuration'].get('re6st-verification-url', 'http://[2001:67c:1254:4::1]/index.html'),
'rotate-num': instance_parameter_dict['configuration'].get('rotate-num', '4000'),
}
%}
{#- SlapOS Master (but not slapproxy!) merges slave's instance and connection parameters, so the slave information passed to nodes have to be limited only to instance related keys #}
{#- Note: As a result, this feature is very hard to be tested with slapproxy, as it does not pollute the slave information, this kind of whitelist is implemented #}
......@@ -108,7 +106,7 @@
{% set kedifa_partition_monitor_httpd_port = 8402 %}
{% set frontend_monitor_httpd_base_port = 8410 %}
{% set caucase_host = '[' ~ instance_parameter_dict['ipv6-random'] ~ ']' %}
{% set caucase_netloc = caucase_host ~ ':' ~ instance_parameter_dict['configuration.caucase_backend_client_port'] %}
{% set caucase_netloc = caucase_host ~ ':' ~ instance_parameter_dict['configuration'].get('caucase_backend_client_port', '8990') %}
{% set caucase_url = 'http://' ~ caucase_netloc %}
[jinja2-template-base]
recipe = slapos.recipe.template:jinja2
......@@ -140,9 +138,18 @@ context =
# Here we request individually each frontend.
# The presence of sla parameters is checked and added if found
{% set NODE_DEFAULT_KEY_VALUE = {
{% set NODE_SPECIFIC_PARAMETER_DICT = {
'backend-haproxy-http-port': '21080',
'backend-haproxy-https-port': '21443',
'backend-haproxy-statistic-port': '21444',
'disk-cache-size': '8G',
'enable-http3': 'false',
'http3-port': '443'
'http3-port': '443',
'plain_http_port': '8080',
'port': '4443',
'ram-cache-size': '1G',
'request-timeout': '600',
'slave-introspection-https-port': '22443',
} %}
{% for i in range(1, frontend_quantity + 1) %}
{% set frontend_name = "%s-%s" % (NAME_BASE, i) %}
......@@ -159,19 +166,18 @@ context =
# We check for specific configuration regarding the frontend
{% elif key.startswith(config_key) %}
{% set node_config_key = key[config_key_length:] %}
{% if node_config_key in ('enable-http3', 'http3-port') %}
{% do config_dict.__setitem__(node_config_key, instance_parameter_dict['configuration'].pop(key) or instance_parameter_dict['configuration'].get(node_config_key) or NODE_DEFAULT_KEY_VALUE[node_config_key]) %}
{% if node_config_key in NODE_SPECIFIC_PARAMETER_DICT.keys() %}
{% do config_dict.__setitem__(node_config_key, instance_parameter_dict['configuration'].pop(key) or instance_parameter_dict['configuration'].get(node_config_key) or NODE_SPECIFIC_PARAMETER_DICT[node_config_key]) %}
{% else %}
{% do config_dict.__setitem__(node_config_key, instance_parameter_dict['configuration'].pop(key)) %}
{% endif %}
{% endif %}
{% endfor %}
{% if 'http3-port' not in config_dict %}
{% do config_dict.__setitem__('http3-port', instance_parameter_dict['configuration'].get('http3-port') or NODE_DEFAULT_KEY_VALUE['http3-port']) %}
{% endif %}
{% if 'enable-http3' not in config_dict %}
{% do config_dict.__setitem__('enable-http3', instance_parameter_dict['configuration'].get('enable-http3') or NODE_DEFAULT_KEY_VALUE['enable-http3']) %}
{% endif %}
{% for node_config_key in NODE_SPECIFIC_PARAMETER_DICT.keys() %}
{% if node_config_key not in config_dict %}
{% do config_dict.__setitem__(node_config_key, instance_parameter_dict['configuration'].get(node_config_key) or NODE_SPECIFIC_PARAMETER_DICT[node_config_key]) %}
{% endif %}
{% endfor %}
{% do config_dict.__setitem__('monitor-httpd-port', frontend_monitor_httpd_base_port + i) %}
{% do config_dict.__setitem__('backend-client-caucase-url', caucase_url) %}
{% set state_key = "-frontend-%s-state" % i %}
......@@ -391,10 +397,8 @@ return = slave-instance-information-list monitor-base-url backend-client-csr-url
{#- Send only needed parameters to frontend nodes #}
{%- set base_node_configuration_dict = {} %}
{%- for key in FRONTEND_NODE_PASSED_KEY_LIST %}
{%- if key in instance_parameter_dict['configuration'] %}
{%- do base_node_configuration_dict.__setitem__(key, instance_parameter_dict['configuration'][key]) %}
{%- endif %}
{%- for key, value in FRONTEND_PARAMETER_DICT.items() %}
{%- do base_node_configuration_dict.__setitem__(key, value) %}
{%- endfor %}
{% for section, frontend_request in request_dict.items() %}
{% set state = frontend_request.get('state', '') %}
......@@ -521,6 +525,9 @@ config-monitor-cors-domains = {{ instance_parameter_dict['configuration'].get('m
config-monitor-username = ${monitor-instance-parameter:username}
config-monitor-password = ${monitor-htpasswd:passwd}
config-monitor-httpd-port = {{ kedifa_partition_monitor_httpd_port }}
config-caucase_port = {{ instance_parameter_dict['configuration'].get('caucase_port', '8890') }}
config-kedifa_port = {{ instance_parameter_dict['configuration'].get('kedifa_port', '7879') }}
config-rotate-num = {{ instance_parameter_dict['configuration'].get('rotate-num', '4000') }}
{% for key in ['kedifa_port', 'caucase_port'] -%}
{%- if key in instance_parameter_dict['configuration'] %}
config-{{ key }} = {{ dumps(instance_parameter_dict['configuration'][key]) }}
......
......@@ -75,35 +75,3 @@ partition = ${slap-connection:partition-id}
url = ${slap-connection:server-url}
key = ${slap-connection:key-file}
cert = ${slap-connection:cert-file}
# Define default parameter(s) that will be used later, in case user didn't
# specify it
# All parameters are available through the configuration.XX syntax.
# All possible parameters should have a default.
configuration.domain = example.org
configuration.port = 4443
configuration.plain_http_port = 8080
configuration.plain_nginx_port = 8081
configuration.nginx_port = 9443
configuration.kedifa_port = 7879
# Warning: Caucase takes also cacuase_port+1
configuration.caucase_port = 8890
configuration.caucase_backend_client_port = 8990
configuration.apache-key =
configuration.apache-certificate =
configuration.disk-cache-size = 8G
configuration.ram-cache-size = 1G
configuration.re6st-verification-url = http://[2001:67c:1254:4::1]/index.html
configuration.enable-http2-by-default = true
configuration.enable-http3 = false
configuration.http3-port = 443
configuration.ciphers = ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA
configuration.request-timeout = 600
configuration.frontend-name =
configuration.backend-connect-timeout = 5
configuration.backend-connect-retries = 3
configuration.backend-haproxy-http-port = 21080
configuration.backend-haproxy-https-port = 21443
configuration.backend-haproxy-statistic-port = 21444
configuration.authenticate-to-backend = False
configuration.rotate-num = 4000
configuration.slave-introspection-https-port = 22443
......@@ -35,6 +35,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": []
},
"full_address_list": [],
......@@ -59,8 +60,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.org",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[]",
"frontend-name": "caddy-frontend-1",
......@@ -73,6 +86,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{}"
},
"full_address_list": [],
......
......@@ -33,6 +33,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": []
},
"full_address_list": [],
......@@ -57,8 +58,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.org",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[]",
"frontend-name": "caddy-frontend-1",
......@@ -71,6 +84,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{}"
},
"full_address_list": [],
......
......@@ -34,6 +34,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": []
},
"full_address_list": [],
......@@ -58,9 +59,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[]",
"frontend-name": "caddy-frontend-1",
......@@ -73,6 +85,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{}"
},
"full_address_list": [],
......
......@@ -42,6 +42,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": [
{
"enable_cache": true,
......@@ -72,9 +73,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[{\"enable_cache\": true, \"slave_reference\": \"_default\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/\"}]",
"frontend-name": "caddy-frontend-1",
......@@ -87,6 +99,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{\"_default\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@default_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@default_key-generate-auth-url@@/@@default_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@default_key-generate-auth-url@@?auth=\"}}"
},
"full_address_list": [],
......
......@@ -42,6 +42,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": [
{
"enable_cache": true,
......@@ -72,9 +73,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[{\"enable_cache\": true, \"slave_reference\": \"_default\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/\"}]",
"frontend-name": "caddy-frontend-1",
......@@ -87,6 +99,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{\"_default\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@default_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@default_key-generate-auth-url@@/@@default_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@default_key-generate-auth-url@@?auth=\"}}"
},
"full_address_list": [],
......
......@@ -46,6 +46,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": [
{
"enable_cache": true,
......@@ -76,9 +77,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[{\"enable_cache\": true, \"slave_reference\": \"_replicate\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/\"}]",
"frontend-name": "caddy-frontend-1",
......@@ -91,6 +103,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{\"_replicate\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@replicate_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@replicate_key-generate-auth-url@@/@@replicate_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@replicate_key-generate-auth-url@@?auth=\"}}"
},
"full_address_list": [],
......@@ -115,9 +132,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[{\"enable_cache\": true, \"slave_reference\": \"_replicate\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/\"}]",
"frontend-name": "caddy-frontend-2",
......@@ -130,6 +158,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{\"_replicate\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@replicate_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@replicate_key-generate-auth-url@@/@@replicate_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@replicate_key-generate-auth-url@@?auth=\"}}"
},
"full_address_list": [],
......
......@@ -51,6 +51,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": [
{
"enable_cache": true,
......@@ -87,10 +88,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[{\"enable_cache\": true, \"slave_reference\": \"_default_ciphers\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/\"}, {\"ciphers\": \"ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256\", \"enable_cache\": true, \"slave_reference\": \"_own_ciphers\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/\"}]",
"frontend-name": "caddy-frontend-1",
......@@ -103,6 +114,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{\"_default_ciphers\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@default_ciphers_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@default_ciphers_key-generate-auth-url@@/@@default_ciphers_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@default_ciphers_key-generate-auth-url@@?auth=\"}, \"_own_ciphers\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@own_ciphers_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@own_ciphers_key-generate-auth-url@@/@@default_ciphers_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@own_ciphers_key-generate-auth-url@@?auth=\"}}"
},
"full_address_list": [],
......
......@@ -50,6 +50,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": [
{
"custom_domain": "*.alias1.example.com",
......@@ -85,9 +86,20 @@
},
{
"_": {
"apache-certificate": "",
"apache-key": "",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[{\"custom_domain\": \"*.alias1.example.com\", \"slave_reference\": \"_wildcard\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/wildcard\"}, {\"custom_domain\": \"zspecific.alias1.example.com\", \"slave_reference\": \"_zspecific\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/zspecific\"}]",
"frontend-name": "caddy-frontend-1",
......@@ -100,7 +112,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "12",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{\"_wildcard\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@wildcard_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@wildcard_key-generate-auth-url@@/@@wildcard_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@wildcard_key-generate-auth-url@@?auth=\"}, \"_zspecific\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@zspecific_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@zspecific_key-generate-auth-url@@/@@wildcard_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@zspecific_key-generate-auth-url@@?auth=\"}}"
},
"full_address_list": [],
......
......@@ -44,6 +44,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": [
{
"enable_cache": true,
......@@ -76,9 +77,18 @@
"_": {
"apache-certificate": "@@certificate_pem@@",
"apache-key": "@@key_pem@@",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[{\"enable_cache\": true, \"slave_reference\": \"_ssl_from_master_kedifa_overrides_master_certificate\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/\"}]",
"frontend-name": "caddy-frontend-1",
......@@ -91,6 +101,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{\"_ssl_from_master_kedifa_overrides_master_certificate\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@ssl_from_master_kedifa_overrides_master_certificate_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@ssl_from_master_kedifa_overrides_master_certificate_key-generate-auth-url@@/@@ssl_from_master_kedifa_overrides_master_certificate_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@ssl_from_master_kedifa_overrides_master_certificate_key-generate-auth-url@@?auth=\"}}"
},
"full_address_list": [],
......
......@@ -44,6 +44,7 @@
"monitor-httpd-port": "8402",
"monitor-password": "@@monitor-password@@",
"monitor-username": "admin",
"rotate-num": "4000",
"slave-list": [
{
"enable_cache": true,
......@@ -76,9 +77,18 @@
"_": {
"apache-certificate": "@@certificate_pem@@",
"apache-key": "@@key_pem@@",
"authenticate-to-backend": "False",
"backend-client-caucase-url": "http://[@@_ipv6_address@@]:8990",
"backend-connect-retries": "3",
"backend-connect-timeout": "5",
"backend-haproxy-http-port": "21080",
"backend-haproxy-https-port": "21443",
"backend-haproxy-statistic-port": "21444",
"ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA AES256-SHA AES128-SHA ECDHE-RSA-DES-CBC3-SHA DES-CBC3-SHA",
"cluster-identification": "testing partition 0",
"disk-cache-size": "8G",
"domain": "example.com",
"enable-http2-by-default": "true",
"enable-http3": "false",
"extra_slave_instance_list": "[{\"enable_cache\": true, \"slave_reference\": \"_ssl_from_master\", \"url\": \"http://@@_ipv4_address@@:@@_server_http_port@@/\"}]",
"frontend-name": "caddy-frontend-1",
......@@ -91,6 +101,11 @@
"monitor-username": "admin",
"plain_http_port": "11080",
"port": "11443",
"ram-cache-size": "1G",
"re6st-verification-url": "http://[2001:67c:1254:4::1]/index.html",
"request-timeout": "600",
"rotate-num": "4000",
"slave-introspection-https-port": "22443",
"slave-kedifa-information": "{\"_ssl_from_master\": {\"kedifa-caucase-url\": \"http://[@@_ipv6_address@@]:15090\", \"key-download-url\": \"https://[@@_ipv6_address@@]:15080/@@ssl_from_master_key-generate-auth-url@@\", \"key-generate-auth-url\": \"https://[@@_ipv6_address@@]:15080/@@ssl_from_master_key-generate-auth-url@@/@@ssl_from_master_key-upload-url@@\", \"key-upload-url\": \"https://[@@_ipv6_address@@]:15080/@@ssl_from_master_key-generate-auth-url@@?auth=\"}}"
},
"full_address_list": [],
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment