Skip to content

slapos
slapos
Commit d26a66dc authored by Alain Takoudjou's avatar Alain Takoudjou
Browse files
Options

Sozu fixup for parameters and certificate

parent 2d3959df
Hide whitespace changes
Inline Side-by-side
Showing with 86 additions and 53 deletions
software/sozu/buildout.hash.cfg
View file @ d26a66dc
...@@ -14,16 +14,24 @@ ...@@ -14,16 +14,24 @@
# not need these here). # not need these here).
[instance.cfg] [instance.cfg]
filename = instance.cfg.in filename = instance.cfg.in
md5sum = 8a714ed894c0eb99cd8de49e588d0af4 md5sum = d53e6dd9d1c1faf6c29837108574958c
[template-sozu] [template-sozu]
filename = instance-sozu.cfg.jinja2.in filename = instance-sozu.cfg.jinja2.in
md5sum = 5ec499b5cab85d9aa2b55ea6ff3cf701 md5sum = 97ba1fa01024f131b932c36896f061ce
[config.toml] [config.toml]
filename = config.toml.in filename = templates/config.toml.in
md5sum = 3b407e5ee362e51de60ffb9f850f9cc0 md5sum = b4e2b7fd4ef12862944e2bcfe4c2e4d6
[publish-sozu-slave-parameters.cfg] [publish-sozu-slave-parameters.cfg]
filename = publish-sozu-slave-parameters.cfg.in filename = publish-sozu-slave-parameters.cfg.in
md5sum = ee8dcb866fbe3b8916c6d2e5a28e19e3 md5sum = ee8dcb866fbe3b8916c6d2e5a28e19e3
[response-404.html]
filename = templates/404.html
md5sum = 688eb86fba7c320370b50ff84edcfa31
[response-503.html]
filename = templates/503.html
md5sum = 1bb8129372c26af854a3d9b60f495414
software/sozu/instance-sozu-slave-input-schema.json
View file @ d26a66dc
...@@ -42,14 +42,9 @@ ...@@ -42,14 +42,9 @@
"patternProperties": { "patternProperties": {
".*": { ".*": {
"properties": { "properties": {
"address": {
"title": "TCP listener",
"description": "TCP address listener (ip and port). Something like: 0.0.0.0:8080",
"type": "string"
},
"hostname": { "hostname": {
"title": "Hostname", "title": "Hostname for frontend",
"description": "host name of the cluster.", "description": "Frontend hostname, this need to resolve frontend IP address. Default is empty.",
"type": "string" "type": "string"
}, },
"path": { "path": {
...@@ -97,7 +92,7 @@ ...@@ -97,7 +92,7 @@
"items": { "items": {
"type": "string" "type": "string"
}, },
"default": [] "default": ["TLS_V12", "TLS_V13"]
}, },
"deploy-certificate": { "deploy-certificate": {
"title": "Deploy self-signed certificate", "title": "Deploy self-signed certificate",
......
software/sozu/instance-sozu.cfg.jinja2.in
View file @ d26a66dc
...@@ -18,6 +18,7 @@ nginx-prefix = ${:var}/nginx ...@@ -18,6 +18,7 @@ nginx-prefix = ${:var}/nginx
tmp = ${:home}/tmp tmp = ${:home}/tmp
ssl = ${:etc}/ssl ssl = ${:etc}/ssl
dssl = ${:etc}/ssl-downloaded dssl = ${:etc}/ssl-downloaded
assets = ${:srv}/sozu/assets
[createfile] [createfile]
recipe = slapos.recipe.template:jinja2 recipe = slapos.recipe.template:jinja2
...@@ -41,31 +42,46 @@ cert-file = ${ca-directory:certs}/${:name}.key ...@@ -41,31 +42,46 @@ cert-file = ${ca-directory:certs}/${:name}.key
executable = echo "request certificate" executable = echo "request certificate"
wrapper = ${directory:tmp}/ca-${:name} wrapper = ${directory:tmp}/ca-${:name}
[cluster-frontend-port]
recipe = slapos.cookbook:free_port
minimum = 7091
maximum = 9190
ip = {{ ipv6 }}
{% set port_base = 7090 -%}
{% for slave_dict in slave_instance_list %} {% for slave_dict in slave_instance_list %}
{% set instance_dict = json_module.loads(slave_dict['_']) -%} {% set instance_dict = json_module.loads(slave_dict['_']) -%}
{% set name = slave_dict['slave_reference'] -%} {% set name = slave_dict['slave_reference'] -%}
{% set slave_title = slave_dict['slave_title'] -%} {% set slave_title = slave_dict['slave_title'] -%}
{% set cert_section_name = '${' ~ name ~ '-ssl:cert-file}' -%} {% set cert_section_name = '${' ~ name ~ '-ssl:cert-file}' -%}
{% set key_section_name = '${' ~ name ~ '-ssl:key-file}' -%} {% set key_section_name = '${' ~ name ~ '-ssl:key-file}' -%}
{% set port_base = port_base + 20 -%}
[{{ name }}-ssl] [{{ name }}-ssl]
<= ca-certificate-base <= ca-certificate-base
name = {{ name }} name = {{ name }}
{% for cluster_name, cluster_dict in instance_dict['frontend-dict'].items() %} {% for frontend_name, frontend_dict in instance_dict['frontend-dict'].items() %}
{% if cluster_dict.get('deploy-certificate') -%} {% set frontend_port = port_base + 1 -%}
{% do instance_dict['frontend-dict'][cluster_name].__setitem__('certificate', '${' ~ name ~ '-ssl:cert-file}') -%} [{{ "%s-%s-port" | format(name, frontend_name) }}]
{% do instance_dict['frontend-dict'][cluster_name].__setitem__('key', '${' ~ name ~ '-ssl:key-file}') -%} <= cluster-frontend-port
{% do instance_dict['frontend-dict'][cluster_name].__setitem__('certificate-chain', '${' ~ name ~ '-ssl:chain-file}') -%} minimum= {{ frontend_port }}
{% elif cluster_dict.get('certificate') and cluster_dict.get('key') and cluster_dict.get('certificate-chain') -%} {% do instance_dict['frontend-dict'][frontend_name].__setitem__("address", "%s:${%s-%s-port:port}" | format(ipv6, name, frontend_name)) -%}
{{ createfile(name ~ cluster_name ~ "-crt", "${directory:dssl}/" ~ name ~ cluster_name ~ ".crt", cluster_dict['certificate']) }} {% if frontend_dict.get('deploy-certificate') -%}
{{ createfile(name ~ cluster_name ~ "-key", "${directory:dssl}/" ~ name ~ cluster_name ~ ".key", cluster_dict['key']) }} {% do instance_dict['frontend-dict'][frontend_name].__setitem__("certificate", "${%s-ssl:cert-file}" | format(name)) -%}
{{ createfile(name ~ cluster_name ~ "-chain", "${directory:dssl}/" ~ name ~ cluster_name ~ "-chain.crt", cluster_dict['certificate-chain']) }} {% do instance_dict['frontend-dict'][frontend_name].__setitem__('key', "${%s-ssl:key-file}" | format(name)) -%}
{% do instance_dict['frontend-dict'][frontend_name].__setitem__('certificate-chain', "${%s-ssl:chain-file}" | format(name)) -%}
{% do instance_dict['frontend-dict'][cluster_name].__setitem__('certificate', '${' ~ name ~ cluster_name~ '-crt:output}') -%}
{% do instance_dict['frontend-dict'][cluster_name].__setitem__('key', '${' ~ name ~ cluster_name~ '-key:output}') -%} {% elif frontend_dict.get('certificate') and frontend_dict.get('key') -%}
{% do instance_dict['frontend-dict'][cluster_name].__setitem__('certificate-chain', '${' ~ name ~ cluster_name~ '-chain:output}') -%} {{ createfile("%s-%s-crt" | format(name, frontend_name), "${directory:dssl}/" ~ name ~ frontend_name ~ ".crt", frontend_dict['certificate']) }}
{{ createfile("%s-%s-key" | format(name, frontend_name), "${directory:dssl}/" ~ name ~ frontend_name ~ ".key", frontend_dict['key']) }}
{% if frontend_dict.get('certificate-chain') -%}
{{ createfile("%s-%s-chain" | format(name, frontend_name), "${directory:dssl}/" ~ name ~ frontend_name ~ "-chain.crt", frontend_dict['certificate-chain']) }}
{% do instance_dict['frontend-dict'][frontend_name].__setitem__('certificate-chain', "${%s-%s-chain:output}" | format(name, frontend_name)) -%}
{% endif -%}
{% do instance_dict['frontend-dict'][frontend_name].__setitem__('certificate', "${%s-%s-crt:output}" | format(name, frontend_name)) -%}
{% do instance_dict['frontend-dict'][frontend_name].__setitem__('key', "${%s-%s-key:output}" | format(name, frontend_name)) -%}
{% endif -%} {% endif -%}
{% endfor -%} {% endfor -%}
{% do cluster_definition_dict.__setitem__(name, instance_dict) -%} {% do cluster_definition_dict.__setitem__(name, instance_dict) -%}
...@@ -75,9 +91,14 @@ name = {{ name }} ...@@ -75,9 +91,14 @@ name = {{ name }}
#warn, info, debug, trace #warn, info, debug, trace
log-level = info log-level = info
log-file = ${directory:log}/sozu.log log-file = ${directory:log}/sozu.log
state-file = ${directory:etc}/sozu-state.json
access-log-file = ${directory:log}/sozu-access.log access-log-file = ${directory:log}/sozu-access.log
socket-file = ${directory:run}/sozu.sock socket-file = ${directory:run}/sozu.sock
max-buffer-size = 163840 404-html = {{ response_404_html }}
503-html = {{ response_503_html }}
buffer-size = 16393
cmd-buffer-size = 1048576
max-cmd-buffer-size = 2097152
worker-count = 2 worker-count = 2
max-connections = 500 max-connections = 500
# wait for a command to complete timeout # wait for a command to complete timeout
...@@ -118,6 +139,7 @@ wrapper-path = ${directory:bin}/sozu ...@@ -118,6 +139,7 @@ wrapper-path = ${directory:bin}/sozu
recipe = slapos.cookbook:certificate_authority.request recipe = slapos.cookbook:certificate_authority.request
key-file = ${sozu-parameters:key-file} key-file = ${sozu-parameters:key-file}
cert-file = ${sozu-parameters:cert-file} cert-file = ${sozu-parameters:cert-file}
chain-file = ${ca-directory:root}/cacert.pem
executable = ${sozu-wrapper:wrapper-path} executable = ${sozu-wrapper:wrapper-path}
wrapper = ${directory:bin}/ca-sozu wrapper = ${directory:bin}/ca-sozu
...@@ -196,7 +218,7 @@ context = ...@@ -196,7 +218,7 @@ context =
[sozu-slave-information] [sozu-slave-information]
{% for name, cluster_dict in cluster_definition_dict.items() -%} {% for name, cluster_dict in cluster_definition_dict.items() -%}
{{ name }} = {{ dumps(cluster_dict) }} {{ name }} = !py!{{ cluster_dict }}
{% endfor -%} {% endfor -%}
[buildout] [buildout]
......
software/sozu/instance.cfg.in
View file @ d26a66dc
...@@ -50,6 +50,8 @@ extra-context = ...@@ -50,6 +50,8 @@ extra-context =
# config files # config files
raw config_toml_in {{ config_toml }} raw config_toml_in {{ config_toml }}
raw template_publish_slave {{ template_publish_slave }} raw template_publish_slave {{ template_publish_slave }}
raw response_404_html {{ template_404_html }}
raw response_503_html {{ template_503_html }}
[slave-output.cfg] [slave-output.cfg]
recipe = slapos.recipe.template:jinja2 recipe = slapos.recipe.template:jinja2
......
software/sozu/software.cfg
View file @ d26a66dc
...@@ -20,16 +20,6 @@ command = ...@@ -20,16 +20,6 @@ command =
PATH=${rustc:location}/bin:$PATH PATH=${rustc:location}/bin:$PATH
cargo install --root=${:location} sozu cargo install --root=${:location} sozu
[sozu-d]
recipe = slapos.recipe.cmmi
url = https://github.com/sozu-proxy/sozu/archive/refs/tags/0.15.6.tar.gz
md5sum = 4cd4386b64c652af5ad416b10b6ca246
configure-command = :
make-binary = cargo install --root=%(location)s --path . --locked
make-targets =
environment =
PATH=${rustc:location}/bin:%(PATH)s
[dl-template] [dl-template]
recipe = slapos.recipe.build:download recipe = slapos.recipe.build:download
url = ${:_profile_base_location_}/${:filename} url = ${:_profile_base_location_}/${:filename}
...@@ -50,6 +40,8 @@ context = ...@@ -50,6 +40,8 @@ context =
key sozu_location sozu:location key sozu_location sozu:location
key template_sozu_cfg template-sozu:target key template_sozu_cfg template-sozu:target
key template_publish_slave publish-sozu-slave-parameters.cfg:target key template_publish_slave publish-sozu-slave-parameters.cfg:target
key template_404_html response-404.html:target
key template_503_html response-503.html:target
[template-sozu] [template-sozu]
<= dl-template <= dl-template
...@@ -59,3 +51,9 @@ context = ...@@ -59,3 +51,9 @@ context =
[publish-sozu-slave-parameters.cfg] [publish-sozu-slave-parameters.cfg]
<= dl-template <= dl-template
[response-404.html]
<= dl-template
[response-503.html]
<= dl-template
software/sozu/templates/404.html 0 → 100644
View file @ d26a66dc
HTTP/1.1 404 Not Found
Cache-Control: no-cache
Connection: close
\ No newline at end of file
software/sozu/templates/503.html 0 → 100644
View file @ d26a66dc
HTTP/1.1 503 Service unavailable
Cache-Control: no-cache
Connection: close
\ No newline at end of file
software/sozu/config.toml.in → software/sozu/templates/config.toml.in
View file @ d26a66dc
...@@ -6,12 +6,12 @@ ...@@ -6,12 +6,12 @@
# routing. You can generate this file from sozu's current routing by running # routing. You can generate this file from sozu's current routing by running
# the command `sozu state save -f state.json` # the command `sozu state save -f state.json`
# this must be RELATIVE to config.toml # this must be RELATIVE to config.toml
# saved_state = "./state.json" saved_state = "{{ parameter_dict['state-file'] }}"
# save the configuration to the saved_state file every time we receive a # save the configuration to the saved_state file every time we receive a
# configuration message on the configuration socket # configuration message on the configuration socket
# defaults to false, and will not work if the 'saved_state' option is not set # defaults to false, and will not work if the 'saved_state' option is not set
# automatic_state_save = false automatic_state_save = false
# logging verbosity. Possible values are "error", "warn", "info", "debug" and # logging verbosity. Possible values are "error", "warn", "info", "debug" and
# "trace". For performance reasons, the logs at "debug" or "trace" level are # "trace". For performance reasons, the logs at "debug" or "trace" level are
...@@ -44,9 +44,9 @@ command_socket = "{{ parameter_dict['socket-file'] }}" ...@@ -44,9 +44,9 @@ command_socket = "{{ parameter_dict['socket-file'] }}"
# buffer will grow up to max_command_buffer_size. If the buffer is still not large # buffer will grow up to max_command_buffer_size. If the buffer is still not large
# enough sozu will close the connection # enough sozu will close the connection
# defaults to 1000000 # defaults to 1000000
command_buffer_size = 16384 command_buffer_size = {{ parameter_dict["cmd-buffer-size"] }}
# defaults to command_buffer_size * 2 # defaults to command_buffer_size * 2
max_command_buffer_size = {{ parameter_dict["max-buffer-size"] }} max_command_buffer_size = {{ parameter_dict["max-cmd-buffer-size"] }}
# the number of worker processes that will handle traffic # the number of worker processes that will handle traffic
# defaults to 2 workers # defaults to 2 workers
...@@ -85,7 +85,7 @@ max_connections = {{ parameter_dict["max-connections"] }} ...@@ -85,7 +85,7 @@ max_connections = {{ parameter_dict["max-connections"] }}
# leave enough memory for one more worker (also for the kernel, etc), so total # leave enough memory for one more worker (also for the kernel, etc), so total
# RAM should be larger than (worker count + 1) * max_buffers * 2 * buffer_size bytes # RAM should be larger than (worker count + 1) * max_buffers * 2 * buffer_size bytes
# defaults to 16393 (minimum size for HTTP/2 is a 16384 bytes frame + 9 bytes of header # defaults to 16393 (minimum size for HTTP/2 is a 16384 bytes frame + 9 bytes of header
buffer_size = 16393 buffer_size = {{ parameter_dict["buffer-size"] }}
# how much time (in milliseconds) sozu command line will wait for a command to complete. # how much time (in milliseconds) sozu command line will wait for a command to complete.
# Defaults to 1000 milliseconds # Defaults to 1000 milliseconds
...@@ -154,8 +154,8 @@ address = "[{{ parameter_dict['ip'] }}]:{{ parameter_dict['port'] }}" ...@@ -154,8 +154,8 @@ address = "[{{ parameter_dict['ip'] }}]:{{ parameter_dict['port'] }}"
# path to custom 404 and 503 answers # path to custom 404 and 503 answers
# a 404 response is sent when sozu does not know about the requested domain or path # a 404 response is sent when sozu does not know about the requested domain or path
# a 503 response is sent if there are no backend servers available # a 503 response is sent if there are no backend servers available
#answer_404 = "../lib/assets/404.html" answer_404 = "{{ parameter_dict['404-html'] }}"
#answer_503 = "../lib/assets/503.html" answer_503 = "{{ parameter_dict['503-html'] }}"
# defines the sticky session cookie's name, if `sticky_session` is activated for # defines the sticky session cookie's name, if `sticky_session` is activated for
# a cluster. Defaults to "SOZUBALANCEID" # a cluster. Defaults to "SOZUBALANCEID"
...@@ -176,8 +176,8 @@ address = "[{{ parameter_dict['ip'] }}]:{{ parameter_dict['https-port'] }}" ...@@ -176,8 +176,8 @@ address = "[{{ parameter_dict['ip'] }}]:{{ parameter_dict['https-port'] }}"
# this option is incompatible with expect_proxy # this option is incompatible with expect_proxy
# public_address = "1.2.3.4:80" # public_address = "1.2.3.4:80"
# answer_404 = "../lib/assets/404.html" answer_404 = "{{ parameter_dict['404-html'] }}"
# answer_503 = "../lib/assets/503.html" answer_503 = "{{ parameter_dict['503-html'] }}"
# sticky_name = "SOZUBALANCEID" # sticky_name = "SOZUBALANCEID"
# Configures the client socket to receive a PROXY protocol header # Configures the client socket to receive a PROXY protocol header
...@@ -212,9 +212,9 @@ cipher_list = [ ...@@ -212,9 +212,9 @@ cipher_list = [
# default certificate and key # default certificate and key
# in case you want to set up TLS without SNI, you can define the default # in case you want to set up TLS without SNI, you can define the default
# certificate here # certificate here
certificate = "{{ parameter_dict['cert-file'] }}" # certificate = "{{ parameter_dict['cert-file'] }}"
key = "{{ parameter_dict['key-file'] }}" # key = "{{ parameter_dict['key-file'] }}"
certificate_chain = "{{ parameter_dict['cert-chain-file'] }}" # certificate_chain = "{{ parameter_dict['cert-chain-file'] }}"
# options specific to a TCP proxy listener # options specific to a TCP proxy listener
#[[listeners]] #[[listeners]]
...@@ -258,19 +258,21 @@ load_metric = "{{ cluster_dict.get('load-metric', 'CONNECTIONS') }}" ...@@ -258,19 +258,21 @@ load_metric = "{{ cluster_dict.get('load-metric', 'CONNECTIONS') }}"
# - hostname: host name of the cluster # - hostname: host name of the cluster
# - path = "/api" # optional. A routing rule for incoming requests. The path of the request must match it. Can be a prefix (default), a regex, or a strictly equal path. # - path = "/api" # optional. A routing rule for incoming requests. The path of the request must match it. Can be a prefix (default), a regex, or a strictly equal path.
# - path_type = PREFIX | REGEX | EQUALS # defaults to PREFIX # - path_type = PREFIX | REGEX | EQUALS # defaults to PREFIX
# - sticky_session = false # activates sticky sessions for this cluster # - sticky_session = false # activates sticky sessions for this cluster (not working!)
# - https_redirect = false # activates automatic redirection to HTTPS for this cluster # - https_redirect = false # activates automatic redirection to HTTPS for this cluster
# - custom_tag: a tag to retrieve a frontend with the CLI or in the logs # - custom_tag: a tag to retrieve a frontend with the CLI or in the logs
# - method
# - position
frontends = [ frontends = [
{% for _, frontend_dict in cluster_dict['frontend-dict'].items() -%} {% for _, frontend_dict in cluster_dict['frontend-dict'].items() -%}
{% set enable_https = frontend_dict.get("certificate") and frontend_dict.get("key") and frontend_dict.get("chain") -%} {% set enable_https = frontend_dict.get("certificate") and frontend_dict.get("key") and frontend_dict.get("certificate-chain") -%}
{% set tag_list = [] -%} {% set tag_list = [] -%}
{% set user_tag_list = frontend_dict.get('tag-list', []) -%} {% set user_tag_list = frontend_dict.get('tag-list', []) -%}
{% for tag in user_tag_list -%} {% for tag in user_tag_list -%}
{% set k, v = tag.split('=') -%} {% set k, v = tag.split('=') -%}
{% do tag_list.append(k.strip() ~ '="' ~ v.strip() ~ '"') -%} {% do tag_list.append(k.strip() ~ '="' ~ v.strip() ~ '"') -%}
{% endfor -%} {% endfor -%}
{ address = "{{ frontend_dict['address'] }}", hostname = "{{ frontend_dict.get('hostname') }}", {% if user_tag_list -%} tags = {{ tag_list | join(',') }}, {%- endif %} path = "{{ frontend_dict.get('path', '') }}", path_type = "{{ frontend_dict.get("path-type", "PREFIX") }}", sticky_session = {{ frontend_dict.get("sticky-session", "false") }}, https_redirect = {{ frontend_dict.get("https-redirect", "false") }}{% if enable_https -%}, tls_versions = {{ frontend_dict.get("tls-versions", []) }}, certificate = "{{ frontend_dict['certificate'] }}", key = "{{ frontend_dict['key'] }}", certificate_chain = "{{ frontend_dict['chain'] }}" {% endif -%} }, { address = "{{ frontend_dict['address'] }}", hostname = "{{ frontend_dict.get('hostname') }}", {% if user_tag_list -%} tags = {{ tag_list | join(',') }}, {%- endif %} path = "{{ frontend_dict.get('path', '') }}", path_type = "{{ frontend_dict.get("path-type", "PREFIX") }}" {% if enable_https -%}, tls_versions = {{ frontend_dict.get("tls-versions", ["TLS_V12", "TLS_V13"]) }}, certificate = "{{ frontend_dict['certificate'] }}", key = "{{ frontend_dict['key'] }}", certificate_chain = "{{ frontend_dict['certificate-chain'] }}" {% endif -%} },
{% endfor -%} {% endfor -%}
] ]
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7