Merge branch 'erp5' into erp5-cluster

Conflicts:
	stack/erp5/buildout.cfg
	stack/erp5/instance-erp5-cluster.cfg.in
	stack/erp5/instance-erp5-single.cfg.in
	stack/erp5/instance-kumofs.cfg.in
	stack/erp5/instance-zope.cfg.in
	stack/erp5/instance.cfg.in

CHANGES.txt

 Changes
 =======
 
+0.85 (2013-12-03)
+-----------------
+
+ * Slaprunner: recipe replaced by a buildout profile [14fbcd92]
+ * Slaprunner: import instances can automatically deploy Software Releases [64c48388]
+ * Slaprunner: backup script passes basic authentification [8877615]
+ * Slaprunner: backup doesn't destroy symlinks for Software Releases [f519a078]
+ * Shellinabox: now uses uid and gid to start [e9349c65]
+ * Shellinabox: can do autoconnection [516e772]
+ * Librecipe-generic: correction of bash code for /bin/sh compatibility [bee8c9c8]
+
+0.84.2 (2013-10-04)
+-------------------
+
+ * sshkeys_authority: don't allow to return None as parameter. [9e340a0]
+
+0.84.1 (2013-10-03)
+-------------------
+
+ * Resiliency: PBS: promise should NOT bang. [64886cd]
+
+0.84 (2013-09-30)
+-----------------
+
+ * Request.py: improve instance-state handling. [ba5f160]
+ * Resilient recipe: remove hashing of urls/names. [ee2aec8]
+ * Resilient pbs recipe: recover from rdiff-backup failures. [be7f2fc, 92ee0c3]
+ * Resilience: add pidfiles in PBS. [0b3ad5c]
+ * Resilient: don't hide exception, print it. [05b3d64, d2b0494]
+ * Resiliency: Only keep 10 increments of backup. [4e89e33]
+ * KVM SR: add fallback in case of download exception. [de8d796]
+ * slaprunner: don't check certificate for importer. [53dc772]
+
+0.83.1 (2013-09-10)
+------------------
+
+ * slapconfiguration: fixes previous releasei (don't encode tap_set because it's not a string). [Cedric de Saint Martin]
+
+0.83 (2013-09-10)
+-----------------
+
+ * slaprunner recipe: remove trailing / from master_url. [Cedric de Saint Martin]
+ * librecipe: add pidfile option for singletons. [Cedric de Saint Martin]
+ * Resiliency: Use new pidfile option. [Cedric de Saint Martin]
+ * Fix request.py for slave instances. [Cedric de Saint Martin]
+ * slapconfiguration recipe: cast some parameters from unicode to str. [Cedric de Saint Martin]
+
+0.82 (2013-08-30)
+-----------------
+
+ * Certificate Authority: Can receice certificate to install. [Cedric Le Ninivin]
+ * Squid: Add squid recipe. [Romain Courteaud]
+ * Request: Trasmit instace state to requested instances. [Benjamin Blanc / Cédric Le Ninivin]
+ * Slapconfiguration: Now return instance state. [Cédric Le Ninivin]
+ * Apache Frontend: Remove recipe
+
 0.81 (2013-08-12)
 -----------------
 

component/apache/buildout.cfg

@@ -15,25 +15,25 @@ extends =
 
 [apr]
 recipe = hexagonit.recipe.download
-version = 1.4.6
+version = 1.5.0
 url = http://mir2.ovh.net/ftp.apache.org/dist/apr/apr-${:version}.tar.bz2
-md5sum = ffee70a111fd07372982b0550bbb14b7
+md5sum = cc93bd2c12d0d037f68e21cc6385dc31
 
 [apr-util]
 recipe = hexagonit.recipe.download
-version = 1.5.1
+version = 1.5.3
 url = http://mir2.ovh.net/ftp.apache.org/dist/apr/apr-util-${:version}.tar.bz2
-md5sum = 9c1db8606e520f201c451ec9a0b095f6
+md5sum = 6f3417691c7a27090f36e7cf4d94b36e
 
 [apache]
 # inspired on http://old.aclark.net/team/aclark/blog/a-lamp-buildout-for-wordpress-and-other-php-apps/
 recipe = slapos.recipe.cmmi
 depends =
   ${gdbm:version}
-version = 2.4.4
+version = 2.4.7
 revision = 1
 url = http://mir2.ovh.net/ftp.apache.org/dist/httpd/httpd-${:version}.tar.bz2
-md5sum = 0e712ee2119cd798c8ae39d5f11a9206
+md5sum = 170d7fb6fe5f28b87d1878020a9ab94e
 configure-command = cp -ar ${apr:location}/apr-${apr:version} srclib/apr/; cp -ar ${apr-util:location}/apr-util-${apr-util:version} srclib/apr-util; ./configure
 configure-options = --prefix=${buildout:parts-directory}/${:_buildout_section_name_}
                     --disable-static
@@ -120,9 +120,9 @@ make-targets =
 [apache-2.2]
 # inspired on http://old.aclark.net/team/aclark/blog/a-lamp-buildout-for-wordpress-and-other-php-apps/
 recipe = slapos.recipe.cmmi
-version = 2.2.25
+version = 2.2.26
 url = http://mir2.ovh.net/ftp.apache.org/dist/httpd/httpd-${:version}.tar.bz2
-md5sum = 9ebe3070c0bb4311f21a0cd0e34f0045
+md5sum = 254eda547f8d624604e4bf403241e617
 patch-options = -p1
 configure-options = --disable-static
                     --enable-authn-alias

component/cloud9/buildout.cfg

@@ -19,7 +19,7 @@ recipe = slapos.recipe.build:npm
 packages = sm@0.2.11
 node = nodejs
 environment =
-  PATH=${nodejs:location}/bin:%(PATH)s
+  PATH=${nodejs-0.6:location}/bin:%(PATH)s
 
 [cloud9-stable]
 # Online IDE written in javascript/node.js
@@ -49,7 +49,34 @@ recipe = hexagonit.recipe.download
 url = ${:_profile_base_location_}/${:filename}
 filename = cloud9-socket.patch
 download-only = true
-#md5sum = 5dc8cc28447ed3747b8a53c768d872aa
+md5sum = c581456cb3a76841898f79f9600e3a1e
+
+[cloud9-file-already-exist.patch]
+# This patch prevents the error "File already exists"
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/${:filename}
+filename = cloud9-file_already_exist.patch
+download-only = true
+md5sum = 0bc104af8176388d60cbf884b72c8318
+
+[cloud9-remove-all-listeners.patch]
+# This patch prevents cloud9 to die every
+# time a tab is closed
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/${:filename}
+filename = cloud9-removeAllListeners.patch
+download-only = true
+md5sum = 357915330d677f4917140e02a55646b7
+
+[cloud9-git-download]
+recipe = slapos.recipe.build:gitclone
+repository = https://github.com/ajaxorg/cloud9.git
+revision = f7d102bc225c922f116d2cea52a746d64343ea59
+location = ${buildout:parts-directory}/cloud9
+git-executable = ${git:location}/bin/git
+develop = true
+use-cache = true
+ignore-ssl-certificate = true
 
 [cloud9-git]
 # Online IDE written in javascript/node.js
@@ -58,13 +85,10 @@ download-only = true
 # NODE_PATH=${:destination}/node_modules ${nodejs:node_location} ${:cloud9_js_location}
 recipe = plone.recipe.command
 stop-on-error = true
-commit = f7d102bc225c922f116d2cea52a746d64343ea59
-repository = https://github.com/ajaxorg/cloud9.git
-location = ${buildout:parts-directory}/${:_buildout_section_name_}
-environment = export GIT_SSL_NO_VERIFY=true; export PATH=${git:location}/bin:${nodejs:location}/bin:${node-sm:location}/node_modules/sm/bin:$PATH; export CPPFLAGS="-I${libxml2:location}/include -I${nodejs:location}/include"; export LDFLAGS="-L${libxml2:location}/lib -Wl,-rpath=${libxml2:location}/lib"; export HOME=${:location};
-command = ${:environment} (git clone --quiet ${:repository} ${:location} && cd ${:location} && git reset --hard ${:commit} && ${node-sm:location}/node_modules/.bin/sm install && patch -p1 < ${cloud9-session-directory.patch:location}/${cloud9-session-directory.patch:filename} && ${node-sm:location}/node_modules/.bin/sm install && patch -p1 < ${cloud9-socket.patch:location}/${cloud9-socket.patch:filename}) || (rm -fr ${:location}; exit 1)
-update-command =
-executable = ${:location}/server.js
+environment = export GIT_SSL_NO_VERIFY=true; export PATH=${git:location}/bin:${nodejs-0.6:location}/bin:${node-sm:location}/node_modules/.bin/:$PATH; export CPPFLAGS="-I${libxml2:location}/include -I${nodejs-0.6:location}/include"; export LDFLAGS="-L${libxml2:location}/lib -Wl,-rpath=${libxml2:location}/lib"; export HOME=${cloud9-git-download:location};
+command = ${:environment} (cd ${cloud9-git-download:location} && ${node-sm:location}/node_modules/.bin/sm install && patch -p1 < ${cloud9-session-directory.patch:location}/${cloud9-session-directory.patch:filename} && patch -p1 < ${cloud9-socket.patch:location}/${cloud9-socket.patch:filename} && patch -p1 < ${cloud9-file-already-exist.patch:location}/${cloud9-file-already-exist.patch:filename} && patch -p1 < ${cloud9-remove-all-listeners.patch:location}/${cloud9-remove-all-listeners.patch:filename}) || (rm -fr ${cloud9-git-download:location}; exit 1)
+update-command = true
+executable = ${cloud9-git-download:location}/server.js
 
 [cloud9-npm]
 # Online IDE written in javascript/node.js

component/cloud9/cloud9-file_already_exist.patch

+diff --git a/node_modules/vfs-local/localfs.js b/node_modules/vfs-local/localfs.js
+index 7ce9981..1dd07b7 100644
+--- a/node_modules/vfs-local/localfs.js
++++ b/node_modules/vfs-local/localfs.js
+@@ -677,7 +677,7 @@ module.exports = function setup(fsOptions) {
+                     else {
+                         var err = new Error("File already exists.");
+                         err.code = "EEXIST";
+-                        callback(err);
++                        //callback(err);
+                     }
+                 });
+             });

component/cloud9/cloud9-removeAllListeners.patch

+diff --git a/plugins-server/cloud9.ide.watcher/file_watcher.js b/plugins-server/cloud9.ide.watcher/file_watcher.
+index b7ed7da..36dcd05 100644
+--- a/plugins-server/cloud9.ide.watcher/file_watcher.js
++++ b/plugins-server/cloud9.ide.watcher/file_watcher.js
+@@ -69,11 +69,11 @@ util.inherits(FileWatcher, EventEmitter);
+ 
+     this.close = function() {
+         if (this.watcher) {
+-            this.watcher.removeAllListeners();
++            //this.watcher.removeAllListeners();
+             this.watcher.close();
+             this.emit("close");
+         }
+         this.watcher = null;
+     };
+ 
+-}).call(FileWatcher.prototype);
+\ No newline at end of file
++}).call(FileWatcher.prototype);
+

component/curl/buildout.cfg

@@ -11,8 +11,8 @@ parts =
 
 [curl]
 recipe = slapos.recipe.cmmi
-url = http://curl.haxx.se/download/curl-7.31.0.tar.bz2
-md5sum = b7bea20579ac2f696338ae03f2c19ba5
+url = http://curl.haxx.se/download/curl-7.34.0.tar.bz2
+md5sum = 88491df2bb32e9146e776ae6ac2f8327
 configure-options =
   --disable-static
   --disable-ldap
@@ -28,12 +28,15 @@ configure-options =
   --enable-ipv6
   --disable-sspi
   --without-gnutls
+  --without-spnego
   --with-ssl=${openssl:location}
   --with-zlib=${zlib:location}
   --without-nss
+  --without-libmetalink
   --without-libssh2
   --without-librtmp
   --without-libidn
+  --without-nghttp2
 
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s

component/firefox/buildout.cfg

@@ -34,7 +34,7 @@ script =
   wrapper = open(wrapper_location, 'w')
   wrapper.write("""#!${dash:location}/bin/dash
   cd %(location)s
-  export LD_LIBRARY_PATH=%(location)s:${libXrender:location}/lib/:{dbus:location}/lib/:${dbus-glib:location}/lib/:${freetype:location}/lib/:${fontconfig:location}/lib/:${libX11:location}/lib/:${bzip2:location}/lib/:${libXext:location}/lib/:${libXt:location}/lib/:${zlib:location}/lib/:${libXcursor:location}/lib/:${gtk-2:location}/lib/:${cairo:location}/lib/:${pango:location}/lib/:${glib:location}/lib/:${atk:location}/lib/:${gdk-pixbuf:location}/lib/:${alsa:location}/lib/:${libpng15:location}/lib/:${libSM:location}/lib/:${libICE:location}/lib:${libxml2:location}/lib:${openssl:location}/lib
+  export LD_LIBRARY_PATH=%(location)s:${libXrender:location}/lib:${dbus:location}/lib:${dbus-glib:location}/lib:${freetype:location}/lib:${fontconfig:location}/lib:${libX11:location}/lib:${bzip2:location}/lib:${libXext:location}/lib:${libXt:location}/lib:${zlib:location}/lib:${libXcursor:location}/lib:${gtk-2:location}/lib:${cairo:location}/lib:${pango:location}/lib:${glib:location}/lib:${atk:location}/lib:${gdk-pixbuf:location}/lib:${alsa:location}/lib:${libpng15:location}/lib:${libSM:location}/lib:${libICE:location}/lib:${libxml2:location}/lib:${openssl:location}/lib
   export PATH=${fontconfig:location}/bin:$PATH
   exec %(location)s/firefox $*""")
   wrapper.close()

component/gettext/buildout.cfg

@@ -8,12 +8,13 @@ extends =
 
 [gettext]
 recipe = slapos.recipe.cmmi
-url = http://ftp.gnu.org/pub/gnu/gettext/gettext-0.18.2.1.tar.gz
-md5sum = 034c8103b14654ebd300fadac44d6f14
+url = http://ftp.gnu.org/pub/gnu/gettext/gettext-0.18.3.2.tar.gz
+md5sum = 241aba309d07aa428252c74b40a818ef
 
 configure-options =
   --disable-static
   --disable-java
+  --disable-native-java
   --disable-csharp
   --with-libncurses-prefix=${ncurses:location}
   --with-libxml2-prefix=${libxml2:location}
@@ -22,6 +23,8 @@ configure-options =
   --disable-acl
   --disable-openmp
   --without-git
+  --without-bz2
+  --without-xz
 
 environment =
   CPPFLAGS=-I${libxml2:location}/include -I${zlib:location}/include -I${ncurses:location}/include

component/grep/buildout.cfg

@@ -8,8 +8,8 @@ parts =
 
 [grep]
 recipe = slapos.recipe.cmmi
-url = http://ftp.gnu.org/gnu/grep/grep-2.14.tar.xz
-md5sum = d4a3f03849d1e17ce56ab76aa5a24cab
+url = http://ftp.gnu.org/gnu/grep/grep-2.16.tar.xz
+md5sum = 502350a6c8f7c2b12ee58829e760b44d
 environment =
   PATH=${xz-utils:location}/bin:%(PATH)s
   CPPFLAGS=-I${pcre:location}/include

component/groonga/buildout.cfg

@@ -11,9 +11,9 @@ extends =
 
 [groonga]
 recipe = slapos.recipe.cmmi
-version = 3.0.5
+version = 3.1.1
 url = http://packages.groonga.org/source/groonga/groonga-${:version}.tar.gz
-md5sum = 2894bbdd2275cb3c62aea14446dc2561
+md5sum = c8bae890be05b4226f095839a049823e
 configure-options =
   --disable-static
   --disable-glibtest

component/gtk-2/buildout.cfg

@@ -22,12 +22,12 @@ depends =
   ${libpng:so_version}
 configure-options = 
   --enable-tee=yes
-  --enable-xlib=no
+  --enable-xlib=yes
 environment = 
   PATH=${freetype:location}/bin:${pkgconfig:location}/bin:%(PATH)s
   PKG_CONFIG_PATH=${fontconfig:location}/lib/pkgconfig:${freetype:location}/lib/pkgconfig:${zlib:location}/lib/pkgconfig:${libpng:location}/lib/pkgconfig:${pixman:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libXrender:location}/lib/pkgconfig
   CPPFLAGS=-I${libpng:location}/include/ -I${zlib:location}/include -I${libX11:location}/include/ -I${xproto:location}/include -I${kbproto:location}/include -I${libXrender:location}/include -I${render:location}/include
-  LDFLAGS=-L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib -L${libXrender:location}/lib -Wl,-rpath=${libXrender:location}/lib
+  LDFLAGS=-L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib -L${libXrender:location}/lib -Wl,-rpath=${libXrender:location}/lib -L${libX11:location}/lib
   LD_LIBRARY_PATH=${render:location}/lib:${libX11:location}/lib:${libXrender:location}/lib
 
 [pango]

component/libpng/buildout.cfg

@@ -28,6 +28,6 @@ md5sum = fd85af68f84cbdf549147811006488c1
 
 [libpng]
 <= libpng-common
-url = http://download.sourceforge.net/libpng/libpng-1.6.2.tar.xz
-md5sum = 9d838f6fca9948a9f360a0cc1b516d5f
+url = http://download.sourceforge.net/libpng/libpng-1.6.6.tar.xz
+md5sum = 3a41dcd58bcac7cc191c2ec80c7fb2ac
 so_version = 16

component/m4/buildout.cfg

 [buildout]
+extends =
+  ../xz-utils/buildout.cfg
 parts =
   m4
 
-[m4-drop.gets.patch]
-recipe = hexagonit.recipe.download
-url = ${:_profile_base_location_}/${:filename}
-md5sum = dc5f06fb42649e181c40177eb1edc333
-download-only = true
-filename = drop.gets.patch
-
 [m4]
-virtual-depends = ${m4-drop.gets.patch:md5sum}
-patch-options = -p1
-patches =
-  ${m4-drop.gets.patch:location}/${m4-drop.gets.patch:filename}
-
 recipe = slapos.recipe.cmmi
-url = http://ftp.gnu.org/gnu/m4/m4-1.4.16.tar.bz2
-md5sum = 8a7cef47fecab6272eb86a6be6363b2f
+url = http://ftp.gnu.org/gnu/m4/m4-1.4.17.tar.xz
+md5sum = 12a3c829301a4fd6586a57d3fcf196dc
+environment =
+  PATH=${xz-utils:location}/bin:%(PATH)s

component/make/buildout.cfg

+[buildout]
+extends =
+  ../autoconf/buildout.cfg
+  ../automake/buildout.cfg
+
+[make]
+# make 3.82 breaks too many things. Stick with 3.81.
+# See http://lists.gnu.org/archive/html/make-alpha/2010-07/msg00025.html
+# for all incompatible changes.
+# Moreover, vanilla 3.81 does some seg faults, so use Debian patched version.
+<= make3.81-debian
+
+[make-dfsg_3.81-8.2.diff]
+# Debian patch coming from:
+# http://ftp.de.debian.org/debian/pool/main/m/make-dfsg/make-dfsg_3.81-8.2.diff.gz
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/${:_buildout_section_name_}
+md5sum = fa77bb989a096fafbe7c78582e9415e3
+download-only = true
+
+[make3.81-debian]
+recipe = slapos.recipe.cmmi
+url = http://ftp.de.debian.org/debian/pool/main/m/make-dfsg/make-dfsg_3.81.orig.tar.gz
+md5sum = 7c93b1ab4680eb21c2c13f4f47741e2d
+patches =
+  ${make-dfsg_3.81-8.2.diff:location}/make-dfsg_3.81-8.2.diff
+patch-options = -p1

component/mariadb/buildout.cfg

@@ -12,28 +12,29 @@ extends =
   ../openssl/buildout.cfg
   ../pkgconfig/buildout.cfg
   ../readline/buildout.cfg
+  ../libxml2/buildout.cfg
 
 parts =
   mariadb
 
-[mariadb-5.5-no_test-patch]
+[mariadb-10.0.5-no_test-patch]
 recipe = hexagonit.recipe.download
 url = ${:_profile_base_location_}/${:filename}
-md5sum = 14e6d713c16298a10f40d29f2b799aca
-filename = mariadb_5.5_create_system_tables__no_test.patch
+md5sum = acc065292320f0c2805ce6bbdc3af0b5
+filename = mariadb_10.0.5_create_system_tables__no_test.patch
 download-only = true
 
 [mariadb]
 recipe = slapos.recipe.cmmi
-version = 5.5.32
+version = 10.0.7
 revision = 1
 url = http://downloads.askmonty.org/f/mariadb-${:version}/kvm-tarbake-jaunty-x86/mariadb-${:version}.tar.gz/from/http://ftp.osuosl.org/pub/mariadb
-md5sum = 565c2dce6a2fb027c9d0ffbae4934135
+md5sum = 46d341a6e76f3faf6891d3db45402862
 # compile directory is required to build mysql plugins.
 keep-compile-dir = true
 patch-options = -p0
 patches =
-  ${mariadb-5.5-no_test-patch:location}/${mariadb-5.5-no_test-patch:filename}
+  ${mariadb-10.0.5-no_test-patch:location}/${mariadb-10.0.5-no_test-patch:filename}
 configure-command = ${cmake:location}/bin/cmake
 configure-options =
   -DCMAKE_INSTALL_PREFIX=${buildout:parts-directory}/${:_buildout_section_name_}
@@ -49,21 +50,21 @@ configure-options =
   -DWITH_EMBEDDED_SERVER=0
   -DWITHOUT_EXAMPLE_STORAGE_ENGINE=1
   -DWITHOUT_DAEMON_EXAMPLE=1
-  -DCMAKE_C_FLAGS="-I${libaio:location}/include -I${ncurses:location}/include -I${openssl:location}/include -I${readline5:location}/include -I${zlib:location}/include"
-  -DCMAKE_CXX_FLAGS="-I${libaio:location}/include -I${ncurses:location}/include -I${openssl:location}/include -I${readline5:location}/include -I${zlib:location}/include"
-  -DCMAKE_INSTALL_RPATH=${libaio:location}/lib:${ncurses:location}/lib:${openssl:location}/lib:${readline5:location}/lib:${zlib:location}/lib
+  -DCMAKE_C_FLAGS="-I${libaio:location}/include -I${libxml2:location}/include -I${ncurses:location}/include -I${openssl:location}/include -I${readline5:location}/include -I${zlib:location}/include"
+  -DCMAKE_CXX_FLAGS="-I${libaio:location}/include -I${libxml2:location}/include -I${ncurses:location}/include -I${openssl:location}/include -I${readline5:location}/include -I${zlib:location}/include"
+  -DCMAKE_INSTALL_RPATH=${libaio:location}/lib:${libxml2:location}/lib:${ncurses:location}/lib:${openssl:location}/lib:${readline5:location}/lib:${zlib:location}/lib
 environment =
   CMAKE_PROGRAM_PATH=${cmake:location}/bin
-  CMAKE_INCLUDE_PATH=${libaio:location}/include:${ncurses:location}/include:${openssl:location}/include:${readline5:location}/include:${zlib:location}/include
-  CMAKE_LIBRARY_PATH=${libaio:location}/lib:${ncurses:location}/lib:${openssl:location}/lib:${readline5:location}/lib:${zlib:location}/lib
-  LDFLAGS=-L${libaio:location}/lib
+  CMAKE_INCLUDE_PATH=${libaio:location}/include:${libxml2:location}/include:${ncurses:location}/include:${openssl:location}/include:${readline5:location}/include:${zlib:location}/include
+  CMAKE_LIBRARY_PATH=${libaio:location}/lib:${libxml2:location}/lib:${ncurses:location}/lib:${openssl:location}/lib:${readline5:location}/lib:${zlib:location}/lib
+  LDFLAGS=-L${libaio:location}/lib -L${zlib:location}/lib
 
 [mroonga-mariadb]
 # mroonga - a storage engine for MySQL. It provides fast fulltext search feature to all MySQL users.
 # http://mroonga.github.com/
 recipe = slapos.recipe.cmmi
-url = http://packages.groonga.org/source/mroonga/mroonga-3.05.tar.gz
-md5sum = ba4cbd79274d832b9343a0b2fe7d0787
+url = http://packages.groonga.org/source/mroonga/mroonga-3.11.tar.gz
+md5sum = 3adfc67972b219586d0fdef9da25bc55
 configure-options =
   --with-mysql-source=${mariadb:location}__compile__/mariadb-${mariadb:version}
   --with-mysql-config=${mariadb:location}/bin/mysql_config

component/mariadb/mariadb_5.5_create_system_tables__no_test.patch → component/mariadb/mariadb_10.0.5_create_system_tables__no_test.patch

@@ -5,9 +5,9 @@ circumstances as it is checked first.
 See http://bugs.debian.org/301741
 and http://bugs.mysql.com/bug.php?id=6901
 
---- scripts/mysql_system_tables_data.sql	2008-12-04 22:59:44.000000000 +0100
-+++ scripts/mysql_system_tables_data.sql	2008-12-04 23:00:07.000000000 +0100
-@@ -27,8 +27,6 @@
+--- scripts/mysql_system_tables_data.sql.orig   2013-11-05 17:46:05.000000000 +0100
++++ scripts/mysql_system_tables_data.sql        2013-11-08 09:28:34.707291508 +0100
+@@ -31,8 +31,6 @@
  -- Fill "db" table with default grants for anyone to
  -- access database 'test' and 'test_%' if "db" table didn't exist
  CREATE TEMPORARY TABLE tmp_db LIKE db;
@@ -15,13 +15,13 @@ and http://bugs.mysql.com/bug.php?id=6901
 -INSERT INTO tmp_db VALUES ('%','test\_%','','Y','Y','Y','Y','Y','Y','N','Y','Y','Y','Y','Y','Y','Y','Y','N','N','Y','Y');
  INSERT INTO db SELECT * FROM tmp_db WHERE @had_db_table=0;
  DROP TABLE tmp_db;
- 
-@@ -41,8 +39,6 @@
- REPLACE INTO tmp_user SELECT @current_hostname,'root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','' FROM dual WHERE LOWER( @current_hostname) != 'localhost';
- REPLACE INTO tmp_user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','');
- REPLACE INTO tmp_user VALUES ('::1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','');
+
+@@ -44,8 +42,6 @@
+ REPLACE INTO tmp_user SELECT @current_hostname,'root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N' FROM dual WHERE LOWER( @current_hostname) != 'localhost';
+ REPLACE INTO tmp_user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N');
+ REPLACE INTO tmp_user VALUES ('::1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N');
 -INSERT INTO tmp_user (host,user) VALUES ('localhost','');
 -INSERT INTO tmp_user (host,user) SELECT @current_hostname,'' FROM dual WHERE LOWER(@current_hostname ) != 'localhost';
  INSERT INTO user SELECT * FROM tmp_user WHERE @had_user_table=0;
  DROP TABLE tmp_user;
- 
+

component/nano/buildout.cfg

+[buildout]
+parts =
+  nano
+  
+extends = 
+  ../ncurses/buildout.cfg
+
+[nano]
+recipe = slapos.recipe.cmmi
+version = 2.2.6
+url = http://www.nano-editor.org/dist/v2.2/nano-2.2.6.tar.gz
+md5sum = 03233ae480689a008eb98feb1b599807
+environment=
+    CFLAGS=-I${ncurses:location}/include
+    LDFLAGS=-L${ncurses:location}/lib/ -Wl,-rpath=${ncurses:location}/lib/
\ No newline at end of file

component/openssl/buildout.cfg

@@ -30,8 +30,8 @@ download-only = true
 
 [openssl]
 recipe = slapos.recipe.cmmi
-url = https://www.openssl.org/source/openssl-1.0.1e.tar.gz
-md5sum = 66bf6f10f060d561929de96f9dfe5b8c
+url = https://www.openssl.org/source/openssl-1.0.1f.tar.gz
+md5sum = f26b09c028a0541cab33da697d522b25
 patch-binary = ${patch:location}/bin/patch
 patches =
   ${openssl-nodoc.patch:location}/${openssl-nodoc.patch:filename}

component/percona-toolkit/buildout.cfg

@@ -10,8 +10,8 @@ parts =
 recipe = slapos.recipe.cmmi
 depends =
   ${perl:version}
-version = 2.1.9
+version = 2.2.6
 url = http://www.percona.com/redir/downloads/percona-toolkit/${:version}/percona-toolkit-${:version}.tar.gz
-md5sum = 94545d0fe6a4893dcad8a3411531107d
+md5sum = 2a008bccc3b62b5362d01a03c916e88d
 configure-command =
   ${perl:location}/bin/perl Makefile.PL

component/python-2.7/buildout.cfg

@@ -10,6 +10,7 @@ extends =
   ../sqlite3/buildout.cfg
   ../zlib/buildout.cfg
   ../file/buildout.cfg
+  ../xz-utils/buildout.cfg
 
 parts =
     python2.7
@@ -25,9 +26,9 @@ python = python2.7
 
 [python2.7]
 recipe = slapos.recipe.cmmi
-package_version = 2.7.5
+package_version = 2.7.6
 package_version_suffix =
-md5sum = 6334b666b7ff2038c761d7b27ba699c1
+md5sum = bcf93efa8eaf383c98ed3ce40b763497
 
 depends =
   ${gdbm:version}
@@ -38,7 +39,7 @@ version = 2.7
 executable = ${:prefix}/bin/python${:version}
 
 url =
-  http://python.org/ftp/python/${:package_version}/Python-${:package_version}${:package_version_suffix}.tar.bz2
+  http://python.org/ftp/python/${:package_version}/Python-${:package_version}${:package_version_suffix}.tar.xz
 configure-options =
   --enable-ipv6
   --enable-unicode=ucs4
@@ -51,5 +52,6 @@ make-targets = make profile-opt && make install
 # the entry "-Wl,-rpath=${file:location}/lib" below is needed by python-magic,
 # which would otherwise load the system libmagic.so with ctypes
 environment =
+  PATH=${xz-utils:location}/bin:%(PATH)s
   CPPFLAGS=-I${zlib:location}/include -I${readline:location}/include -I${libexpat:location}/include -I${ncurses:location}/include -I${ncurses:location}/include/ncursesw -I${bzip2:location}/include  -I${gdbm:location}/include -I${openssl:location}/include -I${sqlite3:location}/include -I${gettext:location}/include
   LDFLAGS=-L${zlib:location}/lib -L${readline:location}/lib -L${libexpat:location}/lib -L${ncurses:location}/lib -L${bzip2:location}/lib -L${gdbm:location}/lib -L${openssl:location}/lib -L${sqlite3:location}/lib -Wl,-rpath=${zlib:location}/lib -Wl,-rpath=${readline:location}/lib -Wl,-rpath=${libexpat:location}/lib -Wl,-rpath=${ncurses:location}/lib -Wl,-rpath=${bzip2:location}/lib -Wl,-rpath=${gdbm:location}/lib -Wl,-rpath=${openssl:location}/lib -Wl,-rpath=${sqlite3:location}/lib -L${gettext:location}/lib -Wl,-rpath=${gettext:location}/lib -Wl,-rpath=${file:location}/lib

component/python-setuptools/buildout.cfg

@@ -4,9 +4,10 @@ parts = python-setuptools
 [setuptools-download]
 recipe = hexagonit.recipe.download
 download-only = true
-filename = setuptools-0.6c11-py2.7.egg
-url = http://pypi.python.org/packages/2.7/s/setuptools/${:filename}
-md5sum = fe1f997bc722265116870bc7919059ea
+package_suffix = setuptools-1.4.2
+filename = ${:package_suffix}.tar.gz
+url = https://pypi.python.org/packages/source/s/setuptools/${:filename}
+md5sum = 13951be6711438073fbe50843e7f141f
 mode = 0644
 
 [python-setuptools]
@@ -16,9 +17,10 @@ mode = 0644
 # To be able to use it, you should in your instance do an:
 # export PYTHONPATH=${:location} (defined in ${:environment})
 location = ${buildout:parts-directory}/${:_buildout_section_name_}
-environment = export PATH=${python2.7:location}/bin:$PATH; export PYTHONPATH=${:location};
+pythonpath = ${:location}/${setuptools-download:package_suffix}
+environment = export PATH=${python2.7:location}/bin:$PATH; export PYTHONPATH=${:pythonpath};
 stop-on-error = true
 recipe = plone.recipe.command
 update = true
 # chmod is a hack, but the mode of hexagonit.recipe.download above didn't worked yet (there was new version recently)
-command = ${:environment} (mkdir ${:location}; chmod 644 ${setuptools-download:location}/${setuptools-download:filename} ; sh ${setuptools-download:location}/${setuptools-download:filename} --install-dir ${:location}) || (rm -fr ${:location}; exit 1)
+command = ${:environment} (mkdir ${:location}; cd ${:location} && tar -xzvf ${setuptools-download:location}/${setuptools-download:filename} && cd ${:pythonpath} && ${buildout:executable} setup.py build) || (rm -fr ${:location}; exit 1)

component/qemu-kvm/buildout.cfg

@@ -15,8 +15,8 @@ extends =
 [kvm]
 recipe = slapos.recipe.cmmi
 # qemu-kvm and qemu are now the same since 1.3.
-url = http://wiki.qemu-project.org/download/qemu-1.5.1.tar.bz2
-md5sum = b56e73bdcfdb214d5c68e13111aca96f
+url = http://wiki.qemu-project.org/download/qemu-1.6.1.tar.bz2
+md5sum = 3a897d722457c5a895cd6ac79a28fda0
 depends =
   ${libpng:so_version}
 configure-options =
@@ -57,9 +57,9 @@ configure-options =
 [debian-amd64-netinst.iso]
 # Download the installer of Debian 7 (Wheezy)
 recipe = hexagonit.recipe.download
-url = http://cdimage.debian.org/debian-cd/7.1.0/amd64/iso-cd/debian-7.1.0-amd64-netinst.iso
+url = http://cdimage.debian.org/debian-cd/7.2.0/amd64/iso-cd/debian-7.2.0-amd64-netinst.iso 
 filename = ${:_buildout_section_name_}
-md5sum = 80f498a1f9daa76bc911ae13692e4495
+md5sum = b86774fe4de88be6378ba3d71b8029bd 
 download-only = true
 mode = 0644
 location = ${buildout:parts-directory}/${:_buildout_section_name_}

component/screen/buildout.cfg

+[buildout]
+parts =
+  screen
+
+extends =
+  ../ncurses/buildout.cfg
+
+[screen]
+recipe = slapos.recipe.cmmi
+version = 4.0.3
+url = http://ftp.gnu.org/gnu/screen/screen-4.0.3.tar.gz
+md5sum = 8506fd205028a96c741e4037de6e3c42
+environment=
+    CFLAGS=-I${ncurses:location}/include
+    LDFLAGS=-L${ncurses:location}/lib/ -Wl,-rpath=${ncurses:location}/lib/
\ No newline at end of file

component/slapos/buildout.cfg

@@ -17,6 +17,7 @@ extends =
   ../pkgconfig/buildout.cfg
   ../popt/buildout.cfg
   ../python-2.7/buildout.cfg
+  ../python-openssl/buildout.cfg
   ../readline/buildout.cfg
   ../sqlite3/buildout.cfg
   ../swig/buildout.cfg
@@ -90,10 +91,14 @@ output = ${buildout:directory}/environment.sh
 [lxml-python]
 python = python2.7
 
+[python-openssl]
+python = python2.7
+
 [slapos]
 recipe = z3c.recipe.scripts
 python = python2.7
 eggs =
+  ${python-openssl:egg}
   slapos.libnetworkcache
   zc.buildout
   ${lxml-python:egg}
@@ -131,46 +136,63 @@ scripts = py
 
 [versions]
 # Use our own buildout version
-zc.buildout = 1.6.0-dev-SlapOS-010
+zc.buildout = 1.6.0-dev-SlapOS-012
 
 # Force to use zc.recipe.egg 1.x
 zc.recipe.egg = 1.3.2
 
 # Use own version of h.r.download to be able to open archives not supported by python2.x: .xz
-hexagonit.recipe.download = 1.6nxd002
+hexagonit.recipe.download = 1.7nxd002
 
-Jinja2 = 2.7
+slapos.core = 1.0.0
+Jinja2 = 2.7.1
 MarkupSafe = 0.18
-Werkzeug = 0.8.3
+Pygments = 1.6
+Werkzeug = 0.9.4
 buildout-versions = 1.7
+cmd2 = 0.6.7
 collective.recipe.template = 1.10
-lxml = 3.1.2
+itsdangerous = 0.23
+lxml = 3.2.3
 meld3 = 0.6.10
 netaddr = 0.7.10
+prettytable = 0.7.2
+pyOpenSSL = 0.13.1
+pyparsing = 2.0.1
+setuptools = 1.1.6
 slapos.libnetworkcache = 0.13.4
+slapos.recipe.cmmi = 0.1.1
 xml-marshaller = 0.9.7
 z3c.recipe.scripts = 1.0.1
 
 # Required by:
-# slapos.core==0.35.2-dev
-Flask = 0.9
+# slapos.core==1.0.0
+Flask = 0.10.1
+
+# Required by:
+# slapos.core==1.0.0
+bpython = 0.12
+
+# Required by:
+# slapos.core==1.0.0
+cliff = 1.4.5
+
+# Required by:
+# slapos.core==1.0.0
+ipython = 1.1.0
 
 # Required by:
-# slapos.core==0.35.2-dev
+# slapos.core==1.0.0
 netifaces = 0.8
 
 # Required by:
-# slapos.core==0.35.2-dev
-# slapos.libnetworkcache==0.13.3
-# supervisor==3.0b1
-# zc.buildout==1.6.0-dev-SlapOS-010
-# zope.interface==4.0.5
-setuptools = 0.6c12dev-r88846
+# slapos.core==1.0.0
+requests = 2.1.0
 
 # Required by:
-# slapos.core==0.35.2-dev
-supervisor = 3.0b2
+# slapos.core==1.0.0
+supervisor = 3.0
 
 # Required by:
-# slapos.core==0.35.2-dev
+# slapos.core==1.0.0
 zope.interface = 4.0.5

component/slapos/testing.cfg

+# This file is used to install testing, not-stable-yet, version of SlapOS Node
+[buildout]
+extends =
+  buildout.cfg
+
+# Add hosting location of testing version of slapos.core
+find-links +=
+  http://www.nexedi.org/static/packages/source/slapos.core-testing/
+
+[versions]
+slapos.core = 1.0.0rc6

component/sqlite3/buildout.cfg

@@ -5,8 +5,8 @@ parts =
 
 [sqlite3]
 recipe = slapos.recipe.cmmi
-url = http://www.sqlite.org/2013/sqlite-autoconf-3071700.tar.gz
-md5sum = 18c285053e9562b848209cb0ee16d4ab
+url = http://www.sqlite.org/2013/sqlite-autoconf-3080100.tar.gz
+md5sum = 8b5a0a02dfcb0c7daf90856a5cfd485a
 configure-options =
   --disable-static
   --enable-readline

component/squid/buildout.cfg

+# Squid: Optimising Web Delivery
+# http://squid-cache.org
+
+[buildout]
+parts =
+  squid
+extends =
+  ../pkgconfig/buildout.cfg
+
+[squid]
+recipe = hexagonit.recipe.cmmi
+url = http://www.squid-cache.org/Versions/v3/3.2/squid-3.2.1.tar.gz
+md5sum = 3fb81acc6b70a432e3f0d8a0491056dc
+configure-options =
+  --disable-dependency-tracking
+  --disable-translation
+  --disable-htcp
+  --disable-snmp
+  --disable-loadable-modules
+  --disable-icmp
+  --disable-esi
+  --disable-icap-client
+  --disable-wccp
+  --disable-wccpv2
+  --disable-eui
+  --enable-http-violations
+  --disable-ipfw-transparent 
+  --disable-ipf-transparent
+  --disable-pf-transparent
+  --disable-linux-netfilter
+  --enable-follow-x-forwarded-for
+  --disable-auth
+  --disable-url-rewrite-helpers
+  --disable-auto-locale
+  --disable-kerberos
+  --enable-x-accelerator-vary
+  --disable-external-acl-helpers
+  --disable-auth-ntlm
+  --with-krb5-config=no
+Environment =
+  PATH=${pkgconfig:location}/bin:%(PATH)s

component/texinfo/buildout.cfg

+[buildout]
+extends =
+  ../ncurses/buildout.cfg
+
+[texinfo]
+# Most other components are not happy with texinfo 5, because it treats some
+# used-to-be-warnings as errors.
+<= texinfo4
+
+[texinfo4]
+recipe = slapos.recipe.cmmi
+url = http://ftp.gnu.org/gnu/texinfo/texinfo-4.13.tar.gz
+md5sum = 71ba711519209b5fb583fed2b3d86fcb
+configure-options =
+  --disable-static
+environment =
+  CFLAGS=-I${ncurses:location}/include
+  LDFLAGS=-L${ncurses:location}/lib -Wl,-rpath=${ncurses:location}/lib

component/varnish/buildout.cfg

@@ -41,5 +41,5 @@ environment =
 
 [varnish-3.0]
 <= varnish-2.1
-url = http://repo.varnish-cache.org/source/varnish-3.0.4.tar.gz
-md5sum = a130ce9c3504b9603a46542635e18701
+url = http://repo.varnish-cache.org/source/varnish-3.0.5.tar.gz
+md5sum = 674d44775cc927aee4601edb37f60198

component/vim/buildout.cfg

+[buildout]
+parts =
+  vim
+  
+extends = 
+  ../ncurses/buildout.cfg
+
+[vim]
+recipe = slapos.recipe.cmmi
+version = 7.4
+url = http://ftp.vim.org/pub/vim/unix/vim-7.4.tar.bz2
+md5sum = 607e135c559be642f210094ad023dc65
+environment=
+    CFLAGS=-I${ncurses:location}/include
+    LDFLAGS=-L${ncurses:location}/lib/ -Wl,-rpath=${ncurses:location}/lib/
\ No newline at end of file

component/xorg/buildout.cfg

@@ -28,13 +28,13 @@ ACLOCAL=${xorg-util-macros:location}/share/aclocal
 
 [xorg-util-macros]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/util/util-macros-1.11.0.tar.bz2
-md5sum = 22d5cdff672450cb6902e0d68c200dcb
+url = http://www.x.org/releases/X11R7.7/src/everything/util-macros-1.17.tar.bz2
+md5sum = 4f41667e1bf4938bb2b24fa09d517f77
 
 [xproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/proto/xproto-7.0.20.tar.bz2
-md5sum = 65633168e5315c19defb4652cd3d83c1
+url = http://www.x.org/releases/X11R7.7/src/everything/xproto-7.0.23.tar.bz2
+md5sum = d4d241a4849167e4e694fe73371c328c
 configure-options =
   --disable-specs
   --without-xmlto
@@ -45,8 +45,8 @@ environment =
 
 [xextproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/proto/xextproto-7.1.2.tar.bz2
-md5sum = 263ae968b223c23b2986603d84e5c30e
+url = http://www.x.org/releases/X11R7.7/src/everything/xextproto-7.2.1.tar.bz2
+md5sum = eaac343af094e6b608cf15cfba0f77c5
 configure-options =
   --disable-specs
   --without-xmlto
@@ -64,8 +64,8 @@ md5sum = 37d82a3b6009113023599632117a6855
 
 [xtrans]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/xtrans-1.2.6.tar.bz2
-md5sum = c66f9ffd2da4fb012220c6c40ebc7609
+url = http://www.x.org/releases/X11R7.7/src/everything/xtrans-1.2.7.tar.bz2
+md5sum = 84c66908cf003ad8c272b0eecbdbaee3
 patches =
   ${xtrans-tmp-env-patch:location}/${xtrans-tmp-env-patch:filename}
 patches_md5sum = ${xtrans-tmp-env-patch:md5sum}
@@ -80,8 +80,8 @@ environment =
 
 [libXau]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libXau-1.0.6.tar.bz2
-md5sum = 4a2cbd83727682f9ee1c1e719bac6adb
+url = http://www.x.org/releases/X11R7.7/src/everything/libXau-1.0.7.tar.bz2
+md5sum = 2d241521df40d27034413436d1a1465c
 configure-options =
   --disable-static
 environment =
@@ -90,15 +90,15 @@ environment =
 
 [xcbproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/xcb/xcb-proto-1.6.tar.bz2
-md5sum = 04313e1d914b44d0e457f6c494fc178b
+url = http://xcb.freedesktop.org/dist/xcb-proto-1.8.tar.bz2
+md5sum = a5de3432cc6e43cc6a27f241dbb991b1
 environment =
   PATH=${libxml2:location}/bin:%(PATH)s
   PYTHON=${buildout:executable}
 
 [xorg-libpthread-stubs]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/xcb/libpthread-stubs-0.3.tar.bz2
+url = http://xcb.freedesktop.org/dist/libpthread-stubs-0.3.tar.bz2
 md5sum = e8fa31b42e13f87e8f5a7a2b731db7ee
 
 [libxcb-tmp-env-patch]
@@ -110,8 +110,8 @@ md5sum = 61f39878120ba434a169e24cae2af862
 
 [libxcb]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/xcb/libxcb-1.7.tar.bz2
-md5sum = 925699df361b99491165ebc12068056b
+url = http://xcb.freedesktop.org/dist/libxcb-1.9.1.tar.bz2
+md5sum = ed632cb0dc31b6fbd7ea5c0f931cf5a4
 patches =
   ${libxcb-tmp-env-patch:location}/${libxcb-tmp-env-patch:filename}
 patches_md5sum = ${libxcb-tmp-env-patch:md5sum}
@@ -130,8 +130,8 @@ environment =
 
 [libXext]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libXext-1.2.0.tar.bz2
-md5sum = 9bb236ff0193e9fc1c1fb504dd840331
+url = http://www.x.org/releases/X11R7.7/src/everything/libXext-1.3.1.tar.bz2
+md5sum = 71251a22bc47068d60a95f50ed2ec3cf
 environment =
   PKG_CONFIG_PATH=${kbproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig
   LD_LIBRARY_PATH=${libX11:location}/lib
@@ -144,33 +144,21 @@ configure-options =
   --without-xmlto
   --without-fop
   XEXT_LIBS=-lX11
-patches =
-  ${libXext-patch-link-error:location}/${libXext-patch-link-error:filename}
-patch-options = -p1
-
-[libXext-patch-link-error]
-# Fixes libXext.la link error
-# http://cgit.freedesktop.org/xorg/lib/libXext/patch/?id=700c7896b832d6e4fb0185f0d5382b01f94e7141
-recipe = hexagonit.recipe.download
-url = ${:_profile_base_location_}/${:filename}
-download-only = true
-filename = 700c7896b832d6e4fb0185f0d5382b01f94e7141.patch
-md5sum = 52635ef694ee6f1acb642a77ee8eb010
 
 [inputproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/inputproto-2.0.1.tar.bz2
-md5sum = da9bf9e5d174163f597d2d72757d9038
+url = http://www.x.org/releases/X11R7.7/src/everything/inputproto-2.2.tar.bz2
+md5sum = 13c8aedaf98a92e282b7e456c0a5bed9
 
 [kbproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/kbproto-1.0.5.tar.bz2
-md5sum = e7edb59a3f54af15f749e8f3e314ee62
+url = http://www.x.org/releases/X11R7.7/src/everything/kbproto-1.0.6.tar.bz2
+md5sum = 677ea8523eec6caca86121ad2dca0b71
 
 [libX11]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libX11-1.4.0.tar.bz2
-md5sum = b63d9f7493a61df51d0c0be04ac435e4
+url = http://www.x.org/releases/X11R7.7/src/everything/libX11-1.5.0.tar.bz2
+md5sum = 78b4b3bab4acbdf0abcfca30a8c70cc6
 configure-options =
   --disable-static
   --enable-loadable-i18n
@@ -190,8 +178,8 @@ environment =
 
 [libXdmcp]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libXdmcp-1.1.0.tar.bz2
-md5sum = 762b6bbaff7b7d0831ddb4f072f939a5
+url = http://www.x.org/releases/X11R7.7/src/everything/libXdmcp-1.1.1.tar.bz2
+md5sum = b94af6cef211cf3ee256f7e81f70fcd9
 environment =
   PKG_CONFIG_PATH=${xorg-util-macros:location}/share/pkgconfig:${xproto:location}/lib/pkgconfig
   PATH=${pkgconfig:location}/bin:%(PATH)s
@@ -202,103 +190,92 @@ configure-options =
 
 [fixesproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/fixesproto-4.1.2.tar.bz2
-md5sum = bdb58ecc313b509247036d5c11fa99df
+url = http://www.x.org/releases/X11R7.7/src/everything/fixesproto-5.0.tar.bz2
+md5sum = e7431ab84d37b2678af71e29355e101d
 
 [bigreqsproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/bigreqsproto-1.1.1.tar.bz2
-md5sum = 6f6c24436c2b3ab235eb14a85b9aaacf
+url = http://www.x.org/releases/X11R7.7/src/everything/bigreqsproto-1.1.2.tar.bz2
+md5sum = 1a05fb01fa1d5198894c931cf925c025
 
 [xcmiscproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/xcmiscproto-1.2.1.tar.bz2
-md5sum = cd7372cd827bfd7ca7e9238f2ce274b1
+url = http://www.x.org/releases/X11R7.7/src/everything/xcmiscproto-1.2.2.tar.bz2
+md5sum = 5f4847c78e41b801982c8a5e06365b24
 
 [damageproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/damageproto-1.2.1.tar.bz2
+url = http://www.x.org/releases/X11R7.7/src/everything/damageproto-1.2.1.tar.bz2
 md5sum = 998e5904764b82642cc63d97b4ba9e95
 
 [randrproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/randrproto-1.3.2.tar.bz2
+url = http://www.x.org/releases/X11R7.7/src/everything/randrproto-1.3.2.tar.bz2
 md5sum = 597491c0d8055e2a66f11350c4985775
 
 [renderproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/renderproto-0.11.1.tar.bz2
+url = http://www.x.org/releases/X11R7.7/src/everything/renderproto-0.11.1.tar.bz2
 md5sum = a914ccc1de66ddeb4b611c6b0686e274
 
 [videoproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/videoproto-2.3.1.tar.bz2
+url = http://www.x.org/releases/X11R7.7/src/everything/videoproto-2.3.1.tar.bz2
 md5sum = c3b348c6e2031b72b11ae63fc7f805c2
 
 [fontsproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/fontsproto-2.1.1.tar.bz2
-md5sum = 37102ffcaa73f77d700acd6f7a25d8f0
+url = http://www.x.org/releases/X11R7.7/src/everything/fontsproto-2.1.2.tar.bz2
+md5sum = c5f4f1fb4ba7766eedbc9489e81f3be2
 
 [recordproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/recordproto-1.14.1.tar.bz2
-md5sum = 24541a30b399213def35f48efd926c63
+url = http://www.x.org/releases/X11R7.7/src/everything/recordproto-1.14.2.tar.bz2
+md5sum = 1b4e5dede5ea51906f1530ca1e21d216
 
 [resourceproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/resourceproto-1.1.1.tar.bz2
-md5sum = 8ff0525ae7502b48597b78d00bc22284
+url = http://www.x.org/releases/X11R7.7/src/everything/resourceproto-1.2.0.tar.bz2
+md5sum = cfdb57dae221b71b2703f8e2980eaaf4
 
 [xineramaproto]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/xineramaproto-1.2.tar.bz2
-md5sum = a8aadcb281b9c11a91303e24cdea45f5
+url = http://www.x.org/releases/X11R7.7/src/everything/xineramaproto-1.2.1.tar.bz2
+md5sum = 9959fe0bfb22a0e7260433b8d199590a
 
 [pixman]
 recipe = slapos.recipe.cmmi
-url = http://xorg.freedesktop.org/archive/individual/lib/pixman-0.23.2.tar.bz2 
-md5sum = 2e2805f5ca02edeb15a7862779670069
+url = http://xorg.freedesktop.org/archive/individual/lib/pixman-0.32.4.tar.bz2
+md5sum = cdb566504fe9daf6728c7b03cc7ea228
 
 [libfontenc]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/libfontenc-1.1.0.tar.bz2
-md5sum = 11d3c292f05a90f6f67840a9e9c3d9b8
+url = http://www.x.org/releases/X11R7.7/src/everything/libfontenc-1.1.1.tar.bz2
+md5sum = a2a861f142c3b4367f14fc14239fc1f7
 environment =
   PKG_CONFIG_PATH=${xproto:location}/lib/pkgconfig
-  LD_LIBRARY_PATH=${xproto:location}/lib/
-  LD_RUN_PATH=${xproto:location}/lib/
-  CPPFLAGS=-I${xproto:location}/include/ -I${zlib:location}/include
-  LDFLAGS=-L${xproto:location}/lib -Wl,-rpath=${xproto:location}/lib -L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib 
   PATH=${pkgconfig:location}/bin:%(PATH)s
 
 [libXfont]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/libXfont-1.4.3.tar.bz2
-md5sum = 6fb689cfe13d8d9460f4abb5bd88588d
+url = http://www.x.org/releases/X11R7.7/src/everything/libXfont-1.4.5.tar.bz2
+md5sum = 6851da5dae0a6cf5f7c9b9e2b05dd3b4
 environment =
   PKG_CONFIG_PATH=${fontsproto:location}/lib/pkgconfig:${libfontenc:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${xtrans:location}/share/pkgconfig:${freetype:location}/lib/pkgconfig
-  LD_LIBRARY_PATH=${fontsproto:location}/lib:${libfontenc:location}/lib:${xtrans:location}/include/:${xproto:location}/lib/:${freetype:location}/lib
-  LD_RUN_PATH=${fontsproto:location}/lib:${libfontenc:location}/lib:${xproto:location}/lib/:${xtrans:location}/include/:${freetype:location}/lib
-  LDFLAGS=-L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib -L${bzip2:location}/lib -Wl,-rpath=${bzip2:location}/lib -L${libfontenc:location}/lib -Wl,-rpath=${libfontenc:location}/lib 
-  CPPFLAGS=-I${zlib:location}/include -I${bzip2:location}/include -I${libfontenc:location}/include
   PATH=${pkgconfig:location}/bin:%(PATH)s
 
 [libxkbfile]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/everything/libxkbfile-1.0.7.tar.bz2
-md5sum = 59b4fe0bdf8d9b05e45b59e8fe9e7516
+url = http://www.x.org/releases/X11R7.7/src/everything/libxkbfile-1.0.8.tar.bz2
+md5sum = 19e6533ae64abba0773816a23f2b9507
 environment =
-  PKG_CONFIG_PATH=${kbproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig
-  LD_LIBRARY_PATH=${kbproto:location}/lib:${libX11:location}/lib:${xproto:location}/lib/
-  LD_RUN_PATH=${kbproto:location}/lib:${libX11:location}/lib:${xproto:location}/lib/
-  CPPFLAGS=-I${xproto:location}/include/ -I${libX11:location}/include/ -I${kbproto:location}/include
+  PKG_CONFIG_PATH=${kbproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig
   PATH=${pkgconfig:location}/bin:%(PATH)s
 
 [xkeyboard-config]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/individual/data/xkeyboard-config/xkeyboard-config-2.1.tar.bz2
-md5sum = 57ecc78bacd8ecc398d8ed6588f4d04b
+url = http://www.x.org/releases/X11R7.7/src/everything/xkeyboard-config-2.6.tar.bz2
+md5sum = e7e31da9adb56ba52b5c18226b8cbef3
 depends =
   ${perl:version}
   ${perl-XML-Parser:location}
@@ -313,17 +290,14 @@ environment =
 
 [xkbcomp]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/app/xkbcomp-1.2.0.tar.bz2
-md5sum = 0f55995cd8da9b2d88553e1a2e17cd0a
+url = http://www.x.org/releases/X11R7.7/src/everything/xkbcomp-1.2.4.tar.bz2
+md5sum = a0fc1ac3fc4fe479ade09674347c5aa0
 # Hardcoded location for xkeyboard-config, needed during compile time
 xkeyboard-config-location = ${libxkbfile:location}/../xkeyboard-config/share/X11/xkb
 configure-options =
   --with-xkb-config-root=${:xkeyboard-config-location}
 environment =
   PKG_CONFIG_PATH=${libxkbfile:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig
-  LD_LIBRARY_PATH=${libxkbfile:location}/lib/:${libX11:location}/lib
-  LD_RUN_PATH=${libxkbfile:location}/lib/:${libX11:location}/lib
-  CPPFLAGS=-I${libxkbfile:location}/include/ -I${libX11:location}/include -I${xproto:location}/include -I${kbproto:location}/include
   PATH=${pkgconfig:location}/bin:%(PATH)s
 
 [render]
@@ -343,8 +317,8 @@ environment =
 
 [libXinerama]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libXinerama-1.1.1.tar.bz2
-md5sum = ecd4839ad01f6f637c6fb5327207f89b
+url = http://www.x.org/releases/X11R7.7/src/everything/libXinerama-1.1.2.tar.bz2
+md5sum = cb45d6672c93a608f003b6404f1dd462
 environment =
   PKG_CONFIG_PATH=${kbproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig:${libXext:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig:${xineramaproto:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig
   PATH=${pkgconfig:location}/bin:%(PATH)s
@@ -353,8 +327,8 @@ configure-options =
 
 [libICE]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libICE-1.0.7.tar.bz2
-md5sum = bb72a732b15e9dc25c3036559387eed5
+url = http://www.x.org/releases/X11R7.7/src/everything/libICE-1.0.8.tar.bz2
+md5sum = 471b5ca9f5562ac0d6eac7a0bf650738
 configure-options =
   --disable-static
   --without-xmlto
@@ -365,8 +339,8 @@ environment =
 
 [libSM]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libSM-1.2.0.tar.bz2
-md5sum = e78c447bf1790552b644eca81b542742
+url = http://www.x.org/releases/X11R7.7/src/everything/libSM-1.2.1.tar.bz2
+md5sum = 766de9d1e1ecf8bf74cebe2111d8e2bd
 configure-options =
   --disable-static
   --without-xmlto
@@ -378,18 +352,17 @@ environment =
 
 [libXt]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libXt-1.0.9.tar.bz2
-md5sum = 8a414f8f2327aaa616ca2dcac1f5d8c3
+url = http://www.x.org/releases/X11R7.7/src/everything/libXt-1.1.3.tar.bz2
+md5sum = a6f137ae100e74ebe3b71eb4a38c40b3
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
-  PKG_CONFIG_PATH=${libSM:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${libICE:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig
-  CPPFLAGS=-I${libSM:location}/include -I${kbproto:location}/include -I${libICE:location}/include -I${xproto:location}/include -I${libX11:location}/include
+  PKG_CONFIG_PATH=${libSM:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${libICE:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig
 
 [dri2proto]
 recipe = slapos.recipe.cmmi
-url = http://xorg.freedesktop.org/releases/individual/proto/dri2proto-2.6.tar.gz
-md5sum = 873142af5db695537cfe05e01d13541f
-configure-options = 
+url = http://www.x.org/releases/X11R7.7/src/everything/dri2proto-2.6.tar.bz2
+md5sum = 2eb74959684f47c862081099059a11ab
+configure-options =
   --disable-static
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
@@ -398,9 +371,9 @@ environment =
 
 [pciaccess]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libpciaccess-0.12.0.tar.bz2
-md5sum = 285e07976274572e1f1e68edee09b70a
-configure-options = 
+url = http://www.x.org/releases/X11R7.7/src/everything/libpciaccess-0.13.1.tar.bz2
+md5sum = 399a419ac6a54f0fc07c69c9bdf452dc
+configure-options =
   --disable-static
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
@@ -409,7 +382,7 @@ environment =
 recipe = slapos.recipe.cmmi
 url = http://xorg.freedesktop.org/releases/individual/util/makedepend-1.0.3.tar.bz2
 md5sum = 4e6cb97bbecfbb34f3f644a75e513093
-configure-options = 
+configure-options =
   --disable-static
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
@@ -419,7 +392,7 @@ environment =
 recipe = slapos.recipe.cmmi
 url = http://xorg.freedesktop.org/releases/individual/proto/glproto-1.4.14.tar.bz2
 md5sum = f48257daf0017f7a7667e5bf48ca3578
-configure-options = 
+configure-options =
   --disable-static
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
@@ -429,23 +402,21 @@ environment =
 recipe = slapos.recipe.cmmi
 url = http://xorg.freedesktop.org/releases/individual/lib/libXfixes-4.0.5.tar.bz2
 md5sum = 1b4b8386bd5d1751b2c7177223ad4629
-configure-options = 
+configure-options =
   --disable-static
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
-  PKG_CONFIG_PATH=${xproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig:${fixesproto:location}/lib/pkgconfig:${xorg-util-macros:location}/share/pkgconfig
-  CPPFLAGS=-I${libX11:location}/include -I${xproto:location}/include -I${fixesproto:location}/include -I${xextproto:location}/include
+  PKG_CONFIG_PATH=${xproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig:${fixesproto:location}/lib/pkgconfig:${xorg-util-macros:location}/share/pkgconfig:${kbproto:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig
 
 [xdamage]
 recipe = slapos.recipe.cmmi
-url = http://xorg.freedesktop.org/releases/individual/lib/libXdamage-1.1.3.tar.bz2
+url = http://www.x.org/releases/X11R7.7/src/everything/libXdamage-1.1.3.tar.bz2
 md5sum = 44774e1a065158b52f1a0da5100cebec
-configure-options = 
+configure-options =
   --disable-static
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
-  PKG_CONFIG_PATH=${damageproto:location}/lib/pkgconfig:${xfixes:location}/lib/pkgconfig:${fixesproto:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig
-  CPPFLAGS=-I${libX11:location}/include -I${xproto:location}/include -I${fixesproto:location}/include -I${xextproto:location}/include -I${damageproto:location}/include -I${xfixes:location}/include 
+  PKG_CONFIG_PATH=${damageproto:location}/lib/pkgconfig:${xfixes:location}/lib/pkgconfig:${fixesproto:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig
 
 [xorg-tmp-env-patch]
 recipe = hexagonit.recipe.download
@@ -456,37 +427,35 @@ md5sum = 8b60ab8121f0564a681fc00d03101696
 
 [libxmu]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libXmu-1.1.0.tar.gz
-md5sum = 15e1cb9aaf97eae169bfe6944e0a541e
+url = http://www.x.org/releases/X11R7.7/src/everything/libXmu-1.1.1.tar.bz2
+md5sum = a4efff8de85bd45dd3da124285d10c00
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
-  PKG_CONFIG_PATH=${xextproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libXext:location}/lib/pkgconfig:${libXt:location}/lib/pkgconfig
-  CPPFLAGS=-I${libX11:location}/include -I${xextproto:location}/include
+  PKG_CONFIG_PATH=${xextproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libXext:location}/lib/pkgconfig:${libXt:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig:${libICE:location}/lib/pkgconfig:${libSM:location}/lib/pkgconfig
 
 [libXcursor]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/lib/libXcursor-1.1.11.tar.gz
-md5sum = 55558a41d0bcf9210636858844fa4d2f
+url = http://www.x.org/releases/X11R7.7/src/everything/libXcursor-1.1.13.tar.bz2
+md5sum = 52efa81b7f26c8eda13510a2fba98eea
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
-  PKG_CONFIG_PATH=${render:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${fixesproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${xfixes:location}/lib/pkgconfig:${libXrender:location}/lib/pkgconfig
-  CPPFLAGS=-I${render:location}/include -I${xproto:location}/include -I${fixesproto:location}/include -I${libX11:location}/include -I${xfixes:location}/include -I${libXrender:location}/include
+  PKG_CONFIG_PATH=${render:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${fixesproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${xfixes:location}/lib/pkgconfig:${libXrender:location}/lib/pkgconfig:${renderproto:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig
 
 [xwd]
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/app/xwd-1.0.4.tar.gz
-md5sum = f8da771069756210833524b5afa1832c
+url = http://www.x.org/releases/X11R7.7/src/everything/xwd-1.0.5.tar.bz2
+md5sum = 2113126f9ac9c02bb8547c112c5d037e
 environment =
   PATH=${pkgconfig:location}/bin:%(PATH)s
-  PKG_CONFIG_PATH=${xorg-util-macros:location}/share/pkgconfig:${xproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libxkbfile:location}/lib/pkgconfig
-  CPPFLAGS=-I${xproto:location}/include -I${libX11:location}/include -I${libxkbfile:location}/include# -I${xfixes:location}/include -I${libXrender:location}/include
-  LDFLAGS=-L${xproto:location}/lib -Wl,-rpath=${xproto:location}/lib -L${libX11:location}/lib -Wl,-rpath=${libX11:location}/lib -L${libxkbfile:location}/lib -Wl,-rpath=${libxkbfile:location}/lib -lX11
+  PKG_CONFIG_PATH=${xorg-util-macros:location}/share/pkgconfig:${xproto:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libxkbfile:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig
+  CPPFLAGS=-I${libXt:location}/include
+  LDFLAGS=-L${libXt:location}/lib -Wl,-rpath=${libXt:location}/lib
 
 [xserver]
 # Adds Xvfb functionnality
 recipe = slapos.recipe.cmmi
-url = http://www.x.org/releases/X11R7.6/src/xserver/xorg-server-1.9.3.tar.bz2
-md5sum = 5bef6839a76d029204ab31aa2fcb5201
+url = http://www.x.org/releases/X11R7.7/src/everything/xorg-server-1.12.2.tar.bz2
+md5sum = 791f0323b886abb7954de7f042bb7dc6
 patches =
   ${xorg-tmp-env-patch:location}/${xorg-tmp-env-patch:filename}
 patches_md5sum = ${xorg-tmp-env-patch:md5sum}
@@ -506,7 +475,7 @@ configure-options =
   --with-xkb-path=${xkeyboard-config:location}/share/X11/xkb
   --with-sha1=libgcrypt
 environment =
-  PKG_CONFIG_PATH=${pixman:location}/lib/pkgconfig:${openssl:location}/lib/pkgconfig:${xorg-util-macros:location}/share/pkgconfig:${fixesproto:location}/lib/pkgconfig:${damageproto:location}/lib/pkgconfig:${xcmiscproto:location}/lib/pkgconfig:${xtrans:location}/share/pkgconfig:${bigreqsproto:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${randrproto:location}/lib/pkgconfig:${renderproto:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig:${inputproto:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${fontsproto:location}/lib/pkgconfig:${videoproto:location}/lib/pkgconfig:${recordproto:location}/lib/pkgconfig:${resourceproto:location}/lib/pkgconfig:${xineramaproto:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig:${libxkbfile:location}/lib/pkgconfig:${libXfont:location}/lib/pkgconfig:${gpg-error:location}/lib/pkgconfig
-  CPPFLAGS=-I${xproto:location}/include -I${pixman:location}/include/pixman-1 -I${xextproto:location}/include -I${inputproto:location}/include -I${fontsproto:location}/include -I${kbproto:location}/include -I${xineramaproto:location}/include -I${renderproto:location}/include -I${bigreqsproto:location}/include -I${videoproto:location}/include -I${resourceproto:location}/include -I${xcmiscproto:location}/include -I${xtrans:location}/include -I${libXau:location}/include -I${randrproto:location}/include -I${libxkbfile:location}/include -I${recordproto:location}/include -I${fixesproto:location}/include -I${damageproto:location}/include -I${bzip2:location}/include -I${gcrypt:location}/include -I${zlib:location}/include -I${libfontenc:location}/include -I${gpg-error:location}/include
+  PKG_CONFIG_PATH=${pixman:location}/lib/pkgconfig:${openssl:location}/lib/pkgconfig:${xorg-util-macros:location}/share/pkgconfig:${fixesproto:location}/lib/pkgconfig:${damageproto:location}/lib/pkgconfig:${xcmiscproto:location}/lib/pkgconfig:${xtrans:location}/share/pkgconfig:${bigreqsproto:location}/lib/pkgconfig:${xproto:location}/lib/pkgconfig:${randrproto:location}/lib/pkgconfig:${renderproto:location}/lib/pkgconfig:${xextproto:location}/lib/pkgconfig:${inputproto:location}/lib/pkgconfig:${kbproto:location}/lib/pkgconfig:${fontsproto:location}/lib/pkgconfig:${videoproto:location}/lib/pkgconfig:${recordproto:location}/lib/pkgconfig:${resourceproto:location}/lib/pkgconfig:${xineramaproto:location}/lib/pkgconfig:${libXau:location}/lib/pkgconfig:${libxkbfile:location}/lib/pkgconfig:${libXfont:location}/lib/pkgconfig:${libX11:location}/lib/pkgconfig:${libxcb:location}/lib/pkgconfig:${xorg-libpthread-stubs:location}/lib/pkgconfig:${libfontenc:location}/lib/pkgconfig:${freetype:location}/lib/pkgconfig
+  CPPFLAGS=-I${bzip2:location}/include -I${gcrypt:location}/include -I${gpg-error:location}/include -I${zlib:location}/include
   PATH=${pkgconfig:location}/bin:%(PATH)s
-  LDFLAGS=-L${gcrypt:location}/lib -L${bzip2:location}/lib -Wl,-rpath=${gcrypt:location}/lib -Wl,-rpath=${openssl:location}/lib -Wl,-rpath=${bzip2:location}/lib -L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib -L${libfontenc:location}/lib -Wl,-rpath=${libfontenc:location}/lib -L${libXau:location}/lib -Wl,-rpath=${libXau:location}/lib -L${gpg-error:location}/lib -Wl,-rpath=${gpg-error:location}/lib
+  LDFLAGS=-L${bzip2:location}/lib -Wl,-rpath=${bzip2:location}/lib -L${gcrypt:location}/lib -Wl,-rpath=${gcrypt:location}/lib -L${gpg-error:location}/lib -Wl,-rpath=${gpg-error:location}/lib -L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib

component/zeromq/buildout.cfg

+[buildout]
+extends =
+  ../libtool/buildout.cfg
+  ../libuuid/buildout.cfg
+
+[zeromq]
+<= zeromq3
+
+[zeromq3]
+recipe = slapos.recipe.cmmi
+url = http://download.zeromq.org/zeromq-3.2.3.tar.gz
+md5sum = 1abf8246363249baf5931a065ee38203
+configure-options = --without-documentation
+environment =
+  PATH=${libtool:location}/bin:%(PATH)s
+  LDFLAGS=-L${libtool:location}/lib -Wl,-rpath -Wl,${libtool:location}/lib -L${libuuid:location}/lib -Wl,-rpath -Wl,${libuuid:location}/lib
+
+[zeromq2]
+recipe = slapos.recipe.cmmi
+url = http://download.zeromq.org/zeromq-2.2.0.tar.gz
+md5sum = 1b11aae09b19d18276d0717b2ea288f6
+configure-options =
+  --without-documentation
+environment =
+  PATH=${libtool:location}/bin:%(PATH)s
+  CXXFLAGS=-I${libuuid:location}/include
+  LDFLAGS=-L${libtool:location}/lib -Wl,-rpath -Wl,${libtool:location}/lib -L${libuuid:location}/lib -Wl,-rpath -Wl,${libuuid:location}/lib

setup.py

@@ -28,7 +28,7 @@ from setuptools import setup, find_packages
 import glob
 import os
 
-version = '0.82-dev'
+version = '0.85'
 name = 'slapos.cookbook'
 long_description = open("README.txt").read() + "\n" + \
     open("CHANGES.txt").read() + "\n"
@@ -70,7 +70,6 @@ setup(name=name,
         'zc.buildout': [
           'addresiliency = slapos.recipe.addresiliency:Recipe',
           'agent = slapos.recipe.agent:Recipe',
-          'apache.frontend = slapos.recipe.apache_frontend:Recipe',
           'apache.zope.backend = slapos.recipe.apache_zope_backend:Recipe',
           'apacheperl = slapos.recipe.apacheperl:Recipe',
           'apachephp = slapos.recipe.apachephp:Recipe',
@@ -185,12 +184,12 @@ setup(name=name,
           'slapmonitor = slapos.recipe.slapmonitor:MonitorRecipe',
           'slapmonitor-xml = slapos.recipe.slapmonitor:MonitorXMLRecipe',
           'slapreport = slapos.recipe.slapreport:Recipe',
-          'slaprunner = slapos.recipe.slaprunner:Recipe',
           'slaprunner.test = slapos.recipe.slaprunner:Test',
           'slaprunner.export = slapos.recipe.slaprunner.backup:ExportRecipe',
           'slaprunner.import = slapos.recipe.slaprunner.backup:ImportRecipe',
           'softwaretype = slapos.recipe.softwaretype:Recipe',
           'sphinx= slapos.recipe.sphinx:Recipe',
+          'squid = slapos.recipe.squid:Recipe',
           'sshkeys_authority = slapos.recipe.sshkeys_authority:Recipe',
           'sshkeys_authority.request = slapos.recipe.sshkeys_authority:Request',
           'stunnel = slapos.recipe.stunnel:Recipe',

slapos/recipe/addresiliency/takeover.py

 # -*- coding: utf-8 -*-
 import logging
 import time
+import traceback
 
 import slapos
 from slapos.slap.slap import NotFoundError
@@ -65,6 +66,7 @@ def takeover(server_url, key_file, cert_file, computer_guid,
       cp_winner.rename(new_name=cp_exporter_ref)
       break
     except NotFoundError:
+      traceback.print_exc()
       log.warning('Impossible to rename. Retrying in a few seconds...')
   log.debug('Renamed.')
 

slapos/recipe/apache_frontend/__init__.py

-##############################################################################
-#
-# Copyright (c) 2010 Vifib SARL and Contributors. All Rights Reserved.
-#
-# WARNING: This program as such is intended to be used by professional
-# programmers who take the whole responsibility of assessing all potential
-# consequences resulting from its eventual inadequacies and bugs
-# End users who are looking for a ready-to-use solution with commercial
-# guarantees and support are strongly adviced to contract a Free Software
-# Service Company
-#
-# This program is Free Software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License
-# as published by the Free Software Foundation; either version 3
-# of the License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-#
-##############################################################################
-from slapos.recipe.librecipe import BaseSlapRecipe
-import os
-import pkg_resources
-import hashlib
-import operator
-import sys
-import zc.buildout
-import zc.recipe.egg
-import ConfigParser
-import re
-import traceback
-
-TRUE_VALUES = ['y', 'yes', '1', 'true']
-
-class Recipe(BaseSlapRecipe):
-
-  def getTemplateFilename(self, template_name):
-    return pkg_resources.resource_filename(__name__,
-        'template/%s' % template_name)
-
-  def _install(self):
-    # Define directory not defined in deprecated lib
-    self.service_directory = os.path.join(self.etc_directory, 'service')
-
-    # Check for mandatory arguments
-    frontend_domain_name = self.parameter_dict.get("domain")
-    if frontend_domain_name is None:
-      raise zc.buildout.UserError('No domain name specified. Please define '
-          'the "domain" instance parameter.')
-
-    # Define optional arguments
-    frontend_port_number = self.parameter_dict.get("port", 4443)
-    frontend_plain_http_port_number = self.parameter_dict.get(
-        "plain_http_port", 8080)
-    base_varnish_port = 26009
-    slave_instance_list = self.parameter_dict.get("slave_instance_list", [])
-
-    self.path_list = []
-    self.requirements, self.ws = self.egg.working_set()
-
-    # self.cron_d is a directory, where cron jobs can be registered
-    self.cron_d = self.installCrond()
-    self.killpidfromfile = zc.buildout.easy_install.scripts(
-        [('killpidfromfile', 'slapos.toolbox.killpidfromfile',
-          'killpidfromfile')], self.ws, sys.executable, self.bin_directory)[0]
-    self.path_list.append(self.killpidfromfile)
-
-    rewrite_rule_list = []
-    rewrite_rule_https_only_list = []
-    rewrite_rule_zope_list = []
-    rewrite_rule_zope_path_list = []
-    slave_dict = {}
-    service_dict = {}
-
-    # Sort slave instance by reference to avoid most security issues
-    slave_instance_list = sorted(slave_instance_list,
-                                 key=operator.itemgetter('slave_reference'))
-
-    # dict of used domains, only used to track duplicates
-    domain_dict = {}
-
-    for slave_instance in slave_instance_list:
-      # Sanitize inputs
-      backend_url = slave_instance.get("url", None)
-      reference = slave_instance.get("slave_reference")
-      enable_cache = slave_instance.get('enable_cache', '').lower() in TRUE_VALUES
-      slave_type = slave_instance.get('type', '').lower() or None
-
-      https_only = slave_instance.get('https-only', '').lower() in TRUE_VALUES
-
-      # Set scheme (http? https?)
-      if https_only:
-        scheme = 'https://'
-      else:
-        scheme = 'http://'
-
-      self.logger.info('Processing slave instance: %s' % reference)
-
-      # Check for mandatory slave fields
-      if backend_url is None:
-        self.logger.warn('No "url" parameter is defined for %s slave'\
-            'instance. Ignoring it.' % reference)
-        continue
-
-      # Check for custom domain (like mypersonaldomain.com)
-      # If no custom domain, use generated one.
-      # Note: if we get an empty custom_domain parameter, we ignore it
-      domain = slave_instance.get('custom_domain')
-      if isinstance(domain, basestring):
-        domain = domain.strip()
-      if domain is None or domain.strip() == '':
-        domain = "%s.%s" % (reference.replace("-", "").lower(),
-            frontend_domain_name)
-
-      if domain_dict.get(domain):
-        # This domain already has been processed, skip this new one
-        continue
-      else:
-        domain_dict[domain] = True
-
-      # Define the URL where the instance will be available
-      # WARNING: we use default ports (443, 80) here.
-      slave_dict[reference] = "%s%s/" % (scheme, domain)
-
-      # Check if we want varnish+stunnel cache.
-      #if enable_cache:
-      #  # XXX-Cedric : need to refactor to clean code? (to many variables)
-      #  rewrite_rule = self.configureVarnishSlave(
-      #      base_varnish_port, backend_url, reference, service_dict, domain)
-      #  base_varnish_port += 2
-      #else:
-      #  rewrite_rule = "%s %s" % (domain, backend_url)
-      # Temporary forbid activation of cache until it is properly tested
-      rewrite_rule = "%s %s" % (domain, backend_url)
-
-      # Finally, if successful, we add the rewrite rule to our list of rules
-      # We have 4 RewriteMaps:
-      #  - One for generic (non-zope) websites, accepting both HTTP and HTTPS
-      #  - One for generic websites that only accept HTTPS
-      #  - Two for Zope-based websites
-      if rewrite_rule:
-        # We check if we have a zope slave. It requires different rewrite
-        # rule structure.
-        # So we will have one RewriteMap for normal websites, and one
-        # RewriteMap for Zope Virtual Host Monster websites.
-        if slave_type in ['zope']:
-          rewrite_rule_zope_list.append(rewrite_rule)
-          # For Zope, we have another dict containing the path e.g '/erp5/...
-          rewrite_rule_path = "%s %s" % (domain, slave_instance.get('path', ''))
-          rewrite_rule_zope_path_list.append(rewrite_rule_path)
-        else:
-          if https_only:
-            rewrite_rule_https_only_list.append(rewrite_rule)
-          else:
-            rewrite_rule_list.append(rewrite_rule)
-
-    # Certificate stuff
-    valid_certificate_str = self.parameter_dict.get("domain_ssl_ca_cert")
-    valid_key_str = self.parameter_dict.get("domain_ssl_ca_key")
-    if valid_certificate_str is None and valid_key_str is None:
-      ca_conf = self.installCertificateAuthority()
-      key, certificate = self.requestCertificate(frontend_domain_name)
-    else:
-      ca_conf = self.installValidCertificateAuthority(
-          frontend_domain_name, valid_certificate_str, valid_key_str)
-      key = ca_conf.pop("key")
-      certificate = ca_conf.pop("certificate")
-    if service_dict != {}:
-      if valid_certificate_str is not None and valid_key_str is not None:
-        self.installCertificateAuthority()
-        stunnel_key, stunnel_certificate = \
-            self.requestCertificate(frontend_domain_name)
-      else:
-        stunnel_key, stunnel_certificate = key, certificate
-      self.installStunnel(service_dict,
-        stunnel_certificate, stunnel_key,
-        ca_conf["ca_crl"],
-        ca_conf["certificate_authority_path"])
-
-    apache_parameter_dict = self.installFrontendApache(
-        ip_list=["[%s]" % self.getGlobalIPv6Address(),
-                 self.getLocalIPv4Address()],
-        port=frontend_port_number,
-        plain_http_port=frontend_plain_http_port_number,
-        name=frontend_domain_name,
-        rewrite_rule_list=rewrite_rule_list,
-        rewrite_rule_https_only_list=rewrite_rule_https_only_list,
-        rewrite_rule_zope_list=rewrite_rule_zope_list,
-        rewrite_rule_zope_path_list=rewrite_rule_zope_path_list,
-        key=key, certificate=certificate)
-
-    # Send connection informations about each slave
-    for reference, url in slave_dict.iteritems():
-      self.logger.debug("Sending connection parameters of slave "
-          "instance: %s" % reference)
-      try:
-        connection_dict = {
-            # Send the public IPs (if possible) so that user knows what IP
-            # to bind to its domain name
-            'frontend_ipv6_address': self.getGlobalIPv6Address(),
-            'frontend_ipv4_address': self.parameter_dict.get("public-ipv4",
-                self.getLocalIPv4Address()),
-            'site_url': url,
-        }
-        self.setConnectionDict(connection_dict, reference)
-      except:
-        self.logger.fatal("Error while sending slave %s informations: %s",
-            reference, traceback.format_exc())
-
-    # Then set it for master instance
-    self.setConnectionDict(
-      dict(site_url=apache_parameter_dict["site_url"],
-           frontend_ipv6_address=self.getGlobalIPv6Address(),
-           frontend_ipv4_address=self.getLocalIPv4Address()))
-
-    # Promises
-    promise_config = dict(
-      hostname=self.getGlobalIPv6Address(),
-      port=frontend_port_number,
-      python_path=sys.executable,
-    )
-    promise_v6 = self.createPromiseWrapper(
-      'apache_ipv6',
-      self.substituteTemplate(
-          pkg_resources.resource_filename(
-              'slapos.recipe.check_port_listening',
-          'template/socket_connection_attempt.py.in'),
-        promise_config))
-    self.path_list.append(promise_v6)
-
-    promise_config = dict(
-      hostname=self.getLocalIPv4Address(),
-      port=frontend_port_number,
-      python_path=sys.executable,
-    )
-    promise_v4 = self.createPromiseWrapper(
-      'apache_ipv4',
-      self.substituteTemplate(
-          pkg_resources.resource_filename(
-              'slapos.recipe.check_port_listening',
-          'template/socket_connection_attempt.py.in'),
-        promise_config))
-    self.path_list.append(promise_v4)
-
-    return self.path_list
-
-  def configureVarnishSlave(self, base_varnish_port, url, reference,
-      service_dict, domain):
-    # Varnish should use stunnel to connect to the backend
-    base_varnish_control_port = base_varnish_port
-    base_varnish_port += 1
-    # Use regex
-    host_regex = "((\[\w*|[0-9]+\.)(\:|)).*(\]|\.[0-9]+)"
-    slave_host = re.search(host_regex, url).group(0)
-    port_regex = "\w+(\/|)$"
-    matcher = re.search(port_regex, url)
-    if matcher is not None:
-      slave_port = matcher.group(0)
-      slave_port = slave_port.replace("/", "")
-    elif url.startswith("https://"):
-      slave_port = 443
-    else:
-      slave_port = 80
-    service_name = "varnish_%s" % reference
-    varnish_ip = self.getLocalIPv4Address()
-    stunnel_port = base_varnish_port + 1
-    self.installVarnishCache(service_name,
-      ip=varnish_ip,
-      port=base_varnish_port,
-      control_port=base_varnish_control_port,
-      backend_host=varnish_ip,
-      backend_port=stunnel_port,
-      size="1G")
-    service_dict[service_name] = dict(public_ip=varnish_ip,
-        public_port=stunnel_port,
-        private_ip=slave_host.replace("[", "").replace("]", ""),
-        private_port=slave_port)
-    return "%s http://%s:%s" % \
-        (domain, varnish_ip, base_varnish_port)
-
-  def requestCertificate(self, name):
-    hash = hashlib.sha512(name).hexdigest()
-    key = os.path.join(self.ca_private, hash + self.ca_key_ext)
-    certificate = os.path.join(self.ca_certs, hash + self.ca_crt_ext)
-    parser = ConfigParser.RawConfigParser()
-    parser.add_section('certificate')
-    parser.set('certificate', 'name', name)
-    parser.set('certificate', 'key_file', key)
-    parser.set('certificate', 'certificate_file', certificate)
-    parser.write(open(os.path.join(self.ca_request_dir, hash), 'w'))
-    return key, certificate
-
-  def installCrond(self):
-   timestamps = self.createDataDirectory('cronstamps')
-   cron_output = os.path.join(self.log_directory, 'cron-output')
-   self._createDirectory(cron_output)
-   catcher = zc.buildout.easy_install.scripts([('catchcron',
-     __name__ + '.catdatefile', 'catdatefile')], self.ws, sys.executable,
-     self.bin_directory, arguments=[cron_output])[0]
-   self.path_list.append(catcher)
-   cron_d = os.path.join(self.etc_directory, 'cron.d')
-   crontabs = os.path.join(self.etc_directory, 'crontabs')
-   self._createDirectory(cron_d)
-   self._createDirectory(crontabs)
-   wrapper = zc.buildout.easy_install.scripts([('crond',
-     'slapos.recipe.librecipe.execute', 'execute')], self.ws, sys.executable,
-     self.service_directory, arguments=[
-       self.options['dcrond_binary'].strip(), '-s', cron_d, '-c', crontabs,
-       '-t', timestamps, '-f', '-l', '5', '-M', catcher]
-     )[0]
-   self.path_list.append(wrapper)
-   return cron_d
-
-  def installValidCertificateAuthority(self, domain_name, certificate, key):
-    ca_dir = os.path.join(self.data_root_directory, 'ca')
-    ca_private = os.path.join(ca_dir, 'private')
-    ca_certs = os.path.join(ca_dir, 'certs')
-    ca_crl = os.path.join(ca_dir, 'crl')
-    self._createDirectory(ca_dir)
-    for path in (ca_private, ca_certs, ca_crl):
-      self._createDirectory(path)
-    key_path = os.path.join(ca_private, domain_name + ".key")
-    certificate_path = os.path.join(ca_certs, domain_name + ".crt")
-    self._writeFile(key_path, key)
-    self._writeFile(certificate_path, certificate)
-    return dict(certificate_authority_path=ca_dir,
-        ca_crl=ca_crl,
-        certificate=certificate_path,
-        key=key_path)
-
-  def installCertificateAuthority(self, ca_country_code='XX',
-      ca_email='xx@example.com', ca_state='State', ca_city='City',
-      ca_company='Company'):
-    backup_path = self.createBackupDirectory('ca')
-    self.ca_dir = os.path.join(self.data_root_directory, 'ca')
-    self._createDirectory(self.ca_dir)
-    self.ca_request_dir = os.path.join(self.ca_dir, 'requests')
-    self._createDirectory(self.ca_request_dir)
-    config = dict(ca_dir=self.ca_dir, request_dir=self.ca_request_dir)
-    self.ca_private = os.path.join(self.ca_dir, 'private')
-    self.ca_certs = os.path.join(self.ca_dir, 'certs')
-    self.ca_crl = os.path.join(self.ca_dir, 'crl')
-    self.ca_newcerts = os.path.join(self.ca_dir, 'newcerts')
-    self.ca_key_ext = '.key'
-    self.ca_crt_ext = '.crt'
-    for d in [self.ca_private, self.ca_crl, self.ca_newcerts, self.ca_certs]:
-      self._createDirectory(d)
-    for f in ['crlnumber', 'serial']:
-      if not os.path.exists(os.path.join(self.ca_dir, f)):
-        open(os.path.join(self.ca_dir, f), 'w').write('01')
-    if not os.path.exists(os.path.join(self.ca_dir, 'index.txt')):
-      open(os.path.join(self.ca_dir, 'index.txt'), 'w').write('')
-    openssl_configuration = os.path.join(self.ca_dir, 'openssl.cnf')
-    config.update(
-        working_directory=self.ca_dir,
-        country_code=ca_country_code,
-        state=ca_state,
-        city=ca_city,
-        company=ca_company,
-        email_address=ca_email,
-    )
-    self._writeFile(openssl_configuration, pkg_resources.resource_string(
-      __name__, 'template/openssl.cnf.ca.in') % config)
-
-    # XXX-Cedric: Don't use this, but use slapos.recipe.certificate_authority
-    #             from the instance profile.
-    self.path_list.extend(zc.buildout.easy_install.scripts([
-      ('certificate_authority', __name__ + '.certificate_authority',
-         'runCertificateAuthority')],
-        self.ws, sys.executable, self.service_directory, arguments=[dict(
-          openssl_configuration=openssl_configuration,
-          openssl_binary=self.options['openssl_binary'],
-          certificate=os.path.join(self.ca_dir, 'cacert.pem'),
-          key=os.path.join(self.ca_private, 'cakey.pem'),
-          crl=os.path.join(self.ca_crl),
-          request_dir=self.ca_request_dir
-          )]))
-
-    # configure backup
-    backup_cron = os.path.join(self.cron_d, 'ca_rdiff_backup')
-    open(backup_cron, 'w').write(
-        '''0 0 * * * %(rdiff_backup)s %(source)s %(destination)s'''%dict(
-          rdiff_backup=self.options['rdiff_backup_binary'],
-          source=self.ca_dir,
-          destination=backup_path))
-    self.path_list.append(backup_cron)
-
-    return dict(
-      ca_certificate=os.path.join(config['ca_dir'], 'cacert.pem'),
-      ca_crl=os.path.join(config['ca_dir'], 'crl'),
-      certificate_authority_path=config['ca_dir']
-    )
-
-  def _getApacheConfigurationDict(self, name, ip_list, port):
-    apache_conf = dict()
-    apache_conf['server_name'] = name
-    apache_conf['pid_file'] = self.options['pid-file']
-    apache_conf['lock_file'] = os.path.join(self.run_directory,
-        name + '.lock')
-    apache_conf['document_root'] = os.path.join(self.data_root_directory,
-        'htdocs')
-    apache_conf['instance_home'] = os.path.join(self.work_directory)
-    apache_conf['httpd_home'] = self.options['httpd_home']
-    apache_conf['ip_list'] = ip_list
-    apache_conf['port'] = port
-    apache_conf['server_admin'] = 'admin@'
-    apache_conf['error_log'] = self.options['error-log']
-    apache_conf['access_log'] = self.options['access-log']
-    return apache_conf
-
-  def installVarnishCache(self, name, ip, port, control_port, backend_host,
-                                backend_port, size="1G"):
-    """
-      Install a varnish daemon for a certain address
-    """
-    directory = self.createDataDirectory(name)
-    varnish_config = dict(
-      directory=directory,
-      pid = "%s/varnish.pid" % directory,
-      port="%s:%s" % (ip, port),
-      varnishd_binary=self.options["varnishd_binary"],
-      control_port="%s:%s" % (ip, control_port),
-      storage="file,%s/storage.bin,%s" % (directory, size))
-
-    config_file = self.createConfigurationFile("%s.conf" % name,
-      self.substituteTemplate(self.getTemplateFilename('varnish.vcl.in'),
-        dict(backend_host=backend_host, backend_port=backend_port)))
-
-    varnish_argument_list = [varnish_config['varnishd_binary'].strip(),
-        "-F", "-n", directory, "-P", varnish_config["pid"], "-p",
-        "cc_command=exec %s " % self.options["gcc_binary"] +\
-            "-fpic -shared -o %o %s",
-        "-f", config_file,
-        "-a", varnish_config["port"], "-T", varnish_config["control_port"],
-        "-s", varnish_config["storage"]]
-    environment = dict(PATH="%s:%s" % (self.options["binutils_directory"],
-                                       os.environ.get('PATH')))
-    wrapper = zc.buildout.easy_install.scripts([(name,
-      'slapos.recipe.librecipe.execute', 'executee')], self.ws,
-      sys.executable, self.service_directory, arguments=[varnish_argument_list,
-      environment])[0]
-    self.path_list.append(wrapper)
-
-    return varnish_config
-
-  def installStunnel(self, service_dict, certificate,
-      key, ca_crl, ca_path):
-    """Installs stunnel
-      service_dict =
-        { name: (public_ip, private_ip, public_port, private_port),}
-    """
-    template_filename = self.getTemplateFilename('stunnel.conf.in')
-    template_entry_filename = self.getTemplateFilename('stunnel.conf.entry.in')
-
-    log = os.path.join(self.log_directory, 'stunnel.log')
-    pid_file = os.path.join(self.run_directory, 'stunnel.pid')
-    stunnel_conf = dict(
-        pid_file=pid_file,
-        log=log,
-        cert = certificate,
-        key = key,
-        ca_crl = ca_crl,
-        ca_path = ca_path,
-        entry_str=''
-    )
-    entry_list = []
-    for name, parameter_dict in service_dict.iteritems():
-      parameter_dict["name"] = name
-      entry_str = self.substituteTemplate(template_entry_filename,
-          parameter_dict)
-      entry_list.append(entry_str)
-
-    stunnel_conf["entry_str"] = "\n".join(entry_list)
-    stunnel_conf_path = self.createConfigurationFile("stunnel.conf",
-        self.substituteTemplate(template_filename,
-          stunnel_conf))
-    wrapper = zc.buildout.easy_install.scripts([('stunnel',
-      'slapos.recipe.librecipe.execute', 'execute_wait')], self.ws,
-      sys.executable, self.service_directory, arguments=[
-        [self.options['stunnel_binary'].strip(), stunnel_conf_path],
-        [certificate, key]]
-      )[0]
-    self.path_list.append(wrapper)
-    return stunnel_conf
-
-  def installFrontendApache(self, ip_list, key, certificate, name,
-                            port=4443, plain_http_port=8080,
-                            rewrite_rule_list=None,
-                            rewrite_rule_zope_list=None,
-                            rewrite_rule_https_only_list=None,
-                            rewrite_rule_zope_path_list=None,
-                            access_control_string=None):
-    if rewrite_rule_list is None:
-      rewrite_rule_list = []
-    if rewrite_rule_https_only_list is None:
-      rewrite_rule_zope_path_list = []
-    if rewrite_rule_zope_list is None:
-      rewrite_rule_zope_list = []
-    if rewrite_rule_zope_path_list is None:
-      rewrite_rule_zope_path_list = []
-
-    # Create htdocs, populate it with default 404 document
-    htdocs_location = os.path.join(self.data_root_directory, 'htdocs')
-    self._createDirectory(htdocs_location)
-    notfound_file_location = os.path.join(htdocs_location, 'notfound.html')
-    notfound_template_file_location = self.getTemplateFilename(
-        'notfound.html')
-    notfound_file_content = open(notfound_template_file_location, 'r').read()
-    self._writeFile(notfound_file_location, notfound_file_content)
-
-    # Create mod_ssl cache directory
-    cache_directory_location = os.path.join(self.var_directory, 'cache')
-    mod_ssl_cache_location = os.path.join(cache_directory_location,
-        'httpd_mod_ssl')
-    self._createDirectory(cache_directory_location)
-    self._createDirectory(mod_ssl_cache_location)
-
-    # Create "custom" apache configuration files if it does not exist.
-    # Note : Those files won't be erased or changed by slapgrid.
-    # It can be freely customized by node admin.
-    custom_apache_configuration_directory = os.path.join(
-        self.data_root_directory, 'apache-conf.d')
-    self._createDirectory(custom_apache_configuration_directory)
-    # First one is included in the end of the apache configuration file
-    custom_apache_configuration_file_location = os.path.join(
-        custom_apache_configuration_directory, 'apache_frontend.custom.conf')
-    if not os.path.exists(custom_apache_configuration_file_location):
-      open(custom_apache_configuration_file_location, 'w')
-    # Second one is included in the virtualhost of apache configuration file
-    custom_apache_virtual_configuration_file_location = os.path.join(
-        custom_apache_configuration_directory,
-        'apache_frontend.virtualhost.custom.conf')
-    if not os.path.exists(custom_apache_virtual_configuration_file_location):
-      open(custom_apache_virtual_configuration_file_location, 'w')
-
-    # Create backup of custom apache configuration
-    backup_path = self.createBackupDirectory('custom_apache_conf_backup')
-    backup_cron = os.path.join(self.cron_d, 'custom_apache_conf_backup')
-    open(backup_cron, 'w').write(
-        '''0 0 * * * %(rdiff_backup)s %(source)s %(destination)s'''%dict(
-          rdiff_backup=self.options['rdiff_backup_binary'],
-          source=custom_apache_configuration_directory,
-          destination=backup_path))
-    self.path_list.append(backup_cron)
-
-    # Create configuration file and rewritemaps
-    apachemap_path = self.createConfigurationFile(
-        "apache_rewritemap_generic.txt",
-        "\n".join(rewrite_rule_list)
-    )
-    apachemap_httpsonly_path = self.createConfigurationFile(
-        "apache_rewritemap_httpsonly.txt",
-        "\n".join(rewrite_rule_https_only_list)
-    )
-    apachemap_zope_path = self.createConfigurationFile(
-        "apache_rewritemap_zope.txt",
-        "\n".join(rewrite_rule_zope_list)
-    )
-    apachemap_zopepath_path = self.createConfigurationFile(
-        "apache_rewritemap_zopepath.txt",
-        "\n".join(rewrite_rule_zope_path_list)
-    )
-
-    apache_conf = self._getApacheConfigurationDict(name, ip_list, port)
-    apache_conf['ssl_snippet'] = self.substituteTemplate(
-        self.getTemplateFilename('apache.ssl-snippet.conf.in'),
-        dict(login_certificate=certificate,
-            login_key=key,
-            httpd_mod_ssl_cache_directory=mod_ssl_cache_location,
-        )
-    )
-
-    apache_conf["listen"] = "\n".join([
-        "Listen %s:%s" % (ip, port)
-        for port in (plain_http_port, port)
-        for ip in ip_list
-    ])
-
-    path = self.substituteTemplate(
-        self.getTemplateFilename('apache.conf.path-protected.in'),
-        dict(path='/',
-             access_control_string='none',
-             document_root=apache_conf['document_root'],
-        )
-    )
-
-    apache_conf.update(**dict(
-      path_enable=path,
-      apachemap_path=apachemap_path,
-      apachemap_httpsonly_path=apachemap_httpsonly_path,
-      apachemapzope_path=apachemap_zope_path,
-      apachemapzopepath_path=apachemap_zopepath_path,
-      apache_domain=name,
-      https_port=port,
-      plain_http_port=plain_http_port,
-      custom_apache_conf=custom_apache_configuration_file_location,
-      custom_apache_virtualhost_conf=custom_apache_virtual_configuration_file_location,
-    ))
-
-    apache_conf_string = self.substituteTemplate(
-          self.getTemplateFilename('apache.conf.in'), apache_conf)
-
-    apache_config_file = self.createConfigurationFile('apache_frontend.conf',
-        apache_conf_string)
-    self.path_list.append(apache_config_file)
-
-    self.path_list.extend(zc.buildout.easy_install.scripts([(
-      'frontend_apache', 'slapos.recipe.erp5.apache', 'runApache')], self.ws,
-          sys.executable, self.service_directory, arguments=[
-            dict(
-              required_path_list=[key, certificate],
-              binary=self.options['httpd_binary'],
-              config=apache_config_file)
-          ]))
-
-    return dict(site_url="https://%s:%s/" % (name, port))

slapos/recipe/apache_frontend/certificate_authority.py

-import os
-import subprocess
-import time
-import ConfigParser
-import uuid
-
-
-def popenCommunicate(command_list, input=None):
-  subprocess_kw = dict(stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  if input is not None:
-    subprocess_kw.update(stdin=subprocess.PIPE)
-  popen = subprocess.Popen(command_list, **subprocess_kw)
-  result = popen.communicate(input)[0]
-  if popen.returncode is None:
-    popen.kill()
-  if popen.returncode != 0:
-    raise ValueError('Issue during calling %r, result was:\n%s' % (
-      command_list, result))
-  return result
-
-
-class CertificateAuthority:
-  def __init__(self, key, certificate, openssl_binary,
-      openssl_configuration, request_dir):
-    self.key = key
-    self.certificate = certificate
-    self.openssl_binary = openssl_binary
-    self.openssl_configuration = openssl_configuration
-    self.request_dir = request_dir
-
-  def checkAuthority(self):
-    file_list = [ self.key, self.certificate ]
-    ca_ready = True
-    for f in file_list:
-      if not os.path.exists(f):
-        ca_ready = False
-        break
-    if ca_ready:
-      return
-    for f in file_list:
-      if os.path.exists(f):
-        os.unlink(f)
-    try:
-      # no CA, let us create new one
-      popenCommunicate([self.openssl_binary, 'req', '-nodes', '-config',
-          self.openssl_configuration, '-new', '-x509', '-extensions', 'v3_ca',
-          '-keyout', self.key, '-out', self.certificate, '-days', '10950'],
-          # Authority name will be random, so no instance has the same issuer
-          'Certificate Authority %s\n' % uuid.uuid1())
-    except:
-      try:
-        for f in file_list:
-          if os.path.exists(f):
-            os.unlink(f)
-      except:
-        # do not raise during cleanup
-        pass
-      raise
-
-  def _checkCertificate(self, common_name, key, certificate):
-    file_list = [key, certificate]
-    ready = True
-    for f in file_list:
-      if not os.path.exists(f):
-        ready = False
-        break
-    if ready:
-      return False
-    for f in file_list:
-      if os.path.exists(f):
-        os.unlink(f)
-    csr = certificate + '.csr'
-    try:
-      popenCommunicate([self.openssl_binary, 'req', '-config',
-        self.openssl_configuration, '-nodes', '-new', '-keyout',
-        key, '-out', csr, '-days', '3650'],
-        common_name + '\n')
-      try:
-        popenCommunicate([self.openssl_binary, 'ca', '-batch', '-config',
-          self.openssl_configuration, '-out', certificate,
-          '-infiles', csr])
-      finally:
-        if os.path.exists(csr):
-          os.unlink(csr)
-    except:
-      try:
-        for f in file_list:
-          if os.path.exists(f):
-            os.unlink(f)
-      except:
-        # do not raise during cleanup
-        pass
-      raise
-    else:
-      return True
-
-  def checkRequestDir(self):
-    for request_file in os.listdir(self.request_dir):
-      parser = ConfigParser.RawConfigParser()
-      parser.readfp(open(os.path.join(self.request_dir, request_file), 'r'))
-      if self._checkCertificate(parser.get('certificate', 'name'),
-          parser.get('certificate', 'key_file'), parser.get('certificate',
-            'certificate_file')):
-        print 'Created certificate %r' % parser.get('certificate', 'name')
-
-def runCertificateAuthority(args):
-  ca_conf = args[0]
-  ca = CertificateAuthority(ca_conf['key'], ca_conf['certificate'],
-      ca_conf['openssl_binary'], ca_conf['openssl_configuration'],
-      ca_conf['request_dir'])
-  while True:
-    ca.checkAuthority()
-    ca.checkRequestDir()
-    time.sleep(60)

slapos/recipe/apache_frontend/template/apache.conf.path-protected.in

-<Directory %(path)s>
-  Order Deny,Allow
-  Allow from %(access_control_string)s
-</Directory>
-
-<Directory %(document_root)s>
-  Order Allow,Deny
-  Allow from All
-</Directory>

slapos/recipe/apache_frontend/template/apache.location-snippet.conf.in

-<Location %(location)s>
-  Order Deny,Allow
-  Deny from all
-  Allow from %(allow_string)s
-</Location>

slapos/recipe/apache_frontend/template/apache.ssl-snippet.conf.in

-SSLCertificateFile %(login_certificate)s
-SSLCertificateKeyFile %(login_key)s
-SSLRandomSeed startup builtin
-SSLRandomSeed connect builtin
-SSLSessionCache shmcb:/%(httpd_mod_ssl_cache_directory)s/ssl_scache(512000)
-SSLSessionCacheTimeout  300
-SSLRandomSeed startup /dev/urandom 256
-SSLRandomSeed connect builtin
-SSLProtocol -ALL +SSLv3 +TLSv1
-SSLHonorCipherOrder On
-SSLCipherSuite RC4-SHA:HIGH:!ADH
-<FilesMatch "\.(cgi|shtml|phtml|php)$">
-      SSLOptions +StdEnvVars
-</FilesMatch>
-# Accept proxy to sites using self-signed SSL certificates
-SSLProxyCheckPeerCN off
-SSLProxyCheckPeerExpire off

slapos/recipe/apache_frontend/template/logrotate_entry.in

-%(file_list)s {
-  daily
-  dateext
-  rotate 30
-  compress
-  notifempty
-  sharedscripts
-  create
-  postrotate
-    %(postrotate)s
-  endscript
-  olddir %(olddir)s
-}

slapos/recipe/apache_frontend/template/openssl.cnf.ca.in

-#
-# OpenSSL example configuration file.
-# This is mostly being used for generation of certificate requests.
-#
-
-# This definition stops the following lines choking if HOME isn't
-# defined.
-HOME			= .
-RANDFILE		= $ENV::HOME/.rnd
-
-# Extra OBJECT IDENTIFIER info:
-#oid_file		= $ENV::HOME/.oid
-oid_section		= new_oids
-
-# To use this configuration file with the "-extfile" option of the
-# "openssl x509" utility, name here the section containing the
-# X.509v3 extensions to use:
-# extensions		= 
-# (Alternatively, use a configuration file that has only
-# X.509v3 extensions in its main [= default] section.)
-
-[ new_oids ]
-
-# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
-# Add a simple OID like this:
-# testoid1=1.2.3.4
-# Or use config file substitution like this:
-# testoid2=${testoid1}.5.6
-
-# Policies used by the TSA examples.
-tsa_policy1 = 1.2.3.4.1
-tsa_policy2 = 1.2.3.4.5.6
-tsa_policy3 = 1.2.3.4.5.7
-
-####################################################################
-[ ca ]
-default_ca	= CA_default		# The default ca section
-
-####################################################################
-[ CA_default ]
-
-dir		= %(working_directory)s		# Where everything is kept
-certs		= $dir/certs		# Where the issued certs are kept
-crl_dir		= $dir/crl		# Where the issued crl are kept
-database	= $dir/index.txt	# database index file.
-#unique_subject	= no			# Set to 'no' to allow creation of
-					# several ctificates with same subject.
-new_certs_dir	= $dir/newcerts		# default place for new certs.
-
-certificate	= $dir/cacert.pem 	# The CA certificate
-serial		= $dir/serial 		# The current serial number
-crlnumber	= $dir/crlnumber	# the current crl number
-					# must be commented out to leave a V1 CRL
-crl		= $dir/crl.pem 		# The current CRL
-private_key	= $dir/private/cakey.pem # The private key
-RANDFILE	= $dir/private/.rand	# private random number file
-
-x509_extensions	= usr_cert		# The extentions to add to the cert
-
-# Comment out the following two lines for the "traditional"
-# (and highly broken) format.
-name_opt 	= ca_default		# Subject Name options
-cert_opt 	= ca_default		# Certificate field options
-
-# Extension copying option: use with caution.
-# copy_extensions = copy
-
-# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
-# so this is commented out by default to leave a V1 CRL.
-# crlnumber must also be commented out to leave a V1 CRL.
-# crl_extensions	= crl_ext
-
-default_days	= 3650			# how long to certify for
-default_crl_days= 30			# how long before next CRL
-default_md	= default		# use public key default MD
-preserve	= no			# keep passed DN ordering
-
-# A few difference way of specifying how similar the request should look
-# For type CA, the listed attributes must be the same, and the optional
-# and supplied fields are just that :-)
-policy		= policy_match
-
-# For the CA policy
-[ policy_match ]
-countryName		= match
-stateOrProvinceName	= match
-organizationName	= match
-organizationalUnitName	= optional
-commonName		= supplied
-emailAddress		= optional
-
-# For the 'anything' policy
-# At this point in time, you must list all acceptable 'object'
-# types.
-[ policy_anything ]
-countryName		= optional
-stateOrProvinceName	= optional
-localityName		= optional
-organizationName	= optional
-organizationalUnitName	= optional
-commonName		= supplied
-emailAddress		= optional
-
-####################################################################
-[ req ]
-default_bits		= 2048
-default_md		= sha1
-default_keyfile 	= privkey.pem
-distinguished_name	= req_distinguished_name
-#attributes		= req_attributes
-x509_extensions	= v3_ca	# The extentions to add to the self signed cert
-
-# Passwords for private keys if not present they will be prompted for
-# input_password = secret
-# output_password = secret
-
-# This sets a mask for permitted string types. There are several options. 
-# default: PrintableString, T61String, BMPString.
-# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
-# utf8only: only UTF8Strings (PKIX recommendation after 2004).
-# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
-# MASK:XXXX a literal mask value.
-# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
-string_mask = utf8only
-
-# req_extensions = v3_req # The extensions to add to a certificate request
-
-[ req_distinguished_name ]
-countryName			= Country Name (2 letter code)
-countryName_value		= %(country_code)s
-countryName_min			= 2
-countryName_max			= 2
-
-stateOrProvinceName		= State or Province Name (full name)
-stateOrProvinceName_value	= %(state)s
-
-localityName			= Locality Name (eg, city)
-localityName_value		= %(city)s
-
-0.organizationName		= Organization Name (eg, company)
-0.organizationName_value	= %(company)s
-
-# we can do this but it is not needed normally :-)
-#1.organizationName		= Second Organization Name (eg, company)
-#1.organizationName_default	= World Wide Web Pty Ltd
-
-commonName			= Common Name (eg, your name or your server\'s hostname)
-commonName_max			= 64
-
-emailAddress			= Email Address
-emailAddress_value = %(email_address)s
-emailAddress_max		= 64
-
-# SET-ex3			= SET extension number 3
-
-#[ req_attributes ]
-#challengePassword		= A challenge password
-#challengePassword_min		= 4
-#challengePassword_max		= 20
-#
-#unstructuredName		= An optional company name
-
-[ usr_cert ]
-
-# These extensions are added when 'ca' signs a request.
-
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-
-basicConstraints=CA:FALSE
-
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-
-# This is OK for an SSL server.
-# nsCertType			= server
-
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-
-# For normal client use this is typical
-# nsCertType = client, email
-
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-# This will be displayed in Netscape's comment listbox.
-nsComment			= "OpenSSL Generated Certificate"
-
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-
-# Copy subject details
-# issuerAltName=issuer:copy
-
-#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-
-# This is required for TSA certificates.
-# extendedKeyUsage = critical,timeStamping
-
-[ v3_req ]
-
-# Extensions to add to a certificate request
-
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-[ v3_ca ]
-
-
-# Extensions for a typical CA
-
-
-# PKIX recommendation.
-
-subjectKeyIdentifier=hash
-
-authorityKeyIdentifier=keyid:always,issuer
-
-# This is what PKIX recommends but some broken software chokes on critical
-# extensions.
-#basicConstraints = critical,CA:true
-# So we do this instead.
-basicConstraints = CA:true
-
-# Key usage: this is typical for a CA certificate. However since it will
-# prevent it being used as an test self-signed certificate it is best
-# left out by default.
-# keyUsage = cRLSign, keyCertSign
-
-# Some might want this also
-# nsCertType = sslCA, emailCA
-
-# Include email address in subject alt name: another PKIX recommendation
-# subjectAltName=email:copy
-# Copy issuer details
-# issuerAltName=issuer:copy
-
-# DER hex encoding of an extension: beware experts only!
-# obj=DER:02:03
-# Where 'obj' is a standard or added object
-# You can even override a supported extension:
-# basicConstraints= critical, DER:30:03:01:01:FF
-
-[ crl_ext ]
-
-# CRL extensions.
-# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
-
-# issuerAltName=issuer:copy
-authorityKeyIdentifier=keyid:always
-
-[ proxy_cert_ext ]
-# These extensions should be added when creating a proxy certificate
-
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-
-basicConstraints=CA:FALSE
-
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-
-# This is OK for an SSL server.
-# nsCertType			= server
-
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-
-# For normal client use this is typical
-# nsCertType = client, email
-
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-# This will be displayed in Netscape's comment listbox.
-nsComment			= "OpenSSL Generated Certificate"
-
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-
-# Copy subject details
-# issuerAltName=issuer:copy
-
-#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-
-# This really needs to be in place for it to be a proxy certificate.
-proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
-
-####################################################################
-[ tsa ]
-
-default_tsa = tsa_config1	# the default TSA section
-
-[ tsa_config1 ]
-
-# These are used by the TSA reply generation only.
-dir		= /etc/pki/tls		# TSA root directory
-serial		= $dir/tsaserial	# The current serial number (mandatory)
-crypto_device	= builtin		# OpenSSL engine to use for signing
-signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
-					# (optional)
-certs		= $dir/cacert.pem	# Certificate chain to include in reply
-					# (optional)
-signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
-
-default_policy	= tsa_policy1		# Policy if request did not specify it
-					# (optional)
-other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
-digests		= md5, sha1		# Acceptable message digests (mandatory)
-accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
-clock_precision_digits  = 0	# number of digits after dot. (optional)
-ordering		= yes	# Is ordering defined for timestamps?
-				# (optional, default: no)
-tsa_name		= yes	# Must the TSA name be included in the reply?
-				# (optional, default: no)
-ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
-				# (optional, default: no)

slapos/recipe/apache_frontend/template/stunnel.conf.entry.in

-[%(name)s]
-accept = %(public_ip)s:%(public_port)s
-connect = %(private_ip)s:%(private_port)s

slapos/recipe/apache_frontend/template/stunnel.conf.in

-foreground = yes
-output = %(log)s
-pid = %(pid_file)s
-syslog = no
-client = yes
-CApath = %(ca_path)s
-key = %(key)s
-CRLpath = %(ca_crl)s
-cert = %(cert)s
-sslVersion = SSLv3
-socket = l:TCP_NODELAY=1
-socket = r:TCP_NODELAY=1
-
-%(entry_str)s

slapos/recipe/apache_frontend/template/varnish.vcl.in

-# This is a basic VCL configuration file for varnish.  See the vcl(7)
-# man page for details on VCL syntax and semantics.
-# 
-# Default backend definition.  Set this to point to your content
-# server.
-# 
-backend default {
-    .host = "%(backend_host)s";
-    .port = "%(backend_port)s";
-    .probe = { 
-        .url = "/";
-        .timeout = 10s;
-        .interval = 10s;
-        .window = 4;
-        .threshold = 3;
-    }
-}
-# 
-# Below is a commented-out copy of the default VCL logic.  If you
-# redefine any of these subroutines, the built-in logic will be
-# appended to your code.
-# 
-# sub vcl_recv {
-#     if (req.http.x-forwarded-for) {
-#   set req.http.X-Forwarded-For =
-#       req.http.X-Forwarded-For ", " client.ip;
-#     } else {
-#   set req.http.X-Forwarded-For = client.ip;
-#     }
-#     if (req.request != "GET" &&
-#       req.request != "HEAD" &&
-#       req.request != "PUT" &&
-#       req.request != "POST" &&
-#       req.request != "TRACE" &&
-#       req.request != "OPTIONS" &&
-#       req.request != "DELETE") {
-#         /* Non-RFC2616 or CONNECT which is weird. */
-#         return (pipe);
-#     }
-#     if (req.request != "GET" && req.request != "HEAD") {
-#         /* We only deal with GET and HEAD by default */
-#         return (pass);
-#     }
-#     if (req.http.Authorization || req.http.Cookie) {
-#         /* Not cacheable by default */
-#         return (pass);
-#     }
-#     return (lookup);
-# }
-sub vcl_recv {
-    if (req.http.cache-control ~ "no-cache") {
-        purge_url(req.url);
-    }
-
-    if (req.url ~ "\.(css|js|ico)$") {
-        unset req.http.cookie;
-    }
-
-    # remove bogus cookies
-    if (req.http.Cookie) {
-        set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__utm.=[^;]+;? *", "\1");
-        set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__ac_name=\x22\x22;? *", "\1");
-        set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__ac=\x22Og.3D.3D\x22;? *", "\1");
-    }
-    if (req.http.Cookie == "") {
-        remove req.http.Cookie;
-    }
-
-    if (req.http.x-forwarded-for) {
-  set req.http.X-Forwarded-For =
-      req.http.X-Forwarded-For ", " client.ip;
-    } else {
-  set req.http.X-Forwarded-For = client.ip;
-    }
-    if (req.request != "GET" &&
-      req.request != "HEAD" &&
-      req.request != "PUT" &&
-      req.request != "POST" &&
-      req.request != "TRACE" &&
-      req.request != "OPTIONS" &&
-      req.request != "DELETE") {
-        /* Non-RFC2616 or CONNECT which is weird. */
-        return (pipe);
-    }
-    if (req.request != "GET" && req.request != "HEAD") {
-        /* We only deal with GET and HEAD by default */
-        return (pass);
-    }
-    if (req.http.Authorization) {
-        /* Not cacheable by default */
-        return (pass);
-    }
-    if (req.http.Cookie && req.http.Cookie ~ "(^|; ) *__ac=") {
-        /* Not cacheable for authorised users,
-     but KM images are cacheable */
-  if (!(req.url ~ "/km_img/.*\.(png|gif)$")) {
-    return (pass);
-  }
-    }
-    # XXX login form can defer based on __ac_name cookie value
-    if (req.url ~ "/(login_form|WebSite_viewLoginDialog)($|\?)") {
-        return (pass);
-    }
-    if (req.backend.healthy) {
-        set req.grace = 1h;
-    } else {
-        set req.grace = 1w;
-    }
-    return (lookup);
-}
-# 
-# sub vcl_pipe {
-#     # Note that only the first request to the backend will have
-#     # X-Forwarded-For set.  If you use X-Forwarded-For and want to
-#     # have it set for all requests, make sure to have:
-#     # set req.http.connection = "close";
-#     # here.  It is not set by default as it might break some broken web
-#     # applications, like IIS with NTLM authentication.
-#     return (pipe);
-# }
-# 
-# sub vcl_pass {
-#     return (pass);
-# }
-# 
-# sub vcl_hash {
-#     set req.hash += req.url;
-#     if (req.http.host) {
-#         set req.hash += req.http.host;
-#     } else {
-#         set req.hash += server.ip;
-#     }
-#     return (hash);
-# }
-# 
-# sub vcl_hit {
-#     if (!obj.cacheable) {
-#         return (pass);
-#     }
-#     return (deliver);
-# }
-# 
-# sub vcl_miss {
-#     return (fetch);
-# }
-# 
-# sub vcl_fetch {
-#     if (!beresp.cacheable) {
-#         return (pass);
-#     }
-#     if (beresp.http.Set-Cookie) {
-#         return (pass);
-#     }
-#     return (deliver);
-# }
-sub vcl_fetch {
-    # we only cache 200 (OK) and 304 (Not Modified) responses.
-    if (beresp.status != 200 && beresp.status != 304) {
-        set beresp.cacheable = false;
-    }
-
-    if (beresp.http.cache-control ~ "no-cache") {
-        set beresp.cacheable = false;
-    }
-
-    if (!beresp.cacheable) {
-        unset beresp.http.expires;
-        set beresp.http.cache-control = "no-cache";
-        return (pass);
-    }
-
-    # we don't care haproxy's cookie.
-    if (beresp.http.Set-Cookie && beresp.http.Set-Cookie !~ "^SERVERID=[^;]+; path=/$") {
-        return (pass);
-    }
-
-    if (req.url ~ "\.(css|js|ico)$") {
-        unset beresp.http.set-cookie;
-        set beresp.http.cache-control = regsub(beresp.http.cache-control, "^", "public,");
-        set beresp.http.cache-control = regsub(beresp.http.cache-control, ",$", "");
-    }
-
-    # remove some headers added by caching policy manager to avoid
-    # '304 Not Modified' in case of login <-> logout switching.
-    if (beresp.http.content-type ~ "^text/html") {
-  unset beresp.http.last-modified;
-    }
-
-    if (beresp.cacheable) {
-        /* Remove Expires from backend, it's not long enough */
-        unset beresp.http.expires;
-        /* Set the clients TTL on this object */
-        set beresp.http.cache-control = "max-age = 900";
-        /* Set how long Varnish will keep it */
-        set beresp.ttl = 1w;
-        /* marker for vcl_deliver to reset Age: */
-        set beresp.http.magicmarker = "1";
-    }
-
-    set beresp.grace = 1w;
-
-    return (deliver);
-}
-# 
-# sub vcl_deliver {
-#     return (deliver);
-# }
-sub vcl_deliver {
-    if (resp.http.magicmarker) {
-        /* Remove the magic marker */
-        unset resp.http.magicmarker;
-        /* By definition we have a fresh object */
-        set resp.http.age = "0";
-    }
-    if (obj.hits > 0) {
-        set resp.http.X-Cache = obj.hits;
-    } else {
-      set resp.http.X-Cache = "MISS";
-    }
-    return (deliver);
-}
-
-# 
-# sub vcl_error {
-#     set obj.http.Content-Type = "text/html; charset=utf-8";
-#     synthetic {"
-# <?xml version="1.0" encoding="utf-8"?>
-# <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
-#  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-# <html>
-#   <head>
-#     <title>"} obj.status " " obj.response {"</title>
-#   </head>
-#   <body>
-#     <h1>Error "} obj.status " " obj.response {"</h1>
-#     <p>"} obj.response {"</p>
-#     <h3>Guru Meditation:</h3>
-#     <p>XID: "} req.xid {"</p>
-#     <hr>
-#     <p>Varnish cache server</p>
-#   </body>
-# </html>
-# "};
-#     return (deliver);
-# }

slapos/recipe/certificate_authority/__init__.py

@@ -103,16 +103,27 @@ class Request(Recipe):
     key_file = self.options['key-file']
     cert_file = self.options['cert-file']
 
+    key_content = self.options.get('key-content', None)
+    cert_content = self.options.get('cert-content', None)
+    request_needed = True
+
     name = self.options['name']
     hash_ = hashlib.sha512(name).hexdigest()
     key = os.path.join(self.ca_private, hash_ + self.ca_key_ext)
     certificate = os.path.join(self.ca_certs, hash_ + self.ca_crt_ext)
-    parser = ConfigParser.RawConfigParser()
-    parser.add_section('certificate')
-    parser.set('certificate', 'name', name)
-    parser.set('certificate', 'key_file', key)
-    parser.set('certificate', 'certificate_file', certificate)
-    parser.write(open(os.path.join(self.request_directory, hash_), 'w'))
+
+    # XXX Ugly hack to quickly provide custom certificate/key to everyone using the recipe
+    if key_content and cert_content:
+      open(key, 'w').write(key_content)
+      open(certificate, 'w').write(cert_content)
+      request_needed = False
+    else:
+      parser = ConfigParser.RawConfigParser()
+      parser.add_section('certificate')
+      parser.set('certificate', 'name', name)
+      parser.set('certificate', 'key_file', key)
+      parser.set('certificate', 'certificate_file', certificate)
+      parser.write(open(os.path.join(self.request_directory, hash_), 'w'))
 
     for link in [key_file, cert_file]:
       if os.path.islink(link):
@@ -123,11 +134,14 @@ class Request(Recipe):
     os.symlink(key, key_file)
     os.symlink(certificate, cert_file)
 
-    wrapper = self.createPythonScript(
-      self.options['wrapper'],
-      'slapos.recipe.librecipe.execute.execute_wait',
-      [ [self.options['executable']],
-        [certificate, key] ],
-    )
+    path_list = [key_file, cert_file]
+    if request_needed:
+      wrapper = self.createPythonScript(
+        self.options['wrapper'],
+        'slapos.recipe.librecipe.execute.execute_wait',
+        [ [self.options['executable']],
+          [certificate, key] ],
+      )
+      path_list.append(wrapper)
 
-    return [key_file, cert_file, wrapper]
+    return path_list

slapos/recipe/erp5_bootstrap/template/erp5_bootstrap.in

@@ -12,7 +12,8 @@ erp5_catalog_storage = 'erp5_mysql_innodb_catalog'
 mysql_url = "%(sql_connection_string)s"
 
 header_dict = {'Authorization': 'Basic %%s' %% \
-  base64.encodestring('%%s:%%s' %% (user, password)).strip()}
+  base64.encodestring('%%s:%%s' %% (user, password)).strip(),
+               'Referer':'http://%%s/manage_addProduct/ERP5/addERP5Site' %% host}
 zope_connection = httplib.HTTPConnection(host)
 
 # Check if an ERP5 site is already created, as ERP5 does support having

slapos/recipe/erp5_update/erp5.py

@@ -50,6 +50,7 @@ class ERP5Updater(object):
     base64string = base64.encodestring(authentication_string).strip()
 
     self.header_dict['Authorization'] = 'Basic %s' % base64string
+    self.header_dict['Referer'] = 'http://%s/manage_addProduct/ERP5/addERP5Site' % host
 
     self.host = host
     self.site_id = site_id

slapos/recipe/kvm/template/kvm_controller_run.in

@@ -6,6 +6,8 @@
 import socket
 import time
 
+# XXX: to be factored with slapos.toolbox qemu qmp wrapper.
+
 socket_path = '%(socket-path)s'
 vnc_password = '%(vnc-passwd)s'
 

slapos/recipe/kvm/template/kvm_run.in

@@ -60,7 +60,11 @@ def getSocketStatus(host, port):
 # Download existing hard drive if needed at first boot
 if not os.path.exists(disk_path) and virtual_hard_drive_url != '':
   print('Downloading virtual hard drive...')
-  urllib.urlretrieve(virtual_hard_drive_url, disk_path)
+  try:
+    urllib.urlretrieve(virtual_hard_drive_url, disk_path)
+  except:
+    os.remove(disk_path)
+    raise
   md5sum = virtual_hard_drive_md5sum.strip()
   if md5sum:
     print('Checking MD5 checksum...')

slapos/recipe/librecipe/generic.py

@@ -33,6 +33,7 @@ import sys
 import inspect
 import re
 import shutil
+from textwrap import dedent
 import urllib
 import urlparse
 
@@ -129,10 +130,14 @@ class GenericBaseRecipe(object):
     return script
 
   def createWrapper(self, name, command, parameters, comments=[],
-        parameters_extra=False, environment=None):
+      parameters_extra=False, environment=None,
+      pidfile=None
+  ):
     """
     Creates a very simple (one command) shell script for process replacement.
     Takes care of quoting.
+    if pidfile parameter is specified, then it will make the wrapper a singleton,
+    accepting to run only if no other instance is running.
     """
 
     lines = [ '#!/bin/sh' ]
@@ -144,6 +149,21 @@ class GenericBaseRecipe(object):
       for key in environment:
         lines.append('export %s=%s' % (key, environment[key]))
 
+    if pidfile:
+      lines.append(dedent("""\
+          # Check for other instances
+          pidfile=%s
+          if [ -e $pidfile ]; then
+            pid=$(cat $pidfile)
+            if [ ! -z $(ps -p "$pid" | grep $(basename %s)) ]; then
+              echo "Already running with pid $pid."
+              exit 1
+            else
+              rm $pidfile
+            fi
+          fi
+          echo $$ > $pidfile""" % (pidfile, command)))
+
     lines.append('exec %s' % shlex.quote(command))
 
     for param in parameters:

slapos/recipe/notifier.py

@@ -50,6 +50,9 @@ class Recipe(GenericBaseRecipe):
 class Callback(GenericBaseRecipe):
 
   def createCallback(self, notification_id, callback):
+    # XXX: hashing the name here and in
+    # slapos.toolbox/slapos/pubsub/__init__.py is completely messed up and
+    # prevent any debug.
     callback_id = sha512(notification_id).hexdigest()
 
     filepath = os.path.join(self.options['callbacks'], callback_id)
@@ -64,7 +67,7 @@ class Callback(GenericBaseRecipe):
 class Notify(GenericBaseRecipe):
 
   def createNotifier(self, notifier_binary, wrapper, executable,
-                     log, title, notification_url, feed_url):
+                     log, title, notification_url, feed_url, pidfile=None):
 
     if not os.path.exists(log):
       # Just a touch
@@ -82,6 +85,7 @@ class Notify(GenericBaseRecipe):
     return self.createWrapper(name=wrapper,
                               command=notifier_binary,
                               parameters=parameters,
+                              pidfile=pidfile,
                               comments=[
                                   '',
                                   'Call an executable and send notification(s).',
@@ -101,6 +105,7 @@ class Notify(GenericBaseRecipe):
                                  executable=options['executable'],
                                  log=log,
                                  title=options['title'],
+                                 pidfile=options['pidfile'],
                                  notification_url=options['notify'],
                                  feed_url=feed_url)
     return [script]

slapos/recipe/pbs.py

@@ -25,43 +25,24 @@
 #
 ##############################################################################
 
-import hashlib
 import json
 import os
-import signal
 import subprocess
 import sys
+import textwrap
 import urlparse
 
 from slapos.recipe.librecipe import GenericSlapRecipe
 from slapos.recipe.dropbear import KnownHostsFile
 from slapos.recipe.notifier import Notify
 from slapos.recipe.notifier import Callback
-from slapos import slap as slapmodule
 
 
 def promise(args):
-
-  def failed_ssh():
-    sys.stderr.write("SSH Connection failed\n")
-    partition = slap.registerComputerPartition(args['computer_id'],
-                                               args['partition_id'])
-    partition.bang("SSH Connection failed. rdiff-backup is unusable.")
-
-  def sigterm_handler(signum, frame):
-    failed_ssh()
-
-  signal.signal(signal.SIGTERM, sigterm_handler)
-
-  slap = slapmodule.slap()
-  slap.initializeConnection(args['server_url'],
-                            key_file=args.get('key_file'),
-                            cert_file=args.get('cert_file'))
-
-  ssh = subprocess.Popen([args['ssh_client'], '%(user)s@%(host)s/%(port)s' % args],
-                         stdin=subprocess.PIPE,
-                         stdout=open(os.devnull, 'w'),
-                         stderr=open(os.devnull, 'w'))
+  ssh = subprocess.Popen(
+      [args['ssh_client'], '%(user)s@%(host)s/%(port)s' % args],
+      stdin=subprocess.PIPE, stdout=None, stderr=None
+  )
 
   # Rdiff Backup protocol quit command
   quitcommand = 'q' + chr(255) + chr(0) * 7
@@ -74,7 +55,7 @@ def promise(args):
   if ssh.poll() is None:
     return 1
   if ssh.returncode != 0:
-    failed_ssh()
+    sys.stderr.write("SSH Connection failed\n")
   return ssh.returncode
 
 
@@ -87,16 +68,19 @@ class Recipe(GenericSlapRecipe, Notify, Callback):
     url = entry.get('url')
     if not url:
       raise ValueError('Missing URL parameter for PBS recipe')
+    parsed_url = urlparse.urlparse(url)
 
-    # We assume that thanks to sha512 there's no collisions
-    url_hash = hashlib.sha512(url).hexdigest()
-    name_hash = hashlib.sha512(entry['name']).hexdigest()
+    slave_type = entry['type']
+    if not slave_type in ['pull', 'push']:
+      raise ValueError('type parameter must be either pull or push.')
 
-    promise_path = os.path.join(self.options['promises-directory'],
-                                url_hash)
-    parsed_url = urlparse.urlparse(url)
-    promise_dict = self.promise_base_dict.copy()
-    promise_dict.update(user=parsed_url.username,
+    slave_id = entry['notification-id']
+
+    print 'Processing PBS slave %s with type %s' % (slave_id, slave_type)
+
+    promise_path = os.path.join(self.options['promises-directory'], slave_id)
+    promise_dict = dict(ssh_client=self.options['sshclient-binary'],
+                        user=parsed_url.username,
                         host=parsed_url.hostname,
                         port=parsed_url.port)
     promise = self.createPythonScript(promise_path,
@@ -104,72 +88,109 @@ class Recipe(GenericSlapRecipe, Notify, Callback):
                                       promise_dict)
     path_list.append(promise)
 
-
     host = parsed_url.hostname
     known_hosts_file[host] = entry['server-key']
 
-    # XXX use -y because the host might not yet be in the
-    #     trusted hosts file until the next time slapgrid is run.
-
-    remote_schema = '%(ssh)s -y -p %%s %(user)s@%(host)s' % \
-      {
-        'ssh': self.options['sshclient-binary'],
-        'user': parsed_url.username,
-        'host': parsed_url.hostname,
-      }
+    notifier_wrapper_path = os.path.join(self.options['wrappers-directory'], slave_id)
+    rdiff_wrapper_path = notifier_wrapper_path + '_raw'
 
-    parameters = ['--remote-schema', remote_schema]
+    # Create the rdiff-backup wrapper
+    # It is useful to separate it from the notifier so that we can run it
+    # Manually.
+    rdiffbackup_parameter_list = []
 
+    # XXX use -y because the host might not yet be in the
+    #     trusted hosts file until the next time slapgrid is run.
+    rdiffbackup_remote_schema = '%(ssh)s -y -p %%s %(user)s@%(host)s' % {
+            'ssh': self.options['sshclient-binary'],
+            'user': parsed_url.username,
+            'host': parsed_url.hostname,
+    }
     remote_directory = '%(port)s::%(path)s' % {'port': parsed_url.port,
                                                'path': parsed_url.path}
-
-    local_directory = self.createDirectory(self.options['directory'],
-                                           name_hash)
-
-    if entry['type'] == 'push':
-      parameters.extend(['--restore-as-of', 'now'])
-      parameters.append('--force')
-      parameters.extend([local_directory, remote_directory])
-      comments = ['','Push data to a PBS *-import instance.','']
-    else:
-      parameters.extend([remote_directory, local_directory])
-      comments = ['','Pull data from a PBS *-export instance.','']
-
-    wrapper_basepath = os.path.join(self.options['wrappers-directory'],
-                                    url_hash)
-
-    if 'notify' in entry:
-      wrapper_path = wrapper_basepath + '_raw'
-    else:
-      wrapper_path = wrapper_basepath
-
-    wrapper = self.createWrapper(name=wrapper_path,
-                                 command=self.options['rdiffbackup-binary'],
-                                 parameters=parameters,
-                                 comments = comments)
-    path_list.append(wrapper)
-
-    if 'notify' in entry:
-      feed_url = '%s/get/%s' % (self.options['notifier-url'],
-                                entry['notification-id'])
-      wrapper = self.createNotifier(notifier_binary=self.options['notifier-binary'],
-                                    wrapper=wrapper_basepath,
-                                    executable=wrapper_path,
-                                    log=os.path.join(self.options['feeds'], entry['notification-id']),
-                                    title=entry.get('title', 'Untitled'),
-                                    notification_url=entry['notify'],
-                                    feed_url=feed_url,
-                                  )
-      path_list.append(wrapper)
-      #self.setConnectionDict(dict(feed_url=feed_url), entry['slave_reference'])
+    local_directory = self.createDirectory(self.options['directory'], entry['name'])
+
+    if slave_type == 'push':
+      # Create a simple rdiff-backup wrapper that will push
+      rdiffbackup_parameter_list.extend(['--remote-schema', rdiffbackup_remote_schema])
+      rdiffbackup_parameter_list.extend(['--restore-as-of', 'now'])
+      rdiffbackup_parameter_list.append('--force')
+      rdiffbackup_parameter_list.append(local_directory)
+      rdiffbackup_parameter_list.append(remote_directory)
+      comments = ['', 'Push data to a PBS *-import instance.', '']
+      rdiff_wrapper = self.createWrapper(
+          name=rdiff_wrapper_path,
+          command=self.options['rdiffbackup-binary'],
+          parameters=rdiffbackup_parameter_list,
+          comments=comments,
+          pidfile=os.path.join(self.options['run-directory'], '%s_raw.pid' % slave_id),
+      )
+    elif slave_type == 'pull':
+      # Wrap rdiff-backup call into a script that checks consistency of backup
+      # We need to manually escape the remote schema
+      rdiffbackup_parameter_list.extend(['--remote-schema', '"%s"' % rdiffbackup_remote_schema])
+      rdiffbackup_parameter_list.append(remote_directory)
+      rdiffbackup_parameter_list.append(local_directory)
+      comments = ['', 'Pull data from a PBS *-export instance.', '']
+      rdiff_wrapper_template = textwrap.dedent("""\
+          #!/bin/sh
+          # %(comment)s
+          RDIFF_BACKUP="%(rdiffbackup_binary)s"
+          $RDIFF_BACKUP %(rdiffbackup_parameter)s
+          if [ ! $? -eq 0 ]; then
+              # Check the backup, go to the last consistent backup, so that next
+              # run will be okay.
+              echo "Checking backup directory..."
+              $RDIFF_BACKUP --check-destination-dir %(local_directory)s
+              if [ ! $? -eq 0 ]; then
+                  # Here, two possiblities:
+                  # * The first backup failed. It is safe to remove it since there is nothing valuable there.
+                  # * The backup has been complete, but is now in a really weird state. Not safe to remove it.
+                  echo "Impossible to check backup: we move it to a safe place."
+                  # XXX: bang
+                  mv %(local_directory)s %(local_directory)s.$(date +%%s)
+              fi
+          else
+              # Everything's okay, cleaning up...
+              $RDIFF_BACKUP --remove-older-than %(remove_backup_older_than)s --force %(local_directory)s
+          fi
+          """)
+      rdiff_wrapper_content = rdiff_wrapper_template % {
+              'comment': comments,
+              'rdiffbackup_binary': self.options['rdiffbackup-binary'],
+              'local_directory': local_directory,
+              'rdiffbackup_parameter': ' \\\n    '.join(rdiffbackup_parameter_list),
+              # XXX: only 10 increments is not enough by default.
+              'remove_backup_older_than': entry.get('remove-backup-older-than', '3B')
+      }
+      rdiff_wrapper = self.createFile(
+          name=rdiff_wrapper_path,
+          content=rdiff_wrapper_content,
+          mode=0700
+      )
+
+    path_list.append(rdiff_wrapper)
+
+    # Create notifier wrapper
+    notifier_wrapper = self.createNotifier(
+        notifier_binary=self.options['notifier-binary'],
+        wrapper=notifier_wrapper_path,
+        executable=rdiff_wrapper,
+        log=os.path.join(self.options['feeds'], entry['notification-id']),
+        title=entry.get('title', slave_id),
+        notification_url=entry['notify'],
+        feed_url='%s/get/%s' % (self.options['notifier-url'], entry['notification-id']),
+        pidfile=os.path.join(self.options['run-directory'], '%s.pid' % slave_id)
+    )
+    path_list.append(notifier_wrapper)
 
     if 'on-notification' in entry:
       path_list.append(self.createCallback(str(entry['on-notification']),
-                                           wrapper))
+                                           notifier_wrapper))
     else:
-      cron_entry = os.path.join(self.options['cron-entries'], url_hash)
+      cron_entry = os.path.join(self.options['cron-entries'], slave_id)
       with open(cron_entry, 'w') as cron_entry_file:
-        cron_entry_file.write('%s %s' % (entry['frequency'], wrapper))
+        cron_entry_file.write('%s %s' % (entry['frequency'], notifier_wrapper))
       path_list.append(cron_entry)
 
     return path_list
@@ -181,20 +202,9 @@ class Recipe(GenericSlapRecipe, Notify, Callback):
     if self.optionIsTrue('client', True):
       self.logger.info("Client mode")
 
-      slap_connection = self.buildout['slap-connection']
-      self.promise_base_dict = {
-              'server_url': slap_connection['server-url'],
-              'computer_id': slap_connection['computer-id'],
-              'cert_file': slap_connection.get('cert-file'),
-              'key_file': slap_connection.get('key-file'),
-              'partition_id': slap_connection['partition-id'],
-              'ssh_client': self.options['sshclient-binary'],
-        }
-
       slaves = json.loads(self.options['slave-instance-list'])
       known_hosts = KnownHostsFile(self.options['known-hosts'])
       with known_hosts:
-        # XXX this API could be cleaner
         for slave in slaves:
           path_list.extend(self.add_slave(slave, known_hosts))
     else:
@@ -209,4 +219,3 @@ class Recipe(GenericSlapRecipe, Notify, Callback):
       path_list.append(wrapper)
 
     return path_list
-

slapos/recipe/request.py

@@ -88,8 +88,15 @@ class Recipe(object):
       installation of request section will fail.
       Possible names depend on requested partition's software type.
 
+    state (optional)
+     Requested state, default value is the state of the requester.
+
     Output:
       See "return" input key.
+      "instance-state"
+          The current state of the instance.
+      "requested-state"
+          The requested state of the instance.
   """
   failed = None
 
@@ -112,6 +119,11 @@ class Recipe(object):
     ))
     slave = options.get('slave', 'false').lower() in \
       librecipe.GenericBaseRecipe.TRUE_VALUES
+
+    # By default XXXX Way of doing it is ugly and dangerous
+    requested_state = options.get('state', buildout['slap-connection'].get('requested','started'))
+    options['requested-state'] = requested_state
+
     slap = slapmodule.slap()
     slap.initializeConnection(
       options['server-url'],
@@ -125,21 +137,25 @@ class Recipe(object):
     self._raise_request_exception = None
     self._raise_request_exception_formatted = None
     self.instance = None
+
     # Try to do the request and fetch parameter dict...
     try:
       self.instance = request(software_url, software_type,
           name, partition_parameter_kw=partition_parameter_kw,
-          filter_kw=filter_kw, shared=slave)
+          filter_kw=filter_kw, shared=slave, state=requested_state)
       return_parameter_dict = self._getReturnParameterDict(self.instance,
           return_parameters)
+      # Fetch the instance-guid and the instance-state
+      # Note: SlapOS Master does not support it for slave instances
       if not slave:
         try:
           options['instance-guid'] = self.instance.getInstanceGuid()
           # XXX: deprecated, to be removed
           options['instance_guid'] = self.instance.getInstanceGuid()
+          options['instance-state'] = self.instance.getState()
         except (slapmodule.ResourceNotReady, AttributeError):
           # Backward compatibility. Old SlapOS master and core don't know this.
-          self.logger.warning("Impossible to fetch instance GUID.")
+          self.logger.warning("Impossible to fetch instance GUID nor state.")
     except (slapmodule.NotFoundError, slapmodule.ServerError, slapmodule.ResourceNotReady) as exc:
       self._raise_request_exception = exc
       self._raise_request_exception_formatted = traceback.format_exc()

slapos/recipe/shellinabox.py

@@ -34,7 +34,11 @@ from slapos.recipe.librecipe import GenericBaseRecipe
 
 def login_shell(args):
   password = args['password']
-  entered_password = getpass()
+  
+  if (password != ''):
+    entered_password = getpass()
+  else:
+    entered_password = ''
 
   if entered_password != password:
     return 1
@@ -54,11 +58,11 @@ def shellinabox(args):
     with open(args['ssl_certificate']) as public_key_file:
       print >> certificate_file, public_key_file.read()
 
-  user = pwd.getpwuid(os.getuid()).pw_name
-  group = grp.getgrgid(os.getgid()).gr_name
+  user = pwd.getpwuid(os.getuid()).pw_uid
+  group = grp.getgrgid(os.getgid()).gr_gid
   service = '/:%(user)s:%(group)s:%(directory)s:%(command)s' % {
-    'user': group,
-    'group': user,
+    'user': user,
+    'group': group,
     'directory': args['directory'],
     'command': args['login_shell'],
   }

slapos/recipe/slapconfiguration.py

@@ -78,6 +78,8 @@ class Recipe(object):
       Partition parameter whose name cannot be represented unambiguously in
       buildout syntax are ignored. They cannot be accessed from buildout syntax
       anyway, and are available through "configuration" output key.
+    instance-state
+      The instance state.
   """
 
   # XXX: used to detect if a configuration key is a valid section key. This
@@ -91,10 +93,12 @@ class Recipe(object):
           options.get('key'),
           options.get('cert'),
       )
-      parameter_dict = slap.registerComputerPartition(
+      computer_partition = slap.registerComputerPartition(
           options['computer'],
           options['partition'],
-      ).getInstanceParameterDict()
+      )
+      parameter_dict = computer_partition.getInstanceParameterDict()
+      options['instance-state'] = computer_partition.getState()
       # XXX: those are not partition parameters, strictly speaking.
       # Make them available as individual section keys.
       for his_key in (
@@ -129,9 +133,9 @@ class Recipe(object):
 
       # also export single ip values for those recipes that don't support sets.
       if ipv4_set:
-          options['ipv4-random'] = list(ipv4_set)[0]
+          options['ipv4-random'] = list(ipv4_set)[0].encode('UTF-8')
       if ipv6_set:
-          options['ipv6-random'] = list(ipv6_set)[0]
+          options['ipv6-random'] = list(ipv6_set)[0].encode('UTF-8')
 
       options['tap'] = tap_set
       parameter_dict = self._expandParameterDict(options, parameter_dict)

slapos/recipe/slaprunner/__init__.py

@@ -27,78 +27,8 @@
 from slapos.recipe.librecipe import GenericBaseRecipe
 import os
 
-class Recipe(GenericBaseRecipe):
-
-  def _options(self, options):
-    self.ipv4 = options['ipv4'].strip()
-    self.ipv6 = options['ipv6'].strip()
-    self.proxy_port = options['proxy_port'].strip()
-    self.runner_port = options['runner_port'].strip()
-    self.workdir = options['working-directory'].strip()
-    self.software_directory = options['software-directory'].strip()
-    self.instance_directory = options['instance-directory'].strip()
-    self.partition_amount = options['partition-amount'].strip()
-    self.cloud9_url = options.get('cloud9-url', '').strip()
-    self.log_file = os.path.join(options['log_dir'].strip(), 'slaprunner.log')
-    # Set slaprunner access URL, CLN Beware ipv6 access is made throught nginx
-    options['access-url'] = 'https://[%s]:%s' % (self.ipv6, self.runner_port)
-
-  def install(self):
-    path_list = []
-
-    configuration = dict(
-        software_root=self.software_directory,
-        instance_root=self.instance_directory,
-        master_url='http://%s:%s/' % (self.ipv4, self.proxy_port),
-        computer_id='slaprunner',
-        partition_amount=self.partition_amount,
-        slapgrid_sr=self.options['slapgrid_sr'],
-        slapgrid_cp=self.options['slapgrid_cp'],
-        slapproxy=self.options['slapproxy'],
-        supervisor=self.options['supervisor'],
-        supervisord_config=os.path.join(self.instance_directory, 'etc',
-          'supervisord.conf'),
-        runner_workdir=self.workdir,
-        etc_dir=self.options['etc_dir'],
-        run_dir=self.options['run_dir'],
-        log_dir=self.options['log_dir'],
-        runner_host=self.ipv4,
-        runner_port=self.runner_port,
-        ipv4_address=self.ipv4,
-        ipv6_address=self.ipv6,
-        proxy_host=self.ipv4,
-        proxy_port=self.proxy_port,
-        proxy_database=os.path.join(self.workdir, 'proxy.db'),
-        git=self.options['git-binary'],
-        ssh_client=self.options['ssh_client'],
-        public_key=self.options['public_key'],
-        private_key=self.options['private_key'],
-        cloud9_url=self.cloud9_url
-    )
-
-    config_file = self.createFile(self.options['slapos.cfg'],
-        self.substituteTemplate(self.getTemplateFilename('slapos.cfg.in'),
-        configuration))
-    path_list.append(config_file)
-
-    environment = dict(
-        PATH=os.path.dirname(
-            self.options['git-binary']) + ':' + os.environ['PATH'],
-        GIT_SSH=self.options['ssh_client']
-    )
-    launch_args = [self.options['slaprunner'].strip(), config_file,
-                   '--log_file', self.log_file]
-    if self.optionIsTrue('debug', default=False):
-      launch_args.append('--debug')
-
-    wrapper = self.createPythonScript(self.options['wrapper'],
-        'slapos.recipe.librecipe.execute.executee',
-        (launch_args, environment)
-    )
-    path_list.append(wrapper)
-
-    return path_list
-
+#XXX-Nicolas This recipe has to be deleted as soon as possible
+#No changes allowed, except full-replacement using buildout
 class Test(GenericBaseRecipe):
   def _options(self, options):
     self.ipv4 = options['ipv4'].strip()

slapos/recipe/slaprunner/backup.py

@@ -70,7 +70,7 @@ class ExportRecipe(GenericBaseRecipe):
                     fi
                   done
                 }
-                sync_element %(srv-directory)s/runner  %(backup-directory)s/runner/ instance project  proxy.db softwareLink
+                sync_element %(srv-directory)s/runner  %(backup-directory)s/runner/ instance project  proxy.db
                 sync_element %(etc-directory)s  %(backup-directory)s/etc/ .rcode .project .users .htpasswd ssh
                 if [ -d %(backup-directory)s/runner/software ]; then
                   rm %(backup-directory)s/runner/software/*
@@ -119,13 +119,14 @@ class ImportRecipe(GenericBaseRecipe):
                     fi
                   done
                 }
-                restore_element %(backup-directory)s/runner/ %(srv-directory)s/runner  instance project  proxy.db softwareLink
+                restore_element %(backup-directory)s/runner/ %(srv-directory)s/runner  instance project  proxy.db
                 restore_element  %(backup-directory)s/etc/ %(etc-directory)s .rcode .project .users .htpasswd ssh
                 ifs=$IFS IFS=';'
                 read user pass remaining < %(etc-directory)s/.users
                 IFS=$ifs
-                %(curl-binary)s -vg6L -F clogin="$user" -F cpwd="$pass" --dump-header login_cookie  %(backend-url)s/doLogin;
-                %(curl-binary)s -vg6LX POST --cookie login_cookie --max-time 5  %(backend-url)s/runSoftwareProfile;
+                %(curl-binary)s --insecure -vg6L -F clogin="$user" -F cpwd="$pass" --dump-header login_cookie  %(backend-url)s/doLogin;
+                %(curl-binary)s --insecure -vg6L --cookie login_cookie --max-time 5  %(backend-url)s/isSRReady;
+                %(curl-binary)s --insecure -vg6LX POST --cookie login_cookie --max-time 5  %(backend-url)s/runSoftwareProfile --user "$user":"$pass";
                 rm -f login_cookie
                 """ % self.options)
         self.createExecutable(wrapper, content=content)

slapos/recipe/squid/__init__.py

+##############################################################################
+#
+# Copyright (c) 2012 Vifib SARL and Contributors. All Rights Reserved.
+#
+# WARNING: This program as such is intended to be used by professional
+# programmers who take the whole responsibility of assessing all potential
+# consequences resulting from its eventual inadequacies and bugs
+# End users who are looking for a ready-to-use solution with commercial
+# guarantees and support are strongly adviced to contract a Free Software
+# Service Company
+#
+# This program is Free Software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 3
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+#
+##############################################################################
+from slapos.recipe.librecipe import GenericBaseRecipe
+
+class Recipe(GenericBaseRecipe):
+  """
+  squid instance configuration.
+
+  wrapper-path -- location of the init script to generate
+
+  prepare-path -- location of the directory creation script to generate
+
+  binary-path -- location of the squid command
+
+  conf-path -- location of the configuration file
+
+  cache-path -- location of the cache directory
+
+  XXXX No good, specific...
+  open_port -- entrance port to the host and allowed to use cache
+
+  ip -- ip of the squid server
+
+  port -- port of the squid server
+
+  backend-ip -- ip of the service to cache
+
+  backend-port -- port of the service to cache
+
+  access-log-path -- location of the access log
+
+  cache-log-path -- location of the cache log
+
+  pid-filename-path -- location of the pid filename
+
+  """
+
+  def install(self):
+    config = dict(
+      ip=self.options['ip'], 
+      port=self.options['port'],
+      backend_ip=self.options['backend-ip'], 
+      backend_port=self.options['backend-port'],
+      cache_path=self.options['cache-path'],
+      access_log_path=self.options['access-log-path'],
+      cache_log_path=self.options['cache-log-path'],
+      pid_filename_path=self.options['pid-filename-path'],
+      open_port=self.options['open-port'],
+      )
+
+    template_filename = self.getTemplateFilename('squid.conf.in')
+    configuration_path = self.createFile(
+      self.options['conf-path'],
+      self.substituteTemplate(template_filename, config))
+
+    # Prepare directories
+    prepare_path = self.createPythonScript(
+      self.options['prepare-path'],
+      'slapos.recipe.librecipe.execute.execute',
+      arguments=[self.options['binary-path'].strip(), 
+                 '-z',
+                 '-f', configuration_path,
+                 ],)
+
+    # Create running wrapper
+    wrapper_path = self.createPythonScript(
+      self.options['wrapper-path'],
+      'slapos.recipe.librecipe.execute.execute',
+      arguments=[self.options['binary-path'].strip(), 
+                 '-N',
+                 '-f', configuration_path,
+                 ],)
+
+    return [configuration_path, wrapper_path, prepare_path]

slapos/recipe/squid/template/squid.conf.in

+refresh_pattern .   0 20%% 4320 max-stale=604800
+
+# Dissallow cachemgr access
+http_access deny manager
+
+# Squid service configuration
+http_port %(ip)s:%(port)s accel defaultsite=%(ip)s
+
+cache_peer %(backend_ip)s parent %(backend_port)s 0 no-query originserver name=backend
+
+acl our_sites port %(open_port)s
+http_access allow our_sites
+cache_peer_access backend allow our_sites
+cache_peer_access backend deny all
+
+# Drop squid headers
+# via off
+# reply_header_access X-Cache-Lookup deny all
+# reply_header_access X-Squid-Error deny all
+# reply_header_access X-Cache deny all
+
+header_replace X-Forwarded-For
+follow_x_forwarded_for allow all
+forwarded_for on
+
+# Use 1Go of RAM
+cache_mem 1024 MB
+# But do not keep big object in RAM
+maximum_object_size_in_memory 2048 KB
+
+# Log
+access_log %(access_log_path)s
+cache_log %(cache_log_path)s
+pid_filename %(pid_filename_path)s

slapos/recipe/sshkeys_authority.py

@@ -113,11 +113,11 @@ class Request(GenericBaseRecipe):
       hashlib.sha256(options['name']).hexdigest())
     self.public_key = self.private_key + '.pub'
 
+    options['public-key-value'] = ''
     if os.path.exists(self.public_key):
-      with open(self.public_key) as key:
-        options['public-key-value'] = key.read()
-    else:
-      options['public-key-value'] = ''
+      key_content = open(self.public_key).read()
+      if key_content:
+        options['public-key-value'] = key_content
 
   def install(self):
     requests_directory = self.options['request-directory']

software/apache-frontend/README.apache_frontend.txt

@@ -8,6 +8,31 @@ apache_frontend works using the master instance / slave instance design.
 It means that a single main instance of Apache will be used to act as frontend
 for many slaves.
 
+Software type
+=============
+
+Apache frontend is available in 3 software types:
+  * default : The standard way to use the apache frontend configuring everything with a few given parameters
+  * custom-personal : This software type allow each slave to edit its apache configuration file
+  * custom-group : This software type use a template given as a parameter on master instance to generate apache configuration for all slaves
+  * replicate : This software type is set to replicate any kind of apache
+
+About replicate frontend
+========================
+
+Slaves of the root instance (type "replicate") are sent as a parameter to requested frontends which will process them. The only difference is that they will then return the « would-be published information » to the root instance instead of publishing it. The root instance will then do a synthesis and publish the information to its slaves. The replicate instance only use 3 type of parameters for itself and will transmit the rest to requested frontends.
+These parameters are :
+  * "-frontend-type" : the type to deploy frontends with. (default to 2)
+  * "-frontend-quantity" : The quantity of frontends to request (default to "default")
+  * "-sla-i-foo" : where "i" is the number of the concerned frontend (between 1 and "-frontend-quantity") and "foo" a sla parameter.
+ex:
+<parameter id="-frontend-quantity">3</parameter>
+<parameter id="-frontend-type">custom-personal</parameter>
+<parameter id="-sla-3-computer_guid">COMP-1234</parameter>
+will request the third frontend on COMP-1234. All frontends will be of software type "custom-personal".
+
+Note: the way slaves are transformed to a parameter avoid modifying more than 3 lines in the frontend logic.
+Important NOTE: The way you ask for slave to a replicate frontend is the same as the one you would use for the software given in "-frontend-quantity". Do not forget to use "replicate" for software type. XXXXX So far it is not possible to do a simple request on a replicate frontend if you do not know the software_guid or other sla-parameter of the master instance. In fact we do not know yet the software type of the "requested" frontends. TO BE IMPLEMENTED
 
 How to deploy a frontend server
 ===============================
@@ -43,24 +68,28 @@ all slave instances.
 Finally, the slave instance will be accessible from:
 https://someidentifier.moulefrite.org.
 
-
-How to have custom configuration in frontend server
-===================================================
-
-In your instance directory, you, as sysadmin, can directly edit two
-configuration files that won't be overwritten by SlapOS to customize your
-instance:
-
- * $PARTITION_PATH/srv/srv/apache-conf.d/apache_frontend.custom.conf
- * $PARTITION_PATH/srv/srv/apache-conf.d/apache_frontend.virtualhost.custom.conf
-
-The first one is included in the end of the main apache configuration file.
-The second one is included in the virtualhost of the main apache configuration file.
-
-SlapOS will jsut create those two files for you, then completely forget them.
-
-Note: make sure that the UNIX user of the instance has read access to those
-files if you edit them.
+About SSL
+=========
+Default and custom-personal software type can handle specific ssl for one slave instance.
+IMPORTANT: One apache can not serve more than One specific SSL VirtualHost and be compatible with obsolete browser (i.e.: IE8). See http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI
+
+#How to have custom configuration in frontend server
+#===================================================
+#
+#In your instance directory, you, as sysadmin, can directly edit two
+#configuration files that won't be overwritten by SlapOS to customize your
+#instance:
+#
+# * $PARTITION_PATH/srv/srv/apache-conf.d/apache_frontend.custom.conf
+# * $PARTITION_PATH/srv/srv/apache-conf.d/apache_frontend.virtualhost.custom.conf
+#
+#The first one is included in the end of the main apache configuration file.
+#The second one is included in the virtualhost of the main apache configuration file.
+#
+#SlapOS will jsut create those two files for you, then completely forget them.
+#
+#Note: make sure that the UNIX user of the instance has read access to those
+#files if you edit them.
 
 Instance Parameters
 ===================
@@ -78,6 +107,10 @@ for the subdomains of the chosen domain like::
 Using the IP given by the Master Instance.
 "domain" is a mandatory Parameter.
 
+public-ipv4
+~~~~~~~~~~~
+Public ipv4 of the frontend (the one Apache will be indirectly listening to)
+
 port
 ~~~~
 Port used by Apache. Optional parameter, defaults to 4443.
@@ -87,8 +120,22 @@ plain_http_port
 Port used by apache to serve plain http (only used to redirect to https).
 Optional parameter, defaults to 8080.
 
-Slave Instance Parameters
--------------------------
+ip-read-limit
+~~~~~~~~~~~~~
+Use to set IPReadLimit Parameter for antiloris.
+Optional parameter, defaults to 10.
+
+apache_custom_http (custom-group)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Jinja template for apache virtualhost http configuration. It will be used by all slaves
+
+apache_custom_https (custom-group)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Jinja template for apache virtualhost https configuration. It will be used by all slaves
+
+
+Slave Instance Parameters (default)
+-----------------------------------
 
 url
 ~~~
@@ -98,7 +145,7 @@ Example: http://mybackend.com/myresource
 
 enable_cache
 ~~~~~
-Specify if slave instance should use a varnish / stunnel to connect to backend.
+Specify if slave instance should use a squid to connect to backend.
 Possible values: "true", "false".
 "enable_cache" is an optional parameter. Defaults to "false".
 Example: true
@@ -111,10 +158,10 @@ Possible values: "zope", "default".
 "type" is an optional parameter. Defaults to "default".
 Example: zope
 
-custom_domain
-~~~~~~~~~~~~~
+domain (former custom_domain)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Domain name to use as frontend. The frontend will be accessible from this domain.
-"custom_domain" is an optional parameter. Defaults to
+"domain" is an optional parameter. Defaults to
 [instancereference].[masterdomain].
 Example: www.mycustomdomain.com
 
@@ -123,7 +170,8 @@ https-only
 Specify if website should be accessed using https only. If so, the frontend
 will redirect the user to https if accessed from http.
 Possible values: "true", "false".
-This is an optional parameter. Defaults to false.
+"https-only" is an optional parameter. Defaults to "false".
+Example: true
 
 path
 ~~~~
@@ -135,14 +183,75 @@ VirtualHostMonster.
 "path" is an optional parameter, ignored if not specified.
 Example of value: "/erp5/web_site_module/hosting/"
 
+Slave Instance Parameters (custom-personal)
+-------------------------------------------
+
+apache_custom_https
+~~~~~~~~~~~~~~~~~~~
+Raw apache configuration in python template format (i.e. write "%%" for one "%") for the slave listening to the https port. Its content will be templatified in order to access functionalities such as cache access, ssl certificates... The list is available above.
+NOTE: If you want to use the cache, use the apache option "ProxyPreserveHost On"
+
+apache_custom_http
+~~~~~~~~~~~~~~~~~~
+Raw apache configuration in python template format (i.e. write "%%" for one "%") for the slave listening to the http port. Its content will be templatified in order to access functionalities such as cache access, ssl certificates... The list is available above
+NOTE: If you want to use the cache, use the apache option "ProxyPreserveHost On"
+
+url
+~~~
+Necesarry to activate cache. url of backend to use.
+"url" is an optional parameter.
+Example: http://mybackend.com/myresource
+
+domain
+~~~~~~
+Necesarry to activate cache. The frontend will be accessible from this domain.
+"domain" is an optional parameter.
+Example: www.mycustomdomain.com
+
+enable_cache
+~~~~~~~~~~~~
+Necesarry to activate cache.
+"enable_cache" is an optional parameter.
+
+ssl_key, ssl_crt, ssl_ca_crt, ssl_crs
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+SSL certificates of the slave.
+They are optional.
+
+Functionalities for apache configuration:
+In the slave apache configuration you can use parameters that will be replaced during instanciation. They should be entered as python templates parameters ex:" %(parameter)s"
+  * cache_access : url of the cache. Should replace backend url in configuration to use the cache
+  * error_log : path of the slave error log in order to log in a deferenciated file.
+  * error_log : path of the slave access log in order to log in a deferenciated file.
+  * ssl_key, ssl_crt, ssl_ca_crt, ssl_crs : path of the certificates given in slave instance parameters
+
+Slave Instance Parameters (custom-group)
+----------------------------------------
+
+url
+~~~
+Necesarry to activate cache. url of backend to use.
+"url" is an optional parameter.
+Example: http://mybackend.com/myresource
+
+domain
+~~~~~~
+Domain name to use as frontend. The frontend will be accessible from this domain.
+"domain" is an optional parameter necessary to activate cache. Defaults to
+[instancereference].[masterdomain].
+Example: www.mycustomdomain.com
+
+The rest of the parameters are defined by templates given to the master and accessible by the slave_parameter dict in it.
+
+
 Examples
 ========
 
 Here are some example of how to make your SlapOS service available through
 an already deployed frontend.
 
-Simple Example
---------------
+Simple Example (default)
+------------------------
 
 Request slave frontend instance so that https://[1:2:3:4:5:6:7:8]:1234 will be
 redirected and accessible from the proxy::
@@ -157,8 +266,8 @@ redirected and accessible from the proxy::
   )
 
 
-Zope Example
-------------
+Zope Example (default)
+----------------------
 
 Request slave frontend instance using a Zope backend so that
 https://[1:2:3:4:5:6:7:8]:1234 will be redirected and accessible from the
@@ -175,8 +284,8 @@ proxy::
   )
 
 
-Advanced example
-----------------
+Advanced example (default)
+--------------------------
 
 Request slave frontend instance using a Zope backend, with Varnish activated,
 listening to a custom domain and redirecting to /erp5/ so that
@@ -192,7 +301,192 @@ the proxy::
         "enable_cache":"true",
         "type":"zope",
         "path":"/erp5",
-        "custom_domain":"mycustomdomain.com",
+        "domain":"mycustomdomain.com",
+    }
+  )
+
+Simple Example (custom-personal)
+--------------------------------
+
+Request slave frontend instance so that https://[1:2:3:4:5:6:7:8]:1234 will be
+  instance = request(
+    software_release=apache_frontend,
+    software_type="RootSoftwareInstance",
+    partition_reference='my frontend',
+    shared=True,
+    software_type="custom-personal",
+    partition_parameter_kw={
+        "url":"https://[1:2:3:4:5:6:7:8]:1234",
+
+        "apache_custom_https":'
+  ServerName www.example.org
+  ServerAlias example.org
+  ServerAdmin geronimo@example.org
+  SSLEngine on
+  SSLProxyEngine on
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+  RewriteRule ^/(.*) https://[1:2:3:4:5:6:7:8]:1234/$1 [L,P]',
+
+        "apache_custom_http":'
+  ServerName www.example.org
+  ServerAlias www.example.org
+  ServerAlias example.org
+  ServerAdmin geronimo@example.org
+  SSLProxyEngine on
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+  # Remove "Secure" from cookies, as backend may be https
+  Header edit Set-Cookie "(?i)^(.+);secure$" "$1"
+  # Not using HTTPS? Ask that guy over there.
+  # Dummy redirection to https. Note: will work only if https listens
+  # on standard port (443).
+  RewriteRule ^/(.*) https://[1:2:3:4:5:6:7:8]:1234/$1 [L,P],
+    }
+  )
+
+Simple Cache Example (custom-personal)
+--------------------------------
+
+Request slave frontend instance so that https://[1:2:3:4:5:6:7:8]:1234 will be
+  instance = request(
+    software_release=apache_frontend,
+    software_type="RootSoftwareInstance",
+    partition_reference='my frontend',
+    shared=True,
+    software_type="custom-personal",
+    partition_parameter_kw={
+        "url":"https://[1:2:3:4:5:6:7:8]:1234",
+	"domain": "www.example.org",
+	"enable_cache": "True",
+
+        "apache_custom_https":'
+  ServerName www.example.org
+  ServerAlias www.example.org
+  ServerAlias example.org
+  ServerAdmin geronimo@example.org
+  SSLEngine on
+  SSLProxyEngine on
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+  RewriteRule ^/(.*) %(cache_access)s/$1 [L,P]',
+
+        "apache_custom_http":'
+  ServerName www.example.org
+  ServerAlias www.example.org
+  ServerAlias example.org
+  ServerAdmin geronimo@example.org
+  SSLProxyEngine on
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+
+  # Remove "Secure" from cookies, as backend may be https
+  Header edit Set-Cookie "(?i)^(.+);secure$" "$1"
+
+  # Not using HTTPS? Ask that guy over there.
+  # Dummy redirection to https. Note: will work only if https listens
+  # on standard port (443).
+  RewriteRule ^/(.*) %(cache_access)s/$1 [L,P],
+    }
+  )
+
+
+Advanced example (custom-personal)
+----------------------------------
+
+Request slave frontend instance using custom apache configuration, willing to use cache and ssl certificates.
+listening to a custom domain and redirecting to /erp5/ so that
+https://[1:2:3:4:5:6:7:8]:1234/erp5/ will be redirected and accessible from
+the proxy::
+  instance = request(
+    software_release=apache_frontend,
+    software_type="RootSoftwareInstance",
+    partition_reference='my frontend',
+    shared=True,
+    software_type="custom-personal",
+    partition_parameter_kw={
+        "url":"https://[1:2:3:4:5:6:7:8]:1234",
+        "enable_cache":"true",
+        "type":"zope",
+        "path":"/erp5",
+        "domain":"example.org",
+
+  	"apache_custom_https":'
+  ServerName www.example.org
+  ServerAlias www.example.org
+  ServerAdmin example.org
+  SSLEngine on
+  SSLProxyEngine on
+  SSLProtocol -ALL +SSLv3 +TLSv1
+  SSLHonorCipherOrder On
+  SSLCipherSuite RC4-SHA:HIGH:!ADH
+  # Use personal ssl certificates
+  SSLCertificateFile %(ssl_crt)s
+  SSLCertificateKeyFile %(ssl_key)s
+  SSLCACertificateFile %(ssl_ca_crt)s
+  SSLCertificateChainFile %(ssl_ca_crt)s
+  # Configure personal logs
+  ErrorLog "%(error_log)s"
+  LogLevel info
+  LogFormat "%%h %%l %%{REMOTE_USER}i %%t \"%%r\" %%>s %%b \"%%{Referer}i\" \"%%{User-Agent}i\" %%D" combined
+  CustomLog "%(access_log)s" combined
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+  # Redirect / to /index.html
+  RewriteRule ^/$ /index.html [R=302,L]
+  # Use cache
+  RewriteRule ^/(.*) %(cache_access)s/VirtualHostBase/https/www.example.org:443/erp5/VirtualHostRoot/$1 [L,P]',
+
+    "apache_custom_http":'
+  ServerName www.example.org
+  ServerAlias www.example.org
+  ServerAlias example.org
+  ServerAdmin geronimo@example.org
+  SSLProxyEngine on
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+  # Configure personal logs
+  ErrorLog "%(error_log)s"
+  LogLevel info
+  LogFormat "%%h %%l %%{REMOTE_USER}i %%t \"%%r\" %%>s %%b \"%%{Referer}i\" \"%%{User-Agent}i\" %%D" combined
+  CustomLog "%(access_log)s" combined
+  # Remove "Secure" from cookies, as backend may be https
+  Header edit Set-Cookie "(?i)^(.+);secure$" "$1"
+  # Not using HTTPS? Ask that guy over there.
+  # Dummy redirection to https. Note: will work only if https listens
+  # on standard port (443).
+  RewriteRule ^/(.*)$ https://%%{SERVER_NAME}%%{REQUEST_URI}',
+
+    "ssl_key":"-----BEGIN RSA PRIVATE KEY-----
+XXXXXXX..........XXXXXXXXXXXXXXX
+-----END RSA PRIVATE KEY-----",
+    "ssl_crt":'-----BEGIN CERTIFICATE-----
+XXXXXXXXXXX.............XXXXXXXXXXXXXXXXXXX
+-----END CERTIFICATE-----',
+    "ssl_ca_crt":'-----BEGIN CERTIFICATE-----
+XXXXXXXXX...........XXXXXXXXXXXXXXXXX
+-----END CERTIFICATE-----',
+    "ssl_csr":'-----BEGIN CERTIFICATE REQUEST-----
+XXXXXXXXXXXXXXX.............XXXXXXXXXXXXXXXXXX
+-----END CERTIFICATE REQUEST-----',
     }
   )
 

software/apache-frontend/TODO.txt

+Apache:
+=======
+- set a redirection of / in option
+- Implement support of multiple ip (if possible) for multiple ssl (other solution is to ask master instance but quid to much apache process?)
+
+Squid:
+======
+- Only cache in ram. Problems with to much squid on the computer or too many slave?
+
+SlapOS:
+=======
+- Implement intelligent apache graceful -> Should check slave configuration and return error to slave if there is a problem (important but difficult)
+- useless srv/squid_cache directory so far

software/apache-frontend/common.cfg

 [buildout]
 extends =
+# dev Stuff
+  ../../component/git/buildout.cfg
+
+  ../../stack/slapos.cfg
   ../../component/binutils/buildout.cfg
   ../../component/lxml-python/buildout.cfg
   ../../component/apache/buildout.cfg
   ../../component/gzip/buildout.cfg
   ../../component/stunnel/buildout.cfg
-  ../../component/varnish/buildout.cfg
   ../../component/dcron/buildout.cfg
   ../../component/logrotate/buildout.cfg
   ../../component/rdiff-backup/buildout.cfg
-  ../../stack/slapos.cfg
+  ../../component/squid/buildout.cfg
 
-parts =
+parts +=
+  slapos-cookbook
+  slapos-toolbox
   template
+  template-apache-frontend
+  template-apache-replicate
   binutils
   apache-2.2
   apache-antiloris-apache-2.2
 
   stunnel
-  varnish-2.1
 
   dcron
   logrotate
   rdiff-backup
+  squid
 
-# Buildoutish
-  eggs
-  instance-recipe-egg
-
-[instance-recipe]
-# Note: In case if specific instantiation recipe is used this is the place to
-# put its name
-egg = slapos.cookbook
-module = apache.frontend
-
-[instance-recipe-egg]
+[slapos-toolbox]
 recipe = zc.recipe.egg
-eggs = ${instance-recipe:egg}
-
-[eggs]
-recipe = z3c.recipe.scripts
 eggs =
   ${lxml-python:egg}
   slapos.toolbox
 
+scripts =
+  killpidfromfile
+  onetimedownload
+
+[check-recipe]
+recipe = plone.recipe.command
+stop-on-error = true
+update-command = ${:command}
+command =
+  grep parts ${buildout:develop-eggs-directory}/slapos.cookbook.egg-link &&
+
 [template]
-# Default template for apache instance.
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg
-md5sum = e7b9f57da7eb1450fc15789e239388d4
+md5sum = 5c22b1e0fe601255ebf19adf6093489f
 output = ${buildout:directory}/template.cfg
 mode = 0644
+
+[template-apache-frontend]
+recipe = slapos.recipe.template
+url = ${:_profile_base_location_}/instance-apache-frontend.cfg
+md5sum = 9f3eec91f43ae0730e9bba93f83572fc
+output = ${buildout:directory}/template-apache-frontend.cfg
+mode = 0644
+
+[template-apache-replicate]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/instance-apache-replicate.cfg.in
+md5sum = 02658d39fa429fef7faba9658e4f1474
+mode = 0644
+
+[template-slave-list]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/apache-custom-slave-list.cfg.in
+md5sum = f5eef006211809669b12422240c6f436
+mode = 640
+
+[template-slave-configuration]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/slave-virtualhost.conf.in
+md5sum = a7ad2e83b7f919fc45a7ef1e64344dcb
+mode = 640
+
+[template-replicate-publish-slave-information]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/replicate-publish-slave-information.cfg.in
+md5sum = 61a14dff06718e3d90c346a0a7b20c5a
+mode = 640
+
+[template-apache-frontend-configuration]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/apache.conf.in
+md5sum = b4d7461c29fb6c36f09e48fa5ad59fba
+mode = 640
+
+[template-apache-cached-configuration]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/apache_cached.conf.in
+md5sum = 0c4393db80670daf18b432b7f07383e9
+mode = 640
+
+[template-rewrite-cached]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/apache_cached_rewrite.txt.in
+md5sum = 2f30af4f9da340c2b0618599da03ed4b
+mode = 640
+
+[template-custom-slave-list]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/apache-default-slave-list.cfg.in
+md5sum = 9362384cd80727987b34c7746a6de196
+mode = 640
+
+[template-not-found-html]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/notfound.html
+filename = notfound.html
+md5sum = f20d6c3d2d94fb685f8d26dfca1e822b
+mode = 640
+
+[template-default-virtualhost]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/000.conf.in
+md5sum = c2bbf029e6adc432de0884fb5cf5d2ab
+mode = 640
+
+[template-default-slave-virtualhost]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/default-virtualhost.conf.in
+md5sum = ac845c0fa3835832307a0e7323cb339d
+mode = 640
+
+[template-squid-configuration]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/squid.conf.jinja2
+md5sum = 9f70474181372d34c8cd203f24ab546e
+mode = 640
+
+[template-empty]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/templates/empty.in
+md5sum = c2314c3a9c3412a38d14b312d3df83c1
+mode = 640
\ No newline at end of file

software/apache-frontend/instance-apache-frontend.cfg

+[buildout]
+parts =
+  directory
+  configtest
+  logrotate
+  cron
+  cron-entry-logrotate
+  ca-frontend
+  certificate-authority
+  logrotate-entry-apache
+  logrotate-entry-apache-cached
+  logrotate-entry-squid
+  apache-frontend
+  apache-cached
+  switch-apache-softwaretype
+  frontend-apache-graceful
+  cached-apache-graceful
+  squid-service
+  squid-prepare
+  squid-reload
+  promise-squid
+  dynamic-template-default-vh
+  not-found-html
+  promise-apache-frontend-v4-https
+  promise-apache-frontend-v4-http
+  promise-apache-frontend-v6-https
+  promise-apache-frontend-v6-http
+  promise-apache-cached
+
+eggs-directory = ${buildout:eggs-directory}
+develop-eggs-directory = ${buildout:develop-eggs-directory}
+offline = true
+
+# Create all needed directories
+[directory]
+recipe = slapos.cookbook:mkdirectory
+
+bin = $${buildout:directory}/bin/
+etc = $${buildout:directory}/etc/
+srv = $${buildout:directory}/srv/
+var = $${buildout:directory}/var/
+template = $${buildout:directory}/template/
+
+backup = $${:srv}/backup
+log = $${:var}/log
+run = $${:var}/run
+service = $${:etc}/service
+etc-run = $${:etc}/run
+promise = $${:etc}/promise
+
+logrotate-backup = $${:backup}/logrotate
+logrotate-entries = $${:etc}/logrotate.d
+
+cron-entries = $${:etc}/cron.d
+crontabs = $${:etc}/crontabs
+cronstamps = $${:etc}/cronstamps
+ca-dir = $${:srv}/ssl
+
+[switch-apache-softwaretype]
+recipe = slapos.cookbook:softwaretype
+single-default = $${dynamic-default-template-slave-list:rendered}
+single-custom-personal = $${dynamic-custom-personal-template-slave-list:rendered}
+single-custom-group = $${dynamic-custom-group-template-slave-list:rendered}
+
+[instance-parameter]
+# Fetches parameters defined in SlapOS Master for this instance.
+# Always the same.
+recipe = slapos.cookbook:slapconfiguration.serialised
+computer = $${slap-connection:computer-id}
+partition = $${slap-connection:partition-id}
+url = $${slap-connection:server-url}
+key = $${slap-connection:key-file}
+cert = $${slap-connection:cert-file}
+# Define default parameter(s) that will be used later, in case user didn't
+# specify it
+# All parameters are available through the configuration.XX syntax.
+# All possible parameters should have a default.
+configuration.domain = example.org
+configuration.public-ipv4 =
+configuration.port = 4443
+configuration.plain_http_port = 8080
+configuration.server-admin = admin@example.com
+configuration.apache_custom_https = ""
+configuration.apache_custom_http = ""
+configuration.apache-key =
+configuration.apache-certificate =
+configuration.open-port = 80 443
+configuration.extra_slave_instance_list =
+
+[jinja2-template-base]
+recipe = slapos.recipe.template:jinja2
+rendered = $${buildout:directory}/$${:filename}
+extra-context =
+context =
+    import json_module json
+    key eggs_directory buildout:eggs-directory
+    key develop_eggs_directory buildout:develop-eggs-directory
+    key slap_software_type instance-parameter:slap-software-type
+    key slapparameter_dict instance-parameter:configuration
+    $${:extra-context}
+
+[dynamic-template-default-vh]
+< = jinja2-template-base
+template = ${template-default-virtualhost:target}
+rendered = $${apache-directory:slave-configuration}/000.conf
+extensions = jinja2.ext.do
+extra-context =
+    key http_port instance-parameter:configuration.plain_http_port
+    key https_port instance-parameter:configuration.port
+
+[dynamic-custom-personal-template-slave-list]
+< = jinja2-template-base
+template = ${template-slave-list:target}
+filename = custom-personal-instance-slave-list.cfg
+extensions = jinja2.ext.do
+extra-context =
+    key apache_configuration_directory apache-directory:slave-configuration
+    key http_port instance-parameter:configuration.plain_http_port
+    key https_port instance-parameter:configuration.port
+    key public_ipv4 instance-parameter:configuration.public-ipv4
+    key slave_instance_list instance-parameter:slave-instance-list
+    key extra_slave_instance_list instance-parameter:configuration.extra_slave_instance_list
+    key rewrite_cached_configuration apache-configuration:cached-rewrite-file
+    key custom_ssl_directory apache-directory:vh-ssl
+    key apache_log_directory apache-directory:slave-log
+    key local_ipv4 instance-parameter:ipv4-random
+    key cache_port apache-configuration:cache-port
+    raw empty_template ${template-empty:target}
+    raw template_slave_configuration ${template-slave-configuration:target}
+    raw template_rewrite_cached ${template-rewrite-cached:target}
+    raw software_type single-custom-personal
+
+[dynamic-custom-group-template-slave-list]
+< = jinja2-template-base
+template = ${template-custom-slave-list:target}
+filename = custom-group-instance-slave-list.cfg
+extensions = jinja2.ext.do
+extra-context =
+    key apache_configuration_directory apache-directory:slave-configuration
+    key domain instance-parameter:configuration.domain
+    key http_port instance-parameter:configuration.plain_http_port
+    key https_port instance-parameter:configuration.port
+    key public_ipv4 instance-parameter:configuration.public-ipv4
+    key slave_instance_list instance-parameter:slave-instance-list
+    key extra_slave_instance_list instance-parameter:configuration.extra_slave_instance_list
+    key rewrite_cached_configuration apache-configuration:cached-rewrite-file
+    key custom_ssl_directory apache-directory:vh-ssl
+    key template_slave_configuration dynamic-virtualhost-template-slave:rendered
+    key apache_log_directory apache-directory:slave-log
+    key local_ipv4 instance-parameter:ipv4-random
+    key cache_port apache-configuration:cache-port
+    raw empty_template ${template-empty:target}
+    raw template_rewrite_cached ${template-rewrite-cached:target}
+    raw software_type single-custom-group
+
+[dynamic-default-template-slave-list]
+< = jinja2-template-base
+template = ${template-custom-slave-list:target}
+filename = default-instance-slave-list.cfg
+extensions = jinja2.ext.do
+extra-context =
+    key apache_configuration_directory apache-directory:slave-configuration
+    key domain instance-parameter:configuration.domain
+    key http_port instance-parameter:configuration.plain_http_port
+    key https_port instance-parameter:configuration.port
+    key public_ipv4 instance-parameter:configuration.public-ipv4
+    key slave_instance_list instance-parameter:slave-instance-list
+    key extra_slave_instance_list instance-parameter:configuration.extra_slave_instance_list
+    key rewrite_cached_configuration apache-configuration:cached-rewrite-file
+    key custom_ssl_directory apache-directory:vh-ssl
+    key apache_log_directory apache-directory:slave-log
+    key local_ipv4 instance-parameter:ipv4-random
+    key cache_port apache-configuration:cache-port
+    raw template_slave_configuration ${template-default-slave-virtualhost:target}
+    raw empty_template ${template-empty:target}
+    raw template_rewrite_cached ${template-rewrite-cached:target}
+    raw software_type single-default
+# XXXX Hack to allow two software types
+
+[dynamic-virtualhost-template-slave]
+<= jinja2-template-base
+template = ${template-slave-configuration:target}
+rendered = $${directory:template}/slave-virtualhost.conf.in
+extensions = jinja2.ext.do
+extra-context =
+    key https_port instance-parameter:configuration.port
+    key http_port instance-parameter:configuration.plain_http_port
+    key apache_custom_https instance-parameter:configuration.apache_custom_https
+    key apache_custom_http instance-parameter:configuration.apache_custom_http
+
+# Deploy Apache Frontend (new way, no recipe, jinja power)
+[dynamic-apache-frontend-template]
+< = jinja2-template-base
+template = ${template-apache-frontend-configuration:target}
+rendered = $${apache-configuration:frontend-configuration}
+extra-context =
+    raw httpd_home ${apache-2.2:location}
+    key httpd_mod_ssl_cache_directory apache-directory:mod-ssl
+    key domain instance-parameter:configuration.domain
+    key document_root apache-directory:document-root
+    key instance_home buildout:directory
+    key ipv4_addr instance-parameter:ipv4-random
+    key ipv6_addr instance-parameter:ipv6-random
+    key http_port instance-parameter:configuration.plain_http_port
+    key https_port instance-parameter:configuration.port
+    key server_admin instance-parameter:configuration.server-admin
+    key protected_path apache-configuration:protected-path
+    key access_control_string apache-configuration:access-control-string
+    key login_certificate ca-frontend:cert-file
+    key login_key ca-frontend:key-file
+    key ca_dir  certificate-authority:ca-dir
+    key ca_crl certificate-authority:ca-crl
+    key access_log apache-configuration:access-log
+    key error_log apache-configuration:error-log
+    key pid_file apache-configuration:pid-file
+    key slave_configuration_directory apache-directory:slave-configuration
+
+[apache-frontend]
+recipe = slapos.cookbook:wrapper
+command-line = ${apache-2.2:location}/bin/httpd -f $${dynamic-apache-frontend-template:rendered} -DFOREGROUND
+wrapper-path = $${directory:service}/frontend_apache
+wait-for-files =
+	       $${ca-frontend:cert-file}
+	       $${ca-frontend:key-file}
+
+# Deploy Apache for cached website
+[dynamic-apache-cached-template]
+< = jinja2-template-base
+template = ${template-apache-cached-configuration:target}
+rendered = $${apache-configuration:cached-configuration}
+extra-context =
+    raw httpd_home ${apache-2.2:location}
+    key httpd_mod_ssl_cache_directory apache-directory:mod-ssl
+    key domain instance-parameter:configuration.domain
+    key document_root apache-directory:document-root
+    key instance_home buildout:directory
+    key ipv4_addr instance-parameter:ipv4-random
+    key cached_port apache-configuration:cache-through-port
+    key server_admin instance-parameter:configuration.server-admin
+    key protected_path apache-configuration:protected-path
+    key access_control_string apache-configuration:access-control-string
+    key login_certificate ca-frontend:cert-file
+    key login_key ca-frontend:key-file
+    key ca_dir  certificate-authority:ca-dir
+    key ca_crl certificate-authority:ca-crl
+    key access_log apache-configuration:cache-access-log
+    key error_log apache-configuration:cache-error-log
+    key pid_file apache-configuration:cache-pid-file
+    key apachecachedmap_path apache-configuration:cached-rewrite-file
+
+[apache-cached]
+recipe = slapos.cookbook:wrapper
+command-line = ${apache-2.2:location}/bin/httpd -f $${dynamic-apache-cached-template:rendered} -DFOREGROUND
+wrapper-path = $${directory:service}/frontend_cached_apache
+wait-for-files =
+	       $${ca-frontend:cert-file}
+	       $${ca-frontend:key-file}
+
+[not-found-html]
+recipe = slapos.cookbook:symbolic.link
+target-directory = $${apache-directory:document-root}
+link-binary =
+	    ${template-not-found-html:target}
+
+[apache-directory]
+recipe = slapos.cookbook:mkdirectory
+document-root = $${directory:srv}/htdocs
+slave-configuration = $${directory:etc}/apache-slave-conf.d/
+cache = $${directory:var}/cache
+mod-ssl = $${:cache}/httpd_mod_ssl
+vh-ssl = $${:slave-configuration}/ssl
+slave-log = $${directory:log}/httpd
+
+[apache-configuration]
+frontend-configuration = $${directory:etc}/apache_frontend.conf
+cached-configuration = $${directory:etc}/apache_frontend_cached.conf
+access-log = $${directory:log}/frontend-apache-access.log
+error-log = $${directory:log}/frontend-apache-error.log
+pid-file = $${directory:run}/httpd.pid
+protected-path = /
+access-control-string = none
+cached-rewrite-file = $${directory:etc}/apache_rewrite_cached.txt
+
+# Apache for cache configuration
+cache-access-log = $${directory:log}/frontend-apache-access-cached.log
+cache-error-log = $${directory:log}/frontend-apache-error-cached.log
+cache-pid-file = $${directory:run}/httpd-cached.pid
+
+# Comunication with squid
+cache-port = 26010
+cache-through-port = 26011
+
+# Create wrapper for "apachectl conftest" in bin
+[configtest]
+recipe = slapos.cookbook:wrapper
+command-line = ${apache-2.2:location}/bin/httpd -f $${directory:etc}/apache_frontend.conf -t
+wrapper-path = $${directory:bin}/apache-configtest
+
+[certificate-authority]
+recipe = slapos.cookbook:certificate_authority
+openssl-binary = ${openssl:location}/bin/openssl
+ca-dir = $${directory:ca-dir}
+requests-directory = $${cadirectory:requests}
+wrapper = $${directory:service}/certificate_authority
+ca-private = $${cadirectory:private}
+ca-certs = $${cadirectory:certs}
+ca-newcerts = $${cadirectory:newcerts}
+ca-crl = $${cadirectory:crl}
+
+[cadirectory]
+recipe = slapos.cookbook:mkdirectory
+requests = $${directory:ca-dir}/requests/
+private = $${directory:ca-dir}/private/
+certs = $${directory:ca-dir}/certs/
+newcerts = $${directory:ca-dir}/newcerts/
+crl = $${directory:ca-dir}/crl/
+
+[ca-frontend]
+<= certificate-authority
+recipe = slapos.cookbook:certificate_authority.request
+key-file = $${cadirectory:certs}/apache_frontend.key
+cert-file = $${cadirectory:certs}/apache_frontend.crt
+executable = $${directory:service}/frontend_apache
+wrapper = $${directory:service}/frontend_apache
+key-content = $${instance-parameter:configuration.apache-key}
+cert-content = $${instance-parameter:configuration.apache-certificate}
+# Put domain name
+name = $${instance-parameter:configuration.domain}
+
+[cron]
+recipe = slapos.cookbook:cron
+dcrond-binary = ${dcron:location}/sbin/crond
+cron-entries = $${directory:cron-entries}
+crontabs = $${directory:crontabs}
+cronstamps = $${directory:cronstamps}
+catcher = $${cron-simplelogger:wrapper}
+binary = $${directory:service}/crond
+
+[cron-simplelogger]
+recipe = slapos.cookbook:simplelogger
+wrapper = $${directory:bin}/cron_simplelogger
+log = $${directory:log}/cron.log
+
+[cron-entry-logrotate]
+<= cron
+recipe = slapos.cookbook:cron.d
+name = logrotate
+frequency = 0 0 * * *
+command = $${logrotate:wrapper}
+
+# Deploy Logrotate
+[logrotate]
+recipe = slapos.cookbook:logrotate
+# Binaries
+logrotate-binary = ${logrotate:location}/usr/sbin/logrotate
+gzip-binary = ${gzip:location}/bin/gzip
+gunzip-binary = ${gzip:location}/bin/gunzip
+# Directories
+wrapper = $${directory:bin}/logrotate
+conf = $${directory:etc}/logrotate.conf
+logrotate-entries = $${directory:logrotate-entries}
+backup = $${directory:logrotate-backup}
+state-file = $${directory:srv}/logrotate.status
+
+[logrotate-entry-apache]
+<= logrotate
+recipe = slapos.cookbook:logrotate.d
+name = apache
+log = $${apache-directory:slave-log}/*_log $${apache-configuration:error-log} $${apache-configuration:access-log}
+frequency = daily
+rotatep-num = 30
+post = ${buildout:bin-directory}/killpidfromfile $${apache-configuration:pid-file} SIGUSR1
+sharedscripts = true
+notifempty = true
+create = true
+
+[logrotate-entry-apache-cached]
+<= logrotate
+recipe = slapos.cookbook:logrotate.d
+name = apache-cached
+log = $${apache-configuration:cache-error-log} $${apache-configuration:cache-access-log}
+frequency = daily
+rotatep-num = 30
+post = ${buildout:bin-directory}/killpidfromfile $${apache-configuration:cache-pid-file} SIGUSR1
+sharedscripts = true
+notifempty = true
+create = true
+
+[logrotate-entry-squid]
+<= logrotate
+recipe = slapos.cookbook:logrotate.d
+name = squid
+log = $${squid-cache:cache-log-path} $${squid-cache:access-log-path}
+frequency = daily
+rotatep-num = 30
+post = ${buildout:bin-directory}/killpidfromfile $${apache-configuration:pid-file} SIGHUP
+sharedscripts = true
+notifempty = true
+create = true
+
+######################
+#  Squid deployment
+######################
+[squid-directory]
+recipe = slapos.cookbook:mkdirectory
+squid-cache = $${directory:srv}/squid_cache
+
+[squid-cache]
+prepare-path = $${directory:etc-run}/squid-prepare
+wrapper-path = $${directory:service}/squid
+binary-path = ${squid:location}/sbin/squid
+configuration-path = $${directory:etc}/squid.cfg
+cache-path = $${squid-directory:squid-cache}
+ip = $${instance-parameter:ipv4-random}
+port = $${apache-configuration:cache-port}
+backend-ip = $${instance-parameter:ipv4-random}
+backend-port = $${apache-configuration:cache-through-port}
+open-port = $${instance-parameter:configuration.open-port}
+access-log-path = $${directory:log}/squid-access.log
+cache-log-path = $${directory:log}/squid-cache.log
+pid-filename-path = $${directory:run}/squid.pid
+
+[squid-configuration]
+< = jinja2-template-base
+template = ${template-squid-configuration:target}
+rendered = $${squid-cache:configuration-path}
+extra-context =
+      key ip squid-cache:ip 
+      key port squid-cache:port
+      key backend_ip squid-cache:backend-ip
+      key backend_port squid-cache:backend-port
+      key cache_path squid-cache:cache-path
+      key access_log_path squid-cache:access-log-path
+      key cache_log_path squid-cache:cache-log-path
+      key pid_filename_path squid-cache:pid-filename-path
+      key open_port squid-cache:open-port
+
+[squid-service]
+recipe = slapos.cookbook:wrapper
+command-line = $${squid-cache:binary-path} -N -f $${squid-configuration:rendered}
+wrapper-path = $${squid-cache:wrapper-path}
+
+[squid-prepare]
+recipe = slapos.cookbook:wrapper
+command-line = $${squid-cache:binary-path} -z -f $${squid-configuration:rendered}
+wrapper-path = $${squid-cache:prepare-path}
+
+[squid-reload]
+recipe = slapos.cookbook:wrapper
+command-line = ${buildout:bin-directory}/killpidfromfile $${squid-cache:pid-filename-path} SIGHUP
+wrapper-path = $${directory:etc-run}/squid-reload
+
+[promise-squid]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/squid
+hostname = $${instance-parameter:ipv4-random}
+port = $${apache-configuration:cache-port}
+
+# End of Squid part
+
+[frontend-apache-graceful]
+recipe = slapos.cookbook:wrapper
+command-line = ${buildout:bin-directory}/killpidfromfile $${apache-configuration:pid-file} SIGUSR1
+wrapper-path = $${directory:etc-run}/frontend-apache-graceful
+
+[cached-apache-graceful]
+recipe = slapos.cookbook:wrapper
+command-line = ${buildout:bin-directory}/killpidfromfile $${apache-configuration:cache-pid-file} SIGUSR1
+wrapper-path = $${directory:etc-run}/cached-apache-graceful
+
+[promise-apache-frontend-v4-https]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/apache_frontend_ipv4_https
+hostname = $${instance-parameter:ipv4-random}
+port = $${instance-parameter:configuration.port}
+
+[promise-apache-frontend-v4-http]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/apache_frontend_ipv4_http
+hostname = $${instance-parameter:ipv4-random}
+port = $${instance-parameter:configuration.plain_http_port}
+
+[promise-apache-frontend-v6-https]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/apache_frontend_ipv6_https
+hostname = $${instance-parameter:ipv6-random}
+port = $${instance-parameter:configuration.port}
+
+[promise-apache-frontend-v6-http]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/apache_frontend_ipv6_http
+hostname = $${instance-parameter:ipv6-random}
+port = $${instance-parameter:configuration.plain_http_port}
+
+[promise-apache-cached]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/apache_cached
+hostname = $${instance-parameter:ipv4-random}
+port = $${apache-configuration:cache-through-port}
+
+[slap_connection]
+# Kept for backward compatiblity
+computer_id = $${slap-connection:computer-id}
+partition_id = $${slap-connection:partition-id}
+server_url = $${slap-connection:server-url}
+software_release_url = $${slap-connection:software-release-url}
+key_file = $${slap-connection:key-file}
+cert_file = $${slap-connection:cert-file}

software/apache-frontend/instance-apache-replicate.cfg.in

+{% if slap_software_type in software_type -%}
+
+[jinja2-template-base]
+recipe = slapos.recipe.template:jinja2
+rendered = ${buildout:directory}/${:filename}
+extra-context =
+context =
+    import json_module json
+    key eggs_directory buildout:eggs-directory
+    key develop_eggs_directory buildout:develop-eggs-directory
+    key slap_software_type slap-parameter:slap_software_type
+    key slave_instance_list slap-parameter:slave_instance_list
+    ${:extra-context}
+
+{% set part_list = [] -%}
+{% set single_type_key = 'single-' %}
+{% if slap_software_type in ("replicate", "RootSoftwareInstance") %}
+{%   set frontend_type = slapparameter_dict.pop('-frontend-type', 'single-default') -%}
+{% else -%}
+{%   set frontend_type = "%s%s" % (single_type_key, slap_software_type) -%}
+{% endif -%}
+{% set frontend_quantity = slapparameter_dict.pop('-frontend-quantity', '1') | int -%}
+{% set slave_list_name = 'extra_slave_instance_list' -%}
+{% set frontend_list = [] %}
+{% set frontend_section_list = [] %}
+{% set namebase = 'apache-frontend' -%}
+# XXX Dirty hack, not possible to define default value before
+{% set sla_computer_apache_1_key = '-sla-1-computer_guid' -%}
+{% if not sla_computer_apache_1_key in slapparameter_dict -%}
+{%   do slapparameter_dict.__setitem__(sla_computer_apache_1_key, '${slap-connection:computer-id}') -%}
+{% endif -%}
+
+# Here we request individualy each frontend.
+# The presence of sla parameters is checked and added if found
+{% for i in range(1, frontend_quantity + 1) -%}
+{%   set frontend_name = "%s-%s" % (namebase, i) -%}
+{%   set request_section_title = 'request-%s' % frontend_name -%}
+{%   set sla_key = "-sla-%s-" % i -%}
+{%   set sla_key_length = sla_key | length %}
+{%   set sla_parameters = [] %}
+{%   for key in slapparameter_dict.keys() %}
+{%     if key.startswith(sla_key) %}
+{%       do sla_parameters.append(key[sla_key_length:]) %}
+{%     endif -%}
+{%   endfor -%}
+{%   do frontend_list.append(frontend_name) -%}
+{%   do frontend_section_list.append(request_section_title) -%}
+{%   do part_list.append(request_section_title) -%}
+[{{request_section_title}}]
+<= replicate
+name = {{frontend_name}}
+{%   if sla_parameters %}
+sla = {{ ' '.join(sla_parameters) }}
+{%     for parameter in sla_parameters -%}
+sla-{{ parameter }} = {{ slapparameter_dict.pop( sla_key + parameter ) }}
+{%     endfor -%}
+{%   endif -%}
+{% endfor -%}
+
+[replicate]
+<= slap-connection
+recipe = slapos.cookbook:request
+software-url = ${slap-connection:software-release-url}
+software-type = {{frontend_type}}
+return = private-ipv4 public-ipv4 slave-instance-information-list
+config = {{ ' '.join(slapparameter_dict.keys()) + ' ' + slave_list_name }}
+{% for parameter, value in slapparameter_dict.iteritems() -%}
+config-{{parameter}} = {{ value }}
+{% endfor -%}
+config-{{ slave_list_name }} = {{ json_module.dumps(slave_instance_list) }}
+
+[publish-information]
+recipe = slapos.cookbook:publish
+domain = {{ slapparameter_dict.get('domain') }}
+slave-amount = {{ slave_instance_list | length }}
+{% for frontend in frontend_list -%}
+#{{frontend}}-private-ipv4 = ${request-{{frontend}}:private-ipv4}
+{% endfor -%}
+
+
+#----------------------------
+#--
+#-- Publish slave information
+[publish-slave-information]
+recipe = slapos.cookbook:softwaretype
+default = ${dynamic-publish-slave-information:rendered}
+replicate = ${dynamic-publish-slave-information:rendered}
+custom-personal = ${dynamic-publish-slave-information:rendered}
+custom-group = ${dynamic-publish-slave-information:rendered}
+
+[slave-information]
+{% for frontend_section in frontend_section_list -%}
+{{ frontend_section }} = {{ "${%s:connection-slave-instance-information-list}" % frontend_section }}
+{% endfor -%}
+
+[dynamic-publish-slave-information]
+< = jinja2-template-base
+template = {{ template_publish_slave_information }}
+filename = dynamic-publish-slave-information.cfg
+extensions = jinja2.ext.do
+extra-context =
+    section slave_information slave-information
+
+[buildout]
+parts =
+  publish-slave-information
+  publish-information
+{% for part in part_list -%}
+{{ '  %s' % part }}
+{% endfor -%}
+#      publish-information
+
+eggs-directory = {{ eggs_directory }}
+develop-eggs-directory = {{ develop_eggs_directory }}
+offline = true
+
+
+[slap_connection]
+# Kept for backward compatiblity
+computer_id = ${slap-connection:computer-id}
+partition_id = ${slap-connection:partition-id}
+server_url = ${slap-connection:server-url}
+software_release_url = ${slap-connection:software-release-url}
+key_file = ${slap-connection:key-file}
+cert_file = ${slap-connection:cert-file}
+
+[slap-parameter]
+slave_instance_list =
+-frontend-quantity = 1
+-frontend-type = single-default
+{%- endif %}

software/apache-frontend/instance.cfg

 [buildout]
 parts =
-  directory
-  apache
-  configtest
-  logrotate
-  logrotate-entry-apache
+  dynamic-template-apache-replicate
+  switch-softwaretype
 
 eggs-directory = ${buildout:eggs-directory}
 develop-eggs-directory = ${buildout:develop-eggs-directory}
-
-# Create all needed directories
-[directory]
-recipe = slapos.cookbook:mkdirectory
-
-bin = $${buildout:directory}/bin/
-etc = $${buildout:directory}/etc/
-srv = $${buildout:directory}/srv/
-var = $${buildout:directory}/var/
-
-backup = $${:srv}/backup
-log = $${:var}/log
-run = $${:var}/run
-service = $${:etc}/service
-
-logrotate-backup = $${:backup}/logrotate
-logrotate-entries = $${:etc}/logrotate.d
-
-
-# Deploy Apache (old way, with monolithic recipe)
-[apache]
-recipe = ${instance-recipe:egg}:${instance-recipe:module}
-httpd_home = ${apache-2.2:location}
-httpd_binary = ${apache-2.2:location}/bin/httpd
-logrotate_binary = ${logrotate:location}/usr/sbin/logrotate
-openssl_binary = ${openssl:location}/bin/openssl
-dcrond_binary = ${dcron:location}/sbin/crond
-varnishd_binary = ${varnish-2.1:location}/sbin/varnishd
-stunnel_binary = ${stunnel:location}/bin/stunnel
-rdiff_backup_binary = ${buildout:bin-directory}/rdiff-backup
-gcc_binary = gcc
-binutils_directory = ${binutils:location}/bin/
-
-access-log = $${directory:log}/frontend-apache-access.log
-error-log = $${directory:log}/frontend-apache-error.log
-pid-file = $${directory:run}/httpd.pid
-
-
-# Create wrapper for "apachectl conftest" in bin
-[configtest]
-recipe = slapos.cookbook:wrapper
-command-line = $${apache:httpd_binary} -f $${directory:etc}/apache_frontend.conf -t
-wrapper-path = $${directory:bin}/apache-configtest
-
-
-# Deploy Logrotate
-[logrotate]
-recipe = slapos.cookbook:logrotate
-# Binaries
-logrotate-binary = ${logrotate:location}/usr/sbin/logrotate
-gzip-binary = ${gzip:location}/bin/gzip
-gunzip-binary = ${gzip:location}/bin/gunzip
-# Directories
-wrapper = $${directory:bin}/logrotate
-conf = $${directory:etc}/logrotate.conf
-logrotate-entries = $${directory:logrotate-entries}
-backup = $${directory:logrotate-backup}
-state-file = $${directory:srv}/logrotate.status
-
-[logrotate-entry-apache]
-<= logrotate
-recipe = slapos.cookbook:logrotate.d
-name = apache
-log = $${apache:error-log} $${apache:access-log}
-frequency = daily
-rotate-num = 30
-post = ${buildout:bin-directory}/killpidfromfile $${apache:pid-file} SIGUSR1
-sharedscripts = true
-notifempty = true
-create = true
+offline = true
+
+[slap-parameters]
+recipe = slapos.cookbook:slapconfiguration
+computer = $${slap-connection:computer-id}
+partition = $${slap-connection:partition-id}
+url = $${slap-connection:server-url}
+key = $${slap-connection:key-file}
+cert = $${slap-connection:cert-file}
+
+[jinja2-template-base]
+recipe = slapos.recipe.template:jinja2
+rendered = $${buildout:directory}/$${:filename}
+extra-context =
+context =
+    import json_module json
+    key eggs_directory buildout:eggs-directory
+    key develop_eggs_directory buildout:develop-eggs-directory
+    key slap_software_type slap-parameters:slap-software-type
+    key slapparameter_dict slap-parameters:configuration
+    key slave_instance_list slap-parameters:slave-instance-list
+    $${:extra-context}
+
+[switch-softwaretype]
+recipe = slapos.cookbook:softwaretype
+default = $${dynamic-template-apache-replicate:rendered}
+custom-personal = $${dynamic-template-apache-replicate:rendered}
+custom-group = $${dynamic-template-apache-replicate:rendered}
+single-default = ${template-apache-frontend:output}
+single-custom-personal = ${template-apache-frontend:output}
+single-custom-group = ${template-apache-frontend:output}
+replicate = $${dynamic-template-apache-replicate:rendered}
+
+[dynamic-template-apache-replicate]
+< = jinja2-template-base
+template = ${template-apache-replicate:target}
+filename = instance-apache-replicate.cfg
+extensions = jinja2.ext.do
+extra-context =
+    raw template_publish_slave_information ${template-replicate-publish-slave-information:target}
+# Must match the key id in [switch-softwaretype] which uses this section.
+    raw software_type RootSoftwareInstance-default-custom-personal-custom-group-replicate

software/apache-frontend/software.cfg

@@ -18,6 +18,15 @@ slapos.recipe.template = 2.4.2
 slapos.toolbox = 0.34.0
 smmap = 0.8.2
 z3c.recipe.scripts = 1.0.1
+cliff = 1.4.4
+cmd2 = 0.6.5.1
+prettytable = 0.7.2
+requests = 1.2.3
+slapos.cookbook = 0.82
+
+# Required by:
+# slapos.cookbook==0.82
+lock-file = 2.0
 
 # Required by:
 # slapos.core==0.35.1
@@ -37,17 +46,17 @@ atomize = 0.1.1
 feedparser = 5.1.3
 
 # Required by:
-# slapos.cookbook==0.77.1
+# slapos.cookbook==0.82
 inotifyx = 0.2.0
 
 # Required by:
-# slapos.cookbook==0.77.1
+# slapos.cookbook==0.82
 # slapos.core==0.35.1
 # xml-marshaller==0.9.7
 lxml = 3.1.2
 
 # Required by:
-# slapos.cookbook==0.77.1
+# slapos.cookbook==0.82
 netaddr = 0.7.10
 
 # Required by:
@@ -67,11 +76,11 @@ psutil = 0.7.0
 pyflakes = 0.7
 
 # Required by:
-# slapos.cookbook==0.77.1
+# slapos.cookbook==0.82
 pytz = 2013b
 
 # Required by:
-# slapos.cookbook==0.77.1
+# slapos.cookbook==0.82
 # slapos.core==0.35.1
 # slapos.toolbox==0.34.0
 # zc.buildout==1.6.0-dev-SlapOS-010
@@ -79,7 +88,7 @@ pytz = 2013b
 setuptools = 0.6c12dev-r88846
 
 # Required by:
-# slapos.cookbook==0.77.1
+# slapos.cookbook==0.82
 # slapos.toolbox==0.34.0
 slapos.core = 0.35.1
 
@@ -92,7 +101,7 @@ supervisor = 3.0b1
 unittest2 = 0.5.1
 
 # Required by:
-# slapos.cookbook==0.77.1
+# slapos.cookbook==0.82
 # slapos.toolbox==0.34.0
 xml-marshaller = 0.9.7
 
@@ -102,10 +111,54 @@ zope.interface = 4.0.5
 
 [networkcache]
 # signature certificates of the following uploaders.
-#   Cedric de Saint Martin
 #   Romain Courteaud
-#   Test Agent
+#   Sebastien Robin
+#   Kazuhiko Shiozaki
+#   Cedric de Saint Martin
+#   Yingjie Xu
+#   Gabriel Monnerat
+#   Łukasz Nowak
+#   Test Agent (Automatic update from tests)
 signature-certificate-list =
+  -----BEGIN CERTIFICATE-----
+  MIIB4DCCAUkCADANBgkqhkiG9w0BAQsFADA5MQswCQYDVQQGEwJGUjEZMBcGA1UE
+  CBMQRGVmYXVsdCBQcm92aW5jZTEPMA0GA1UEChMGTmV4ZWRpMB4XDTExMDkxNTA5
+  MDAwMloXDTEyMDkxNTA5MDAwMlowOTELMAkGA1UEBhMCRlIxGTAXBgNVBAgTEERl
+  ZmF1bHQgUHJvdmluY2UxDzANBgNVBAoTBk5leGVkaTCBnzANBgkqhkiG9w0BAQEF
+  AAOBjQAwgYkCgYEApYZv6OstoqNzxG1KI6iE5U4Ts2Xx9lgLeUGAMyfJLyMmRLhw
+  boKOyJ9Xke4dncoBAyNPokUR6iWOcnPHtMvNOsBFZ2f7VA28em3+E1JRYdeNUEtX
+  Z0s3HjcouaNAnPfjFTXHYj4um1wOw2cURSPuU5dpzKBbV+/QCb5DLheynisCAwEA
+  ATANBgkqhkiG9w0BAQsFAAOBgQBCZLbTVdrw3RZlVVMFezSHrhBYKAukTwZrNmJX
+  mHqi2tN8tNo6FX+wmxUUAf3e8R2Ymbdbn2bfbPpcKQ2fG7PuKGvhwMG3BlF9paEC
+  q7jdfWO18Zp/BG7tagz0jmmC4y/8akzHsVlruo2+2du2freE8dK746uoMlXlP93g
+  QUUGLQ==
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB8jCCAVugAwIBAgIJAPu2zchZ2BxoMA0GCSqGSIb3DQEBBQUAMBIxEDAOBgNV
+  BAMMB3RzeGRldjMwHhcNMTExMDE0MTIxNjIzWhcNMTIxMDEzMTIxNjIzWjASMRAw
+  DgYDVQQDDAd0c3hkZXYzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrPbh+
+  YGmo6mWmhVb1vTqX0BbeU0jCTB8TK3i6ep3tzSw2rkUGSx3niXn9LNTFNcIn3MZN
+  XHqbb4AS2Zxyk/2tr3939qqOrS4YRCtXBwTCuFY6r+a7pZsjiTNddPsEhuj4lEnR
+  L8Ax5mmzoi9nE+hiPSwqjRwWRU1+182rzXmN4QIDAQABo1AwTjAdBgNVHQ4EFgQU
+  /4XXREzqBbBNJvX5gU8tLWxZaeQwHwYDVR0jBBgwFoAU/4XXREzqBbBNJvX5gU8t
+  LWxZaeQwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA07q/rKoE7fAda
+  FED57/SR00OvY9wLlFEF2QJ5OLu+O33YUXDDbGpfUSF9R8l0g9dix1JbWK9nQ6Yd
+  R/KCo6D0sw0ZgeQv1aUXbl/xJ9k4jlTxmWbPeiiPZEqU1W9wN5lkGuLxV4CEGTKU
+  hJA/yXa1wbwIPGvX3tVKdOEWPRXZLg==
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB7jCCAVegAwIBAgIJAJWA0jQ4o9DGMA0GCSqGSIb3DQEBBQUAMA8xDTALBgNV
+  BAMMBHg2MXMwIBcNMTExMTI0MTAyNDQzWhgPMjExMTEwMzExMDI0NDNaMA8xDTAL
+  BgNVBAMMBHg2MXMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANdJNiFsRlkH
+  vq2kHP2zdxEyzPAWZH3CQ3Myb3F8hERXTIFSUqntPXDKXDb7Y/laqjMXdj+vptKk
+  3Q36J+8VnJbSwjGwmEG6tym9qMSGIPPNw1JXY1R29eF3o4aj21o7DHAkhuNc5Tso
+  67fUSKgvyVnyH4G6ShQUAtghPaAwS0KvAgMBAAGjUDBOMB0GA1UdDgQWBBSjxFUE
+  RfnTvABRLAa34Ytkhz5vPzAfBgNVHSMEGDAWgBSjxFUERfnTvABRLAa34Ytkhz5v
+  PzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAFLDS7zNhlrQYSQO5KIj
+  z2RJe3fj4rLPklo3TmP5KLvendG+LErE2cbKPqnhQ2oVoj6u9tWVwo/g03PMrrnL
+  KrDm39slYD/1KoE5kB4l/p6KVOdeJ4I6xcgu9rnkqqHzDwI4v7e8/D3WZbpiFUsY
+  vaZhjNYKWQf79l6zXfOvphzJ
+  -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
   MIIB9jCCAV+gAwIBAgIJAO4V/jiMoICoMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
   BAMMCENPTVAtMjMyMCAXDTEyMDIxNjExMTAyM1oYDzIxMTIwMTIzMTExMDIzWjAT
@@ -120,17 +173,43 @@ signature-certificate-list =
   If1a2ZoqHRxoNo2yTmm7TSYRORWVS+vvfjY=
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
-  MIIB4DCCAUkCADANBgkqhkiG9w0BAQsFADA5MQswCQYDVQQGEwJGUjEZMBcGA1UE
-  CBMQRGVmYXVsdCBQcm92aW5jZTEPMA0GA1UEChMGTmV4ZWRpMB4XDTExMDkxNTA5
-  MDAwMloXDTEyMDkxNTA5MDAwMlowOTELMAkGA1UEBhMCRlIxGTAXBgNVBAgTEERl
-  ZmF1bHQgUHJvdmluY2UxDzANBgNVBAoTBk5leGVkaTCBnzANBgkqhkiG9w0BAQEF
-  AAOBjQAwgYkCgYEApYZv6OstoqNzxG1KI6iE5U4Ts2Xx9lgLeUGAMyfJLyMmRLhw
-  boKOyJ9Xke4dncoBAyNPokUR6iWOcnPHtMvNOsBFZ2f7VA28em3+E1JRYdeNUEtX
-  Z0s3HjcouaNAnPfjFTXHYj4um1wOw2cURSPuU5dpzKBbV+/QCb5DLheynisCAwEA
-  ATANBgkqhkiG9w0BAQsFAAOBgQBCZLbTVdrw3RZlVVMFezSHrhBYKAukTwZrNmJX
-  mHqi2tN8tNo6FX+wmxUUAf3e8R2Ymbdbn2bfbPpcKQ2fG7PuKGvhwMG3BlF9paEC
-  q7jdfWO18Zp/BG7tagz0jmmC4y/8akzHsVlruo2+2du2freE8dK746uoMlXlP93g
-  QUUGLQ==
+  MIIB9jCCAV+gAwIBAgIJAIlBksrZVkK8MA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMzU3MCAXDTEyMDEyNjEwNTUyOFoYDzIxMTIwMTAyMTA1NTI4WjAT
+  MREwDwYDVQQDDAhDT01QLTM1NzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  ts+iGUwi44vtIfwXR8DCnLtHV4ydl0YTK2joJflj0/Ws7mz5BYkxIU4fea/6+VF3
+  i11nwBgYgxQyjNztgc9u9O71k1W5tU95yO7U7bFdYd5uxYA9/22fjObaTQoC4Nc9
+  mTu6r/VHyJ1yRsunBZXvnk/XaKp7gGE9vNEyJvPn2bkCAwEAAaNQME4wHQYDVR0O
+  BBYEFKuGIYu8+6aEkTVg62BRYaD11PILMB8GA1UdIwQYMBaAFKuGIYu8+6aEkTVg
+  62BRYaD11PILMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAMoTRpBxK
+  YLEZJbofF7gSrRIcrlUJYXfTfw1QUBOKkGFFDsiJpEg4y5pUk1s5Jq9K3SDzNq/W
+  it1oYjOhuGg3al8OOeKFrU6nvNTF1BAvJCl0tr3POai5yXyN5jlK/zPfypmQYxE+
+  TaqQSGBJPVXYt6lrq/PRD9ciZgKLOwEqK8w=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAPHoWu90gbsgMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+  BAMMCXZpZmlibm9kZTAeFw0xMjAzMTkyMzIwNTVaFw0xMzAzMTkyMzIwNTVaMBQx
+  EjAQBgNVBAMMCXZpZmlibm9kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  ozBijpO8PS5RTeKTzA90vi9ezvv4vVjNaguqT4UwP9+O1+i6yq1Y2W5zZxw/Klbn
+  oudyNzie3/wqs9VfPmcyU9ajFzBv/Tobm3obmOqBN0GSYs5fyGw+O9G3//6ZEhf0
+  NinwdKmrRX+d0P5bHewadZWIvlmOupcnVJmkks852BECAwEAAaNQME4wHQYDVR0O
+  BBYEFF9EtgfZZs8L2ZxBJxSiY6eTsTEwMB8GA1UdIwQYMBaAFF9EtgfZZs8L2ZxB
+  JxSiY6eTsTEwMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAc43YTfc6
+  baSemaMAc/jz8LNLhRE5dLfLOcRSoHda8y0lOrfe4lHT6yP5l8uyWAzLW+g6s3DA
+  Yme/bhX0g51BmI6gjKJo5DoPtiXk/Y9lxwD3p7PWi+RhN+AZQ5rpo8UfwnnN059n
+  yDuimQfvJjBFMVrdn9iP6SfMjxKaGk6gVmI=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAMNZBmoIOXPBMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMTMyMCAXDTEyMDUwMjEyMDQyNloYDzIxMTIwNDA4MTIwNDI2WjAT
+  MREwDwYDVQQDDAhDT01QLTEzMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  6peZQt1sAmMAmSG9BVxxcXm8x15kE9iAplmANYNQ7z2YO57c10jDtlYlwVfi/rct
+  xNUOKQtc8UQtV/fJWP0QT0GITdRz5X/TkWiojiFgkopza9/b1hXs5rltYByUGLhg
+  7JZ9dZGBihzPfn6U8ESAKiJzQP8Hyz/o81FPfuHCftsCAwEAAaNQME4wHQYDVR0O
+  BBYEFNuxsc77Z6/JSKPoyloHNm9zF9yqMB8GA1UdIwQYMBaAFNuxsc77Z6/JSKPo
+  yloHNm9zF9yqMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAl4hBaJy1
+  cgiNV2+Z5oNTrHgmzWvSY4duECOTBxeuIOnhql3vLlaQmo0p8Z4c13kTZq2s3nhd
+  Loe5mIHsjRVKvzB6SvIaFUYq/EzmHnqNdpIGkT/Mj7r/iUs61btTcGUCLsUiUeci
+  Vd0Ozh79JSRpkrdI8R/NRQ2XPHAo+29TT70=
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
   MIIB9jCCAV+gAwIBAgIJAKRvzcy7OH0UMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV

software/apache-frontend/templates/000.conf.in

+<VirtualHost *:{{ https_port }}>
+  ServerName www.example.org
+  SSLEngine on
+  SSLProxyEngine on
+  SSLProtocol -ALL +SSLv3 +TLSv1
+  SSLHonorCipherOrder On
+  SSLCipherSuite RC4-SHA:HIGH:!ADH
+
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+
+
+  ErrorDocument 404 /notfound.html
+
+</VirtualHost>
+
+<VirtualHost *:{{ http_port }}>
+
+  ServerName www.example.org
+  ErrorDocument 404 /notfound.html
+</VirtualHost>
\ No newline at end of file

software/apache-frontend/templates/apache-custom-slave-list.cfg.in

+{% if software_type == slap_software_type -%}
+
+{% set cached_server_dict = {} -%}
+{% set part_list = [] -%}
+{% set cache_access = "http://%s:%s" % (local_ipv4, cache_port) -%}
+{% set generic_instance_parameter_dict = {'cache_access': cache_access,} -%}
+{% if extra_slave_instance_list -%}
+{%   set slave_instance_information_list = []-%}
+{%   set slave_instance_list = slave_instance_list + json_module.loads(extra_slave_instance_list) -%}
+{% endif -%}
+[jinja2-template-base]
+recipe = slapos.recipe.template:jinja2
+rendered = {{ apache_configuration_directory }}/${:filename}
+extra-context =
+context =
+    key eggs_directory buildout:eggs-directory
+    key develop_eggs_directory buildout:develop-eggs-directory
+    ${:extra-context}
+
+# Loop trhought slave list to set up slaves
+{% for slave_instance in slave_instance_list -%}
+{%   set slave_reference = slave_instance.get('slave_reference') -%}
+{%   set slave_section_title = 'dynamic-template-slave-instance-%s' % slave_reference -%}
+{%   set slave_parameter_dict = generic_instance_parameter_dict.copy() -%}
+{%   do part_list.append(slave_section_title) -%}
+# Set Up log files
+{%   do slave_parameter_dict.__setitem__('access_log', '/'.join([apache_log_directory, '%s_access_log' % slave_reference])) -%}
+{%   do slave_parameter_dict.__setitem__('error_log', '/'.join([apache_log_directory, '%s_error_log' % slave_reference])) -%}
+# Set up apache configuration file for slave
+[{{ slave_section_title }}]
+< = jinja2-template-base
+template = {{ template_slave_configuration }}
+filename = {{ '%s.conf' % slave_reference }}
+extra-context =
+    key apache_custom_https {{ 'slave-instance-%s-configuration:apache_custom_https' % slave_reference }}
+    key apache_custom_http {{ 'slave-instance-%s-configuration:apache_custom_http' % slave_reference }}
+    raw https_port {{ https_port }}
+    raw http_port {{ http_port }}
+{{ '\n' }}
+
+# Set ssl certificates for each slave
+{%   for cert_name in ('ssl_key', 'ssl_crt', 'ssl_ca_crt', 'ssl_csr')-%}
+{%     if cert_name in slave_instance -%}
+{%       set cert_title = '%s-%s' % (slave_reference, cert_name.replace('ssl_', '')) -%}
+{%       set cert_file = '/'.join([custom_ssl_directory, cert_title.replace('-','.')]) -%}
+{%       do part_list.append(cert_title) -%}
+{%       do slave_parameter_dict.__setitem__(cert_name, cert_file) -%}
+# Store certificates on fs
+[{{ cert_title }}]
+< = jinja2-template-base
+template = {{ empty_template }}
+rendered = {{ cert_file }}
+extra-context =
+    key content {{ cert_title + '-config:value' }}
+# Store certificate in config
+[{{ cert_title + '-config' }}]
+value = {{ dumps(slave_instance.get(cert_name)) }}
+{%     endif -%}
+{%   endfor -%}
+
+# Set apache configuration value for slave
+[{{ ('slave-instance-%s-configuration' % slave_reference) }}]
+{% set apache_custom_http = ((slave_instance.get('apache_custom_http', '')) % slave_parameter_dict) -%}
+{% set apache_custom_https = ((slave_instance.get('apache_custom_https', '')) % slave_parameter_dict) -%}
+apache_custom_http = {{ dumps(apache_custom_http) }}
+apache_custom_https = {{ dumps(apache_custom_https) }}
+{{ '\n' }}
+
+# The slave use cache
+{%   if 'enable_cache' in slave_instance and 'url' in slave_instance and 'domain' in slave_instance -%}
+{%     do cached_server_dict.__setitem__(slave_instance.get('domain'), slave_instance.get('url')) -%}
+{%   endif -%}
+
+# Publish slave information
+{%   if not extra_slave_instance_list -%}
+{%     set publish_section_title = 'publish-%s-connection-information' % slave_instance.get('slave_reference') -%}
+{%     do part_list.append(publish_section_title) -%}
+[{{ publish_section_title }}]
+recipe = slapos.cookbook:publish
+public-ipv4 = {{ public_ipv4 }}
+-slave-reference = {{ slave_instance.get('slave_reference') }}
+{%   else -%}
+{%     do slave_instance_information_list.append({'slave-reference':slave_instance.get('slave_reference'), 'public-ipv4':public_ipv4}) -%}
+{%   endif -%}
+{% endfor -%}
+
+# Publish information for the instance
+{% set publish_section_title = 'publish-apache-information' -%}
+{% do part_list.append(publish_section_title) -%}
+[{{ publish_section_title }}]
+recipe = slapos.cookbook:publish
+public-ipv4 = {{ public_ipv4 }}
+private-ipv4 = {{ local_ipv4 }}
+{% if extra_slave_instance_list -%}
+slave-instance-information-list = {{ json_module.dumps(slave_instance_information_list) }}
+{% endif -%}
+
+{% do part_list.append('cached-rewrite-rules') -%}
+[cached-rewrite-rules]
+< = jinja2-template-base
+template = {{ template_rewrite_cached }}
+rendered = {{ rewrite_cached_configuration }}
+extra-context =
+    import json_module json
+    key server_dict rewrite-rules:rules
+
+[rewrite-rules]
+rules = {{ dumps(cached_server_dict) }}
+
+[buildout]
+parts +=
+{% for part in part_list -%}
+{{ '    %s' % part }}
+{% endfor -%}
+
+eggs-directory = {{ eggs_directory }}
+develop-eggs-directory = {{ develop_eggs_directory }}
+offline = true
+cache-access = {{ cache_access }}
+
+{% endif -%}

software/apache-frontend/templates/apache-default-slave-list.cfg.in

+{% if slap_software_type in software_type  -%}
+
+{% set cached_server_dict = {} -%}
+{% set part_list = [] -%}
+{% set cache_access = "http://%s:%s" % (local_ipv4, cache_port) -%}
+{% set TRUE_VALUES = ['y', 'yes', '1', 'true'] -%}
+{% set generic_instance_parameter_dict = {'cache_access': cache_access,} -%}
+{% if extra_slave_instance_list -%}
+{%   set slave_instance_information_list = []-%}
+{%   set slave_instance_list = slave_instance_list + json_module.loads(extra_slave_instance_list) -%}
+{% endif -%}
+[jinja2-template-base]
+recipe = slapos.recipe.template:jinja2
+rendered = {{ apache_configuration_directory }}/${:filename}
+extra-context =
+context =
+    key eggs_directory buildout:eggs-directory
+    key develop_eggs_directory buildout:develop-eggs-directory
+    ${:extra-context}
+
+# Go throught slave list to set their configuration
+{% for slave_instance in slave_instance_list -%}
+{%   set slave_reference = slave_instance.get('slave_reference') -%}
+{%   set slave_section_title = 'dynamic-template-slave-instance-%s' % slave_reference -%}
+{%   set slave_parameter_dict = generic_instance_parameter_dict.copy() -%}
+# Set slave domain if none was defined
+{%   if slave_instance.get('domain', None) == None -%}
+# Backward compatibility
+{%     if slave_instance.get('custom_domain', None) != None -%}
+{%       do slave_instance.__setitem__('domain', slave_instance.get('custom_domain') )-%}
+{%     else -%}
+{%       do slave_instance.__setitem__('domain', "%s.%s" % (slave_instance.get('slave_reference').replace("-", "").lower(), domain)) -%}
+{%     endif -%}
+{%   endif -%}
+# Set personal log, two per slave
+{%   set access_log = '/'.join([apache_log_directory, '%s_access_log' % slave_reference]) -%}
+{%   set error_log = '/'.join([apache_log_directory, '%s_error_log' % slave_reference]) -%}
+# The slave use cache
+# Next line is forbidden and people who copy it will be hanged short
+{%   set enable_cache = ('' ~ slave_instance.get('enable_cache', '')).lower() in TRUE_VALUES -%}
+{%   if enable_cache -%}
+{%     do cached_server_dict.__setitem__(slave_instance.get('domain'), slave_instance.get('url')) -%}
+{%     do slave_instance.__setitem__('url', cache_access) -%}
+{%   endif -%}
+{%   do part_list.append(slave_section_title) -%}
+# Set up slave configuration file
+[{{ slave_section_title }}]
+< = jinja2-template-base
+template = {{ template_slave_configuration }}
+filename = {{ '%s.conf' % slave_reference }}
+extensions = jinja2.ext.do
+extra-context =
+    section slave_parameter {{ 'slave-instance-%s-configuration' % slave_reference }}
+    raw domain {{ domain }}
+    raw https_port {{ https_port }}
+    raw http_port {{ http_port }}
+    raw access_log {{ access_log }}
+    raw error_log {{ error_log }}
+{{ '\n' }}
+
+# Set ssl certificates for each slave
+{%   for cert_name in ('ssl_key', 'ssl_crt', 'ssl_ca_crt', 'ssl_csr')-%}
+{%     if cert_name in slave_instance -%}
+{%       set cert_title = '%s-%s' % (slave_reference, cert_name.replace('ssl_', '')) -%}
+{%       set cert_file = '/'.join([custom_ssl_directory, cert_title.replace('-','.')]) -%}
+{%       do part_list.append(cert_title) -%}
+{%       do slave_instance.__setitem__('path_to_' ~ cert_name, cert_file) -%}
+# Store certificates on fs
+[{{ cert_title }}]
+< = jinja2-template-base
+template = {{ empty_template }}
+rendered = {{ cert_file }}
+extra-context =
+    key content {{ cert_title + '-config:value' }}
+# Store certificate in config
+[{{ cert_title + '-config' }}]
+value = {{ dumps(slave_instance.get(cert_name)) }}
+{%     endif -%}
+{%   endfor -%}
+
+# Set apache configuration for slave
+[{{ ('slave-instance-%s-configuration' % slave_reference) }}]
+{%   for key, value in slave_instance.iteritems() -%}
+{{ key }} = {{ dumps(value) }}
+{%   endfor %}
+
+# Publish slave information
+{%   if not extra_slave_instance_list -%}
+{%     set publish_section_title = 'publish-%s-connection-information' % slave_instance.get('slave_reference') -%}
+{%     do part_list.append(publish_section_title) -%}
+[{{ publish_section_title }}]
+recipe = slapos.cookbook:publish
+-slave-reference = {{ slave_instance.get('slave_reference') }}
+public-ipv4 = {{ public_ipv4 }}
+domain = {{ slave_instance.get('domain') }}
+url = http://{{ slave_instance.get('domain') }}
+# Backward compatibility
+site_url = ${:url}
+{%   else -%}
+{%     do slave_instance_information_list.append({'slave-reference':slave_instance.get('slave_reference'), 'public-ipv4':public_ipv4, 'domain':slave_instance.get('domain'), 'url':"http://%s" % slave_instance.get('domain'), 'site_url':"http://%s" % slave_instance.get('domain')}) -%}
+{%   endif -%}
+{% endfor -%}
+
+# Publish information for the instance
+{% set publish_section_title = 'publish-apache-information' -%}
+{% do part_list.append(publish_section_title) -%}
+[{{ publish_section_title }}]
+recipe = slapos.cookbook:publish
+public-ipv4 = {{ public_ipv4 }}
+private-ipv4 = {{ local_ipv4 }}
+domain = {{ domain }}
+{% if extra_slave_instance_list -%}
+slave-instance-information-list = {{ json_module.dumps(slave_instance_information_list) }}
+{% endif -%}
+
+
+{% do part_list.append('cached-rewrite-rules') -%}
+# Set rewrite rules for second apache
+[cached-rewrite-rules]
+< = jinja2-template-base
+template = {{ template_rewrite_cached }}
+rendered = {{ rewrite_cached_configuration }}
+extra-context =
+    import json_module json
+    key server_dict rewrite-rules:rules
+
+# Store Rewrite rules for second apache
+[rewrite-rules]
+rules = {{ dumps(cached_server_dict) }}
+
+# Add parts generated by template
+[buildout]
+parts +=
+{% for part in part_list -%}
+{{ '    %s' % part }}
+{% endfor -%}
+
+eggs-directory = {{ eggs_directory }}
+develop-eggs-directory = {{ develop_eggs_directory }}
+offline = true
+cache-access = {{ cache_access }}
+
+{% endif -%}

software/apache-frontend/templates/apache.conf.in

+# Apache configuration file for Zope
+# Automatically generated
+
+# Basic server configuration
+PidFile "{{ pid_file }}"
+ServerName {{ domain }}
+DocumentRoot {{ document_root }}
+ServerRoot {{ instance_home }}
+
+{% for ip in (ipv4_addr, "[%s]" % ipv6_addr) -%}
+{%   for port in (http_port, https_port) -%}
+{{ "Listen %s:%s" % (ip, port)  }}
+{%   endfor -%}
+{% endfor -%}
+
+ServerAdmin {{ server_admin }}
+DefaultType text/plain
+TypesConfig {{ httpd_home }}/conf/mime.types
+AddType application/x-compress .Z
+AddType application/x-gzip .gz .tgz
+
+# As backend is trusting REMOTE_USER header unset it always
+RequestHeader unset REMOTE_USER
+
+ServerTokens Prod
+
+# Log configuration
+ErrorLog "{{ error_log }}"
+LogLevel info
+# LogFormat "%h %{REMOTE_USER}i %{Host}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+# LogFormat "%h %{REMOTE_USER}i %{Host}i %l %u %t \"%r\" %>s %b" common
+# CustomLog "{{ access_log }}" common
+LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
+CustomLog "{{ access_log }}" combined
+
+<Directory {{ protected_path }}>
+  Order Deny,Allow
+  Allow from {{ access_control_string }}
+</Directory>
+
+<Directory {{ document_root }}>
+  Order Allow,Deny
+  Allow from All
+</Directory>
+
+# List of modules
+#LoadModule unixd_module modules/mod_unixd.so
+#LoadModule access_compat_module modules/mod_access_compat.so
+#LoadModule authz_core_module modules/mod_authz_core.so
+LoadModule authz_host_module  {{ httpd_home }}/modules/mod_authz_host.so
+LoadModule log_config_module  {{ httpd_home }}/modules/mod_log_config.so
+LoadModule deflate_module     {{ httpd_home }}/modules/mod_deflate.so
+LoadModule setenvif_module    {{ httpd_home }}/modules/mod_setenvif.so
+LoadModule version_module     {{ httpd_home }}/modules/mod_version.so
+LoadModule proxy_module       {{ httpd_home }}/modules/mod_proxy.so
+LoadModule proxy_http_module  {{ httpd_home }}/modules/mod_proxy_http.so
+LoadModule ssl_module         {{ httpd_home }}/modules/mod_ssl.so
+LoadModule mime_module        {{ httpd_home }}/modules/mod_mime.so
+LoadModule dav_module         {{ httpd_home }}/modules/mod_dav.so
+LoadModule dav_fs_module      {{ httpd_home }}/modules/mod_dav_fs.so
+LoadModule negotiation_module {{ httpd_home }}/modules/mod_negotiation.so
+LoadModule rewrite_module     {{ httpd_home }}/modules/mod_rewrite.so
+LoadModule headers_module     {{ httpd_home }}/modules/mod_headers.so
+LoadModule cache_module       {{ httpd_home }}/modules/mod_cache.so
+LoadModule mem_cache_module   {{ httpd_home }}/modules/mod_mem_cache.so
+LoadModule antiloris_module   {{ httpd_home }}/modules/mod_antiloris.so
+
+# The following directives modify normal HTTP response behavior to
+# handle known problems with browser implementations.
+BrowserMatch "Mozilla/2" nokeepalive
+BrowserMatch ".*MSIE.*" nokeepalive ssl-unclean-shutdown \
+                        downgrade-1.0 force-response-1.0
+BrowserMatch "RealPlayer 4\.0" force-response-1.0
+BrowserMatch "Java/1\.0" force-response-1.0
+BrowserMatch "JDK/1\.0" force-response-1.0
+# The following directive disables redirects on non-GET requests for
+# a directory that does not include the trailing slash.  This fixes a
+# problem with Microsoft WebFolders which does not appropriately handle
+# redirects for folders with DAV methods.
+# Same deal with Apple's DAV filesystem and Gnome VFS support for DAV.
+BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
+BrowserMatch "MS FrontPage" redirect-carefully
+BrowserMatch "^WebDrive" redirect-carefully
+BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
+BrowserMatch "^gnome-vfs" redirect-carefully
+BrowserMatch "^XML Spy" redirect-carefully
+BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
+
+# Increase IPReadLimit to 10
+<IfModule antiloris_module>
+   # IPReadLimit - Maximum simultaneous connections in READ state per IP address 
+   IPReadLimit {{ slapparameter_dict.get('ip-read-limit', '10') }}
+</IfModule>
+
+# Cache directives
+CacheEnable mem /
+CacheDefaultExpire 3600
+MCacheSize 8192
+MCacheMaxObjectCount 1000
+MCacheMaxObjectSize 8192
+MCacheRemovalAlgorithm LRU
+
+# Deflate
+AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/x-javascript application/javascript
+BrowserMatch ^Mozilla/4 gzip-only-text/html
+BrowserMatch ^Mozilla/4\.0[678] no-gzip
+BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
+
+# SSL Configuration
+SSLCertificateFile {{ login_certificate }}
+SSLCertificateKeyFile {{ login_key }}
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+SSLSessionCache shmcb:/{{ httpd_mod_ssl_cache_directory }}/ssl_scache(512000)
+SSLSessionCacheTimeout  300
+SSLRandomSeed startup /dev/urandom 256
+SSLRandomSeed connect builtin
+SSLProtocol -ALL +SSLv3 +TLSv1
+SSLHonorCipherOrder On
+SSLCipherSuite RC4-SHA:HIGH:!ADH
+<FilesMatch "\.(cgi|shtml|phtml|php)$">
+      SSLOptions +StdEnvVars
+</FilesMatch>
+# Accept proxy to sites using self-signed SSL certificates
+SSLProxyCheckPeerCN off
+SSLProxyCheckPeerExpire off
+
+NameVirtualHost *:{{ http_port }}
+NameVirtualHost *:{{ https_port }}
+include {{ slave_configuration_directory }}/*.conf
\ No newline at end of file

slapos/recipe/apache_frontend/template/apache.conf.in → software/apache-frontend/templates/apache_cached.conf.in

@@ -2,16 +2,16 @@
 # Automatically generated
 
 # Basic server configuration
-PidFile "%(pid_file)s"
-ServerName %(server_name)s
-DocumentRoot %(document_root)s
-ServerRoot %(instance_home)s
+PidFile "{{ pid_file }}"
+ServerName {{ domain }}
+DocumentRoot {{ document_root }}
+ServerRoot {{ instance_home }}
 
-%(listen)s
+{{ "Listen %s:%s" % (ipv4_addr, cached_port)  }}
 
-ServerAdmin %(server_admin)s
+ServerAdmin {{ server_admin }}
 DefaultType text/plain
-TypesConfig %(httpd_home)s/conf/mime.types
+TypesConfig {{ httpd_home }}/conf/mime.types
 AddType application/x-compress .Z
 AddType application/x-gzip .gz .tgz
 
@@ -21,35 +21,45 @@ RequestHeader unset REMOTE_USER
 ServerTokens Prod
 
 # Log configuration
-ErrorLog "%(error_log)s"
+ErrorLog "{{ error_log }}"
 LogLevel info
-LogFormat "%%h %%{REMOTE_USER}i %%{Host}i %%l %%u %%t \"%%r\" %%>s %%b \"%%{Referer}i\" \"%%{User-Agent}i\"" combined
-LogFormat "%%h %%{REMOTE_USER}i %%{Host}i %%l %%u %%t \"%%r\" %%>s %%b" common
-CustomLog "%(access_log)s" common
-
-%(path_enable)s
+# LogFormat "%h %{REMOTE_USER}i %{Host}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+# LogFormat "%h %{REMOTE_USER}i %{Host}i %l %u %t \"%r\" %>s %b" common
+# CustomLog "{{ access_log }}" common
+LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
+CustomLog "{{ access_log }}" combined
+
+<Directory {{ protected_path }}>
+  Order Deny,Allow
+  Allow from {{ access_control_string }}
+</Directory>
+
+<Directory {{ document_root }}>
+  Order Allow,Deny
+  Allow from All
+</Directory>
 
 # List of modules
 #LoadModule unixd_module modules/mod_unixd.so
 #LoadModule access_compat_module modules/mod_access_compat.so
 #LoadModule authz_core_module modules/mod_authz_core.so
-LoadModule authz_host_module  %(httpd_home)s/modules/mod_authz_host.so
-LoadModule log_config_module  %(httpd_home)s/modules/mod_log_config.so
-LoadModule deflate_module     %(httpd_home)s/modules/mod_deflate.so
-LoadModule setenvif_module    %(httpd_home)s/modules/mod_setenvif.so
-LoadModule version_module     %(httpd_home)s/modules/mod_version.so
-LoadModule proxy_module       %(httpd_home)s/modules/mod_proxy.so
-LoadModule proxy_http_module  %(httpd_home)s/modules/mod_proxy_http.so
-LoadModule ssl_module         %(httpd_home)s/modules/mod_ssl.so
-LoadModule mime_module        %(httpd_home)s/modules/mod_mime.so
-LoadModule dav_module         %(httpd_home)s/modules/mod_dav.so
-LoadModule dav_fs_module      %(httpd_home)s/modules/mod_dav_fs.so
-LoadModule negotiation_module %(httpd_home)s/modules/mod_negotiation.so
-LoadModule rewrite_module     %(httpd_home)s/modules/mod_rewrite.so
-LoadModule headers_module     %(httpd_home)s/modules/mod_headers.so
-LoadModule cache_module       %(httpd_home)s/modules/mod_cache.so
-LoadModule mem_cache_module   %(httpd_home)s/modules/mod_mem_cache.so
-LoadModule antiloris_module   %(httpd_home)s/modules/mod_antiloris.so
+LoadModule authz_host_module  {{ httpd_home }}/modules/mod_authz_host.so
+LoadModule log_config_module  {{ httpd_home }}/modules/mod_log_config.so
+LoadModule deflate_module     {{ httpd_home }}/modules/mod_deflate.so
+LoadModule setenvif_module    {{ httpd_home }}/modules/mod_setenvif.so
+LoadModule version_module     {{ httpd_home }}/modules/mod_version.so
+LoadModule proxy_module       {{ httpd_home }}/modules/mod_proxy.so
+LoadModule proxy_http_module  {{ httpd_home }}/modules/mod_proxy_http.so
+LoadModule ssl_module         {{ httpd_home }}/modules/mod_ssl.so
+LoadModule mime_module        {{ httpd_home }}/modules/mod_mime.so
+LoadModule dav_module         {{ httpd_home }}/modules/mod_dav.so
+LoadModule dav_fs_module      {{ httpd_home }}/modules/mod_dav_fs.so
+LoadModule negotiation_module {{ httpd_home }}/modules/mod_negotiation.so
+LoadModule rewrite_module     {{ httpd_home }}/modules/mod_rewrite.so
+LoadModule headers_module     {{ httpd_home }}/modules/mod_headers.so
+LoadModule cache_module       {{ httpd_home }}/modules/mod_cache.so
+LoadModule mem_cache_module   {{ httpd_home }}/modules/mod_mem_cache.so
+LoadModule antiloris_module   {{ httpd_home }}/modules/mod_antiloris.so
 
 # The following directives modify normal HTTP response behavior to
 # handle known problems with browser implementations.
@@ -85,14 +95,28 @@ AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javasc
 BrowserMatch ^Mozilla/4 gzip-only-text/html
 BrowserMatch ^Mozilla/4\.0[678] no-gzip
 BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
-# Make sure proxies don't deliver the wrong content
-Header append Vary User-Agent
 
 # SSL Configuration
-%(ssl_snippet)s
+SSLCertificateFile {{ login_certificate }}
+SSLCertificateKeyFile {{ login_key }}
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+SSLSessionCache shmcb:/{{ httpd_mod_ssl_cache_directory }}/ssl_scache(512000)
+SSLSessionCacheTimeout  300
+SSLRandomSeed startup /dev/urandom 256
+SSLRandomSeed connect builtin
+SSLProtocol -ALL +SSLv3 +TLSv1
+SSLHonorCipherOrder On
+SSLCipherSuite RC4-SHA:HIGH:!ADH
+<FilesMatch "\.(cgi|shtml|phtml|php)$">
+      SSLOptions +StdEnvVars
+</FilesMatch>
+# Accept proxy to sites using self-signed SSL certificates
+SSLProxyCheckPeerCN off
+SSLProxyCheckPeerExpire off
 
-<VirtualHost *:%(https_port)s>
-  SSLEngine on
+# Only accept generic (i.e not Zope) backends on http
+<VirtualHost *:{{ cached_port }}>
   SSLProxyEngine on
   # Rewrite part
   ProxyVia On
@@ -100,68 +124,10 @@ Header append Vary User-Agent
   ProxyTimeout 600
   RewriteEngine On
 
-  # Include configuration file not operated by slapos. This file won't be erased
-  # or changed when slapgrid is ran. It can be freely customized by node admin.
-  Include %(custom_apache_virtualhost_conf)s
-
-  # Define the 3 RewriteMaps (key -> value store): one for Zope, one generic,
-  # one generic https only,
-  # containing: rewritten URL -> original URL (a.k.a VirtualHostBase in Zope)
-  RewriteMap apachemapzope txt:%(apachemapzope_path)s
-  RewriteMap apachemapgeneric txt:%(apachemap_path)s
-  RewriteMap apachemapgenerichttpsonly txt:%(apachemap_httpsonly_path)s
-
-  # Define another RewriteMap for Zope, containing:
-  # rewritten URL -> VirtualHostRoot
-  RewriteMap apachemapzopepath txt:%(apachemapzopepath_path)s
-
-  # First, we check if we have a zope backend server
-  # If so, let's use Virtual Host Daemon rewrite
-  RewriteCond ${apachemapzope:%%{SERVER_NAME}} >""
-  # We suppose that Apache listens to 443 (even indirectly thanks to things like iptables)
-  RewriteRule ^/(.*)$ ${apachemapzope:%%{SERVER_NAME}}/VirtualHostBase/https/%%{SERVER_NAME}:443/${apachemapzopepath:%%{SERVER_NAME}}/VirtualHostRoot/$1 [L,P]
-
-  # If we have generic backend server, let's rewrite without virtual host daemon
-  RewriteCond ${apachemapgeneric:%%{SERVER_NAME}} >""
-  # We suppose that Apache listens to 443 (even indirectly thanks to things like iptables)
-  RewriteRule ^/(.*)$ ${apachemapgeneric:%%{SERVER_NAME}}/$1 [L,P]
-  # Same for https only server
-  RewriteCond ${apachemapgenerichttpsonly:%%{SERVER_NAME}} >""
-  # We suppose that Apache listens to 443 (even indirectly thanks to things like iptables)
-  RewriteRule ^/(.*)$ ${apachemapgenerichttpsonly:%%{SERVER_NAME}}/$1 [L,P]
+  RewriteMap apachemapcached txt:{{ apachecachedmap_path }}
+  RewriteCond ${apachemapcached:%{SERVER_NAME}} >""
+  RewriteRule ^/(.*)$ ${apachemapcached:%{SERVER_NAME}}/$1 [L,P]
 
   # If nothing exist : put a nice error
   ErrorDocument 404 /notfound.html
 </VirtualHost>
-
-
-# Only accept generic (i.e not Zope) backends on http
-<VirtualHost *:%(plain_http_port)s>
-  SSLProxyEngine on
-  # Rewrite part
-  ProxyVia On
-  ProxyPreserveHost On
-  ProxyTimeout 600
-  RewriteEngine On
-
-  # Remove "Secure" from cookies, as backend may be https
-  Header edit Set-Cookie "(?i)^(.+);secure$" "$1"
-
-  # Include configuration file not operated by slapos. This file won't be erased
-  # or changed when slapgrid is ran. It can be freely customized by node admin.
-  Include %(custom_apache_virtualhost_conf)s
-
-  RewriteMap apachemapgeneric txt:%(apachemap_path)s
-  RewriteCond ${apachemapgeneric:%%{SERVER_NAME}} >""
-  RewriteRule ^/(.*)$ ${apachemapgeneric:%%{SERVER_NAME}}/$1 [L,P]
-
-  # Not using HTTPS? Ask that guy over there.
-  # Dummy redirection to https. Note: will work only if https listens
-  # on standard port (443).
-  RewriteRule ^/(.*)$ https://%%{SERVER_NAME}%%{REQUEST_URI}
-</VirtualHost>
-
-
-# Include configuration file not operated by slapos. This file won't be erased
-# or changed when slapgrid is ran. It can be freely customized by node admin.
-Include %(custom_apache_conf)s

software/apache-frontend/templates/apache_cached_rewrite.txt.in

+{% for server_tuple in server_dict.items() -%}
+{{ "%s %s" % server_tuple }}
+{% endfor -%}

software/apache-frontend/templates/default-virtualhost.conf.in

+{% set TRUE_VALUES = ['y', 'yes', '1', 'true'] -%}
+ 
+<VirtualHost *:{{ https_port }}>
+  ServerName {{ slave_parameter.get('domain') }}
+  ServerAlias {{ slave_parameter.get('domain') }}
+
+  SSLEngine on
+  SSLProxyEngine on
+  SSLProtocol -ALL +SSLv3 +TLSv1
+  SSLHonorCipherOrder On
+  SSLCipherSuite RC4-SHA:HIGH:!ADH
+
+{% set ssl_configuration_list = [('SSLCertificateFile', 'path_to_ssl_crt'),
+       			      	 ('SSLCertificateKeyFile', 'path_to_ssl_key'),
+                                 ('SSLCACertificateFile', 'path_to_ssl_ca_crt'),
+                                 ('SSLCertificateChainFile', 'path_to_ssl_ca_crt')] -%}
+
+{% for key, value in ssl_configuration_list -%}
+{%   if value in slave_parameter -%}
+{{ '  %s' % key }} {{ slave_parameter.get(value) }}
+{% endif -%}
+{% endfor -%}
+
+
+  # One Slave two logs
+  ErrorLog "{{ error_log }}"
+  LogLevel info
+  LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
+  CustomLog "{{ access_log }}" combined
+
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+
+{% if slave_parameter.get('type', '') ==  'zope' -%}
+  # First, we check if we have a zope backend server
+  # If so, let's use Virtual Host Daemon rewrite
+  # We suppose that Apache listens to 443 (even indirectly thanks to things like iptables)
+  RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/VirtualHostBase/https/{{ slave_parameter.get('domain', '') }}:443/{{ slave_parameter.get('path', '') }}/VirtualHostRoot/$1 [L,P]
+{% else -%}
+  RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/$1 [L,P]
+{% endif -%}
+</VirtualHost>
+
+<VirtualHost *:{{ http_port }}>
+  ServerName {{ slave_parameter.get('domain') }}
+  ServerAlias {{ slave_parameter.get('domain') }}
+  SSLProxyEngine on
+  # Rewrite part
+  ProxyVia On
+  ProxyPreserveHost On
+  ProxyTimeout 600
+  RewriteEngine On
+
+  # One Slave two logs
+  ErrorLog "{{ error_log }}"
+  LogLevel info
+  LogFormat "%h %l %{REMOTE_USER}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined
+  CustomLog "{{ access_log }}" combined
+
+  # Remove "Secure" from cookies, as backend may be https
+  Header edit Set-Cookie "(?i)^(.+);secure$" "$1"
+
+# Next line is forbidden and people who copy it will be hanged short
+{% set https_only = ('' ~ slave_parameter.get('https-only', '')).lower() in TRUE_VALUES -%}
+{% if https_only -%}
+  # Not using HTTPS? Ask that guy over there.
+  # Dummy redirection to https. Note: will work only if https listens
+  # on standard port (443).
+  RewriteCond     %{SERVER_PORT}  !^{{ https_port }}$
+  RewriteRule     ^/(.*)          https://%{SERVER_NAME}/$1 [NC,R,L]
+{% elif slave_parameter.get('type', '') ==  'zope' -%}
+  # First, we check if we have a zope backend server
+  # If so, let's use Virtual Host Daemon rewrite
+  # We suppose that Apache listens to 80 (even indirectly thanks to things like iptables)
+  RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/VirtualHostBase/http/{{ slave_parameter.get('domain', '') }}:80/{{ slave_parameter.get('path', '') }}/VirtualHostRoot/$1 [L,P]
+{% else -%}
+  RewriteRule ^/(.*)$ {{ slave_parameter.get('url', '') }}/$1 [L,P]
+{% endif -%}
+  # If nothing exist : put a nice error
+#  ErrorDocument 404 /notfound.html
+# Dadiboom
+
+</VirtualHost>

software/apache-frontend/templates/empty.in

+{{ content }}
\ No newline at end of file

software/apache-frontend/templates/replicate-publish-slave-information.cfg.in

+{% set part_list = [] -%}
+{% set slave_information_dict = {} -%}
+
+# regroup slave information from all frontends
+{%- for frontend, slave_list_raw in slave_information.iteritems() -%}
+{%   set slave_list = json_module.loads(slave_list_raw) -%}
+{%   for slave_dict in slave_list -%}
+{%     set slave_reference = slave_dict.pop('slave-reference') %}
+{%     set current_slave_dict = slave_information_dict.get(slave_reference, {}) %}
+{%     do current_slave_dict.update(slave_dict) -%}
+{%     do current_slave_dict.__setitem__(
+            'replication_number',
+            current_slave_dict.get('replication_number', 0) + 1
+            ) -%}
+{%     do slave_information_dict.__setitem__(slave_reference, current_slave_dict) -%}
+{%   endfor -%}
+{% endfor %}
+
+# Publish information for each slave
+{% for slave_reference, slave_information in slave_information_dict.iteritems() %}
+{%   set publish_section_title = 'publish-%s' % slave_reference -%}
+{%   do part_list.append(publish_section_title) -%}
+[{{ publish_section_title }}]
+recipe = slapos.cookbook:publish
+-slave-reference = {{ slave_reference }}
+{%   for key, value in slave_information.iteritems() -%}
+{{ key }} = {{ value }}
+{%   endfor -%}
+{% endfor %}
+
+[buildout]
+parts =
+{% for part in part_list %}
+{{ '  %s' % part }}
+{% endfor %}
+
+eggs-directory = {{ eggs_directory }}
+develop-eggs-directory = {{ develop_eggs_directory }}
+offline = true
\ No newline at end of file

software/apache-frontend/templates/slave-virtualhost.conf.in

+<VirtualHost *:{{ https_port }}>
+{{ apache_custom_https }}
+</VirtualHost>
+
+<VirtualHost *:{{ http_port }}>
+{{ apache_custom_http }}
+</VirtualHost>

software/apache-frontend/templates/squid.conf.jinja2

+refresh_pattern .   0 20% 4320 max-stale=604800
+
+# Dissallow cachemgr access
+http_access deny manager
+
+# Squid service configuration
+http_port {{ ip }}:{{ port }} accel defaultsite={{ ip }}
+
+cache_peer {{ backend_ip }} parent {{ backend_port }} 0 no-query originserver name=backend
+
+acl our_sites port {{ open_port }}
+http_access allow our_sites
+cache_peer_access backend allow our_sites
+cache_peer_access backend deny all
+
+# Drop squid headers
+# via off
+# reply_header_access X-Cache-Lookup deny all
+# reply_header_access X-Squid-Error deny all
+# reply_header_access X-Cache deny all
+
+header_replace X-Forwarded-For
+follow_x_forwarded_for allow all
+forwarded_for on
+
+# Use 1Go of RAM
+cache_mem 1024 MB
+# But do not keep big object in RAM
+maximum_object_size_in_memory 2048 KB
+
+# Log
+access_log {{ access_log_path }}
+cache_log {{ cache_log_path }}
+pid_filename {{ pid_filename_path }}

software/erp5-util-testing/instance.cfg

@@ -39,7 +39,7 @@ environment = environment
 [environment]
 CPPFLAGS = -I${python2.7:location}/include/python2.7 -I${libxml2:location}/include -I${libxslt:location}/include
 LDFLAGS = -L${python2.7:location}/lib -L${libxml2:location}/lib -L${libxslt:location}/lib -L${zlib:location}/lib
-PYTHONPATH = ${python-setuptools:location}
+PYTHONPATH = ${buildout:eggs-directory}/setuptools-${versions:setuptools}-py2.7.egg
 LD_LIBRARY_PATH = ${libxslt:location}/lib:${libxml2:location}/lib:${zlib:location}/lib
 
 [sh-environment]

software/erp5-util-testing/software.cfg

@@ -45,7 +45,7 @@ branch = master
 [template]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg
-md5sum = 6b919dd280d6972afe0f50d389ba5fe6
+md5sum = e8b87313667c944567029c61c9c0bd2e
 output =  ${buildout:directory}/template.cfg
 mode = 640
 
@@ -94,7 +94,7 @@ netifaces = 0.8
 # slapos.core==0.28.5
 # zc.buildout==1.6.0-dev-SlapOS-006
 # zc.recipe.egg==1.3.2
-setuptools = 0.6c12dev-r88846
+setuptools = 0.9.8
 
 # Required by:
 # slapos.cookbook==0.65

software/helloworld/instance.cfg.in

@@ -45,7 +45,9 @@ configuration.name = John Doe
 # Create all needed directories, depending on your needs
 [directory]
 recipe = slapos.cookbook:mkdirectory
-etc = $${buildout:directory}/etc
+home = $${buildout:directory}
+etc = $${:home}/etc
+var = $${:home}/var
 # Executables put here will be started but not monitored (for startup scripts)
 script = $${:etc}/run/
 # Executables put here will be started and monitored (for daemons)
@@ -53,7 +55,8 @@ service = $${:etc}/service
 # Executables put here will be launched after buildout has completed to see
 # if instance is running
 promise = $${:etc}/promise/
-
+# Path of the log directory used by our service (see [hello-world])
+log = $${:var}/log
 
 # Create a simple shell script that will only output your name if you
 # specified it as instance parameter.
@@ -62,9 +65,11 @@ promise = $${:etc}/promise/
 # This recipe will try to "exec" the command-line after separating parameters.
 recipe = slapos.cookbook:wrapper
 # Notice that there is only one $ at ${dash:location}, it is because it comes from the Software Release buildout profile.
-command-line = ${dash:location}/bin/dash -c 'echo "Hello $${instance-parameter:configuration.name}!"; sleep 100000;' 
+command-line = ${dash:location}/bin/dash -c 'echo "Hello $${instance-parameter:configuration.name}, it is $(date)." > $${directory:log}/log.log; sleep 1000000;'
 # Put this shell script in the "etc/service" directory. Every executable of this
-# repository will be started and monitored by supervisord
+# repository will be started and monitored by supervisord. If one service
+# exits/crashes, it will trigger a "bang" and cause run of slapgrid for the
+# instance.
 wrapper-path = $${directory:service}/hello-world
 
 

software/helloworld/software.cfg

@@ -16,15 +16,15 @@ parts =
   slapos-cookbook
 # Call creation of instance.cfg file that will be called for deployment of
 # instance
-  template
+  instance-profile
 
 # Download instance.cfg.in (buildout profile used to deployment of instance),
 # replace all ${foo:bar} parameters by real values, and change $${foo:bar} to
 # ${foo:bar}
-[template]
+[instance-profile]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg.in
 output = ${buildout:directory}/instance.cfg
 # MD5 checksum can be skipped for development (easier to develop), but must be filled for production
-md5sum = 1fc461c00e86485bee77a942f39e3c43
+md5sum = ed94ac99ae1e596c0da5350da6ab6f52
 mode = 0644

software/jio/instance.cfg.in

@@ -39,7 +39,7 @@ environment = environment
 [environment]
 CPPFLAGS = -I${python2.7:location}/include/python2.7 -I${libxml2:location}/include -I${libxslt:location}/include
 LDFLAGS = -L${python2.7:location}/lib -L${libxml2:location}/lib -L${libxslt:location}/lib -L${zlib:location}/lib -L${fontconfig:location}/lib -L${libexpat:location}/lib -L${freetype:location}/lib
-PYTHONPATH = ${python-setuptools:location}
+PYTHONPATH = ${python-setuptools:pythonpath}
 LD_LIBRARY_PATH = ${libxslt:location}/lib:${libxml2:location}/lib:${zlib:location}/lib:${fontconfig:location}/lib:${libexpat:location}/lib:${freetype:location}/lib
 
 [phantomjs-wrapper]

software/jio/software.cfg

@@ -30,7 +30,7 @@ recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg.in
 output = ${buildout:directory}/instance.cfg
 # MD5 checksum can be skipped for development, but must be filled for production
-md5sum = fa9193534c44717eaad226b552523932
+md5sum = fa50ec507dafffedd1c7367195d4e214
 mode = 0644
 
 [jio-repository]
@@ -88,7 +88,7 @@ pytz = 2013b
 # supervisor==3.0b1
 # zc.buildout==1.6.0-dev-SlapOS-010
 # zope.interface==4.0.5
-setuptools = 0.6c12dev-r88846
+setuptools = 1.4.2
 
 # Required by:
 # slapos.cookbook==0.76.0

software/kvm/README.txt

@@ -16,7 +16,7 @@ The following examples list how to request different possible instances of KVM
 Software Release from slap console or command line.
 
 KVM instance (1GB of RAM, 10GB of SSD, one core)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Note that the KVM instance will try to request a frontend slave instance in order
 to be accessible from IPv4.
@@ -32,22 +32,51 @@ to be accessible from IPv4.
 
 See the instance-kvm-input-schema.json file for more instance parameters (cpu-count, ram-size, disk-size, etc).
 
-NBD instance
+
+KVM instance (1GB of RAM, 10GB of SSD, one core)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-This type of instance will allow to host a disk image that will be used by
-any KVM instance.
+Note that the KVM instance will try to request a frontend slave instance in order
+to be accessible from IPv4.
 
 ::
-  mynbd = request(
+  myawesomekvm = request(
       software_release=kvm,
-      partition_reference="mynbd",
-      software_type="nbd",
+      partition_reference="My awesome KVM",
+      partition_parameter_kw={
+          "nbd-host":"ubuntu-1204.nbd.vifib.net",
+      }
   )
 
+See the instance-kvm-input-schema.json file for more instance parameters (cpu-count, ram-size, disk-size, etc).
+
+Resilient KVM instance
+~~~~~~~~~~~~~~~~~~~~~
+
+Like KVM instance, but backed-up (with history) in two places.
+
+::
+  kvm = 'http://git.erp5.org/gitweb/slapos.git/blob_plain/refs/tags/slapos-0.188:/software/kvm/software.cfg'
+  myresilientkvm = request(
+      software_release=kvm,
+      partition_reference="My resilient KVM",
+      software_type="kvm-resilient",
+      partition_parameter_kw={
+          "-sla-0-computer_guid": "COMP-1000", # Location of the main instance (KVM)
+          "-sla-1-computer_guid": "COMP-1001", # Location of the first clone
+          "-sla-2-computer_guid": "COMP-1002", # Location of the second clone
+      }
+  )
+
+See the instance-kvm-input-schema.json AND instance-kvm-resilient-input-schema.json AND /stack/resilient/README.txt
+files for more instance parameters (cpu-count, ram-size, disk-size, specific location of clones, etc).
+
+Then, if you want one of the two clones to takeover, you need to login into
+the hosting machine, go to the partition of the clone, and invoke bin/takeover.
+
 
 KVM Frontend Master Instance (will host all frontend Slave Instances)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 This type of instance will allow to host any frontend slave instance requested
 by KVM instances. Slave instances (and thus KVM instance) will be accessible

software/kvm/common.cfg

@@ -21,6 +21,7 @@ parts =
 
 # XXX: we have to manually add this for resilience
   rdiff-backup
+  collective.recipe.template-egg
 
 #XXX-Cedric : Currently, one can only access to KVM using noVNC.
 #             Ideally one should be able to access KVM by using either NoVNC or VNC.
@@ -79,30 +80,33 @@ command =
 [template]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg.in
-#md5sum = bdd0495ef729e7272ec9c97aca919c09
+md5sum = bc5a986c7208d02d3284a897ea90b39d
 output = ${buildout:directory}/template.cfg
 mode = 0644
 
 [template-kvm]
-recipe = slapos.recipe.template
-url = ${:_profile_base_location_}/instance-kvm.cfg.in
-#md5sum = c3c888c78bbff334135be9e8ad5885a9
-output = ${buildout:directory}/template-kvm.cfg
-mode = 0644
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/instance-kvm.cfg.jinja2
+mode = 644
+md5sum = e16c15f72fdeb92ce1854bc25daf5ad7
+download-only = true
+on-update = true
 
 [template-kvm-resilient]
 recipe = hexagonit.recipe.download
 url = ${:_profile_base_location_}/instance-kvm-resilient.cfg.jinja2
 mode = 644
-md5sum = 6753004b582c0470bd028253ce1964ad
+md5sum = a07c96b53fe9145278cd64a3b27a459a
 download-only = true
+on-update = true
 
 [template-kvm-resilient-test]
 recipe = hexagonit.recipe.download
 url = ${:_profile_base_location_}/instance-kvm-resilient-test.cfg.jinja2
-md5sum = 027d68d9decbc6aec59365fa723975d7
+md5sum = b4894680283d3912df4e9740f3e7848b
 mode = 0644
 download-only = true
+on-update = true
 
 [template-kvm-import]
 recipe = slapos.recipe.template
@@ -115,22 +119,23 @@ mode = 0644
 recipe = hexagonit.recipe.download
 url = ${:_profile_base_location_}/template/kvm-import.sh.in
 filename = kvm-import.sh.in
-md5sum = a731372420dc59c0b5ba7bc5f39a14ad
+md5sum = e03ed049cddd8d157228b09e1ebc071a
 download-only = true
 mode = 0755
 
 [template-kvm-export]
-recipe = slapos.recipe.template
-url = ${:_profile_base_location_}/instance-kvm-export.cfg.in
-md5sum = 64a1a505aff9fde52afac46240811047
-output = ${buildout:directory}/template-kvm-export.cfg
-mode = 0644
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/instance-kvm-export.cfg.jinja2
+mode = 644
+md5sum = 900f416956903fa4858e67e93b5169a1
+download-only = true
+on-update = true
 
 [template-kvm-export-script]
 recipe = hexagonit.recipe.download
 url = ${:_profile_base_location_}/template/kvm-export.sh.in
 filename = kvm-export.sh.in
-md5sum = 3e878b3343c76f0d6950986fffcb6a8c
+md5sum = 95fde96f35cbf90d677c44d18b60fafb
 download-only = true
 mode = 0755
 
@@ -147,4 +152,3 @@ url = ${:_profile_base_location_}/instance-frontend.cfg.in
 md5sum = cdb690495e9eb007d2b7d2f8e12f5c59
 output = ${buildout:directory}/template-frontend.cfg
 mode = 0644
-

software/kvm/instance-kvm-export.cfg.in → software/kvm/instance-kvm-export.cfg.jinja2

 [buildout]
-extends = ${template-kvm:output}
-          ${pbsready-export:output}
+extends =
+  {{ kvm_template }}
+  {{ pbsready_export_template }}
 
 parts +=
   cron-entry-backup
 
   certificate-authority
   publish-connection-information
-  kvm-promise
+  kvm-vnc-promise
+  kvm-disk-image-corruption-promise
   websockify-sighandler
   novnc-promise
   cron
@@ -16,12 +18,12 @@ parts +=
 # Create the exporter executable, which is a simple shell script
 [exporter]
 recipe = slapos.recipe.template
-url = ${template-kvm-export-script:location}/${template-kvm-export-script:filename}
-output = $${directory:bin}/$${slap-parameter:namebase}-exporter
+url = {{ template_kvm_export }}
+output = ${directory:bin}/${slap-parameter:namebase}-exporter
 mode = 0755
-backup-disk-path = $${directory:backup}/virtual.qcow2
+backup-disk-path = ${directory:backup}/virtual.qcow2
 # Resilient stack wants a "wrapper" parameter
-wrapper = $${:output}
+wrapper = ${:output}
 
 # Extends publish section with resilient parameters
 [publish-connection-information]

software/kvm/instance-kvm-input-schema.json

@@ -78,7 +78,6 @@
       "description": "MD5 checksum of virtual hard drive, used if virtual-hard-drive-url is specified.",
       "type": "string",
     },
-virtual-hard-drive-md5sum
 
     "use-tap": {
       "title": "Use QEMU TAP network interface",

software/kvm/instance-kvm-resilient-input-schema.json

+{
+  "type": "object",
+  "$schema": "http://json-schema.org/draft-04/schema",
+  "items": {
+      "allOf": [
+          {
+              "$ref": "instance-kvm-input-schema.json"
+          }
+      ],
+  "title": "Input Parameters",
+  "properties": {
+    "-sla-0-computer_guid": {
+      "title": "Target computer for main instance",
+      "description": "Target computer GUID for main instance.",
+      "type": "string"
+    },
+    "-sla-1-computer_guid": {
+      "title": "Target computer for first clone",
+      "description": "Target computer for first clone and PBS.",
+      "type": "string"
+    },
+    "-sla-2-computer_guid": {
+      "title": "Target computer for second clone",
+      "description": "Target computer for second clone and PBS.",
+      "type": "string"
+    },
+    "resiliency-backup-periodicity": {
+      "title": "Periodicity of backup",
+      "description": "Periodicity of backup, in cron format.",
+      "type": "string"
+    },
+    "remove-backup-older-than": {
+      "title": "Remove backups older than...",
+      "description": "Remove all the backups in PBS that are older than specified value. It should be rdiff-backup-compatible.",
+      "type": "string",
+      "default": "3B"
+    }
+  }
+}

software/kvm/instance-kvm-resilient-test.cfg.jinja2

@@ -7,6 +7,7 @@ offline = true
 parts =
   deploy-resiliency-test
   request-resilient-kvm
+  deploy-standalone-resiliency-test
 
 [directory]
 recipe = slapos.cookbook:mkdirectory
@@ -32,7 +33,7 @@ command-line = {{ bin_directory }}/runResiliencyTest ${:testnode-parameters} ${:
 [deploy-standalone-resiliency-test]
 # Used to manually run the KVM test if we don't have a running testnode.
 recipe = slapos.cookbook:wrapper
-wrapper-path = ${directory:bin}/runStandaloneKVMResiliencyTestSuite
+wrapper-path = ${directory:bin}/runStandaloneResiliencyTestSuite
 command-line = {{ bin_directory }}/runStandaloneResiliencyTest --test-suite-title=kvm ${deploy-resiliency-test:kvm-test-parameters}
 
 [request-resilient-kvm]
@@ -41,16 +42,18 @@ recipe = slapos.cookbook:request
 software-url = ${slap-connection:software-release-url}
 software-type = kvm-resilient
 name = Resilient KVM (Root Instance)
-config = virtual-hard-drive-url virtual-hard-drive-md5sum resiliency-backup-periodicity
+{% set cluster_parameter_dict = slapparameter_dict.get('cluster', {}) -%}
+config = virtual-hard-drive-url virtual-hard-drive-md5sum resiliency-backup-periodicity {{ cluster_parameter_dict.keys() | join(' ') }}
+{% for key, value in cluster_parameter_dict.items() -%}
+config-{{ key }} = {{ dumps(value) }}
+{% endfor -%}
 config-virtual-hard-drive-url = ${slap-parameter:virtual-hard-drive-url}
 config-virtual-hard-drive-md5sum = ${slap-parameter:virtual-hard-drive-md5sum}
-config-resiliency-backup-periodicity = */5
-# We don't use url parameter, but we want it to be there to make sure root instance is ready.
-return = url
+config-resiliency-backup-periodicity = */5 * * * *
 # XXX What to do?
-#sla = instance_guid
-#sla-instance_guid = ${slap-parameter:frontend-instance-guid}
+sla = computer_guid
+sla-computer_guid = ${slap-connection:computer-id}
 
 [slap-parameter]
-virtual-hard-drive-url = https://softinst43236.host.vifib.net/data/public/8e2138.php?dl=true
-virtual-hard-drive-md5sum = de0f10c7c6538e9928879332afd9be7a
+virtual-hard-drive-url = https://softinst43236.host.vifib.net/data/public/fbd4ad.php?dl=true
+virtual-hard-drive-md5sum = 465e1024447997e7b86ee2e5151e031b

software/kvm/instance-kvm-resilient.cfg.jinja2

@@ -12,8 +12,15 @@ offline = true
 parts +=
   {{ parts.replicate("kvm", "3") }}
   publish-connection-informations
+  kvm-frontend-url-promise
+  kvm-backend-url-promise
 
-{{ replicated.replicate("kvm", "3", "kvm-export", "kvm-import") }}
+{{ replicated.replicate("kvm", "3", "kvm-export", "kvm-import", slapparameter_dict=slapparameter_dict) }}
+
+[directory]
+recipe = slapos.cookbook:mkdirectory
+etc = ${buildout:directory}/etc
+promises = ${:etc}/promise
 
 # Bubble down the parameters of the requested instance to the user
 [request-kvm]
@@ -22,10 +29,29 @@ return =
 # Resilient related parameters
   url ssh-public-key ssh-url notification-id ip
 # KVM related parameters
-  backend-url url ipv6
+# XXX: return ALL parameters (like nat rules), through jinja
+  backend-url url
 
 [publish-connection-informations]
 recipe = slapos.cookbook:publish
 backend-url = ${request-kvm:connection-backend-url}
 url = ${request-kvm:connection-url}
-ipv6 = ${request-kvm:connection-ipv6}
+
+[kvm-frontend-url-promise]
+# Check that url parameter is complete
+recipe = collective.recipe.template
+input = inline:#!/bin/sh
+  URL="${request-kvm:connection-url}"
+  if [[ ! "$URL" == https://* ]]; then
+    exit 1
+  fi
+output = ${resilient-directory:promise}/kvm-frontend-url
+mode = 700
+
+[kvm-backend-url-promise]
+# Check that backend url is reachable
+recipe = slapos.cookbook:check_url_available
+path = ${directory:promises}/frontend_promise
+url = ${publish-connection-informations:url}
+dash_path = /bin/sh
+curl_path = {{ curl_executable_location }}

software/kvm/instance-kvm.cfg.in

-#############################
-#
-# Instanciate kvm
-#
-#############################
-[buildout]
-parts =
-  certificate-authority
-  publish-connection-information
-  kvm-promise
-  websockify-sighandler
-  novnc-promise
-#  kvm-monitor
-  cron
-#  cron-entry-monitor
-  frontend-promise
-
-eggs-directory = ${buildout:eggs-directory}
-develop-eggs-directory = ${buildout:develop-eggs-directory}
-offline = true
-
-[directory]
-recipe = slapos.cookbook:mkdirectory
-etc = $${buildout:directory}/etc
-bin = $${buildout:directory}/bin
-srv = $${buildout:directory}/srv
-var = $${buildout:directory}/var
-log = $${:var}/log
-scripts = $${:etc}/run
-services = $${:etc}/service
-promises = $${:etc}/promise
-novnc-conf = $${:etc}/novnc
-run = $${:var}/run
-ca-dir = $${:srv}/ssl
-cron-entries = $${:etc}/cron.d
-crontabs = $${:etc}/crontabs
-cronstamps = $${:etc}/cronstamps
-
-[create-mac]
-recipe = slapos.cookbook:generate.mac
-storage-path = $${directory:srv}/mac
-
-[gen-passwd]
-recipe = slapos.cookbook:generate.password
-storage-path = $${directory:srv}/passwd
-bytes = 8
-
-
-[kvm-instance]
-# XXX-Cedric: change "KVM" recipe to simple "create wrappers". No need for this
-# Specific code. It needs Jinja.
-recipe = slapos.cookbook:kvm
-
-vnc-passwd = $${gen-passwd:passwd}
-
-ipv4 = $${slap-network-information:local-ipv4}
-ipv6 = $${slap-network-information:global-ipv6}
-vnc-ip = $${:ipv4}
-
-vnc-port = 5901
-
-# XXX-Cedric: should be named "default-cdrom-iso"
-default-disk-image = ${debian-amd64-netinst.iso:location}/${debian-amd64-netinst.iso:filename}
-nbd-host = $${slap-parameter:nbd-host}
-nbd-port = $${slap-parameter:nbd-port}
-nbd2-host = $${slap-parameter:nbd2-host}
-nbd2-port = $${slap-parameter:nbd2-port}
-
-tap-interface = $${slap-network-information:network-interface}
-
-disk-path = $${directory:srv}/virtual.qcow2
-disk-size = $${slap-parameter:disk-size}
-disk-type = $${slap-parameter:disk-type}
-
-socket-path = $${directory:var}/qmp_socket
-pid-file-path = $${directory:run}/pid_file
-
-smp-count = $${slap-parameter:cpu-count}
-ram-size = $${slap-parameter:ram-size}
-mac-address = $${create-mac:mac-address}
-
-# XXX-Cedric: should be named runner-wrapper-path and controller-wrapper-path
-runner-path = $${directory:services}/kvm
-controller-path = $${directory:scripts}/kvm_controller
-
-use-tap = $${slap-parameter:use-tap}
-nat-rules = $${slap-parameter:nat-rules}
-6tunnel-wrapper-path = $${directory:services}/6tunnel
-
-virtual-hard-drive-url = $${slap-parameter:virtual-hard-drive-url}
-virtual-hard-drive-md5sum = $${slap-parameter:virtual-hard-drive-md5sum}
-
-shell-path = ${dash:location}/bin/dash
-qemu-path = ${kvm:location}/bin/qemu-system-x86_64
-qemu-img-path = ${kvm:location}/bin/qemu-img
-6tunnel-path = ${6tunnel:location}/bin/6tunnel
-
-
-[kvm-promise]
-recipe = slapos.cookbook:check_port_listening
-path = $${directory:promises}/vnc_promise
-hostname = $${kvm-instance:vnc-ip}
-port = $${kvm-instance:vnc-port}
-
-
-[novnc-instance]
-recipe = slapos.cookbook:novnc
-path = $${ca-novnc:executable}
-ip = $${slap-network-information:global-ipv6}
-port = 6080
-vnc-ip = $${kvm-instance:vnc-ip}
-vnc-port = $${kvm-instance:vnc-port}
-novnc-location = ${noVNC:location}
-websockify-path = ${buildout:directory}/bin/websockify
-ssl-key-path = $${ca-novnc:key-file}
-ssl-cert-path = $${ca-novnc:cert-file}
-
-[websockify-sighandler]
-recipe = slapos.cookbook:signalwrapper
-wrapper-path = $${directory:services}/websockify
-wrapped-path = $${novnc-instance:path}
-
-[certificate-authority]
-recipe = slapos.cookbook:certificate_authority
-openssl-binary = ${openssl:location}/bin/openssl
-ca-dir = $${directory:ca-dir}
-requests-directory = $${cadirectory:requests}
-wrapper = $${directory:services}/certificate_authority
-ca-private = $${cadirectory:private}
-ca-certs = $${cadirectory:certs}
-ca-newcerts = $${cadirectory:newcerts}
-ca-crl = $${cadirectory:crl}
-
-[cadirectory]
-recipe = slapos.cookbook:mkdirectory
-requests = $${directory:ca-dir}/requests/
-private = $${directory:ca-dir}/private/
-certs = $${directory:ca-dir}/certs/
-newcerts = $${directory:ca-dir}/newcerts/
-crl = $${directory:ca-dir}/crl/
-
-[ca-novnc]
-<= certificate-authority
-recipe = slapos.cookbook:certificate_authority.request
-key-file = $${directory:novnc-conf}/novnc.key
-cert-file = $${directory:novnc-conf}/novnc.crt
-executable = $${directory:bin}/novnc
-wrapper = $${directory:bin}/websockify
-
-[novnc-promise]
-recipe = slapos.cookbook:check_port_listening
-path = $${directory:promises}/novnc_promise
-hostname = $${novnc-instance:ip}
-port = $${novnc-instance:port}
-
-
-#[kvm-monitor]
-#recipe = slapos.cookbook:wrapper
-#wrapper-path = $${directory:services}/kvm_monitor
-#command-line = ${buildout:bin-directory}/kvm.monitor.test
-#             $${buildout:directory}/buildout-switch-softwaretype.cfg
-#             $${buildout:directory}/report.xml
-#             -s slap-parameter
-#             -opts disk-size ram-size cpu-count
-
-
-
-#----------------
-#--
-#-- Deploy cron.
-
-[cron]
-recipe = slapos.cookbook:cron
-dcrond-binary = ${dcron:location}/sbin/crond
-cron-entries = $${directory:cron-entries}
-crontabs = $${directory:crontabs}
-cronstamps = $${directory:cronstamps}
-catcher = $${cron-simplelogger:wrapper}
-binary = $${directory:services}/crond
-
-[cron-simplelogger]
-recipe = slapos.cookbook:simplelogger
-wrapper = $${directory:bin}/cron_simplelogger
-log = $${directory:log}/crond.log
-
-
-#[cron-entry-monitor]
-#<= cron
-#recipe = slapos.cookbook:cron.d
-#name = kvm_monitor
-#frequency = 0 0 * * *
-#command = $${kvm-monitor:wrapper-path}
-
-[request-slave-frontend]
-recipe = slapos.cookbook:requestoptional
-software-url = $${slap-parameter:frontend-software-url}
-server-url = $${slap-connection:server-url}
-key-file = $${slap-connection:key-file}
-cert-file = $${slap-connection:cert-file}
-computer-id = $${slap-connection:computer-id}
-partition-id = $${slap-connection:partition-id}
-name = VNC Frontend
-software-type = $${slap-parameter:frontend-software-type}
-slave = true
-config = host port
-config-host = $${novnc-instance:ip}
-config-port = $${novnc-instance:port}
-return = url resource port domainname
-sla = instance_guid
-sla-instance_guid = $${slap-parameter:frontend-instance-guid}
-
-
-[publish-connection-information]
-recipe = slapos.cookbook:publish
-backend-url = https://[$${novnc-instance:ip}]:$${novnc-instance:port}/vnc_auto.html?host=[$${novnc-instance:ip}]&port=$${novnc-instance:port}&encrypt=1&password=$${kvm-instance:vnc-passwd}
-url = $${request-slave-frontend:connection-url}/vnc_auto.html?host=$${request-slave-frontend:connection-domainname}&port=$${request-slave-frontend:connection-port}&encrypt=1&path=$${request-slave-frontend:connection-resource}&password=$${kvm-instance:vnc-passwd}
-ipv6 = $${slap-network-information:global-ipv6}
-
-[frontend-promise]
-recipe = slapos.cookbook:check_url_available
-path = $${directory:promises}/frontend_promise
-url = $${publish-connection-information:url}
-dash_path = ${dash:location}/bin/dash
-curl_path = ${curl:location}/bin/curl
-
-[slap-parameter]
-# Default values if not specified
-frontend-software-type = frontend
-frontend-software-url = http://git.erp5.org/gitweb/slapos.git/blob_plain/refs/tags/slapos-0.92:/software/kvm/software.cfg
-frontend-instance-guid =
-nbd-port = 1024
-nbd-host =
-nbd2-port = 1024
-nbd2-host =
-
-ram-size = 1024
-disk-size = 10
-disk-type = virtio
-
-cpu-count = 1
-
-nat-rules = 22 80 443
-use-tap = False
-
-virtual-hard-drive-url =
-virtual-hard-drive-md5sum =

software/kvm/instance-kvm.cfg.jinja2

+#############################
+#
+# Instanciate kvm
+#
+#############################
+[buildout]
+parts =
+  certificate-authority
+  publish-connection-information
+  kvm-vnc-promise
+  kvm-disk-image-corruption-promise
+  websockify-sighandler
+  novnc-promise
+#  kvm-monitor
+  cron
+#  cron-entry-monitor
+  frontend-promise
+
+eggs-directory = {{ eggs_directory }}
+develop-eggs-directory = {{ develop_eggs_directory }}
+offline = true
+
+[directory]
+recipe = slapos.cookbook:mkdirectory
+etc = ${buildout:directory}/etc
+bin = ${buildout:directory}/bin
+srv = ${buildout:directory}/srv
+var = ${buildout:directory}/var
+log = ${:var}/log
+scripts = ${:etc}/run
+services = ${:etc}/service
+promises = ${:etc}/promise
+novnc-conf = ${:etc}/novnc
+run = ${:var}/run
+ca-dir = ${:srv}/ssl
+cron-entries = ${:etc}/cron.d
+crontabs = ${:etc}/crontabs
+cronstamps = ${:etc}/cronstamps
+
+[create-mac]
+recipe = slapos.cookbook:generate.mac
+storage-path = ${directory:srv}/mac
+
+[gen-passwd]
+recipe = slapos.cookbook:generate.password
+storage-path = ${directory:srv}/passwd
+bytes = 8
+
+
+[kvm-instance]
+# XXX-Cedric: change "KVM" recipe to simple "create wrappers". No need for this
+# Specific code. It needs Jinja.
+recipe = slapos.cookbook:kvm
+
+vnc-passwd = ${gen-passwd:passwd}
+
+ipv4 = ${slap-network-information:local-ipv4}
+ipv6 = ${slap-network-information:global-ipv6}
+vnc-ip = ${:ipv4}
+
+vnc-port = 5901
+
+# XXX-Cedric: should be named "default-cdrom-iso"
+default-disk-image = {{ debian_amd64_netinst_location }}
+nbd-host = ${slap-parameter:nbd-host}
+nbd-port = ${slap-parameter:nbd-port}
+nbd2-host = ${slap-parameter:nbd2-host}
+nbd2-port = ${slap-parameter:nbd2-port}
+
+tap-interface = ${slap-network-information:network-interface}
+
+disk-path = ${directory:srv}/virtual.qcow2
+disk-size = ${slap-parameter:disk-size}
+disk-type = ${slap-parameter:disk-type}
+
+socket-path = ${directory:var}/qmp_socket
+pid-file-path = ${directory:run}/pid_file
+
+smp-count = ${slap-parameter:cpu-count}
+ram-size = ${slap-parameter:ram-size}
+mac-address = ${create-mac:mac-address}
+
+# XXX-Cedric: should be named runner-wrapper-path and controller-wrapper-path
+runner-path = ${directory:services}/kvm
+controller-path = ${directory:scripts}/kvm_controller
+
+use-tap = ${slap-parameter:use-tap}
+nat-rules = ${slap-parameter:nat-rules}
+6tunnel-wrapper-path = ${directory:services}/6tunnel
+
+virtual-hard-drive-url = ${slap-parameter:virtual-hard-drive-url}
+virtual-hard-drive-md5sum = ${slap-parameter:virtual-hard-drive-md5sum}
+
+shell-path = {{ dash_executable_location }}
+qemu-path =  {{ qemu_executable_location }}
+qemu-img-path = {{ qemu_img_executable_location }}
+6tunnel-path = {{ sixtunnel_executable_location }}
+
+
+[kvm-vnc-promise]
+recipe = slapos.cookbook:check_port_listening
+path = ${directory:promises}/vnc_promise
+hostname = ${kvm-instance:vnc-ip}
+port = ${kvm-instance:vnc-port}
+
+[kvm-disk-image-corruption-promise]
+# Check that disk image is not corrupted
+recipe = collective.recipe.template
+input = inline:#!/bin/sh
+  ${kvm-instance:qemu-img-path} check ${kvm-instance:disk-path}
+output = ${directory:promises}/kvm-disk-image-corruption
+mode = 700
+
+
+[novnc-instance]
+recipe = slapos.cookbook:novnc
+path = ${ca-novnc:executable}
+ip = ${slap-network-information:global-ipv6}
+port = 6080
+vnc-ip = ${kvm-instance:vnc-ip}
+vnc-port = ${kvm-instance:vnc-port}
+novnc-location = {{ novnc_location }}
+websockify-path = {{ websockify_executable_location }}
+ssl-key-path = ${ca-novnc:key-file}
+ssl-cert-path = ${ca-novnc:cert-file}
+
+[websockify-sighandler]
+recipe = slapos.cookbook:signalwrapper
+wrapper-path = ${directory:services}/websockify
+wrapped-path = ${novnc-instance:path}
+
+[certificate-authority]
+recipe = slapos.cookbook:certificate_authority
+openssl-binary = {{ openssl_executable_location }}
+ca-dir = ${directory:ca-dir}
+requests-directory = ${cadirectory:requests}
+wrapper = ${directory:services}/certificate_authority
+ca-private = ${cadirectory:private}
+ca-certs = ${cadirectory:certs}
+ca-newcerts = ${cadirectory:newcerts}
+ca-crl = ${cadirectory:crl}
+
+[cadirectory]
+recipe = slapos.cookbook:mkdirectory
+requests = ${directory:ca-dir}/requests/
+private = ${directory:ca-dir}/private/
+certs = ${directory:ca-dir}/certs/
+newcerts = ${directory:ca-dir}/newcerts/
+crl = ${directory:ca-dir}/crl/
+
+[ca-novnc]
+<= certificate-authority
+recipe = slapos.cookbook:certificate_authority.request
+key-file = ${directory:novnc-conf}/novnc.key
+cert-file = ${directory:novnc-conf}/novnc.crt
+executable = ${directory:bin}/novnc
+wrapper = ${directory:bin}/websockify
+
+[novnc-promise]
+recipe = slapos.cookbook:check_port_listening
+path = ${directory:promises}/novnc_promise
+hostname = ${novnc-instance:ip}
+port = ${novnc-instance:port}
+
+
+#----------------
+#--
+#-- Deploy cron.
+
+[cron]
+recipe = slapos.cookbook:cron
+dcrond-binary = {{ dcron_executable_location }}
+cron-entries = ${directory:cron-entries}
+crontabs = ${directory:crontabs}
+cronstamps = ${directory:cronstamps}
+catcher = ${cron-simplelogger:wrapper}
+binary = ${directory:services}/crond
+
+[cron-simplelogger]
+recipe = slapos.cookbook:simplelogger
+wrapper = ${directory:bin}/cron_simplelogger
+log = ${directory:log}/crond.log
+
+#----------------
+#--
+#-- Deploy frontend.
+
+[request-slave-frontend]
+recipe = slapos.cookbook:requestoptional
+software-url = ${slap-parameter:frontend-software-url}
+server-url = ${slap-connection:server-url}
+key-file = ${slap-connection:key-file}
+cert-file = ${slap-connection:cert-file}
+computer-id = ${slap-connection:computer-id}
+partition-id = ${slap-connection:partition-id}
+name = VNC Frontend
+software-type = ${slap-parameter:frontend-software-type}
+slave = true
+config = host port
+config-host = ${novnc-instance:ip}
+config-port = ${novnc-instance:port}
+return = url resource port domainname
+sla = instance_guid
+sla-instance_guid = ${slap-parameter:frontend-instance-guid}
+
+[frontend-promise]
+recipe = slapos.cookbook:check_url_available
+path = ${directory:promises}/frontend_promise
+url = ${publish-connection-information:url}
+dash_path = {{ dash_executable_location }}
+curl_path = {{ curl_executable_location }}
+
+
+[publish-connection-information]
+recipe = slapos.cookbook:publish
+backend-url = https://[${novnc-instance:ip}]:${novnc-instance:port}/vnc_auto.html?host=[${novnc-instance:ip}]&port=${novnc-instance:port}&encrypt=1&password=${kvm-instance:vnc-passwd}
+url = ${request-slave-frontend:connection-url}/vnc_auto.html?host=${request-slave-frontend:connection-domainname}&port=${request-slave-frontend:connection-port}&encrypt=1&path=${request-slave-frontend:connection-resource}&password=${kvm-instance:vnc-passwd}
+# Publish NAT port mapping status
+# XXX: hardcoded value from [slap-parameter]
+{% set nat_rule_list = slapparameter_dict.get('nat-rules', '22 80 443') %}
+{% for port in nat_rule_list.split(' ') -%}
+  {% set external_port = 10000 + port|int() -%}
+  nat-rule-port-{{port}} = ${slap-network-information:global-ipv6} : {{external_port}}
+{% endfor -%}
+
+
+[slap-parameter]
+# Default values if not specified
+frontend-software-type = frontend
+frontend-software-url = http://git.erp5.org/gitweb/slapos.git/blob_plain/refs/tags/slapos-0.92:/software/kvm/software.cfg
+frontend-instance-guid =
+nbd-port = 1024
+nbd-host =
+nbd2-port = 1024
+nbd2-host =
+
+ram-size = 1024
+disk-size = 10
+disk-type = virtio
+
+cpu-count = 1
+
+nat-rules = 22 80 443
+use-tap = False
+
+virtual-hard-drive-url =
+virtual-hard-drive-md5sum =

software/kvm/instance.cfg.in

@@ -7,14 +7,14 @@ develop-eggs-directory = ${buildout:develop-eggs-directory}
 
 [switch-softwaretype]
 recipe = slapos.cookbook:softwaretype
-default = ${template-kvm:output}
-kvm = ${template-kvm:output}
+default = $${:kvm}
+kvm = $${dynamic-template-kvm:rendered}
 nbd = ${template-nbd:output}
 frontend = ${template-frontend:output}
 
 kvm-resilient = $${dynamic-template-kvm-resilient:rendered}
 kvm-import = ${template-kvm-import:output}
-kvm-export = ${template-kvm-export:output}
+kvm-export = $${dynamic-template-kvm-export:rendered}
 
 # Used for the test of resiliency. The system wants a "test" software_type.
 test = $${dynamic-template-kvm-resilient-test:rendered}
@@ -30,28 +30,67 @@ url = $${slap-connection:server-url}
 key = $${slap-connection:key-file}
 cert = $${slap-connection:cert-file}
 
+[dynamic-template-kvm]
+recipe = slapos.recipe.template:jinja2
+template = ${template-kvm:location}/instance-kvm.cfg.jinja2
+rendered = $${buildout:directory}/template-kvm.cfg
+extensions = jinja2.ext.do
+context =
+    key develop_eggs_directory buildout:develop-eggs-directory
+    key eggs_directory buildout:eggs-directory
+    key slapparameter_dict slap-configuration:configuration
+    raw curl_executable_location ${curl:location}/bin/curl
+    raw dash_executable_location ${dash:location}/bin/dash
+    raw dcron_executable_location ${dcron:location}/sbin/crond
+    raw debian_amd64_netinst_location ${debian-amd64-netinst.iso:location}/${debian-amd64-netinst.iso:filename}
+    raw novnc_location ${noVNC:location}
+    raw openssl_executable_location ${openssl:location}/bin/openssl
+    raw qemu_executable_location ${kvm:location}/bin/qemu-system-x86_64
+    raw qemu_img_executable_location ${kvm:location}/bin/qemu-img
+    raw sixtunnel_executable_location ${6tunnel:location}/bin/6tunnel
+    raw websockify_executable_location ${buildout:directory}/bin/websockify
+template-parts-destination = ${template-parts:destination}
+template-replicated-destination = ${template-replicated:destination}
+import-list = file parts :template-parts-destination
+              file replicated :template-replicated-destination
+mode = 0644
+
 [dynamic-template-kvm-resilient]
 recipe = slapos.recipe.template:jinja2
 template = ${template-kvm-resilient:location}/instance-kvm-resilient.cfg.jinja2
 rendered = $${buildout:directory}/template-kvm-resilient.cfg
+extensions = jinja2.ext.do
 context =
     key develop_eggs_directory buildout:develop-eggs-directory
     key eggs_directory buildout:eggs-directory
     key slapparameter_dict slap-configuration:configuration
+    raw curl_executable_location ${curl:location}/bin/curl
 template-parts-destination = ${template-parts:destination}
 template-replicated-destination = ${template-replicated:destination}
 import-list = file parts :template-parts-destination
               file replicated :template-replicated-destination
 mode = 0644
 
+[dynamic-template-kvm-export]
+recipe = slapos.recipe.template:jinja2
+template = ${template-kvm-export:location}/instance-kvm-export.cfg.jinja2
+rendered = $${buildout:directory}/template-kvm-export.cfg
+extensions = jinja2.ext.do
+context =
+    key develop_eggs_directory buildout:develop-eggs-directory
+    key eggs_directory buildout:eggs-directory
+    raw kvm_template $${dynamic-template-kvm:rendered}
+    raw template_kvm_export ${template-kvm-export-script:location}/${template-kvm-export-script:filename}
+    raw pbsready_export_template ${pbsready-export:output}
+mode = 0644
+
 [dynamic-template-kvm-resilient-test]
 recipe = slapos.recipe.template:jinja2
 template = ${template-kvm-resilient-test:location}/instance-kvm-resilient-test.cfg.jinja2
 rendered = $${buildout:directory}/template-kvm-resilient-test.cfg
-bin-directory = ${buildout:bin-directory}
 context =
-    key bin_directory dynamic-template-kvm-resilient-test:bin-directory
     key develop_eggs_directory buildout:develop-eggs-directory
     key eggs_directory buildout:eggs-directory
     key slapparameter_dict slap-configuration:configuration
+    raw bin_directory ${buildout:bin-directory}
 mode = 0644

software/kvm/software.cfg

@@ -4,8 +4,13 @@ extends = common.cfg
 [networkcache]
 # signature certificates of the following uploaders.
 #   Romain Courteaud
+#   Sebastien Robin
+#   Kazuhiko Shiozaki
 #   Cedric de Saint Martin
-#   Test Agent
+#   Yingjie Xu
+#   Gabriel Monnerat
+#   Test Agent (Automatic update from tests)
+#   Aurélien Calonne
 signature-certificate-list =
   -----BEGIN CERTIFICATE-----
   MIIB4DCCAUkCADANBgkqhkiG9w0BAQsFADA5MQswCQYDVQQGEwJGUjEZMBcGA1UE
@@ -21,6 +26,32 @@ signature-certificate-list =
   QUUGLQ==
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
+  MIIB8jCCAVugAwIBAgIJAPu2zchZ2BxoMA0GCSqGSIb3DQEBBQUAMBIxEDAOBgNV
+  BAMMB3RzeGRldjMwHhcNMTExMDE0MTIxNjIzWhcNMTIxMDEzMTIxNjIzWjASMRAw
+  DgYDVQQDDAd0c3hkZXYzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrPbh+
+  YGmo6mWmhVb1vTqX0BbeU0jCTB8TK3i6ep3tzSw2rkUGSx3niXn9LNTFNcIn3MZN
+  XHqbb4AS2Zxyk/2tr3939qqOrS4YRCtXBwTCuFY6r+a7pZsjiTNddPsEhuj4lEnR
+  L8Ax5mmzoi9nE+hiPSwqjRwWRU1+182rzXmN4QIDAQABo1AwTjAdBgNVHQ4EFgQU
+  /4XXREzqBbBNJvX5gU8tLWxZaeQwHwYDVR0jBBgwFoAU/4XXREzqBbBNJvX5gU8t
+  LWxZaeQwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA07q/rKoE7fAda
+  FED57/SR00OvY9wLlFEF2QJ5OLu+O33YUXDDbGpfUSF9R8l0g9dix1JbWK9nQ6Yd
+  R/KCo6D0sw0ZgeQv1aUXbl/xJ9k4jlTxmWbPeiiPZEqU1W9wN5lkGuLxV4CEGTKU
+  hJA/yXa1wbwIPGvX3tVKdOEWPRXZLg==
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB7jCCAVegAwIBAgIJAJWA0jQ4o9DGMA0GCSqGSIb3DQEBBQUAMA8xDTALBgNV
+  BAMMBHg2MXMwIBcNMTExMTI0MTAyNDQzWhgPMjExMTEwMzExMDI0NDNaMA8xDTAL
+  BgNVBAMMBHg2MXMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANdJNiFsRlkH
+  vq2kHP2zdxEyzPAWZH3CQ3Myb3F8hERXTIFSUqntPXDKXDb7Y/laqjMXdj+vptKk
+  3Q36J+8VnJbSwjGwmEG6tym9qMSGIPPNw1JXY1R29eF3o4aj21o7DHAkhuNc5Tso
+  67fUSKgvyVnyH4G6ShQUAtghPaAwS0KvAgMBAAGjUDBOMB0GA1UdDgQWBBSjxFUE
+  RfnTvABRLAa34Ytkhz5vPzAfBgNVHSMEGDAWgBSjxFUERfnTvABRLAa34Ytkhz5v
+  PzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAFLDS7zNhlrQYSQO5KIj
+  z2RJe3fj4rLPklo3TmP5KLvendG+LErE2cbKPqnhQ2oVoj6u9tWVwo/g03PMrrnL
+  KrDm39slYD/1KoE5kB4l/p6KVOdeJ4I6xcgu9rnkqqHzDwI4v7e8/D3WZbpiFUsY
+  vaZhjNYKWQf79l6zXfOvphzJ
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
   MIIB9jCCAV+gAwIBAgIJAO4V/jiMoICoMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
   BAMMCENPTVAtMjMyMCAXDTEyMDIxNjExMTAyM1oYDzIxMTIwMTIzMTExMDIzWjAT
   MREwDwYDVQQDDAhDT01QLTIzMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
@@ -34,6 +65,32 @@ signature-certificate-list =
   If1a2ZoqHRxoNo2yTmm7TSYRORWVS+vvfjY=
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAIlBksrZVkK8MA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMzU3MCAXDTEyMDEyNjEwNTUyOFoYDzIxMTIwMTAyMTA1NTI4WjAT
+  MREwDwYDVQQDDAhDT01QLTM1NzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  ts+iGUwi44vtIfwXR8DCnLtHV4ydl0YTK2joJflj0/Ws7mz5BYkxIU4fea/6+VF3
+  i11nwBgYgxQyjNztgc9u9O71k1W5tU95yO7U7bFdYd5uxYA9/22fjObaTQoC4Nc9
+  mTu6r/VHyJ1yRsunBZXvnk/XaKp7gGE9vNEyJvPn2bkCAwEAAaNQME4wHQYDVR0O
+  BBYEFKuGIYu8+6aEkTVg62BRYaD11PILMB8GA1UdIwQYMBaAFKuGIYu8+6aEkTVg
+  62BRYaD11PILMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAMoTRpBxK
+  YLEZJbofF7gSrRIcrlUJYXfTfw1QUBOKkGFFDsiJpEg4y5pUk1s5Jq9K3SDzNq/W
+  it1oYjOhuGg3al8OOeKFrU6nvNTF1BAvJCl0tr3POai5yXyN5jlK/zPfypmQYxE+
+  TaqQSGBJPVXYt6lrq/PRD9ciZgKLOwEqK8w=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAPHoWu90gbsgMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+  BAMMCXZpZmlibm9kZTAeFw0xMjAzMTkyMzIwNTVaFw0xMzAzMTkyMzIwNTVaMBQx
+  EjAQBgNVBAMMCXZpZmlibm9kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  ozBijpO8PS5RTeKTzA90vi9ezvv4vVjNaguqT4UwP9+O1+i6yq1Y2W5zZxw/Klbn
+  oudyNzie3/wqs9VfPmcyU9ajFzBv/Tobm3obmOqBN0GSYs5fyGw+O9G3//6ZEhf0
+  NinwdKmrRX+d0P5bHewadZWIvlmOupcnVJmkks852BECAwEAAaNQME4wHQYDVR0O
+  BBYEFF9EtgfZZs8L2ZxBJxSiY6eTsTEwMB8GA1UdIwQYMBaAFF9EtgfZZs8L2ZxB
+  JxSiY6eTsTEwMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAc43YTfc6
+  baSemaMAc/jz8LNLhRE5dLfLOcRSoHda8y0lOrfe4lHT6yP5l8uyWAzLW+g6s3DA
+  Yme/bhX0g51BmI6gjKJo5DoPtiXk/Y9lxwD3p7PWi+RhN+AZQ5rpo8UfwnnN059n
+  yDuimQfvJjBFMVrdn9iP6SfMjxKaGk6gVmI=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
   MIIB9jCCAV+gAwIBAgIJAKRvzcy7OH0UMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
   BAMMCENPTVAtNzcyMCAXDTEyMDgxMDE1NDI1MVoYDzIxMTIwNzE3MTU0MjUxWjAT
   MREwDwYDVQQDDAhDT01QLTc3MjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
@@ -46,55 +103,74 @@ signature-certificate-list =
   5pW18Ry5Ie7iFK4cQMerZwWPxBodEbAteYlRsI6kePV7Gf735Y1RpuN8qZ2sYL6e
   x2IMeSwJ82BpdEI5niXxB+iT0HxhmR+XaMI=
   -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB+DCCAWGgAwIBAgIJAKGd0vpks6T/MA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+  BAMMCUNPTVAtMTU4NDAgFw0xMzA2MjAxMjE5MjBaGA8yMTEzMDUyNzEyMTkyMFow
+  FDESMBAGA1UEAwwJQ09NUC0xNTg0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+  gQDZTH9etPUC+wMZQ3UIiOwyyCfHsJ+7duCFYjuo1uZrhtDt/fp8qb8qK9ob+df3
+  EEYgA0IgI2j/9jNUEnKbc5+OrfKznzXjrlrH7zU8lKBVNCLzQuqBKRNajZ+UvO8R
+  nlqK2jZCXP/p3HXDYUTEwIR5W3tVCEn/Vda4upTLcPVE5wIDAQABo1AwTjAdBgNV
+  HQ4EFgQU7KXaNDheQWoy5uOU01tn1M5vNkEwHwYDVR0jBBgwFoAU7KXaNDheQWoy
+  5uOU01tn1M5vNkEwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQASmqCU
+  Znbvu6izdicvjuE3aKnBa7G++Fdp2bdne5VCwVbVLYCQWatB+n4crKqGdnVply/u
+  +uZ16u1DbO9rYoKgWqjLk1GfiLw5v86pd5+wZd5I9QJ0/Sbz2vZk5S4ciMIGwArc
+  m711+GzlW5xe6GyH9SZaGOPAdUbI6JTDwLzEgA==
+  -----END CERTIFICATE-----
 
 [versions]
-Werkzeug = 0.9.3
-apache-libcloud = 0.13.0
+Werkzeug = 0.9.4
+apache-libcloud = 0.13.2
 async = 0.6.1
 buildout-versions = 1.7
+collective.recipe.template = 1.10
+erp5.util = 0.4.36
 gitdb = 0.5.4
-itsdangerous = 0.22
+itsdangerous = 0.23
 lxml = 3.2.3
 meld3 = 0.6.10
 plone.recipe.command = 1.1
+psutil = 1.1.1
 pycrypto = 2.6
 rdiff-backup = 1.0.5
-slapos.cookbook = 0.79
+slapos.cookbook = 0.84.2
 slapos.recipe.cmmi = 0.2
 slapos.recipe.download = 1.0.dev-r4053
-slapos.recipe.template = 2.4.2
-slapos.toolbox = 0.35.0
+slapos.toolbox = 0.37.4
 smmap = 0.8.2
 websockify = 0.5.1
 z3c.recipe.scripts = 1.0.1
 
 # Required by:
 # slapos.core==0.35.1
-# slapos.toolbox==0.35.0
+# slapos.toolbox==0.37.4
 Flask = 0.10.1
 
 # Required by:
-# slapos.toolbox==0.35.0
+# slapos.toolbox==0.37.4
 GitPython = 0.3.2.RC1
 
 # Required by:
-# slapos.toolbox==0.35.0
+# slapos.toolbox==0.37.4
 atomize = 0.1.1
 
 # Required by:
-# slapos.toolbox==0.35.0
+# paramiko==1.12.0
+ecdsa = 0.9
+
+# Required by:
+# slapos.toolbox==0.37.4
 feedparser = 5.1.3
 
 # Required by:
-# slapos.cookbook==0.79
+# slapos.cookbook==0.84.2
 inotifyx = 0.2.0-1
 
 # Required by:
-# slapos.cookbook==0.79
+# slapos.cookbook==0.84.2
 lock-file = 2.0
 
 # Required by:
-# slapos.cookbook==0.79
+# slapos.cookbook==0.84.2
 netaddr = 0.7.10
 
 # Required by:
@@ -106,37 +182,33 @@ netifaces = 0.8-1
 numpy = 1.7.1
 
 # Required by:
-# slapos.toolbox==0.35.0
-paramiko = 1.11.0
-
-# Required by:
-# slapos.toolbox==0.35.0
-psutil = 1.0.1
+# slapos.toolbox==0.37.4
+paramiko = 1.12.0
 
 # Required by:
 # slapos.core==0.35.1
 pyflakes = 0.7.3
 
 # Required by:
-# slapos.cookbook==0.79
-pytz = 2013b
+# slapos.cookbook==0.84.2
+pytz = 2013.7
 
 # Required by:
-# slapos.cookbook==0.79
-# slapos.toolbox==0.35.0
+# slapos.cookbook==0.84.2
+# slapos.toolbox==0.37.4
 slapos.core = 0.35.1
 
 # Required by:
 # slapos.core==0.35.1
-supervisor = 3.0b2
+supervisor = 3.0
 
 # Required by:
 # slapos.core==0.35.1
 unittest2 = 0.5.1
 
 # Required by:
-# slapos.cookbook==0.79
-# slapos.toolbox==0.35.0
+# slapos.cookbook==0.84.2
+# slapos.toolbox==0.37.4
 xml-marshaller = 0.9.7
 
 # Required by:

software/kvm/template/kvm-export.sh.in

 #!/bin/bash
 # Create a backup of the disk image of the virtual machine
-QEMU_IMG=${kvm-instance:qemu-img-path}
-SNAPSHOT_NAME=$(date +%s)
-DISK_PATH=${kvm-instance:disk-path}
 BACKUP_PATH=${:backup-disk-path}
+QMP_CLIENT=${buildout:directory}/software_release/bin/qemu-qmp-client
 
 if [ ! -f $DISK_PATH ]; then
   echo "Nothing to backup, disk image doesn't exist yet."
   exit 0;
 fi
 
-$QEMU_IMG snapshot -c $SNAPSHOT_NAME $DISK_PATH
-if [ -f $BACKUP_PATH ]; then
-  rm $BACKUP_PATH
-fi
-$QEMU_IMG convert -f qcow2 -O qcow2 -s $SNAPSHOT_NAME $DISK_PATH $BACKUP_PATH && \
-$QEMU_IMG snapshot -d $SNAPSHOT_NAME $DISK_PATH
+$QMP_CLIENT --socket ${kvm-instance:socket-path} --drive-backup $BACKUP_PATH
+

software/kvm/template/kvm-import.sh.in

@@ -3,5 +3,5 @@ DISK_PATH=${:disk-path}
 BACKUP_PATH=${:backup-disk-path}
 
 # TODO: Use rdiff
-rm $DISK_PATH && \
+rm $DISK_PATH
 cp $BACKUP_PATH $DISK_PATH

software/slapos-in-partition/README.txt

+XXX TODO

software/slapos-in-partition/common.cfg

+[buildout]
+extends =
+  ../../component/apache/buildout.cfg
+  ../../component/bash/buildout.cfg
+  ../../component/dcron/buildout.cfg
+  ../../component/dropbear/buildout.cfg
+  ../../component/gzip/buildout.cfg
+  ../../component/logrotate/buildout.cfg
+  ../../stack/slapos.cfg
+
+parts =
+  instance-profile
+  slapos-cookbook
+  eggs
+
+# Add hosting location of testing version of slapos.core
+find-links +=
+  http://www.nexedi.org/static/packages/source/slapos.core-testing/
+
+[environment]
+recipe = collective.recipe.environment
+
+
+[instance-profile]
+# 3 advantages of using jinja2 for ALL templates:
+# 1/ Explicit scope (pythonic style, we explicitely list what we want to be in the scope)
+# 2/ No troubles between $ and $$ (more simple)
+# 3/ We can explicitely define the path of executables (i.e
+#    in software, define httpd-executable = ${apache:location}/bin/httpd
+#    and in instance, just use httpd-executable without bother where it is actually
+#    (location can change inside of the component, from bin to sbin for example).
+recipe = slapos.recipe.template:jinja2
+template = ${:_profile_base_location_}/instance.cfg.jinja2
+rendered = ${buildout:directory}/instance.cfg
+#md5sum = 4861be4a581686feef9f9edea865d7ee
+mode = 0644
+context =
+    key bin_directory buildout:bin-directory
+    key develop_eggs_directory buildout:develop-eggs-directory
+    key eggs_directory buildout:eggs-directory
+    key path environment:PATH
+    raw httpd_executable ${apache:location}/bin/httpd
+    raw bash_executable ${bash:location}/bin/bash
+    raw dcron_executable ${dcron:location}/sbin/crond
+    raw dropbear_executable ${dropbear:location}/sbin/dropbear
+    raw dropbearkey_executable ${dropbear:location}/bin/dropbearkey
+    raw gzip_executable ${gzip:location}/bin/gzip
+    raw gunzip_executable ${gzip:location}/bin/gunzip
+    raw logrotate_executable ${logrotate:location}/sbin/logrotate
+    raw slapos_configuration_file_template_path ${slapos-configuration-file-template:target}
+    raw httpd_configuration_file_template_path ${httpd-configuration-file-template:target}
+
+[slapos-configuration-file-template]
+# Download the template of slapos.cfg
+recipe = slapos.recipe.download
+url = ${:_profile_base_location_}/template/slapos.cfg.in
+#md5sum = 
+target = ${buildout:directory}/slapos.cfg.in
+mode = 0644
+
+
+[httpd-configuration-file-template]
+# Download the template of httpd.conf
+recipe = slapos.recipe.download
+url = ${:_profile_base_location_}/template/httpd.conf.in
+mode = 0644
+#md5sum = 
+#target = ${
+
+[eggs]
+recipe = zc.recipe.egg
+eggs =
+  collective.recipe.template
+
+# Add slapos.libnetworkcache to path of slapos.core.
+[slapos-cookbook]
+eggs =
+  ${lxml-python:egg}
+  slapos.cookbook
+  cliff
+  hexagonit.recipe.download
+  inotifyx
+  netaddr
+  netifaces
+  requests
+  slapos.core
+  supervisor
+  xml_marshaller
+  pytz
+  slapos.libnetworkcache
+

software/slapos-in-partition/instance.cfg.jinja2

+[buildout]
+parts =
+  slapos-configuration-file
+  cron-entry-slapos
+  slapos-node-status-wrapper
+  slapos-node-format-wrapper-script
+
+  httpd-wrapper
+
+  cron
+  logrotate
+  logrotate-entry-httpd
+  logrotate-entry-slapos
+
+  sshkeys-dropbear
+  dropbear-server-add-authorized-key
+  sshkeys-authority
+  publish-connection-informations
+
+  dropbear-promise
+  httpd-promise
+  slapos-promise
+
+
+eggs-directory = {{ eggs_directory }}
+develop-eggs-directory = {{ develop_eggs_directory }}
+offline = true
+
+[instance-parameter]
+recipe = slapos.cookbook:slapconfiguration
+computer = ${slap_connection:computer_id}
+partition = ${slap_connection:partition_id}
+url = ${slap_connection:server_url}
+key = ${slap_connection:key_file}
+cert = ${slap_connection:cert_file}
+
+configuration.master-url = https://slap.vifib.com
+configuration.authorized-key =
+
+# Create all needed directories
+[directory]
+recipe = slapos.cookbook:mkdirectory
+mode = 0750
+
+etc = ${buildout:directory}/etc/
+var = ${buildout:directory}/var/
+srv = ${buildout:directory}/srv/
+bin = ${buildout:directory}/bin/
+
+sshkeys = ${:srv}/sshkeys
+service = ${:etc}/service/
+script = ${:etc}/run/
+ssh = ${:etc}/ssh/
+log = ${:var}/log/
+run = ${:var}/run/
+backup = ${:srv}/backup/
+promises = ${:etc}/promise/
+
+slapos-partitions-certificate-repository = ${:var}/pki
+software-root = ${:srv}/slapos-software
+instance-root = ${:srv}/slapos-instance
+slapos-log = ${:log}/slapos
+
+{% for i in range(0,10) %}
+slappart{{i}} = ${:instance-root}/slappart{{i}}
+{% endfor %}
+
+cron-entries = ${:etc}/cron.d
+crontabs = ${:etc}/crontabs
+cronstamps = ${:etc}/cronstamps
+
+logrotate-entries = ${:etc}/logrotate.d
+logrotate-backup = ${:backup}/logrotate
+
+httpd-log = ${:log}/httpd
+
+
+########
+# Deploy slapos.cfg, computer certificates and slapos node wrapper
+########
+[slapos-computer-certificate-file]
+recipe = collective.recipe.template
+input = inline:${instance-parameter:configuration.computer-certificate}
+output = ${directory:var}/slapos-computer.crt
+
+[slapos-computer-key-file]
+recipe = collective.recipe.template
+input = inline:${instance-parameter:configuration.computer-key}
+output = ${directory:var}/slapos-computer.key
+
+[computer-definition-file]
+recipe = collective.recipe.template
+input = inline:
+  [computer]
+{% for i in range(0,10|int) %}
+  [partition_{{i}}]
+  address = ${instance-parameter:ipv4-random}/255.255.255.0 ${instance-parameter:ipv6-random}/64
+  pathname = slappart{{i}}
+  user = dummy
+  network_interface = dummy
+{% endfor %}
+output = ${directory:etc}/slapos-computer-definition.cfg
+
+[slapos-configuration-file]
+recipe = slapos.recipe.template
+url = {{ slapos_configuration_file_template_path }}
+output = ${directory:etc}/slapos.cfg
+#md5sum = 4861be4a581686feef9f9edea865d7ee
+software-root = ${directory:software-root}
+instance-root = ${directory:instance-root}
+master-url = ${instance-parameter:configuration.master-url}
+computer-id = ${instance-parameter:configuration.computer-id}
+# XXX should be a parameter
+partition-amount = 10
+computer-definition-file = ${computer-definition-file:output}
+computer-xml = ${directory:var}/slapos.xml
+computer-key-file = ${slapos-computer-key-file:output}
+computer-certificate-file = ${slapos-computer-certificate-file:output}
+certificate-repository-path = ${directory:slapos-partitions-certificate-repository}
+
+[slapos-node-instance-wrapper]
+recipe = slapos.cookbook:wrapper
+command-line = {{ bin_directory }}/slapos node instance --cfg ${slapos-configuration-file:output} --pidfile ${directory:run}/slapos-instance.pid --logfile ${directory:slapos-log}/slapos-instance.log
+wrapper-path = ${directory:bin}/slapos-node-instance
+parameters-extra = true
+
+[slapos-node-software-wrapper]
+recipe = slapos.cookbook:wrapper
+command-line = {{ bin_directory }}/slapos node software --cfg ${slapos-configuration-file:output} --pidfile ${directory:run}/slapos-software.pid --logfile ${directory:slapos-log}/slapos-software.log
+wrapper-path = ${directory:bin}/slapos-node-software
+parameters-extra = true
+
+[slapos-node-report-wrapper]
+recipe = slapos.cookbook:wrapper
+command-line = {{ bin_directory }}/slapos node report --cfg ${slapos-configuration-file:output} --pidfile ${directory:run}/slapos-report.pid --logfile ${directory:slapos-log}/slapos-report.log
+wrapper-path = ${directory:bin}/slapos-node-report
+parameters-extra = true
+
+[slapos-node-status-wrapper]
+recipe = slapos.cookbook:wrapper
+command-line = {{ bin_directory }}/slapos node status --cfg ${slapos-configuration-file:output}
+wrapper-path = ${directory:bin}/slapos-node-status
+parameters-extra = true
+
+[slapos-node-format-wrapper]
+recipe = slapos.cookbook:wrapper
+command-line = {{ bin_directory }}/slapos node format --cfg ${slapos-configuration-file:output} --logfile=${directory:slapos-log}/slapos-node-format.log --now
+wrapper-path = ${directory:bin}/slapos-node-format
+parameters-extra = true
+
+[slapos-node-format-wrapper-script]
+# Create a wrapper of the wrapper in etc/run
+recipe = collective.recipe.template
+input = inline:#!{{ bash_executable }}
+  false
+  while [ ! $? -eq 0 ]; do
+    ${slapos-node-format-wrapper:wrapper-path}
+  done
+output = ${directory:script}/slapos-node-format
+mode = 700
+
+
+#########
+# Deploy some http server to see logs online
+#########
+# XXX could it be something lighter?
+[httpd-configuration-file]
+recipe = slapos.recipe.template
+url = {{ httpd_configuration_file_template_path }}
+output = ${directory:etc}/httpd.conf
+# md5sum =
+listening-ip = ${instance-parameter:ipv6-random}
+listening-port = 8080
+htdocs = ${directory:log}
+pid-file = ${directory:run}/httpd.pid
+access-log = ${directory:httpd-log}/access-log
+error-log = ${directory:httpd-log}/error-log
+document-root = ${directory:log}
+
+# XXX logrotate for httpd
+
+[httpd-wrapper]
+recipe = slapos.cookbook:wrapper
+apache-executable = {{ httpd_executable }}
+command-line = ${:apache-executable} -f ${httpd-configuration-file:output} -DFOREGROUND
+wrapper-path = ${directory:service}/httpd
+# generated parameter containing url to use for other sections
+url = http://[${httpd-configuration-file:listening-ip}]/
+
+
+#########
+# Deploy logrotate
+#########
+[logrotate]
+recipe = slapos.cookbook:logrotate
+# Binaries
+logrotate-binary = {{ logrotate_executable }}
+gzip-binary = {{ gzip_executable }}
+gunzip-binary = {{ gunzip_executable }}
+# Directories
+wrapper = ${directory:bin}/logrotate
+conf = ${directory:etc}/logrotate.conf
+logrotate-entries = ${directory:logrotate-entries}
+backup = ${directory:logrotate-backup}
+state-file = ${directory:srv}/logrotate.status
+
+[logrotate-entry-httpd]
+<= logrotate
+recipe = slapos.cookbook:logrotate.d
+name = httpd
+log = ${httpd-configuration-file:access-log} ${httpd-configuration-file:error-log}
+frequency = daily
+rotate-num = 30
+post = {{ bin_directory }}/killpidfromfile $${apache-configuration:pid-file} SIGUSR1
+sharedscripts = true
+notifempty = true
+create = true
+
+[logrotate-entry-slapos]
+<= logrotate
+recipe = slapos.cookbook:logrotate.d
+name = slapos
+log = ${directory:slapos-log}/*.log
+frequency = daily
+rotate-num = 30
+#post = {{ bin_directory }}/killpidfromfile ${nginx-configuration:pid-file} SIGUSR1
+sharedscripts = true
+notifempty = true
+create = true
+
+###########
+# Deploy cron and configure it
+###########
+[cron-simplelogger]
+recipe = slapos.cookbook:simplelogger
+wrapper = ${directory:bin}/cron_simplelogger
+log = ${directory:log}/crond.log
+
+[cron]
+recipe = slapos.cookbook:cron
+dcrond-binary = {{ dcron_executable }}
+cron-entries = ${directory:cron-entries}
+crontabs = ${directory:crontabs}
+cronstamps = ${directory:cronstamps}
+catcher = ${cron-simplelogger:wrapper}
+binary = ${directory:service}/crond
+
+[cron-entry-slapos]
+recipe = collective.recipe.template
+# Add current PATH to environment, otherwise, gcc is not able to find its own cc1.
+# We don't add it in the top of the script, because dcron disallow it.
+# XXX: maybe it works if we take PATH from instance, not software.
+input = inline:
+  * * * * * PATH={{ path }} ${slapos-node-instance-wrapper:wrapper-path} > /dev/null 2>&1
+  * * * * * PATH={{ path }} ${slapos-node-software-wrapper:wrapper-path} > /dev/null 2>&1
+  * * * * * PATH={{ path }} ${slapos-node-report-wrapper:wrapper-path} > /dev/null 2>&1
+output = ${directory:cron-entries}/slapos
+
+[cron-entry-logrotate]
+<= cron
+recipe = slapos.cookbook:cron.d
+name = logrotate
+frequency = 0 0 * * *
+command = $${logrotate:wrapper}
+
+
+
+# XXX what to do for slapformat?
+
+#########
+# Deploy dropbear (minimalist SSH server)
+#########
+[sshkeys-directory]
+recipe = slapos.cookbook:mkdirectory
+requests = ${directory:sshkeys}/requests/
+keys = ${directory:sshkeys}/keys/
+
+[sshkeys-authority]
+recipe = slapos.cookbook:sshkeys_authority
+request-directory = ${sshkeys-directory:requests}
+keys-directory = ${sshkeys-directory:keys}
+wrapper = ${directory:service}/sshkeys_authority
+keygen-binary = {{ dropbearkey_executable }}
+
+[dropbear-server]
+recipe = slapos.cookbook:dropbear
+host = ${instance-parameter:ipv6-random}
+port = 2222
+home = ${directory:ssh}
+wrapper = ${directory:bin}/raw_sshd
+shell = {{ bash_executable }}
+rsa-keyfile = ${directory:ssh}/server_key.rsa
+dropbear-binary = {{ dropbear_executable }}
+
+[sshkeys-dropbear]
+<= sshkeys-authority
+recipe = slapos.cookbook:sshkeys_authority.request
+name = dropbear
+type = rsa
+executable = ${dropbear-server:wrapper}
+public-key = ${dropbear-server:rsa-keyfile}.pub
+private-key = ${dropbear-server:rsa-keyfile}
+wrapper = ${directory:service}/sshd
+
+[dropbear-server-add-authorized-key]
+<= dropbear-server
+recipe = slapos.cookbook:dropbear.add_authorized_key
+key = ${instance-parameter:configuration.authorized-key}
+
+
+#########
+# Send informations to SlapOS Master
+#########
+[publish-connection-informations]
+recipe = slapos.cookbook:publish
+log-viewer-url = http://[${httpd-configuration-file:listening-ip}]:${httpd-configuration-file:listening-port}
+ssh_command = ssh ${dropbear-server:host} -p ${dropbear-server:port}
+
+#########
+# Deploy promises scripts
+#########
+[dropbear-promise]
+recipe = slapos.cookbook:check_port_listening
+path = ${directory:promises}/dropbear
+hostname = ${dropbear-server:host}
+port = ${dropbear-server:port}
+
+[httpd-promise]
+recipe = slapos.cookbook:check_port_listening
+path = ${directory:promises}/httpd
+hostname = ${httpd-configuration-file:listening-ip}
+port = ${httpd-configuration-file:listening-port}
+
+[slapos-promise]
+recipe = collective.recipe.template
+input = inline:#!/{{ bash_executable }}
+  {{ bin_directory }}/slapgrid-supervisorctl ${slapos-configuration-file:output} status watchdog | grep RUNNING
+output = ${directory:promises}/slapos
+mode = 0700
+

software/slapos-in-partition/software.cfg

+# Production profile of slapos-in-partition
+# Exactly the same as common.cfg, but:
+# 1/ Use a defined set of Python eggs instead of using the latest available
+#    ones from Pypi, to ensure stability;
+# 2/ Define list of trusted certificates for the cache.
+
+[buildout]
+extends = common.cfg
+
+[networkcache]
+# signature certificates of the following uploaders.
+#   Romain Courteaud
+#   Sebastien Robin
+#   Kazuhiko Shiozaki
+#   Cedric de Saint Martin
+#   Yingjie Xu
+#   Gabriel Monnerat
+#   Łukasz Nowak
+#   Test Agent (Automatic update from tests)
+#   Aurélien Calonne
+signature-certificate-list =
+  -----BEGIN CERTIFICATE-----
+  MIIB4DCCAUkCADANBgkqhkiG9w0BAQsFADA5MQswCQYDVQQGEwJGUjEZMBcGA1UE
+  CBMQRGVmYXVsdCBQcm92aW5jZTEPMA0GA1UEChMGTmV4ZWRpMB4XDTExMDkxNTA5
+  MDAwMloXDTEyMDkxNTA5MDAwMlowOTELMAkGA1UEBhMCRlIxGTAXBgNVBAgTEERl
+  ZmF1bHQgUHJvdmluY2UxDzANBgNVBAoTBk5leGVkaTCBnzANBgkqhkiG9w0BAQEF
+  AAOBjQAwgYkCgYEApYZv6OstoqNzxG1KI6iE5U4Ts2Xx9lgLeUGAMyfJLyMmRLhw
+  boKOyJ9Xke4dncoBAyNPokUR6iWOcnPHtMvNOsBFZ2f7VA28em3+E1JRYdeNUEtX
+  Z0s3HjcouaNAnPfjFTXHYj4um1wOw2cURSPuU5dpzKBbV+/QCb5DLheynisCAwEA
+  ATANBgkqhkiG9w0BAQsFAAOBgQBCZLbTVdrw3RZlVVMFezSHrhBYKAukTwZrNmJX
+  mHqi2tN8tNo6FX+wmxUUAf3e8R2Ymbdbn2bfbPpcKQ2fG7PuKGvhwMG3BlF9paEC
+  q7jdfWO18Zp/BG7tagz0jmmC4y/8akzHsVlruo2+2du2freE8dK746uoMlXlP93g
+  QUUGLQ==
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB8jCCAVugAwIBAgIJAPu2zchZ2BxoMA0GCSqGSIb3DQEBBQUAMBIxEDAOBgNV
+  BAMMB3RzeGRldjMwHhcNMTExMDE0MTIxNjIzWhcNMTIxMDEzMTIxNjIzWjASMRAw
+  DgYDVQQDDAd0c3hkZXYzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrPbh+
+  YGmo6mWmhVb1vTqX0BbeU0jCTB8TK3i6ep3tzSw2rkUGSx3niXn9LNTFNcIn3MZN
+  XHqbb4AS2Zxyk/2tr3939qqOrS4YRCtXBwTCuFY6r+a7pZsjiTNddPsEhuj4lEnR
+  L8Ax5mmzoi9nE+hiPSwqjRwWRU1+182rzXmN4QIDAQABo1AwTjAdBgNVHQ4EFgQU
+  /4XXREzqBbBNJvX5gU8tLWxZaeQwHwYDVR0jBBgwFoAU/4XXREzqBbBNJvX5gU8t
+  LWxZaeQwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA07q/rKoE7fAda
+  FED57/SR00OvY9wLlFEF2QJ5OLu+O33YUXDDbGpfUSF9R8l0g9dix1JbWK9nQ6Yd
+  R/KCo6D0sw0ZgeQv1aUXbl/xJ9k4jlTxmWbPeiiPZEqU1W9wN5lkGuLxV4CEGTKU
+  hJA/yXa1wbwIPGvX3tVKdOEWPRXZLg==
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB7jCCAVegAwIBAgIJAJWA0jQ4o9DGMA0GCSqGSIb3DQEBBQUAMA8xDTALBgNV
+  BAMMBHg2MXMwIBcNMTExMTI0MTAyNDQzWhgPMjExMTEwMzExMDI0NDNaMA8xDTAL
+  BgNVBAMMBHg2MXMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANdJNiFsRlkH
+  vq2kHP2zdxEyzPAWZH3CQ3Myb3F8hERXTIFSUqntPXDKXDb7Y/laqjMXdj+vptKk
+  3Q36J+8VnJbSwjGwmEG6tym9qMSGIPPNw1JXY1R29eF3o4aj21o7DHAkhuNc5Tso
+  67fUSKgvyVnyH4G6ShQUAtghPaAwS0KvAgMBAAGjUDBOMB0GA1UdDgQWBBSjxFUE
+  RfnTvABRLAa34Ytkhz5vPzAfBgNVHSMEGDAWgBSjxFUERfnTvABRLAa34Ytkhz5v
+  PzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAFLDS7zNhlrQYSQO5KIj
+  z2RJe3fj4rLPklo3TmP5KLvendG+LErE2cbKPqnhQ2oVoj6u9tWVwo/g03PMrrnL
+  KrDm39slYD/1KoE5kB4l/p6KVOdeJ4I6xcgu9rnkqqHzDwI4v7e8/D3WZbpiFUsY
+  vaZhjNYKWQf79l6zXfOvphzJ
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAO4V/jiMoICoMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMjMyMCAXDTEyMDIxNjExMTAyM1oYDzIxMTIwMTIzMTExMDIzWjAT
+  MREwDwYDVQQDDAhDT01QLTIzMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  wi/3Z8W9pUiegUXIk/AiFDQ0UJ4JFAwjqr+HSRUirlUsHHT+8DzH/hfcTDX1I5BB
+  D1ADk+ydXjMm3OZrQcXjn29OUfM5C+g+oqeMnYQImN0DDQIOcUyr7AJc4xhvuXQ1
+  P2pJ5NOd3tbd0kexETa1LVhR6EgBC25LyRBRae76qosCAwEAAaNQME4wHQYDVR0O
+  BBYEFMDmW9aFy1sKTfCpcRkYnP6zUd1cMB8GA1UdIwQYMBaAFMDmW9aFy1sKTfCp
+  cRkYnP6zUd1cMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAskbFizHr
+  b6d3iIyN+wffxz/V9epbKIZVEGJd/6LrTdLiUfJPec7FaxVCWNyKBlCpINBM7cEV
+  Gn9t8mdVQflNqOlAMkOlUv1ZugCt9rXYQOV7rrEYJBWirn43BOMn9Flp2nibblby
+  If1a2ZoqHRxoNo2yTmm7TSYRORWVS+vvfjY=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAIlBksrZVkK8MA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMzU3MCAXDTEyMDEyNjEwNTUyOFoYDzIxMTIwMTAyMTA1NTI4WjAT
+  MREwDwYDVQQDDAhDT01QLTM1NzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  ts+iGUwi44vtIfwXR8DCnLtHV4ydl0YTK2joJflj0/Ws7mz5BYkxIU4fea/6+VF3
+  i11nwBgYgxQyjNztgc9u9O71k1W5tU95yO7U7bFdYd5uxYA9/22fjObaTQoC4Nc9
+  mTu6r/VHyJ1yRsunBZXvnk/XaKp7gGE9vNEyJvPn2bkCAwEAAaNQME4wHQYDVR0O
+  BBYEFKuGIYu8+6aEkTVg62BRYaD11PILMB8GA1UdIwQYMBaAFKuGIYu8+6aEkTVg
+  62BRYaD11PILMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAMoTRpBxK
+  YLEZJbofF7gSrRIcrlUJYXfTfw1QUBOKkGFFDsiJpEg4y5pUk1s5Jq9K3SDzNq/W
+  it1oYjOhuGg3al8OOeKFrU6nvNTF1BAvJCl0tr3POai5yXyN5jlK/zPfypmQYxE+
+  TaqQSGBJPVXYt6lrq/PRD9ciZgKLOwEqK8w=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAPHoWu90gbsgMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+  BAMMCXZpZmlibm9kZTAeFw0xMjAzMTkyMzIwNTVaFw0xMzAzMTkyMzIwNTVaMBQx
+  EjAQBgNVBAMMCXZpZmlibm9kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  ozBijpO8PS5RTeKTzA90vi9ezvv4vVjNaguqT4UwP9+O1+i6yq1Y2W5zZxw/Klbn
+  oudyNzie3/wqs9VfPmcyU9ajFzBv/Tobm3obmOqBN0GSYs5fyGw+O9G3//6ZEhf0
+  NinwdKmrRX+d0P5bHewadZWIvlmOupcnVJmkks852BECAwEAAaNQME4wHQYDVR0O
+  BBYEFF9EtgfZZs8L2ZxBJxSiY6eTsTEwMB8GA1UdIwQYMBaAFF9EtgfZZs8L2ZxB
+  JxSiY6eTsTEwMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAc43YTfc6
+  baSemaMAc/jz8LNLhRE5dLfLOcRSoHda8y0lOrfe4lHT6yP5l8uyWAzLW+g6s3DA
+  Yme/bhX0g51BmI6gjKJo5DoPtiXk/Y9lxwD3p7PWi+RhN+AZQ5rpo8UfwnnN059n
+  yDuimQfvJjBFMVrdn9iP6SfMjxKaGk6gVmI=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAMNZBmoIOXPBMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMTMyMCAXDTEyMDUwMjEyMDQyNloYDzIxMTIwNDA4MTIwNDI2WjAT
+  MREwDwYDVQQDDAhDT01QLTEzMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  6peZQt1sAmMAmSG9BVxxcXm8x15kE9iAplmANYNQ7z2YO57c10jDtlYlwVfi/rct
+  xNUOKQtc8UQtV/fJWP0QT0GITdRz5X/TkWiojiFgkopza9/b1hXs5rltYByUGLhg
+  7JZ9dZGBihzPfn6U8ESAKiJzQP8Hyz/o81FPfuHCftsCAwEAAaNQME4wHQYDVR0O
+  BBYEFNuxsc77Z6/JSKPoyloHNm9zF9yqMB8GA1UdIwQYMBaAFNuxsc77Z6/JSKPo
+  yloHNm9zF9yqMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAl4hBaJy1
+  cgiNV2+Z5oNTrHgmzWvSY4duECOTBxeuIOnhql3vLlaQmo0p8Z4c13kTZq2s3nhd
+  Loe5mIHsjRVKvzB6SvIaFUYq/EzmHnqNdpIGkT/Mj7r/iUs61btTcGUCLsUiUeci
+  Vd0Ozh79JSRpkrdI8R/NRQ2XPHAo+29TT70=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAKRvzcy7OH0UMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtNzcyMCAXDTEyMDgxMDE1NDI1MVoYDzIxMTIwNzE3MTU0MjUxWjAT
+  MREwDwYDVQQDDAhDT01QLTc3MjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  o7aipd6MbnuGDeR1UJUjuMLQUariAyQ2l2ZDS6TfOwjHiPw/mhzkielgk73kqN7A
+  sUREx41eTcYCXzTq3WP3xCLE4LxLg1eIhd4nwNHj8H18xR9aP0AGjo4UFl5BOMa1
+  mwoyBt3VtfGtUmb8whpeJgHhqrPPxLoON+i6fIbXDaUCAwEAAaNQME4wHQYDVR0O
+  BBYEFEfjy3OopT2lOksKmKBNHTJE2hFlMB8GA1UdIwQYMBaAFEfjy3OopT2lOksK
+  mKBNHTJE2hFlMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAaNRx6YN2
+  M/p3R8/xS6zvH1EqJ3FFD7XeAQ52WuQnKSREzuw0dsw12ClxjcHiQEFioyTiTtjs
+  5pW18Ry5Ie7iFK4cQMerZwWPxBodEbAteYlRsI6kePV7Gf735Y1RpuN8qZ2sYL6e
+  x2IMeSwJ82BpdEI5niXxB+iT0HxhmR+XaMI=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB+DCCAWGgAwIBAgIJAKGd0vpks6T/MA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+  BAMMCUNPTVAtMTU4NDAgFw0xMzA2MjAxMjE5MjBaGA8yMTEzMDUyNzEyMTkyMFow
+  FDESMBAGA1UEAwwJQ09NUC0xNTg0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+  gQDZTH9etPUC+wMZQ3UIiOwyyCfHsJ+7duCFYjuo1uZrhtDt/fp8qb8qK9ob+df3
+  EEYgA0IgI2j/9jNUEnKbc5+OrfKznzXjrlrH7zU8lKBVNCLzQuqBKRNajZ+UvO8R
+  nlqK2jZCXP/p3HXDYUTEwIR5W3tVCEn/Vda4upTLcPVE5wIDAQABo1AwTjAdBgNV
+  HQ4EFgQU7KXaNDheQWoy5uOU01tn1M5vNkEwHwYDVR0jBBgwFoAU7KXaNDheQWoy
+  5uOU01tn1M5vNkEwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQASmqCU
+  Znbvu6izdicvjuE3aKnBa7G++Fdp2bdne5VCwVbVLYCQWatB+n4crKqGdnVply/u
+  +uZ16u1DbO9rYoKgWqjLk1GfiLw5v86pd5+wZd5I9QJ0/Sbz2vZk5S4ciMIGwArc
+  m711+GzlW5xe6GyH9SZaGOPAdUbI6JTDwLzEgA==
+  -----END CERTIFICATE-----
+
+
+[versions]
+slapos.libnetworkcache = 0.13.4
+Jinja2 = 2.7.1
+MarkupSafe = 0.18
+Pygments = 1.6
+Werkzeug = 0.9.4
+buildout-versions = 1.7
+cliff = 1.4.4
+cmd2 = 0.6.5.1
+collective.recipe.environment = 0.2.0
+collective.recipe.template = 1.10
+inotifyx = 0.2.0-1
+itsdangerous = 0.23
+lxml = 3.2.3
+meld3 = 0.6.10
+netaddr = 0.7.10
+netifaces = 0.8-1
+pytz = 2013d
+requests = 1.2.3
+slapos.cookbook = 0.83.1
+slapos.core = 1.0.0rc5
+slapos.recipe.cmmi = 0.2
+slapos.recipe.download = 1.0.dev-r4053
+slapos.recipe.template = 2.5
+supervisor = 3.0
+xml-marshaller = 0.9.7
+
+# Required by:
+# slapos.core==1.0.0rc5
+Flask = 0.10.1
+
+# Required by:
+# slapos.core==1.0.0rc5
+bpython = 0.12
+
+# Required by:
+# slapos.core==1.0.0rc5
+ipython = 1.0.0
+
+# Required by:
+# slapos.cookbook==0.83.1
+lock-file = 2.0
+
+# Required by:
+# slapos.core==1.0.0rc5
+zope.interface = 4.0.5
+

software/slapos-in-partition/template/httpd.conf.in

+# Apache static configuration
+# Automatically generated
+
+# Basic server configuration
+PidFile "${:pid-file}"
+Listen [${:listening-ip}]:${:listening-port}
+ServerAdmin someone@email
+DefaultType text/plain
+TypesConfig conf/mime.types
+AddType application/x-compress .Z
+AddType application/x-gzip .gz .tgz
+
+DocumentRoot "${:document-root}"
+
+# Log configuration
+ErrorLog "${:error-log}"
+LogLevel warn
+LogFormat "%h %{REMOTE_USER}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %{REMOTE_USER}i %l %u %t \"%r\" %>s %b" common
+CustomLog "${:access-log}" common
+
+# Allow cross site scripting
+Header set Access-Control-Allow-Origin "*"
+
+# List of modules
+LoadModule unixd_module modules/mod_unixd.so
+LoadModule access_compat_module modules/mod_access_compat.so
+LoadModule authz_core_module modules/mod_authz_core.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule log_config_module modules/mod_log_config.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule version_module modules/mod_version.so
+LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
+LoadModule mime_module modules/mod_mime.so
+LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule headers_module modules/mod_headers.so
+LoadModule dir_module modules/mod_dir.so
+LoadModule alias_module modules/mod_alias.so
+LoadModule ssl_module modules/mod_ssl.so
+LoadModule autoindex_module modules/mod_autoindex.so
+
+<Directory />
+    Options Indexes FollowSymLinks
+    IndexOptions FancyIndexing
+    order allow,deny
+    Allow from All
+</Directory>
+

software/slapos-in-partition/template/slapos.cfg.in

+[slapos]
+software_root = ${:software-root}
+instance_root = ${:instance-root}
+master_url = ${:master-url}
+
+key_file = ${:computer-key-file}
+cert_file = ${:computer-certificate-file}
+certificate_repository_path = ${:certificate-repository-path}
+
+computer_id = ${:computer-id}
+maximal_delay = 0
+
+# Don't check if we are using root
+root_check = false
+
+[slapformat]
+alter_user = false
+alter_network = false
+input_definition_file = ${:computer-definition-file}
+computer_xml = ${:computer-xml}
+partition_amount = ${:partition-amount}
+create_tap = false
+

software/slapos-testing/instance.cfg

@@ -50,7 +50,7 @@ environment = environment
 CPPFLAGS = -I${python2.7:location}/include/python2.7 -I${libxml2:location}/include -I${libxslt:location}/include
 LDFLAGS = -L${python2.7:location}/lib -L${libxml2:location}/lib -L${libxslt:location}/lib -L${libxslt:location}/lib -L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib -Wl,-rpath=${python2.7:location}/lib -Wl,-rpath=${libxml2:location}/lib -Wl,-rpath=${libxslt:location}/lib -Wl,-rpath=${zlib:location}/lib
 LD_LIBRARY_PATH = ${python2.7:location}/lib:${libxml2:location}/lib:${libxslt:location}/lib:${libxslt:location}/lib:${zlib:location}/lib
-PYTHONPATH = ${python-setuptools:location}
+PYTHONPATH = ${python-setuptools:pythonpath}
 
 [sh-environment]
 # Section exposes testing default environment as sh file. It is thus easy

software/slapos-testing/software.cfg

@@ -61,7 +61,7 @@ branch = master
 [template]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg
-md5sum = 1dba62d737ef76dfac50febd61357041
+md5sum = 7a8be25961238f8e11d5de95d2f05598
 output =  ${buildout:directory}/template.cfg
 mode = 640
 
@@ -98,68 +98,86 @@ signature-certificate-list =
   -----END CERTIFICATE-----
 
 [versions]
-Jinja2 = 2.6
-Werkzeug = 0.8.3
+setuptools = 1.4.2
+Jinja2 = 2.7.1
+MarkupSafe = 0.18
+Pygments = 1.6
+Werkzeug = 0.9.4
 buildout-versions = 1.7
-erp5.util = 0.4.7
-hexagonit.recipe.cmmi = 1.6
-lxml = 2.3.6
-meld3 = 0.6.8
+cmd2 = 0.6.7
+collective.recipe.template = 1.10
+erp5.util = 0.4.36
+itsdangerous = 0.23
+lxml = 3.3.0beta3
+meld3 = 0.6.10
 plone.recipe.command = 1.1
-slapos.cookbook = 0.65
-slapos.libnetworkcache = 0.13.2
-slapos.recipe.build = 0.11.2
-slapos.recipe.download = 1.0.dev-r4053
-slapos.recipe.template = 2.4.2
+psutil = 1.2.1
+pyparsing = 2.0.1
+slapos.cookbook = 0.85
+slapos.recipe.build = 0.12
+slapos.recipe.cmmi = 0.2
+slapos.recipe.template = 2.5
 
 # Required by:
-# slapos.core==0.28.5
-Flask = 0.9
+# slapos.core==1.0.0
+Flask = 0.10.1
 
 # Required by:
-# slapos.cookbook==0.65
-PyXML = 0.8.4
+# slapos.core==1.0.0
+bpython = 0.12
 
 # Required by:
-# hexagonit.recipe.cmmi==1.6
-hexagonit.recipe.download = 1.6nxd002
+# slapos.core==1.0.0
+cliff = 1.5.2
 
 # Required by:
-# slapos.cookbook==0.65
-inotifyx = 0.2.0
+# slapos.cookbook==0.85
+inotifyx = 0.2.0-1
 
 # Required by:
-# slapos.cookbook==0.65
+# slapos.core==1.0.0
+ipython = 1.1.0
+
+# Required by:
+# slapos.cookbook==0.85
+lock-file = 2.0
+
+# Required by:
+# slapos.cookbook==0.85
 netaddr = 0.7.10
 
 # Required by:
-# slapos.core==0.28.5
-netifaces = 0.8
+# slapos.core==1.0.0
+netifaces = 0.8-1
 
 # Required by:
-# erp5.util==0.4.7
-# slapos.cookbook==0.65
-# slapos.core==0.28.5
-# zc.buildout==1.6.0-dev-SlapOS-006
-# zc.recipe.egg==1.3.2
-setuptools = 0.6c12dev-r88846
+# slapos.cookbook==0.85
+pytz = 2013.9
 
 # Required by:
-# slapos.cookbook==0.65
-slapos.core = 0.28.5
+# slapos.core==1.0.0
+requests = 2.1.0
 
 # Required by:
-# slapos.core==0.28.5
-supervisor = 3.0a12
+# cliff==1.5.2
+six = 1.5.2
 
 # Required by:
-# slapos.cookbook==0.65
-xml-marshaller = 0.9.7
+# slapos.cookbook==0.85
+slapos.core = 1.0.0
 
 # Required by:
-# slapos.cookbook==0.65
-zc.recipe.egg = 1.3.2
+# cliff==1.5.2
+stevedore = 0.13
+
+# Required by:
+# slapos.core==1.0.0
+supervisor = 3.0
+
+# Required by:
+# slapos.cookbook==0.85
+xml-marshaller = 0.9.7
 
 # Required by:
-# slapos.core==0.28.5
-zope.interface = 4.0.1
+# slapos.core==1.0.0
+zope.interface = 4.0.5

software/slaprunner/README.txt

@@ -28,3 +28,74 @@ instance-amount
 Optional parameter.
 
 Default: 10
+
+AUTO-DEPLOYMENT
+---------------
+
+You can automatically deploy a software release while deploying the webrunner itself, using the paramater XML.
+
+To do this, you only need to pass as a parameter named "slapos-software" : "AAA/BBB", where AAA is the folder of slapos.git where is located your BBB software.
+For example, to deploy the hello-world software, you need to pass : software/helloworld
+
+This is possible because the slapos.git is automatically downloaded when the webrunner is deployed.
+
+It is also possible to download you own git repository, by providing the url in the "slapos-repository" parameter.
+
+Last but not least, it is also possible to switch the branch with the parameter "slapos-reference" (by default pointing on master)
+
+Resilience :
+------------
+
+To order a resilient runner, you have to request a runner with the option: "--type resilient"
+
+You can then decide on which node you want to deploy each instance, with the parameters.xml :
+	<?xml version='1.0' encoding='utf-8'?>
+	<instance>
+	  <parameter id="-sla-runner2-computer_guid">COMP-XXXX</parameter>
+	  <parameter id="-sla-pbs2-computer_guid">COMP-XXXX</parameter>
+	  <parameter id="-sla-pbs1-computer_guid">COMP-XXXX</parameter>
+	  <parameter id="-sla-runner1-computer_guid">COMP-XXXX</parameter>
+	  <parameter id="-sla-runner0-computer_guid">COMP-XXXX</parameter>
+	</instance>
+
+If you want to check by yourself that the pull-backup instances do their job, you can change directory to the slappart of runner0, and run ./bin/exporter (after creating your account, using the given backend_url or url): it would fill ./srv/backup/runner with data. If you then go to an import instance (runner1 or runner2) on the port 50005, you should be able to sign in the runner.
+
+
+Tips :
+~~~~~
+
+To find in which partition the instance has been deployed, you can open the page of this specific instance, and look for "slappartXX" on the page.
+
+Tests :
+-------
+
+To test the runner, start by ordering a runner with default type. Then READ the important note below :
+
+/!\ IMPORTANT NOTE ON THE TESTS /!\ : in order to make them work, you have to comment the last line of the file __init__.py in the runner module (which is just : "run()"). Indeed, this line is used to load the config, when importing this module throught Gunicorn (the wsgi server). But the test suite loads itself the configuration, in fonction of the tested scenarios, etc... (You can find the module in the SR folder directory, under ./eggs/slapos.toolbox, or under parts/slapos.toolbox if you have a development version)
+
+Then, su in the concerned slapuserX and run "./bin/runTestSuite".
+
+For the tests on the resiliency of the webrunner, please refer to the README in slapos.toolbox.git/slapos/resiliencytest
+
+Request custom frontend :
+-------------------------
+
+While deploying a server in your instance, you may need to ask for a custom ipv4 frontend.
+
+The way to do that is to send a new parameter to your runner instance, using the parameters XML. The name of it is "custom-frontend-backend-url".
+
+To create the frontend, you now have to wait the slaprunner to be processed.
+
+If you deploy a server, which uses basic auth, you also have to declare the parameter "custom-frontend-basic-auth" as true, or your slaprunner instance won't show as correctly instanciated.
+
+Example :
+	<?xml version='1.0' encoding='utf-8'?>
+	<instance>
+	<parameter id="custom-frontend-backend-url">http(s)://[THE_IPV6_ADDRESS]:PORT</parameter>
+	<parameter id="custom-frontend-basic-auth">true</parameter>
+	</instance>
+
+Things to notice for the nex developer :
+----------------------------------------
+
+As you can see in instance-runner-*.cfg, the buildout section extends a hard-coded template file. If one day you need to modify the filename, do not forget to modify it in instance.cfg, but also in these files ! (the problem is that the content of instance.cfg is not known by buildout while the deployment of the software release)

software/slaprunner/TODO.txt

-- Use https to connect to the runner. !!! Critical
 - resilient sr: Cloned instances should not launch slapgrid-sr if it was not launched on export instance
+- shellinabox password should be the same in all the resilient instances

software/slaprunner/common.cfg

 [buildout]
 extends =
   ../../component/bash/buildout.cfg
-  ../../component/cloud9/buildout.cfg
+  ../../component/busybox/buildout.cfg
   ../../component/curl/buildout.cfg
   ../../component/dash/buildout.cfg
+  ../../component/dcron/buildout.cfg
   ../../component/dropbear/buildout.cfg
   ../../component/git/buildout.cfg
+  ../../component/logrotate/buildout.cfg
   ../../component/lxml-python/buildout.cfg
+  ../../component/nano/buildout.cfg
   ../../component/nginx/buildout.cfg
   ../../component/rsync/buildout.cfg
+  ../../component/python-2.7/buildout.cfg
+  ../../component/screen/buildout.cfg
+  ../../component/shellinabox/buildout.cfg
+  ../../component/vim/buildout.cfg
   ../../stack/flask.cfg
   ../../stack/shacache-client.cfg
   ../../stack/resilient/buildout.cfg
   ../../stack/slapos.cfg
 
 parts =
-  rdiff-backup
   template
   eggs
   nginx
-  simple-proxy
-  node-frontend-template
-  http-proxy
-  npm-modules
   instance-runner-import
   instance-runner-export
   slapos-cookbook
-
-####################
-## Node JS proxy
-####################
-[simple-proxy]
-recipe = slapos.recipe.download
-url = ${:_profile_base_location_}/simple-proxy.js
-location = ${buildout:parts-directory}/${:_buildout_section_name_}
-md5sum = 86e2231b3f65587b56d9be63e21a4e05
-filename = simple-proxy.js
-mode = 0644
-
-[node-frontend-template]
-recipe = slapos.recipe.download
-url = ${:_profile_base_location_}/node-frontend.in
-location = ${buildout:parts-directory}/${:_buildout_section_name_}
-filename = node-frontend.in
-md5sum = 72904152860dddb30ca936dac5bbf4cd
-mode = 0644
-
-[http-proxy]
-# https://github.com/nodejitsu/node-http-proxy
-recipe = slapos.recipe.build:download-unpacked
-#XXX-Cedric : use upstream when merged
-url = https://github.com/desaintmartin/node-http-proxy/archive/20120621.zip
-md5sum = 621e5fca448cbea137c5d847d780d84d
-
-[npm-modules]
-recipe = plone.recipe.command
-destination = ${buildout:parts-directory}/${:_buildout_section_name_}
-location = ${buildout:parts-directory}/${:_buildout_section_name_}
-command =
-  export HOME=${:location};
-  rm -fr ${:destination} &&
-  mkdir -p ${:destination} &&
-  cd ${:destination} &&
-  ${nodejs:location}/bin/node ${nodejs:location}/bin/npm install colors@0.6.0-1 &&
-  ${nodejs:location}/bin/node ${nodejs:location}/bin/npm install socket.io@0.8.7 &&
-  ${nodejs:location}/bin/node ${nodejs:location}/bin/npm install socket.io-client@0.8.7 &&
-  ${nodejs:location}/bin/node ${nodejs:location}/bin/npm install optimist@0.3.1 &&
-  ${nodejs:location}/bin/node ${nodejs:location}/bin/npm install pkginfo@0.2.3
+  slapos-cfg-template 
+# XXX: we have to manually add this for resilience
+  rdiff-backup
+  collective.recipe.template-egg
 
 
 [template]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg
 output = ${buildout:directory}/template.cfg
-md5sum = b6ed8c30cc2ec51244796ce57315089f
+md5sum = 8a47421ac6158b4ee476acab212c67d9
 mode = 0644
 
 [template-runner]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-runner.cfg
-output = ${buildout:directory}/template-runner.cfg
-md5sum = 4877c808972b6b04bfac1de94c14a301
+output = ${buildout:directory}/template-runner.cfg.in
+md5sum = b3288126400c4ca8469c255ef130dec9
 mode = 0644
 
 [instance-runner-import]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-runner-import.cfg.in
 output = ${buildout:directory}/instance-runner-import.cfg
-md5sum = f16cb60bb16632e652bea69cd5cdd9b7
+md5sum = 82f2d0be111617eac9849cb7b8baac5d
 mode = 0644
 
 [instance-runner-export]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-runner-export.cfg.in
 output = ${buildout:directory}/instance-runner-export.cfg
-md5sum = 7e71622c09271790b5cef21c8613b8ac
+md5sum = 9a8cdf65bca8a562accb710a7c3b6595
 mode = 0644
 
 [template-resilient]
 recipe = slapos.recipe.download
 url = ${:_profile_base_location_}/instance-resilient.cfg.jinja2
-md5sum = fc253453da66583e7d515a6e2eb1475e
+md5sum = f8758a5a2f886d649ad02157d76550ba
 filename = instance-resilient.cfg.jinja2
 mode = 0644
 
+[template-resilient-test]
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/instance-resilient-test.cfg.jinja2
+download-only = true
+md5sum = b231383bb63edc0009fb6e0ff5c54d8e
+filename = instance-resilient-test.cfg.jinja2
+mode = 0644
+
 [template_nginx_conf]
-recipe = slapos.recipe.download
+recipe = hexagonit.recipe.download
 url = ${:_profile_base_location_}/nginx_conf.in
-md5sum = 09b7677dfc6b23c1f58e67fd06a7625e
+download-only = true
+md5sum = 67d2ce92b4ad6dca6eaf69eeb2c2734c
 filename = nginx_conf.in
 mode = 0644
 
@@ -119,17 +93,49 @@ filename = launcher.in
 mode = 0644
 location = ${buildout:parts-directory}/${:_buildout_section_name_}
 
+[slapos-cfg-template]
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/template/${:filename}
+md5sum = 8207e74c7b97a4a3f3be390ea4f97ae1
+location = ${buildout:parts-directory}/${:_buildout_section_name_}
+filename = slapos.cfg.in 
+download-only = true
+mode = 0644
+
 [eggs]
 recipe = z3c.recipe.scripts
 eggs =
   ${lxml-python:egg}
+  collective.recipe.environment
   cns.recipe.symlink
+  erp5.util
   hexagonit.recipe.download
   inotifyx
   lock-file
   netaddr
+  plone.recipe.command
+  pytz
+  slapos.cookbook
   slapos.libnetworkcache
+  slapos.recipe.build
   slapos.toolbox[flask_auth]
   slapos.core
   xml_marshaller
+  Gunicorn
+
+# Add slapos.libnetworkcache to path of slapos.core so that slaprunner can build SRs using cache
+[slapos-cookbook]
+eggs =
+  ${lxml-python:egg}
+  slapos.cookbook
+  cliff
+  hexagonit.recipe.download
+  inotifyx
+  netaddr
+  netifaces
+  requests
+  slapos.core
+  supervisor
+  xml_marshaller
   pytz
+  slapos.libnetworkcache

software/slaprunner/development.cfg

@@ -11,26 +11,36 @@ extends = common.cfg
 parts +=
   slapos.cookbook-repository
   slapos.toolbox-repository
+  erp5.util-repository
+  check-recipe
 
 #  slapos.core-repository
-#  check-recipe
 
 develop =
-	${:parts-directory}/slapos.toolbox-repository
-	${:parts-directory}/slapos.cookbook-repository
+  ${:parts-directory}/slapos.toolbox-repository
+  ${:parts-directory}/slapos.cookbook-repository
+  ${:parts-directory}/erp5.util-repository
 #  ${:parts-directory}/slapos.core-repository
 
 
 [slapos.toolbox-repository]
 recipe = slapos.recipe.build:gitclone
 repository = http://git.erp5.org/repos/slapos.toolbox.git
-branch = slaprunner-resiliency
+branch = slaprunner-paas
 git-executable = ${git:location}/bin/git
 
 [slapos.cookbook-repository]
 recipe = slapos.recipe.build:gitclone
 repository = http://git.erp5.org/repos/slapos.git
-branch = slaprunner
+branch = slaprunner-paas-test
+git-executable = ${git:location}/bin/git
+
+# Used for resiliency tests only
+[erp5.util-repository]
+recipe = slapos.recipe.build:gitclone
+repository = http://git.erp5.org/repos/erp5.git
+#branch = scalability-master2
+revision = f9a812f4e97ffeed359bc5611366a5c8675ec749
 git-executable = ${git:location}/bin/git
 
 #[slapos.core-repository]
@@ -45,6 +55,7 @@ stop-on-error = true
 update-command = ${:command}
 command =
   grep parts ${buildout:develop-eggs-directory}/slapos.cookbook.egg-link &&
-  grep parts ${buildout:develop-eggs-directory}/slapos.toolbox.egg-link
+  grep parts ${buildout:develop-eggs-directory}/slapos.toolbox.egg-link &&
+  grep parts ${buildout:develop-eggs-directory}/erp5.util.egg-link
 
 #  grep parts ${buildout:develop-eggs-directory}/slapos.core.egg-link &&

software/slaprunner/instance-resilient-test.cfg.jinja2

+[buildout]
+
+eggs-directory = {{ eggs_directory }}
+develop-eggs-directory = {{ develop_eggs_directory }}
+offline = true
+
+parts =
+  deploy-resiliency-test
+  request-resilient-instance
+  deploy-standalone-resiliency-test
+
+[directory]
+recipe = slapos.cookbook:mkdirectory
+home = ${buildout:directory}
+etc = ${:home}/etc/
+var = ${:home}/var/
+srv = ${:home}/srv/
+bin = ${:home}/bin/
+tmp = ${:home}/tmp/
+log = ${:var}/log/
+services = ${:etc}/service/
+scripts = ${:etc}/run/
+
+[deploy-resiliency-test]
+recipe = slapos.cookbook:wrapper
+testnode-parameters = --test-result-path={{ slapparameter_dict.get('test-result-path') }} --revision={{ slapparameter_dict.get('test-suite-revision') }} --node-title={{ slapparameter_dict.get('scalability-launcher-title') }} --test-suite={{ slapparameter_dict.get('test-suite') }} --test-suite-master-url={{ slapparameter_dict.get('test-suite-master-url') }} --log-path=${directory:log}
+test-parameters = server_url=${slap-connection:server-url} key_file=${slap-connection:key-file} cert_file=${slap-connection:cert-file} computer_id=${slap-connection:computer-id} partition_id=${slap-connection:partition-id} software=${slap-connection:software-release-url} namebase=runner slaprunner_rootinstance_name='${request-resilient-instance:name}'
+command-line = {{ bin_directory }}/runResiliencyTest ${:testnode-parameters} ${:test-parameters}
+wrapper-path = ${directory:scripts}/runResiliencyTestSuite
+
+[deploy-standalone-resiliency-test]
+# Used to manually run the resilient test if we don't have a running testnode.
+recipe = slapos.cookbook:wrapper
+test-suite-title = slaprunner
+command-line = {{ bin_directory }}/runStandaloneResiliencyTest --test-suite-title=${:test-suite-title} ${deploy-resiliency-test:test-parameters}
+wrapper-path = ${directory:bin}/runStandaloneResiliencyTestSuite
+
+[request-resilient-instance]
+<= slap-connection
+recipe = slapos.cookbook:request
+software-url = ${slap-connection:software-release-url}
+software-type = resilient
+name = Resilient Instance (Root Instance)
+{% set cluster_parameter_dict = slapparameter_dict.get('cluster', {}) -%}
+config = resiliency-backup-periodicity frontend-domain {{ cluster_parameter_dict.keys() | join(' ') }}
+{% for key, value in cluster_parameter_dict.items() -%}
+config-{{ key }} = {{ dumps(value) }}
+{% endfor -%}
+config-resiliency-backup-periodicity = * * * * *
+# XXX hardcoded
+config-frontend-domain = google.com
+# XXX Hack to deploy Root Instance on the same computer as the type-test Instance
+sla = computer_guid
+sla-computer_guid = ${slap-connection:computer-id}
+return = backend_url
+
+[slap-parameter]

software/slaprunner/instance-resilient.cfg.jinja2

@@ -17,30 +17,17 @@ parts +=
 
 # Bubble up the parameters
 [request-runner]
-return = url ssh-public-key ssh-url notification-id ip backend_url url cloud9_url ssh_command password_recovery_code cloud9_backend_url
-config = instance-amount debug domain number authorized-key notify ip-list namebase runner1-computer-guid pbs-runner1-computer-guid runner2-computer-guid pbs-runner2-computer-guid runner3-computer-guid pbs-runner3-computer-guid
-# XXX Cedric LN Ugly hack, resilient stack and slaprunner stack sharing too much ssh sections
-config-authorized-key = ${request-pbs-runner-1:connection-ssh-key} ${request-pbs-runner-2:connection-ssh-key} ${slap-parameter:authorized-key}
-config-instance-amount = ${slap-parameter:instance-amount}
-config-debug = ${slap-parameter:debug}
-config-runner1-computer-guid = ${slap-parameter:runner1-computer-guid}
-config-pbs-runner1-computer-guid = ${slap-parameter:pbs-runner1-computer-guid}
-config-runner2-computer-guid = ${slap-parameter:runner2-computer-guid}
-config-pbs-runner2-computer-guid = ${slap-parameter:pbs-runner2-computer-guid}
-config-runner3-computer-guid = ${slap-parameter:runner3-computer-guid}
-config-pbs-runner3-computer-guid = ${slap-parameter:pbs-runner3-computer-guid}
-config-domain = ${slap-parameter:domain}
-
+return = url ssh-public-key ssh-url notification-id ip backend_url url ssh_command password_recovery_code shell_password access_url 1_info
 
 [publish-connection-informations]
 recipe = slapos.cookbook:publish
-1_info = Set your passord in slaprunner in order to access cloud9
+1_info = ${request-runner:connection-1_info}
 backend_url = ${request-runner:connection-backend_url}
+access_url = ${request-runner:connection-access_url}
 url = ${request-runner:connection-url}
-cloud9_url = ${request-runner:connection-cloud9_url}
-cloud9_backend_url = ${request-runner:connection-cloud9_backend_url}
 ssh_command = ${request-runner:connection-ssh_command}
 password_recovery_code = ${request-runner:connection-password_recovery_code}
+shell_password = ${request-runner:connection-shell_password}
 
 [slap-parameter]
 # Default parameters for distributed deployment
@@ -56,4 +43,4 @@ pbs-runner3-computer-guid =
 domain =
 authorized-key =
 instance-amount = 10
-debug = false
+debug = false
\ No newline at end of file

software/slaprunner/instance-runner-export.cfg.in

 [buildout]
-extends = ${template-runner:output}
+extends = template-runner.cfg
           ${pbsready-export:output}
 
 parts +=
   nginx_conf
   nginx-launcher
-  cloud9
   certificate-authority
   ca-nginx
-  ca-node-frontend
-  slaprunner
+  ca-shellinabox
+  gunicorn-launcher
+  gunicorn-graceful
   test-runner
   sshkeys-dropbear-runner
   dropbear-server-add-authorized-key
   sshkeys-authority
+  publish-connection-informations
   slaprunner-promise
   slaprunner-frontend-promise
-  cloud9-promise
-  cloud9-frontend-promise
   dropbear-promise
+  shellinabox-promise
   symlinks
-  node-frontend-promise
-  nginx-promise
-  urls
+  shellinabox
+  slapos-cfg
+  slapos-repo-config
+  prepare-software
   cron-entry-backup
 
 [exporter]
@@ -36,11 +37,5 @@ rsync-binary = ${rsync:location}/bin/rsync
 
 
 # Extends publish section with resilient parameters
-[urls]
+[publish-connection-informations]
 <= resilient-publish-connection-parameter
-backend_url = $${slaprunner:access-url}
-url =  https://$${request-frontend:connection-domain}
-cloud9_backend_url = $${node-frontend:access-url}
-cloud9_url = https://$${request-cloud9-frontend:connection-domain}
-ssh_command = ssh $${dropbear-runner-server:host} -p $${dropbear-runner-server:port}
-password_recovery_code = $${recovery-code:passwd}

software/slaprunner/instance-runner-import.cfg.in

 [buildout]
-extends = ${template-runner:output}
+extends = template-runner.cfg
           ${pbsready-import:output}
 
 parts +=
   nginx_conf
   nginx-launcher
-  cloud9
   certificate-authority
   ca-nginx
-  ca-node-frontend
-  slaprunner
+  ca-shellinabox
+  gunicorn-launcher
+  gunicorn-graceful
   test-runner
   sshkeys-dropbear-runner
   dropbear-server-add-authorized-key
   sshkeys-authority
   slaprunner-promise
-  cloud9-promise
   dropbear-promise
+  shellinabox-promise
+  shellinabox
   symlinks
-  nginx-promise
+  slapos-cfg
+  slapos-repo-config
+  prepare-software
 # have to repeat the next one, as it's not inherited from pbsready-import
   import-on-notification
 

software/slaprunner/instance-runner.cfg

@@ -2,11 +2,11 @@
 parts =
   nginx_conf
   nginx-launcher
-  cloud9
   certificate-authority
   ca-nginx
-  ca-node-frontend
-  slaprunner
+  ca-shellinabox
+  gunicorn-launcher
+  gunicorn-graceful
   test-runner
   sshkeys-dropbear-runner
   dropbear-server-add-authorized-key
@@ -14,18 +14,62 @@ parts =
   publish-connection-informations
   slaprunner-promise
   slaprunner-frontend-promise
-  cloud9-promise
-  cloud9-frontend-promise
   dropbear-promise
+  shellinabox-promise
   symlinks
-  request-cloud9-frontend
-  node-frontend-promise
-  nginx-promise
+  shellinabox
+  slapos-cfg
+  slapos-repo-config
+  prepare-software
+{% if slapparameter_dict.get('custom-frontend-backend-url') %}
+  custom-frontend-promise
+{% endif %}
 
 eggs-directory = ${buildout:eggs-directory}
 develop-eggs-directory = ${buildout:develop-eggs-directory}
 offline = true
 
+{% if slapparameter_dict.get('custom-frontend-backend-url') -%}
+# Requests, if defined, a frontend to allow access to a server
+# located inside of the virtual machine listening to port X
+# to LAN IPv4.
+# Internaly, the frontend will be asked to listen on the IPv6
+# with port X + 10000, to match NAT rules of Qemu.
+[request-custom-frontend]
+recipe = slapos.cookbook:request
+software-url = {{ slapparameter_dict.get('custom-frontend-software-url', 'http://git.erp5.org/gitweb/slapos.git/blob_plain/HEAD:/software/apache-frontend/software.cfg') }}
+software-type = {{ slapparameter_dict.get('custom-frontend-software-type', 'RootSoftwareInstance') }}
+slave = true
+name = Custom Web Frontend
+
+server-url = $${slap-connection:server-url}
+key-file = $${slap-connection:key-file}
+cert-file = $${slap-connection:cert-file}
+computer-id = $${slap-connection:computer-id}
+partition-id = $${slap-connection:partition-id}
+
+{% if slapparameter_dict.get('custom-frontend-instance-guid') -%}
+sla = instance_guid
+sla-instance_guid = $${slap-parameter:frontend-instance-guid}
+{% endif -%}
+
+config = url
+config-url = {{ slapparameter_dict.get('custom-frontend-backend-url') }}
+return = site_url domain
+
+[custom-frontend-promise]
+recipe = slapos.cookbook:check_url_available
+path = $${directory:promises}/custom_frontend_promise
+url = https://$${request-custom-frontend:connection-domain}
+{% if slapparameter_dict.get('custom-frontend-basic-auth') -%}
+check-secure = 1
+{% endif -%}
+dash_path = {{ dash_executable_location }}
+curl_path = {{ curl_executable_location }}
+
+[publish-connection-informations]
+custom-frontend-url = https://$${request-custom-frontend:connection-domain}
+{% endif -%}
 
 # Create all needed directories
 [directory]
@@ -47,7 +91,7 @@ promises = $${:etc}/promise/
 test = $${:etc}/test/
 nginx-data = $${directory:srv}/nginx
 ca-dir = $${:srv}/ssl
-
+project = $${:srv}/runner/project/
 
 [runnerdirectory]
 recipe = slapos.cookbook:mkdirectory
@@ -65,21 +109,9 @@ sessions = $${buildout:directory}/.sessions
 [recovery-code]
 recipe = slapos.cookbook:generate.password
 storage-path = $${directory:etc}/.rcode
-bytes = 4
-
-# Deploy cloud9 and slaprunner
-[cloud9]
-recipe = slapos.cookbook:cloud9
-ip = $${slap-network-information:local-ipv4}
-port = 4443
-wrapper = $${directory:services}/cloud9
-working-directory = $${runnerdirectory:home}
-git-binary = ${git:location}/bin/git
-node-binary = ${nodejs:location}/bin/node
-cloud9 = ${cloud9:executable}
+bytes = 8
 
 [slaprunner]
-recipe = slapos.cookbook:slaprunner
 slaprunner = ${buildout:directory}/bin/slaprunner
 slapgrid_sr = ${buildout:directory}/bin/slapgrid-sr
 slapgrid_cp = ${buildout:directory}/bin/slapgrid-cp
@@ -102,9 +134,14 @@ ipv6 = $${slap-network-information:global-ipv6}
 proxy_port = 50000
 runner_port = 50005
 partition-amount = $${slap-parameter:instance-amount}
-cloud9-url = $${cloud9:access-url}
 wrapper = $${directory:services}/slaprunner
 debug = $${slap-parameter:debug}
+access-url = https://[$${:ipv6}]:$${:runner_port} 
+supd-temp-var = $${directory:etc}/supervisord.conf
+prox-db-var = $${slaprunner:working-directory}/proxy.db
+console = False
+verbose = False
+debug = False
 
 [test-runner]
 <= slaprunner
@@ -158,33 +195,6 @@ wrapper = $${directory:services}/runner_sshd
 recipe = slapos.cookbook:dropbear.add_authorized_key
 key = $${slap-parameter:authorized-key}
 
-#---------------------
-#--
-#-- Set node frontend
-
-[node-frontend]
-launcher = $${directory:bin}/node-frontend
-ip = $${slap-network-information:global-ipv6}
-port = $${cloud9:port}
-access-url = https://[$${:ip}]:$${:port}
-
-[node-frontend-launcher]
-recipe = slapos.recipe.template:jinja2
-template = ${node-frontend-template:location}/${node-frontend-template:filename}
-rendered = $${node-frontend:launcher}
-mode = 700
-context =
-	key ip node-frontend:ip
-	key port node-frontend:port
-	key key ca-node-frontend:key-file
-	key certificate ca-node-frontend:cert-file
-	key backend_ip nginx-frontend:local-ip
-	key backend_port nginx-frontend:port
-	raw shell_path ${bash:location}/bin/bash
-	raw node_env ${buildout:parts-directory}:${npm-modules:location}/node_modules
-	raw node_path ${nodejs:location}/bin/node
-	raw conf_path ${simple-proxy:location}/${simple-proxy:filename}
-
 #---------------------------
 #--
 #-- Set nginx frontend
@@ -206,8 +216,6 @@ port = 30001
 global-ip = $${slap-network-information:global-ipv6}
 global-port = $${slaprunner:runner_port}
 # Backend
-cloud9-ip = $${cloud9:ip}
-cloud9-port = $${cloud9:port}
 runner-ip = $${slaprunner:ipv4}
 runner-port = $${slaprunner:runner_port}
 # SSL
@@ -218,7 +226,7 @@ path_pid = $${directory:run}/nginx.pid
 path_log = $${directory:log}/nginx.log
 path_access_log = $${directory:log}/nginx.access.log
 path_error_log = $${directory:log}/nginx.error.log
-path_tmp = $${buildout:directory}/tmp
+path_tmp = $${directory:tmp}/
 # Config files
 path_nginx_conf = $${directory:etc}/nginx.conf
 # Executables
@@ -235,6 +243,8 @@ recipe = slapos.recipe.template:jinja2
 template = ${template_nginx_conf:location}/${template_nginx_conf:filename}
 rendered = $${nginx-frontend:path_nginx_conf}
 context =
+    key shellinabox_port shellinabox:port
+    key socket gunicorn:socket
     section param_nginx_frontend nginx-frontend
     section param_tempdir tempdirectory
 
@@ -246,6 +256,29 @@ mode = 700
 context =
     section param_nginx_frontend nginx-frontend
 
+#--------------------
+#--
+#-- WSGI
+
+[gunicorn]
+bin_gunicorn = $${directory:bin}/gunicorn
+bin_launcher = $${directory:services}/gunicorn
+path_shell = ${dash:location}/bin/dash
+socket = $${directory:tmp}/flaskserver.sock
+path_pid = $${directory:run}/gunicorn.pid
+
+[gunicorn-launcher]
+recipe = slapos.cookbook:wrapper
+command-line = $${gunicorn:bin_gunicorn} slapos.runner:app -p $${gunicorn:path_pid} -b unix:$${gunicorn:socket} -e RUNNER_CONFIG=$${slaprunner:slapos.cfg} --preload
+wrapper-path = $${gunicorn:bin_launcher}
+environment = PATH=$${environ:PATH}
+  RUNNER_CONFIG=$${slaprunner:slapos.cfg}
+
+[gunicorn-graceful]
+recipe = slapos.cookbook:wrapper
+command-line = $${directory:bin}/killpidfromfile $${gunicorn:path_pid} SIGHUP
+wrapper-path = $${directory:scripts}/gunicorn-graceful
+
 #--------------------
 #--
 #-- ssl certificates
@@ -279,16 +312,13 @@ wrapper = $${directory:services}/nginx-frontend
 # Put domain name
 name = example.com
 
-[ca-node-frontend]
+[ca-shellinabox]
 <= certificate-authority
 recipe = slapos.cookbook:certificate_authority.request
-key-file = $${cadirectory:certs}/nodejs.key
-cert-file = $${cadirectory:certs}/nodejs.crt
-executable = $${node-frontend-launcher:rendered}
-wrapper = $${directory:services}/node-frontend
-# Put domain name
-name = example.com
-
+executable = $${shellinabox:wrapper}
+wrapper = $${directory:services}/shellinaboxd
+key-file = $${cadirectory:certs}/shellinabox.key
+cert-file = $${cadirectory:certs}/shellinabox.crt
 #--------------------
 #--
 #-- Request frontend
@@ -300,18 +330,9 @@ name = SlapRunner Frontend
 # XXX We have hardcoded SR URL here.
 software-url = http://git.erp5.org/gitweb/slapos.git/blob_plain/HEAD:/software/apache-frontend/software.cfg
 slave = true
-config = url
+config = url domain
 config-url = $${slaprunner:access-url}
-return = site_url domain
-
-[request-cloud9-frontend]
-<= slap-connection
-recipe = slapos.cookbook:requestoptional
-name = Cloud9 Frontend
-software-url = http://git.erp5.org/gitweb/slapos.git/blob_plain/HEAD:/software/apache-frontend/software.cfg
-slave = true
-config = url
-config-url = $${node-frontend:access-url}
+config-domain = $${slap-parameter:frontend-domain}
 return = site_url domain
 
 #--------------------------------------
@@ -320,12 +341,12 @@ return = site_url domain
 
 [publish-connection-informations]
 recipe = slapos.cookbook:publish
-1_info = Set your passord in slaprunner in order to access cloud9
+1_info = On your first run, Use "access_url" to setup you account.Then you can use both "url" or "access_url". Or "backend_url" if you want to use ipv6.
 backend_url = $${slaprunner:access-url}
+access_url = $${:url}/login
 url =  https://$${request-frontend:connection-domain}
-cloud9_backend_url = $${node-frontend:access-url}
-cloud9_url = https://$${request-cloud9-frontend:connection-domain}
 ssh_command = ssh $${dropbear-runner-server:host} -p $${dropbear-runner-server:port}
+shell_password = $${shellinabox:password}
 password_recovery_code = $${recovery-code:passwd}
 
 #---------------------------
@@ -341,43 +362,22 @@ port = $${slaprunner:runner_port}
 [slaprunner-frontend-promise]
 recipe = slapos.cookbook:check_url_available
 path = $${directory:promises}/slaprunner_frontend
-url = https://$${request-frontend:connection-domain}
+url = https://$${request-frontend:connection-domain}/login
 dash_path = ${dash:location}/bin/dash
 curl_path = ${curl:location}/bin/curl
 
-[cloud9-promise]
-recipe = slapos.cookbook:check_url_available
-path = $${directory:promises}/cloud9
-url = http://$${cloud9:ip}:$${cloud9:port}
-dash_path = ${dash:location}/bin/dash
-curl_path = ${curl:location}/bin/curl
-
-[cloud9-frontend-promise]
-recipe = slapos.cookbook:check_url_available
-path = $${directory:promises}/cloud9-frontend-promise
-url = $${publish-connection-informations:cloud9_url}
-check-secure = 1
-dash_path = ${dash:location}/bin/dash
-curl_path = ${curl:location}/bin/curl
-
-[node-frontend-promise]
-recipe = slapos.cookbook:check_port_listening
-path = $${directory:promises}/node-frontend
-hostname = $${node-frontend:ip}
-port = $${node-frontend:port}
-
-[nginx-promise]
-recipe = slapos.cookbook:check_port_listening
-path = $${directory:promises}/nginx
-hostname = $${nginx-frontend:local-ip}
-port = $${nginx-frontend:port}
-
 [dropbear-promise]
 recipe = slapos.cookbook:check_port_listening
 path = $${directory:promises}/dropbear
 hostname = $${dropbear-runner-server:host}
 port = $${dropbear-runner-server:port}
 
+[shellinabox-promise]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promises}/shellinabox
+hostname = $${shellinabox:ipv6}
+port = $${shellinabox:port}
+
 [symlinks]
 recipe = cns.recipe.symlink
 symlink_target = $${directory:bin}
@@ -388,4 +388,92 @@ symlink_base = ${buildout:directory}/bin
 authorized-key =
 # Default value of instances number in slaprunner
 instance-amount = 10
-debug = false
+debug = false
\ No newline at end of file
+frontend-domain =
+slapos-repository = http://git.erp5.org/repos/slapos.git
+slapos-software =
+slapos-reference = master
+auto-deploy = true
+
+[slapos-cfg]
+recipe = slapos.recipe.template:jinja2
+template = ${slapos-cfg-template:location}/${slapos-cfg-template:filename}
+rendered = $${slaprunner:slapos.cfg}
+mode = 700
+context =
+  key software_root runnerdirectory:software-root
+  key instance_root runnerdirectory:instance-root
+  key ipv4 slaprunner:ipv4
+  key proxy_port slaprunner:proxy_port
+  key partition_amount slaprunner:partition-amount
+  key slapgrid_sr slaprunner:slapgrid_sr 
+  key slapgrid_cp slaprunner:slapgrid_cp
+  key slapproxy slaprunner:slapproxy 
+  key supervisor slaprunner:supervisor
+  key supervisord_config slaprunner:supd-temp-var
+  key runner_workdir slaprunner:working-directory
+  key runner_port slaprunner:runner_port
+  key ipv6 slaprunner:ipv6
+  key etc_dir slaprunner:etc_dir
+  key proxy_host slaprunner:ipv4
+  key proxy_database slaprunner:prox-db-var
+  key ssh_client slaprunner:ssh_client
+  key public_key slaprunner:public_key
+  key private_key slaprunner:private_key
+  key git slaprunner:git-binary
+  key run_dir slaprunner:run_dir
+  key log_dir slaprunner:log_dir
+  key console slaprunner:console
+  key verbose slaprunner:verbose
+  key debug slaprunner:debug
+  key auto_deploy slap-parameter:auto-deploy
+
+[shellinabox]
+recipe = slapos.cookbook:shellinabox
+ipv6 = $${slap-network-information:global-ipv6}
+port = 8080
+shell = $${shell:wrapper}
+wrapper = $${directory:bin}/shellinaboxd
+shellinabox-binary = ${shellinabox:location}/bin/shellinaboxd 
+password = $${shellinabox-code:passwd}
+directory = $${runnerdirectory:home}
+login-shell = $${directory:bin}/login
+certificate-directory = $${cadirectory:certs}
+cert-file = $${ca-shellinabox:cert-file}
+key-file = $${ca-shellinabox:key-file}
+
+[shellinabox-code]
+recipe = slapos.cookbook:generate.password
+storage-path = $${directory:etc}/.scode
+bytes = 8
+
+[shell]
+recipe = slapos.cookbook:shell
+wrapper = $${directory:bin}/sh
+shell = ${bash:location}/bin/bash
+home = $${runnerdirectory:home}
+path = $${environ:PATH}:${nano:location}/bin:${vim:location}/bin:${screen:location}/bin:${git:location}/bin
+ps1 = "\\w> "
+
+[environ]
+recipe = collective.recipe.environment
+
+[slapos-repo]
+recipe = slapos.recipe.build:gitclone
+repository = $${slap-parameter:slapos-repository}
+git-executable = ${git:location}/bin/git
+develop = true
+location = $${directory:project}/slapos
+
+[slapos-repo-config]
+recipe = plone.recipe.command
+stop-on-error = true
+reference = $${slap-parameter:slapos-reference}
+location = $${slapos-repo:location}
+command = cd $${:location} && ${git:location}/bin/git checkout $${:reference} && echo "$${directory:etc}/.project" && SR=$${slap-parameter:slapos-software} && if [ -n "$SR" ] && [ ! -f "$${directory:etc}/.project" ]; then echo workspace/slapos/$${slap-parameter:slapos-software}/ > $${directory:etc}/.project; fi
+
+[prepare-software]
+recipe = slapos.cookbook:wrapper
+command-line = ${curl:location}/bin/curl -g https://[$${slaprunner:ipv6}]:$${slaprunner:runner_port}/isSRReady --max-time 1 --insecure
+wrapper-path = $${directory:scripts}/prepareSoftware
+

software/slaprunner/instance.cfg

@@ -7,15 +7,30 @@ develop-eggs-directory = ${buildout:develop-eggs-directory}
 
 [switch_softwaretype]
 recipe = slapos.cookbook:softwaretype
-default = ${template-runner:output}
+default = $${instance-base-runner:rendered}
 resilient = $${instance-resilient:rendered}
-runner = ${template-runner:output}
+test = $${instance-resilient-test:rendered}
+runner = $${instance-base-runner:rendered}
 runner-import = ${instance-runner-import:output}
 runner-export = ${instance-runner-export:output}
 
 frozen = ${instance-frozen:output}
 pull-backup = ${template-pull-backup:output}
 
+[instance-base-runner]
+recipe = slapos.recipe.template:jinja2
+template = ${template-runner:output}
+rendered = $${buildout:directory}/template-runner.cfg
+extensions = jinja2.ext.do
+context = key buildout buildout:bin-directory
+          key develop_eggs_directory buildout:develop-eggs-directory
+          key eggs_directory buildout:eggs-directory
+          key slapparameter_dict slap-configuration:configuration
+          raw curl_executable_location ${curl:location}/bin/curl
+          raw dash_executable_location ${dash:location}/bin/dash
+          raw dcron_executable_location ${dcron:location}/sbin/crond
+mode = 0644
+
 [instance-resilient]
 recipe = slapos.recipe.template:jinja2
 template = ${template-resilient:target}
@@ -24,18 +39,29 @@ extensions = jinja2.ext.do
 context = key buildout buildout:bin-directory
           key develop_eggs_directory buildout:develop-eggs-directory
           key eggs_directory buildout:eggs-directory
-          key slapparameter_dict slap-parameters:configuration
+          key slapparameter_dict slap-configuration:configuration
 template-parts-destination = ${template-parts:destination}
 template-replicated-destination = ${template-replicated:destination}
 import-list = file parts :template-parts-destination
               file replicated :template-replicated-destination
+mode = 0644
 
+[instance-resilient-test]
+recipe = slapos.recipe.template:jinja2
+template = ${template-resilient-test:location}/instance-resilient-test.cfg.jinja2
+rendered = $${buildout:directory}/template-resilient-test.cfg
+bin-directory = ${buildout:bin-directory}
+context =
+    key bin_directory instance-resilient-test:bin-directory
+    key develop_eggs_directory buildout:develop-eggs-directory
+    key eggs_directory buildout:eggs-directory
+    key slapparameter_dict slap-configuration:configuration
 mode = 0644
 
-[slap-parameters]
-recipe = slapos.cookbook:slapconfiguration
+[slap-configuration]
+recipe = slapos.cookbook:slapconfiguration.serialised
 computer = $${slap-connection:computer-id}
 partition = $${slap-connection:partition-id}
 url = $${slap-connection:server-url}
 key = $${slap-connection:key-file}
-cert = $${slap-connection:cert-file}
+cert = $${slap-connection:cert-file}
\ No newline at end of file

software/slaprunner/nginx_conf.in

@@ -17,31 +17,6 @@ http {
         default upgrade;
         ''      close;
      }
-     server {
-        listen {{ param_nginx_frontend['local-ip'] }}:{{ param_nginx_frontend['port'] }};
-        server_name _;
-
-        keepalive_timeout 90s;
-        client_body_temp_path {{ param_tempdir['client_body_temp_path'] }};
-        proxy_temp_path {{ param_tempdir['proxy_temp_path'] }};
-        fastcgi_temp_path {{ param_tempdir['fastcgi_temp_path'] }};
-        uwsgi_temp_path {{ param_tempdir['uwsgi_temp_path'] }};
-        scgi_temp_path {{ param_tempdir['scgi_temp_path'] }};
-        location / {
-            auth_basic  "Restricted";
-            auth_basic_user_file   {{ param_nginx_frontend['etc_dir'] }}/.htpasswd;
-            proxy_pass  http://{{ param_nginx_frontend['cloud9-ip'] }}:{{ param_nginx_frontend['cloud9-port'] }};
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-            proxy_redirect off;
-            proxy_buffering off;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header        Host            $host;
-            proxy_set_header        X-Real-IP       $remote_addr;
-            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
-        }
-    }
      server {
         listen [{{ param_nginx_frontend['global-ip'] }}]:{{ param_nginx_frontend['global-port'] }} ssl;
         server_name _;
@@ -55,16 +30,39 @@ http {
         fastcgi_temp_path {{ param_tempdir['fastcgi_temp_path'] }};
         uwsgi_temp_path {{ param_tempdir['uwsgi_temp_path'] }};
         scgi_temp_path {{ param_tempdir['scgi_temp_path'] }};
+	error_page 401 /login;
         location / {
-            proxy_pass  http://{{ param_nginx_frontend['runner-ip'] }}:{{ param_nginx_frontend['runner-port'] }};
+            auth_basic "Restricted";
+            auth_basic_user_file {{ param_nginx_frontend['etc_dir'] }}/.htpasswd;
+            proxy_redirect off;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Host  $http_host;
+            proxy_set_header   X-Accel-Mapping   /private/;
+
+            proxy_pass http://unix:{{ socket }};
+        }
+        location ~ ^(/login|/doLogin|/static|/setAccount|/configAccount|/slapgridResult|/isSRReady) {
+            proxy_redirect off;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Host  $http_host;
+            proxy_set_header   X-Accel-Mapping   /private/;
+
+            proxy_pass http://unix:{{ socket }};
+        }
+	location /shellinabox {
+            proxy_pass  http://[{{ param_nginx_frontend['global-ip'] }}]:{{ shellinabox_port }}/;
             proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
+            auth_basic "Restricted";
+            auth_basic_user_file {{ param_nginx_frontend['etc_dir'] }}/.htpasswd;
             proxy_redirect off;
             proxy_buffering off;
             proxy_set_header        Host              $host;
             proxy_set_header        X-Real-IP         $remote_addr;
-            proxy_set_header        X-Forwarded-Proto $scheme;
+	    proxy_set_header        X-Forwarded-Proto $scheme;
             proxy_set_header        X-Forwarded-For   $proxy_add_x_forwarded_for;
-            proxy_set_header        X-Forwarded-Host  $http_host;
-        }
+	    proxy_set_header        X-Forwarded-Host  $http_host;
+	}
     }
 }

software/slaprunner/simple-proxy.js

-/*****************************************************************************
-*
-* Copyright (c) 2013 Vifib SARL and Contributors. All Rights Reserved.
-*
-* WARNING: This program as such is intended to be used by professional
-* programmers who take the whole responsibility of assessing all potential
-* consequences resulting from its eventual inadequacies and bugs
-* End users who are looking for a ready-to-use solution with commercial
-* guarantees and support are strongly adviced to contract a Free Software
-* Service Company
-*
-* This program is Free Software; you can redistribute it and/or
-* modify it under the terms of the GNU General Public License
-* as published by the Free Software Foundation; either version 3
-* of the License, or (at your option) any later version.
-*
-* This program is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-* GNU General Public License for more details.
-*
-* You should have received a copy of the GNU General Public License
-* along with this program; if not, write to the Free Software
-* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-*
-*****************************************************************************/
-
-var fs = require('fs'),
-    util = require('util'),
-    colors = require('colors'),
-    http = require('http'),
-    httpProxy = require('http-proxy');
-
-
-var listenInterface = process.argv[2],
-    port = process.argv[3],
-    sslKeyFile = process.argv[4],
-    sslCertFile = process.argv[5],
-    backendIp = process.argv[6],
-    backendPort = process.argv[7];
-
-if (process.argv.length < 8) {
-  console.error("Too few arguments. Exiting.");
-  process.exit(1);
-}
-
-var middleware = function (req, res, proxy) {
-  return proxy.proxyRequest(req, res,{
-    host: backendIp,
-    port: backendPort
-  });
-};
-
-middleware.proxyWebSocketRequest = function (req, socket, head, proxy) {
-  return proxy.proxyWebSocketRequest(req, socket, head,{
-    host: backendIp,
-    port: backendPort
-  });
-};
-
-/**
- * Create server
- */
-var proxyServer = httpProxy.createServer(
-  middleware,
-  {
-    https: {
-      key: fs.readFileSync(
-        sslKeyFile,
-        'utf8'
-      ),
-      cert: fs.readFileSync(
-        sslCertFile,
-        'utf8'
-      )
-    },
-    source: {
-    host: listenInterface,
-    port: port
-  }}
-);
-
-console.log('HTTPS server starting and trying to listen on ' +
-            listenInterface + ':' + port);
-
-// Release the beast.
-proxyServer.listen(port, listenInterface);

software/slaprunner/software.cfg

@@ -11,7 +11,82 @@ extends = common.cfg
 # signature certificates of the following uploaders.
 #   Cedric de Saint Martin
 #   Test Agent
+#   Romain Courteaud
+#   Sebastien Robin
+#   Kazuhiko Shiozaki
+#   Cedric de Saint Martin
+#   Yingjie Xu
+#   Gabriel Monnerat
+#   Łukasz Nowak
+#   Test Agent (Automatic update from tests)
+#   Aurélien Calonne
+#   Nicolas Wavrant
 signature-certificate-list =
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAO4V/jiMoICoMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMjMyMCAXDTEyMDIxNjExMTAyM1oYDzIxMTIwMTIzMTExMDIzWjAT
+  MREwDwYDVQQDDAhDT01QLTIzMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  wi/3Z8W9pUiegUXIk/AiFDQ0UJ4JFAwjqr+HSRUirlUsHHT+8DzH/hfcTDX1I5BB
+  D1ADk+ydXjMm3OZrQcXjn29OUfM5C+g+oqeMnYQImN0DDQIOcUyr7AJc4xhvuXQ1
+  P2pJ5NOd3tbd0kexETa1LVhR6EgBC25LyRBRae76qosCAwEAAaNQME4wHQYDVR0O
+  BBYEFMDmW9aFy1sKTfCpcRkYnP6zUd1cMB8GA1UdIwQYMBaAFMDmW9aFy1sKTfCp
+  cRkYnP6zUd1cMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAskbFizHr
+  b6d3iIyN+wffxz/V9epbKIZVEGJd/6LrTdLiUfJPec7FaxVCWNyKBlCpINBM7cEV
+  Gn9t8mdVQflNqOlAMkOlUv1ZugCt9rXYQOV7rrEYJBWirn43BOMn9Flp2nibblby
+  If1a2ZoqHRxoNo2yTmm7TSYRORWVS+vvfjY= 
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAKRvzcy7OH0UMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtNzcyMCAXDTEyMDgxMDE1NDI1MVoYDzIxMTIwNzE3MTU0MjUxWjAT
+  MREwDwYDVQQDDAhDT01QLTc3MjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  o7aipd6MbnuGDeR1UJUjuMLQUariAyQ2l2ZDS6TfOwjHiPw/mhzkielgk73kqN7A
+  sUREx41eTcYCXzTq3WP3xCLE4LxLg1eIhd4nwNHj8H18xR9aP0AGjo4UFl5BOMa1
+  mwoyBt3VtfGtUmb8whpeJgHhqrPPxLoON+i6fIbXDaUCAwEAAaNQME4wHQYDVR0O
+  BBYEFEfjy3OopT2lOksKmKBNHTJE2hFlMB8GA1UdIwQYMBaAFEfjy3OopT2lOksK
+  mKBNHTJE2hFlMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAaNRx6YN2
+  M/p3R8/xS6zvH1EqJ3FFD7XeAQ52WuQnKSREzuw0dsw12ClxjcHiQEFioyTiTtjs
+  5pW18Ry5Ie7iFK4cQMerZwWPxBodEbAteYlRsI6kePV7Gf735Y1RpuN8qZ2sYL6e
+  x2IMeSwJ82BpdEI5niXxB+iT0HxhmR+XaMI=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB4DCCAUkCADANBgkqhkiG9w0BAQsFADA5MQswCQYDVQQGEwJGUjEZMBcGA1UE
+  CBMQRGVmYXVsdCBQcm92aW5jZTEPMA0GA1UEChMGTmV4ZWRpMB4XDTExMDkxNTA5
+  MDAwMloXDTEyMDkxNTA5MDAwMlowOTELMAkGA1UEBhMCRlIxGTAXBgNVBAgTEERl
+  ZmF1bHQgUHJvdmluY2UxDzANBgNVBAoTBk5leGVkaTCBnzANBgkqhkiG9w0BAQEF
+  AAOBjQAwgYkCgYEApYZv6OstoqNzxG1KI6iE5U4Ts2Xx9lgLeUGAMyfJLyMmRLhw
+  boKOyJ9Xke4dncoBAyNPokUR6iWOcnPHtMvNOsBFZ2f7VA28em3+E1JRYdeNUEtX
+  Z0s3HjcouaNAnPfjFTXHYj4um1wOw2cURSPuU5dpzKBbV+/QCb5DLheynisCAwEA
+  ATANBgkqhkiG9w0BAQsFAAOBgQBCZLbTVdrw3RZlVVMFezSHrhBYKAukTwZrNmJX
+  mHqi2tN8tNo6FX+wmxUUAf3e8R2Ymbdbn2bfbPpcKQ2fG7PuKGvhwMG3BlF9paEC
+  q7jdfWO18Zp/BG7tagz0jmmC4y/8akzHsVlruo2+2du2freE8dK746uoMlXlP93g
+  QUUGLQ==
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB8jCCAVugAwIBAgIJAPu2zchZ2BxoMA0GCSqGSIb3DQEBBQUAMBIxEDAOBgNV
+  BAMMB3RzeGRldjMwHhcNMTExMDE0MTIxNjIzWhcNMTIxMDEzMTIxNjIzWjASMRAw
+  DgYDVQQDDAd0c3hkZXYzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrPbh+
+  YGmo6mWmhVb1vTqX0BbeU0jCTB8TK3i6ep3tzSw2rkUGSx3niXn9LNTFNcIn3MZN
+  XHqbb4AS2Zxyk/2tr3939qqOrS4YRCtXBwTCuFY6r+a7pZsjiTNddPsEhuj4lEnR
+  L8Ax5mmzoi9nE+hiPSwqjRwWRU1+182rzXmN4QIDAQABo1AwTjAdBgNVHQ4EFgQU
+  /4XXREzqBbBNJvX5gU8tLWxZaeQwHwYDVR0jBBgwFoAU/4XXREzqBbBNJvX5gU8t
+  LWxZaeQwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA07q/rKoE7fAda
+  FED57/SR00OvY9wLlFEF2QJ5OLu+O33YUXDDbGpfUSF9R8l0g9dix1JbWK9nQ6Yd
+  R/KCo6D0sw0ZgeQv1aUXbl/xJ9k4jlTxmWbPeiiPZEqU1W9wN5lkGuLxV4CEGTKU
+  hJA/yXa1wbwIPGvX3tVKdOEWPRXZLg==
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB7jCCAVegAwIBAgIJAJWA0jQ4o9DGMA0GCSqGSIb3DQEBBQUAMA8xDTALBgNV
+  BAMMBHg2MXMwIBcNMTExMTI0MTAyNDQzWhgPMjExMTEwMzExMDI0NDNaMA8xDTAL
+  BgNVBAMMBHg2MXMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANdJNiFsRlkH
+  vq2kHP2zdxEyzPAWZH3CQ3Myb3F8hERXTIFSUqntPXDKXDb7Y/laqjMXdj+vptKk
+  3Q36J+8VnJbSwjGwmEG6tym9qMSGIPPNw1JXY1R29eF3o4aj21o7DHAkhuNc5Tso
+  67fUSKgvyVnyH4G6ShQUAtghPaAwS0KvAgMBAAGjUDBOMB0GA1UdDgQWBBSjxFUE
+  RfnTvABRLAa34Ytkhz5vPzAfBgNVHSMEGDAWgBSjxFUERfnTvABRLAa34Ytkhz5v
+  PzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAFLDS7zNhlrQYSQO5KIj
+  z2RJe3fj4rLPklo3TmP5KLvendG+LErE2cbKPqnhQ2oVoj6u9tWVwo/g03PMrrnL
+  KrDm39slYD/1KoE5kB4l/p6KVOdeJ4I6xcgu9rnkqqHzDwI4v7e8/D3WZbpiFUsY
+  vaZhjNYKWQf79l6zXfOvphzJ
+  -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
   MIIB9jCCAV+gAwIBAgIJAO4V/jiMoICoMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
   BAMMCENPTVAtMjMyMCAXDTEyMDIxNjExMTAyM1oYDzIxMTIwMTIzMTExMDIzWjAT
@@ -26,6 +101,45 @@ signature-certificate-list =
   If1a2ZoqHRxoNo2yTmm7TSYRORWVS+vvfjY=
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAIlBksrZVkK8MA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMzU3MCAXDTEyMDEyNjEwNTUyOFoYDzIxMTIwMTAyMTA1NTI4WjAT
+  MREwDwYDVQQDDAhDT01QLTM1NzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  ts+iGUwi44vtIfwXR8DCnLtHV4ydl0YTK2joJflj0/Ws7mz5BYkxIU4fea/6+VF3
+  i11nwBgYgxQyjNztgc9u9O71k1W5tU95yO7U7bFdYd5uxYA9/22fjObaTQoC4Nc9
+  mTu6r/VHyJ1yRsunBZXvnk/XaKp7gGE9vNEyJvPn2bkCAwEAAaNQME4wHQYDVR0O
+  BBYEFKuGIYu8+6aEkTVg62BRYaD11PILMB8GA1UdIwQYMBaAFKuGIYu8+6aEkTVg
+  62BRYaD11PILMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAMoTRpBxK
+  YLEZJbofF7gSrRIcrlUJYXfTfw1QUBOKkGFFDsiJpEg4y5pUk1s5Jq9K3SDzNq/W
+  it1oYjOhuGg3al8OOeKFrU6nvNTF1BAvJCl0tr3POai5yXyN5jlK/zPfypmQYxE+
+  TaqQSGBJPVXYt6lrq/PRD9ciZgKLOwEqK8w=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAPHoWu90gbsgMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+  BAMMCXZpZmlibm9kZTAeFw0xMjAzMTkyMzIwNTVaFw0xMzAzMTkyMzIwNTVaMBQx
+  EjAQBgNVBAMMCXZpZmlibm9kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  ozBijpO8PS5RTeKTzA90vi9ezvv4vVjNaguqT4UwP9+O1+i6yq1Y2W5zZxw/Klbn
+  oudyNzie3/wqs9VfPmcyU9ajFzBv/Tobm3obmOqBN0GSYs5fyGw+O9G3//6ZEhf0
+  NinwdKmrRX+d0P5bHewadZWIvlmOupcnVJmkks852BECAwEAAaNQME4wHQYDVR0O
+  BBYEFF9EtgfZZs8L2ZxBJxSiY6eTsTEwMB8GA1UdIwQYMBaAFF9EtgfZZs8L2ZxB
+  JxSiY6eTsTEwMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAc43YTfc6
+  baSemaMAc/jz8LNLhRE5dLfLOcRSoHda8y0lOrfe4lHT6yP5l8uyWAzLW+g6s3DA
+  Yme/bhX0g51BmI6gjKJo5DoPtiXk/Y9lxwD3p7PWi+RhN+AZQ5rpo8UfwnnN059n
+  yDuimQfvJjBFMVrdn9iP6SfMjxKaGk6gVmI=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB9jCCAV+gAwIBAgIJAMNZBmoIOXPBMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+  BAMMCENPTVAtMTMyMCAXDTEyMDUwMjEyMDQyNloYDzIxMTIwNDA4MTIwNDI2WjAT
+  MREwDwYDVQQDDAhDT01QLTEzMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+  6peZQt1sAmMAmSG9BVxxcXm8x15kE9iAplmANYNQ7z2YO57c10jDtlYlwVfi/rct
+  xNUOKQtc8UQtV/fJWP0QT0GITdRz5X/TkWiojiFgkopza9/b1hXs5rltYByUGLhg
+  7JZ9dZGBihzPfn6U8ESAKiJzQP8Hyz/o81FPfuHCftsCAwEAAaNQME4wHQYDVR0O
+  BBYEFNuxsc77Z6/JSKPoyloHNm9zF9yqMB8GA1UdIwQYMBaAFNuxsc77Z6/JSKPo
+  yloHNm9zF9yqMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAl4hBaJy1
+  cgiNV2+Z5oNTrHgmzWvSY4duECOTBxeuIOnhql3vLlaQmo0p8Z4c13kTZq2s3nhd
+  Loe5mIHsjRVKvzB6SvIaFUYq/EzmHnqNdpIGkT/Mj7r/iUs61btTcGUCLsUiUeci
+  Vd0Ozh79JSRpkrdI8R/NRQ2XPHAo+29TT70=
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
   MIIB9jCCAV+gAwIBAgIJAKRvzcy7OH0UMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
   BAMMCENPTVAtNzcyMCAXDTEyMDgxMDE1NDI1MVoYDzIxMTIwNzE3MTU0MjUxWjAT
   MREwDwYDVQQDDAhDT01QLTc3MjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
@@ -38,6 +152,32 @@ signature-certificate-list =
   5pW18Ry5Ie7iFK4cQMerZwWPxBodEbAteYlRsI6kePV7Gf735Y1RpuN8qZ2sYL6e
   x2IMeSwJ82BpdEI5niXxB+iT0HxhmR+XaMI=
   -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB+DCCAWGgAwIBAgIJAKGd0vpks6T/MA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+  BAMMCUNPTVAtMTU4NDAgFw0xMzA2MjAxMjE5MjBaGA8yMTEzMDUyNzEyMTkyMFow
+  FDESMBAGA1UEAwwJQ09NUC0xNTg0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+  gQDZTH9etPUC+wMZQ3UIiOwyyCfHsJ+7duCFYjuo1uZrhtDt/fp8qb8qK9ob+df3
+  EEYgA0IgI2j/9jNUEnKbc5+OrfKznzXjrlrH7zU8lKBVNCLzQuqBKRNajZ+UvO8R
+  nlqK2jZCXP/p3HXDYUTEwIR5W3tVCEn/Vda4upTLcPVE5wIDAQABo1AwTjAdBgNV
+  HQ4EFgQU7KXaNDheQWoy5uOU01tn1M5vNkEwHwYDVR0jBBgwFoAU7KXaNDheQWoy
+  5uOU01tn1M5vNkEwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQASmqCU
+  Znbvu6izdicvjuE3aKnBa7G++Fdp2bdne5VCwVbVLYCQWatB+n4crKqGdnVply/u
+  +uZ16u1DbO9rYoKgWqjLk1GfiLw5v86pd5+wZd5I9QJ0/Sbz2vZk5S4ciMIGwArc
+  m711+GzlW5xe6GyH9SZaGOPAdUbI6JTDwLzEgA==
+  -----END CERTIFICATE-----
+  -----BEGIN CERTIFICATE-----
+  MIIB+DCCAWGgAwIBAgIJAJAOvB8P2YYMMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+  BAMMCUNPTVAtMTg1MjAgFw0xMzEyMDMxMjU5NDJaGA8yMTEzMTEwOTEyNTk0Mlow
+  FDESMBAGA1UEAwwJQ09NUC0xODUyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+  gQDgR2qKVURmOUmzc7KVL2Gk2VezWlHlJy3V3k1WVYahhFsSjf3O4VyTtroHbIGu
+  YMJaHLSvGvvvkVJIz/DKqOvl1/6435t+coYECimvzqzTBDWFlEKJbEixz/3nPnXe
+  CFqVzuCQ7e3nRIrIGLml6jZnXwPlzx8ANn1LO8pwKHj+xwIDAQABo1AwTjAdBgNV
+  HQ4EFgQUvo7qkSq82Ax5/vnxHoJOhySQSGowHwYDVR0jBBgwFoAUvo7qkSq82Ax5
+  /vnxHoJOhySQSGowDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCbNxtq
+  BckDSWb92gy/p+JbkMXLjRSSWgeKafvWQXMXpPHW847CPzUDB7zT0rT8a8SRjVuL
+  Vt/oo2VlJ9xbKEz/qppX8w1TwEZhEJk6h8ky51s2EyyITUy8LHESJes9l46DRbr8
+  Rm6WS5sk5oiCd146YkWhfZuOsQHXSG/+WC/GPQ==
+  -----END CERTIFICATE-----
 
 [versions]
 Flask-Auth = 0.85
@@ -46,35 +186,36 @@ Werkzeug = 0.8.3
 apache-libcloud = 0.11.4
 async = 0.6.1
 buildout-versions = 1.7
+cliff = 1.4
+cmd2 = 0.6.6
 cns.recipe.symlink = 0.2.3
+collective.recipe.environment = 0.2.0
+collective.recipe.template = 1.10
+erp5.util = 0.4.36
 gitdb = 0.5.4
 hexagonit.recipe.cmmi = 1.6
-inotifyx = 0.2.0
+inotifyx = 0.2.0-1
+lock-file = 2.0
 lxml = 3.0.1
 meld3 = 0.6.10
 netaddr = 0.7.10
 plone.recipe.command = 1.1
+prettytable = 0.7.2
 pycrypto = 2.6
-pytz = 2013b
-#slapos.cookbook = 0.71.1
+pytz = 2013.7
+rdiff-backup = 1.0.5
+requests = 1.2.3
+slapos.cookbook = 0.85
 slapos.core = 0.35.1
 slapos.libnetworkcache = 0.13.4
 slapos.recipe.build = 0.11.5
+slapos.recipe.cmmi = 0.2
+slapos.recipe.download = 1.0.dev-r4053
 slapos.recipe.template = 2.4.2
-#slapos.toolbox = 0.34.0
+slapos.toolbox = 0.38.1
 smmap = 0.8.2
 xml-marshaller = 0.9.7
 z3c.recipe.scripts = 1.0.1
-lock-file = 2.0
-rdiff-backup = 1.0.5
-slapos.recipe.cmmi = 0.2
-slapos.recipe.download = 1.0.dev-r4053
-slapos.toolbox = 0.35.1
-slapos.cookbook = 0.78.5
-cliff = 1.4
-cmd2 = 0.6.6
-prettytable = 0.7.2
-requests = 1.2.3
 # Required by:
 # slapos.core==0.34
 # slapos.toolbox==0.34.0
@@ -94,7 +235,7 @@ feedparser = 5.1.3
 
 # Required by:
 # hexagonit.recipe.cmmi==1.6
-hexagonit.recipe.download = 1.6nxd002
+hexagonit.recipe.download = 1.7nxd002
 
 # Required by:
 # slapos.core==0.34
@@ -134,3 +275,6 @@ unittest2 = 0.5.1
 # Required by:
 # slapos.core==0.34
 zope.interface = 4.0.3
+
+# WSGI server
+gunicorn = 18.0

software/slaprunner/template/slapos.cfg.in

+[slapos]
+software_root = {{ software_root }}
+instance_root = {{instance_root }}
+master_url = http://{{ ipv4 }}:{{ proxy_port }}
+computer_id = slaprunner
+maximal_delay = 0
+
+[slapformat]
+partition_amount = {{ partition_amount }}
+
+[slaprunner]
+slapgrid_sr = {{ slapgrid_sr }}
+slapgrid_cp = {{ slapgrid_cp }}
+slapproxy = {{ slapproxy }}
+supervisor = {{ supervisor }}
+supervisord_config = {{ supervisord_config }}
+runner_workdir = {{ runner_workdir }}
+runner_host = {{ ipv4 }}
+runner_port = {{ runner_port }}
+ipv4_address = {{ ipv4 }}
+ipv6_address = {{ ipv6 }}
+etc_dir = {{ etc_dir }}
+run_dir = {{ run_dir }}
+log_dir = {{ log_dir }}
+console = {{ console }}
+verbose = {{ verbose }}
+debug = {{ debug }}
+auto_deploy = {{ auto_deploy }}
+
+[slapproxy]
+host = {{ proxy_host }}
+port = {{ proxy_port }}
+database_uri = {{ proxy_database }}
+
+[sshkeys_authority]
+ssh_client = {{ ssh_client }}
+public_key = {{ public_key }}
+private_key = {{ private_key }}
+
+[gitclient]
+git = {{ git }}
+
+[cloud9_IDE]

stack/erp5/buildout.cfg

@@ -166,6 +166,7 @@ context =
     key bin_directory buildout:bin-directory
     key develop_eggs_directory buildout:develop-eggs-directory
     key eggs_directory buildout:eggs-directory
+    key slapos_core_version versions:slapos.core
     ${:extra-context}
 
 [template-mariadb]
@@ -187,7 +188,7 @@ link-binary =
 [template-kumofs]
 < = download-base
 filename = instance-kumofs.cfg.in
-md5sum = 90cfea3b4b38a5a1682e016eb82b391c
+md5sum = fe9a9349c4bad2ba999e9d8bac065ebb
 
 [template-cloudooo]
 < = download-base
@@ -214,7 +215,7 @@ md5sum = 564006953b7d7a12d40a14b6648b32f0
 # XXX: "template.cfg" is hardcoded in instanciation recipe
 filename = template.cfg
 template = ${:_profile_base_location_}/instance.cfg.in
-md5sum = f71e14621d90903eba1b943401548b8a
+md5sum = c717ed0f17a85da36f268cf55e545da7
 extra-context =
     key mariadb_link_binary template-mariadb:link-binary
     key zope_link_binary template-zope:link-binary
@@ -286,7 +287,7 @@ md5sum = 32de16140a294a7e456a9665124bdb93
 [template-zope]
 < = download-base
 filename = instance-zope.cfg.in
-md5sum = 882927b01ee5d5d5c05b9eb8bf3b5255
+md5sum = 21116639ac07dd3473f99522ea042334
 link-binary =
   ${coreutils:location}/bin/basename
   ${coreutils:location}/bin/cat
@@ -438,6 +439,7 @@ eggs =
   ${pycrypto-python:egg}
   lock_file
   PyXML
+  Pympler
   SOAPpy
   cElementTree
   chardet
@@ -446,13 +448,13 @@ eggs =
   erp5diff
   inotifyx
   ipdb
+  Jinja2
   mechanize
   numpy
-  ordereddict
   paramiko
   ply
   pyflakes
-  pyPdf # should be replaced by PyPDF2, but it is not installable
+  pypdf2
   python-magic
   python-memcached
   pytz
@@ -470,7 +472,11 @@ eggs =
   huBarcode
   qrcode
   spyne
+  httplib2
+  suds
   pprofile
+# Needed for checking ZODB Components source code
+  pylint
 
 # Zope
   ZODB3
@@ -571,14 +577,21 @@ scripts =
 
 [versions]
 # pin Acquisition and Products.DCWorkflow to Nexedi flavour of eggs
-Acquisition = 2.13.7nxd001
-Products.DCWorkflow = 2.2.3nxd002
+Acquisition = 2.13.8nxd001
+Products.DCWorkflow = 2.2.4nxd001
 
 # specify dev version to be sure that an old released version is not used
 cloudooo = 1.2.5-dev
 
 # use newer version than specified in ZTK
-lxml = 2.3.6
+Jinja2 = 2.7.1
+PasteDeploy = 1.5.2
+Pygments = 1.6
+argparse = 1.2.1
+coverage = 3.7.1
+lxml = 3.2.5
+mr.developer = 1.26
+setuptools = 2.1
 
 # Known version with works
 numpy = 1.6.2
@@ -596,25 +609,19 @@ python-memcached = 1.47-ipv6-1
 # use newest version of pytz
 pytz =
 
-# Patched version which support python 2.6
-PyXML = 0.8.4nxd001
-
 # we are still using this old stable version.
 rdiff-backup = 1.0.5
 
-# use dev version
-setuptools = 0.6c12dev-r88846
-
 # use newest version of slapos.cookbook
 slapos.cookbook =
 
 # modified version that works fine for buildout installation
 SOAPpy = 0.12.0nxd001
 
-# CMF 2.3 requries Zope 2.13.
+# CMF 2.3 is not yet supported.
 Products.CMFCalendar = 2.2.2
-Products.CMFCore = 2.2.6
-Products.CMFDefault = 2.2.2
+Products.CMFCore = 2.2.8
+Products.CMFDefault = 2.2.3
 Products.CMFTopic = 2.2.1
 Products.CMFUid = 2.2.1
 
@@ -624,90 +631,82 @@ zope.app.appsetup = 3.16.0
 # newer version requires zope.i18n>=4.0.0a3
 zope.app.publication = 3.14.0
 
-# BBB: Temporarily keep zope.app.testing awaiting we use newer version of CMF
-#      (for tests like testCookieCrumbler).
+# newer version requires zope.testbrowser>=4
 zope.app.testing = 3.8.1
 
 # Pinned versions
 Flask = 0.9
 GitPython = 0.3.2.RC1
-Jinja2 = 2.6
-MySQL-python = 1.2.4
+MySQL-python = 1.2.5
 PIL = 1.1.7
-Paste = 1.7.5.1
-PasteDeploy = 1.5.0
-PasteScript = 1.7.5
+PyXML = 0.8.5
 Products.CMFActionIcons = 2.1.3
 Products.DCWorkflowGraph = 0.4.1
 Products.ExternalEditor = 1.1.0
-Products.GenericSetup = 1.7.3
+Products.GenericSetup = 1.7.4
 Products.LongRequestLogger = 1.1.0
-Products.MimetypesRegistry = 2.0.4
+Products.MimetypesRegistry = 2.0.5
 Products.PluginRegistry = 1.3
-Products.TIDStorage = 5.4.8
+Products.TIDStorage = 5.4.9
 Products.ZSQLMethods = 2.13.4
-Pygments = 1.6
+PyPDF2 = 1.19
 StructuredText = 2.11.1
 WSGIUtils = 0.7
 Werkzeug = 0.8.3
 apache-libcloud = 0.12.4
-argparse = 1.2.1
 async = 0.6.1
 atomize = 0.1.1
 cElementTree = 1.0.5-20051216
-chardet = 2.1.1
-coverage = 3.6
+chardet = 2.2.1
 csp-eventlet = 0.7.0
 elementtree = 1.2.7-20070827-preview
 erp5.recipe.cmmiforcei686 = 0.1.3
-erp5.util = 0.4.34
+erp5.util = 0.4.36
 erp5diff = 0.8.1.5
-eventlet = 0.12.1
+eventlet = 0.14.0
 feedparser = 5.1.3
 five.formlib = 1.0.4
 five.localsitemanager = 2.0.5
 fpconst = 0.7.2
 gitdb = 0.5.4
-greenlet = 0.4.0
-hexagonit.recipe.cmmi = 1.6
-http-parser = 0.8.1
+greenlet = 0.4.1
+hexagonit.recipe.cmmi = 2.0
+http-parser = 0.8.3
 huBarcode = 0.63
 inotifyx = 0.2.0
-ipdb = 0.7
-ipython = 0.13.2
+ipdb = 0.8
+ipython = 1.1.0
 meld3 = 0.6.10
-mr.developer = 1.25
 netaddr = 0.7.10
 netifaces = 0.8_1
-ordereddict = 1.1
-paramiko = 1.10.1
+paramiko = 1.12.0
 plone.recipe.command = 1.1
 ply = 3.4
 polib = 1.0.3
-psutil = 0.7.1
-pyPdf = 1.13
+psutil = 1.2.1
 pyflakes = 0.7.2
-python-ldap = 2.4.10
-python-magic = 0.4.3
-qrcode = 2.7
-requests = 1.2.3
-restkit = 4.2.1
+python-ldap = 2.4.13
+python-magic = 0.4.6
+qrcode = 4.0.4
+requests = 2.1.0
+restkit = 4.2.2
 rtjp-eventlet = 0.3.2
 slapos.core = 0.35.1
 slapos.recipe.build = 0.12
 slapos.recipe.template = 2.5
 slapos.toolbox = 0.33.1
 smmap = 0.8.2
-socketpool = 0.5.2
-spyne = 2.10.7
+socketpool = 0.5.3
+spyne = 2.10.9
 supervisor = 3.0b2
 threadframe = 0.2
 timerserver = 2.0.2
 urlnorm = 1.1.2
 uuid = 1.30
-validictory = 0.9.1
+validictory = 0.9.3
 xml-marshaller = 0.9.7
 xupdate-processor = 0.4
 zope.app.debug = 3.4.1
 zope.app.dependable = 3.5.1
 zope.app.form = 4.0.2
+pylint = 1.1.0

stack/erp5/instance-kumofs.cfg.in

@@ -45,7 +45,8 @@ gateway-port = {{ tcpv4_port + 3 }}
 {% if ram_storage_size -%}
 data-path = *#capsiz={{ ram_storage_size }}m
 {% else -%}
-data-directory = ${directory:kumofs-data}
+# (with 10M buckets and HDBTLARGE option)
+data-path = ${directory:kumofs-data}/kumodb.tch#bnum=10485760#opts=l
 {% endif -%}
 
 # Paths: Running wrappers

stack/erp5/instance-zope.cfg.in

@@ -308,4 +308,8 @@ parts +=
   erp5-promise
   {{ part_list | join('\n  ') }}
   publish-zope
+versions = versions
+
+[versions]
+slapos.core = {{ slapos_core_version }}
 {% endif %}

stack/erp5/instance.cfg.in

@@ -25,6 +25,7 @@ context =
     key slap_software_type slap-configuration:slap-software-type
     key slapparameter_dict slap-configuration:configuration
     key computer_id slap-configuration:computer
+    raw slapos_core_version {{ slapos_core_version }}
     ${:extra-context}
 
 [dynamic-template-cloudooo-parameters]

stack/resilient/TODO.txt

+* Report, from pbs and from clone, when a backup failed
+* Make sure, when a takeover is done, that "importer" script finishes to run while importer instance is changed into exporter.
+* Test that, after a successful backup/takeover, another backup is possible and will be successful.
+
+* PBSs and mirrors should monitor/replace themselves
+* Report errors from backup
+
+* If a PBS master is down and then back again, it might want to participate in the ongoing election, then.. what happens?
+* If the network is partitioned (the two backups don't see each other, but each can see the slapos master) there will be two concurrent elections taking place, with two winners and two renames.
+
+* How to ensure "synchronization" between two main instances? example: Wordpress: mysql is down, then replaced, then inconsistency between apache and the new mysql
+* How to deal with big data? I.e how to have working backup/restore system of 1TB data with slow connection?
+* How to be sure that elected importer contains a/ the latest data and b/ has finished to pull. We should prevent importer not having a/ and b/ to become the main.
+
+* Should we crypt backed up data?
+
+* If a PBS is lost, a new PBS should be created from another one, in order ot keep history
+
+* If an election takes place and asks for a rename, but no slapgrid is running (or takes too much) then another election will take place
+and ask to rename the previously selected winner, thus breaking the resiliency system.

stack/resilient/buildout.cfg

 [buildout]
 extends =
+  ../../component/apache/buildout.cfg
+  ../../component/bash/buildout.cfg
   ../../component/dropbear/buildout.cfg
   ../../component/gzip/buildout.cfg
   ../../component/rdiff-backup/buildout.cfg
   ../../component/rsync/buildout.cfg
 
 parts =
-  rdiff-backup
+  collective.recipe.template-egg
   pbsready
   pbsready-import
   pbsready-export
@@ -16,7 +18,12 @@ parts =
 
   # needed tools for resiliency
   gzip
+  rdiff-backup
+  dash
 
+[collective.recipe.template-egg]
+recipe = zc.recipe.egg
+eggs = collective.recipe.template
 
 #----------------
 #--
@@ -30,7 +37,7 @@ parts =
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/pbsready.cfg.in
 output = ${buildout:directory}/pbsready.cfg
-md5sum = 9f4212a79f10bee8f6d75061943110e2
+md5sum = 02a5f1741d6b732519c06b522dbe0d66
 mode = 0644
 
 [pbsready-import]
@@ -39,7 +46,7 @@ mode = 0644
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/pbsready-import.cfg.in
 output = ${buildout:directory}/pbsready-import.cfg
-md5sum = 3c2e73f49abdc52282fc045e6d91f3e9
+md5sum = 0f953067aac3e0132f72fc7e1ed38bd4
 mode = 0644
 
 [pbsready-export]
@@ -48,27 +55,27 @@ mode = 0644
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/pbsready-export.cfg.in
 output = ${buildout:directory}/pbsready-export.cfg
-md5sum = ef3861861746d3574f39f1aa3200d74e
+md5sum = 135638b8c513c7723efb51e3d9182ae9
 mode = 0644
 
 [template-pull-backup]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-pull-backup.cfg.in
 output = ${buildout:directory}/instance-pull-backup.cfg
-md5sum = c67a9dad66490ae264f9e7003521bf59
+md5sum = c49e5911b94078d87b94507fb4efc93b
 mode = 0644
 
 [template-replicated]
 recipe = slapos.recipe.download
 url = ${:_profile_base_location_}/template-replicated.cfg.in
-#md5sum = 9e20f283bf709c63c9c6692d5e1f8972
+md5sum = 771e1ab7e7e77b35116c57bbae56ba62
 mode = 0644
 destination = ${buildout:directory}/template-replicated.cfg.in
 
 [template-parts]
 recipe = slapos.recipe.download
 url = ${:_profile_base_location_}/template-parts.cfg.in
-md5sum = c942f82552fcb42fc74a5f896e0cd5f3
+md5sum = a3f55a20881c3f1ec4416662146c06f7
 mode = 0644
 destination = ${buildout:directory}/template-parts.cfg.in
 
@@ -81,9 +88,15 @@ url = ${:_profile_base_location_}/instance-frozen.cfg.in
 md5sum = d21472f0e58f928fb827f2cbf22c4d4a
 output = ${buildout:directory}/instance-frozen.cfg
 
+[resilient-web-takeover-cgi-script-download]
+recipe = slapos.recipe.download
+url = ${:_profile_base_location_}/resilient-web-takeover-cgi-script.py.in
+md5sum = e6262c5cf9b1c4d1ea4d959fdcbe3070
+mode = 0644
+destination = ${buildout:directory}/resilient-web-takeover-cgi-script.py.in
+
 [versions]
 # Pin Jinja2 to 2.6, as 2.7 breaks current code
 Jinja2 = 2.6
 # ... And newer s.r.template requires Jinja2 >= 2.7
 slapos.recipe.template = 2.4.2
-

stack/resilient/instance-pull-backup.cfg.in

@@ -75,7 +75,7 @@ callbacks = $${directory:notifier-callbacks}
 id-file = $${rootdirectory:etc}/notifier.id
 equeue-socket = $${equeue:socket}
 host = $${slap-network-information:global-ipv6}
-port = 8080
+port = 8088
 wrapper = $${basedirectory:services}/notifier
 server-binary = ${buildout:bin-directory}/pubsubserver
 notifier-binary = ${buildout:bin-directory}/pubsubnotifier
@@ -105,6 +105,7 @@ promises-directory = $${basedirectory:promises}
 directory = $${directory:pbs-backup}
 cron-entries = $${cron:cron-entries}
 wrappers-directory = $${directory:pbs-wrappers}
+run-directory = $${basedirectory:run}
 # XXX: this should be named "notifier-host"
 notifier-url = http://[$${notifier:host}]:$${notifier:port}
 slave-instance-list = $${slap-parameter:slave_instance_list}

stack/resilient/parameter-schema.json

+{
+  "$schema": "http://json-schema.org/draft-04/schema",
+  "title": "Resiliency Parameters",
+  "description": "List of possible parameters used in the resilient stack",
+  "type": "object",
+
+  "properties": {
+    "-sla-0-computer_guid": {
+      "title": "Target computer for main instance",
+      "description": "Target computer GUID for main instance.",
+      "type": "string"
+    },
+    "-sla-1-computer_guid": {
+      "title": "Target computer for first clone",
+      "description": "Target computer for first clone and PBS.",
+      "type": "string"
+    },
+    "-sla-2-computer_guid": {
+      "title": "Target computer for second clone",
+      "description": "Target computer for second clone and PBS.",
+      "type": "string"
+    },
+    "resiliency-backup-periodicity": {
+      "title": "Periodicity of backup",
+      "description": "Periodicity of backup, in cron format. Default is every hour.",
+      "type": "string"
+    },
+    "remove-backup-older-than": {
+      "title": "Remove backups older than...",
+      "description": "Remove all the backups in PBS that are older than specified value. It should be rdiff-backup-compatible.",
+      "type": "string",
+      "default": "2W"
+    }
+  }
+}

stack/resilient/pbsready-export.cfg.in

@@ -14,11 +14,24 @@ parts =
   sshkeys-authority
   dropbear-server
   sshkeys-dropbear
+  resilient-sshkeys-dropbear-promise
   dropbear-server-pbs-authorized-key
   notifier
 
   cron-entry-backup
 
+[resilient-directory]
+recipe = slapos.cookbook:mkdirectory
+home = $${buildout:directory}
+var = $${:home}/var
+pid = $${:var}/pid
+
+# Define port of ssh server. It has to be different from import so that it
+# supports export/import using same IP (slaprunner, slapos-in-partition,
+# ipv4...)
+[dropbear-server]
+port = 22221
+
 [resilient-publish-connection-parameter]
 notification-id = http://[$${notifier:host}]:$${notifier:port}/get/$${notifier-exporter:name}
 
@@ -32,6 +45,7 @@ title = Dumping $${slap-parameter:namebase}
 executable = $${exporter:wrapper}
 wrapper = $${rootdirectory:bin}/exporter
 notify = $${slap-parameter:notify}
+pidfile = $${resilient-directory:pid}/$${:name}.pid
 
 [cron-entry-backup]
 # Schedule the periodic database dump.
@@ -39,10 +53,10 @@ notify = $${slap-parameter:notify}
 <= cron
 recipe = slapos.cookbook:cron.d
 name = backup
-frequency = $${slap-parameter:resiliency-backup-periodicity} * * * *
+frequency = $${slap-parameter:resiliency-backup-periodicity}
 command = $${notifier-exporter:wrapper}
 
 [slap-parameter]
-# in minutes, modulo 60, in cron.d format (i.e */15 is accepted).
-resiliency-backup-periodicity = 0
+# In cron.d format (i.e things like */15 * * * * are accepted).
+resiliency-backup-periodicity = 0 0 * * *
 

stack/resilient/pbsready-import.cfg.in

@@ -14,14 +14,27 @@ parts =
   sshkeys-authority
   dropbear-server
   sshkeys-dropbear
+  resilient-sshkeys-dropbear-promise
   dropbear-server-pbs-authorized-key
   notifier
 
+  resilient-web-takeover-cgi-script
+  resilient-web-takeover-httpd-wrapper
+  resilient-web-takeover-httpd-promise
+
   import-on-notification
   resilient-publish-connection-parameter
 
 [resilient-publish-connection-parameter]
 notification-url = http://[$${notifier:host}]:$${notifier:port}/notify
+takeover-url = http://[$${resilient-web-takeover-httpd-configuration-file:listening-ip}]:$${resilient-web-takeover-httpd-configuration-file:listening-port}/
+takeover-password = $${resilient-web-takeover-password:passwd}
+
+# Define port of ssh server. It has to be different from import so that it
+# supports export/import using same IP (slaprunner, slapos-in-partition,
+# ipv4...)
+[dropbear-server]
+port = 22220
 
 [import-on-notification]
 # notifier.callback runs a script when a notification (sent by a parent PBS)
@@ -30,3 +43,67 @@ notification-url = http://[$${notifier:host}]:$${notifier:port}/notify
 recipe = slapos.cookbook:notifier.callback
 on-notification-id = $${slap-parameter:on-notification}
 callback = $${importer:wrapper}
+
+###########
+# Deploy a webserver allowing to do takeover from a web browser.
+###########
+[resilient-web-takeover-password]
+recipe = slapos.cookbook:generate.password
+storage-path = $${directory:srv}/passwd
+bytes = 8
+
+[resilient-web-takeover-cgi-script]
+recipe = collective.recipe.template
+input = ${resilient-web-takeover-cgi-script-download:destination}
+output = $${directory:cgi-bin}/web-takeover.cgi
+password = $${resilient-web-takeover-password:passwd}
+mode = 700
+
+# XXX could it be something lighter?
+# XXX Add SSL
+[resilient-web-takeover-httpd-configuration-file]
+recipe = collective.recipe.template
+input = inline:
+  PidFile "$${:pid-file}"
+  Listen [$${:listening-ip}]:$${:listening-port}
+  ServerAdmin someone@email
+  DocumentRoot "$${:document-root}"
+  ErrorLog "$${:error-log}"
+  LoadModule unixd_module modules/mod_unixd.so
+  LoadModule access_compat_module modules/mod_access_compat.so
+  LoadModule authz_core_module modules/mod_authz_core.so
+  LoadModule authz_host_module modules/mod_authz_host.so
+  LoadModule mime_module modules/mod_mime.so
+  LoadModule cgid_module modules/mod_cgid.so
+  LoadModule dir_module modules/mod_dir.so
+  ScriptSock $${:cgid-pid-file}
+  <Directory $${:document-root}>
+    # XXX: security????
+    Options +ExecCGI
+    AddHandler cgi-script .cgi
+    DirectoryIndex web-takeover.cgi
+  </Directory>
+output = $${directory:etc}/resilient-web-takeover-httpd.conf
+# md5sum =
+listening-ip = $${slap-network-information:global-ipv6}
+# XXX: randomize-me
+listening-port = 9263
+htdocs = $${directory:cgi-bin}
+pid-file = $${directory:run}/resilient-web-takeover-httpd.pid
+cgid-pid-file = $${directory:run}/resilient-web-takeover-httpd-cgid.pid
+document-root = $${directory:cgi-bin}
+error-log = $${directory:log}/resilient-web-takeover-httpd-error-log
+
+[resilient-web-takeover-httpd-wrapper]
+recipe = slapos.cookbook:wrapper
+apache-executable = ${apache:location}/bin/httpd
+command-line = $${:apache-executable} -f $${resilient-web-takeover-httpd-configuration-file:output} -DFOREGROUND
+wrapper-path = $${basedirectory:services}/resilient-web-takeover-httpd
+
+[resilient-web-takeover-httpd-promise]
+recipe = slapos.cookbook:check_url_available
+path = $${basedirectory:promises}/resilient-web-takeover-httpd
+url = http://[$${resilient-web-takeover-httpd-configuration-file:listening-ip}]:$${resilient-web-takeover-httpd-configuration-file:listening-port}/
+dash_path = ${dash:location}/bin/dash
+curl_path = ${curl:location}/bin/curl
+

stack/resilient/pbsready.cfg.in

@@ -10,6 +10,7 @@ parts =
   sshkeys-authority
   dropbear-server
   sshkeys-dropbear
+  resilient-sshkeys-dropbear-promise
   dropbear-server-pbs-authorized-key
   notifier
 
@@ -49,6 +50,7 @@ crontabs = $${rootdirectory:etc}/crontabs
 cronstamps = $${rootdirectory:etc}/cronstamps
 logrotate-entries = $${rootdirectory:etc}/logrotate.d
 logrotate-backup = $${basedirectory:backup}/logrotate
+cgi-bin = $${rootdirectory:srv}/cgi-bin
 
 #----------------
 #--
@@ -179,6 +181,27 @@ server-binary = ${buildout:bin-directory}/pubsubserver
 notifier-binary = ${buildout:bin-directory}/pubsubnotifier
 
 
+#----------------
+#--
+#-- Dropbear.
+
+[dropbear-server]
+recipe = slapos.cookbook:dropbear
+host = $${slap-network-information:global-ipv6}
+# Explicitely excludes to define "port" argument. It will be defined in
+# pbs-ready-import.cfg.in and pbs-ready-export.cfg.in
+home = $${directory:ssh}
+wrapper = $${rootdirectory:bin}/raw_sshd
+shell = $${rdiff-backup-server:wrapper}
+rsa-keyfile = $${directory:ssh}/server_key.rsa
+dropbear-binary = ${dropbear:location}/sbin/dropbear
+
+[dropbear-server-pbs-authorized-key]
+<= dropbear-server
+recipe = slapos.cookbook:dropbear.add_authorized_key
+key = $${slap-parameter:authorized-key}
+
+
 #----------------
 #--
 #-- sshkeys
@@ -205,30 +228,21 @@ public-key = $${dropbear-server:rsa-keyfile}.pub
 private-key = $${dropbear-server:rsa-keyfile}
 wrapper = $${basedirectory:services}/sshd
 
-
-#----------------
-#--
-#-- Dropbear.
-
-[dropbear-server]
-recipe = slapos.cookbook:dropbear
-host = $${slap-network-information:global-ipv6}
-port = 2222
-home = $${directory:ssh}
-wrapper = $${rootdirectory:bin}/raw_sshd
-shell = $${rdiff-backup-server:wrapper}
-rsa-keyfile = $${directory:ssh}/server_key.rsa
-dropbear-binary = ${dropbear:location}/sbin/dropbear
-
-[dropbear-server-pbs-authorized-key]
-<= dropbear-server
-recipe = slapos.cookbook:dropbear.add_authorized_key
-key = $${slap-parameter:authorized-key}
+[resilient-sshkeys-dropbear-promise]
+# Check that public key file exists and is not empty
+recipe = collective.recipe.template
+input = inline:#!${bash:location}/bin/bash
+  PUBLIC_KEY_CONTENT="$${sshkeys-dropbear:public-key-value}"
+  if [[ ! -n "$PUBLIC_KEY_CONTENT" || "$PUBLIC_KEY_CONTENT" == *None* ]]; then
+    exit 1
+  fi
+output = $${basedirectory:promises}/public-key-existence
+mode = 700
 
 
 #----------------
 #--
-#-- Conncetion informations to re-use.
+#-- Connection informations to re-use.
 # XXX-Cedric: when "aggregation" system is done in libslap, directly publish.
 [resilient-publish-connection-parameter]
 recipe = slapos.cookbook:publish

stack/resilient/resilient-web-takeover-cgi-script.py.in

+#!${buildout:executable}
+import cgi
+import cgitb
+import os
+import subprocess
+import sys
+cgitb.enable()
+
+print "Content-Type: text/html"
+print    
+
+form = cgi.FieldStorage()
+if "password" not in form:
+  print """<html>
+<body>
+  <h1>This is takeover web interface.</h1>
+  <p>Calling takeover will stop and freeze the current main instance, and make this clone instance the new main instance, replacing the old one.</p>
+  <p><b>Warning: submit the form only if you understand what you are doing.</b></p>
+  <p>Note: the password asked here can be found within the parameters of your SlapOS instance page.</p>
+  <form action="/">
+    Password: <input type="text" name="password">
+    <input type="submit" value="Take over" style="background: red;">
+  </form>
+</body>
+</html>"""
+  sys.exit(0)
+
+if form['password'].value != '${:password}':
+  print "<H1>Error</H1>"
+  print "Password is invalid."
+  sys.exit(1)
+
+# XXX hardcoded location
+result = subprocess.check_output([os.path.expanduser("~/bin/takeover")], stderr=subprocess.STDOUT)
+print 'Success.'
+print '<pre>%s</pre>' % result

stack/resilient/template-parts.cfg.in

@@ -4,18 +4,21 @@
 
   request-{{namebase}}
   request-{{namebase}}-2
+  resilient-request-{{namebase}}-public-key-promise
   
-  {% for i in range(1,nbbackup|int) %}
-  request-{{namebase}}-pseudo-replicating-{{i}}
-  request-{{namebase}}-pseudo-replicating-{{i}}-2
+  {% for id in range(1,nbbackup|int) %}
+  request-{{namebase}}-pseudo-replicating-{{id}}
+  request-{{namebase}}-pseudo-replicating-{{id}}-2
+  resilient-request-{{namebase}}-pseudo-replicating-{{id}}-public-key-promise
   {% endfor %}
   
-  {% for i in range(1,nbbackup|int) %}
-  request-pbs-{{namebase}}-{{i}}
-  request-pull-backup-server-{{namebase}}-{{i}}
-  request-pull-backup-server-{{namebase}}-backup-{{i}}
+  {% for id in range(1,nbbackup|int) %}
+  request-pbs-{{namebase}}-{{id}}
+  resilient-request-pbs-{{namebase}}-{{id}}-public-key-promise
+  request-pull-backup-server-{{namebase}}-{{id}}
+  request-pull-backup-server-{{namebase}}-backup-{{id}}
   {% endfor %}
-  
+
 
 
   {% endmacro %}

stack/resilient/template-replicated.cfg.in

@@ -11,6 +11,13 @@
 {% endif -%}
 
 
+[resilient-directory]
+recipe = slapos.cookbook:mkdirectory
+home = ${buildout:directory}
+etc = ${:home}/etc
+promise = ${:etc}/promise
+
+
 ## Tells the Backupable recipe that we want a backup
 [resilient]
 recipe = slapos.cookbook:request
@@ -28,7 +35,6 @@ software-url = ${slap-connection:software-release-url}
 software-type = {{typeexport}}
 name = {{namebase}}0
 return = ssh-public-key ssh-url notification-id ip
-
 config =
 # Resilient related parameters
   number authorized-key notify ip-list namebase
@@ -45,7 +51,10 @@ config-ip-list =
 {% for parameter_name, parameter_value in slapparameter_dict.items() %}config-{{parameter_name}} = {{parameter_value}}
 {% endfor %}
 {% endif %}
-{% if sla_parameter_dict -%}
+{% if sla_parameter_dict == {} -%}
+sla = mode
+sla-mode = unique_by_network
+{% else %}
 {%   set sla_key_main = "-sla-%s%s-" % (namebase, 0) -%}
 {%   set sla_key_secondary = "-sla-%s-" % (0) -%}
 {%   set sla_key_main_length = sla_key_main | length -%}
@@ -79,14 +88,17 @@ software-url = ${slap-connection:software-release-url}
 software-type = {{typeimport}}
 return = ssh-public-key ssh-url notification-url ip
 
-pbs-notification-id = ${slap-connection:computer-id}-${slap-connection:partition-id}-{{namebase}}-push
+pbs-notification-id = ${slap-connection:computer-id}-${slap-connection:partition-id}-{{namebase}}-{{id}}-push
 
 config = number authorized-key on-notification ip-list namebase
 config-number = {{id}}
 config-authorized-key = ${request-pbs-{{namebase}}-{{id}}:connection-ssh-key}
 config-on-notification = ${request-pbs-{{namebase}}-{{id}}:connection-feeds-url}${:pbs-notification-id}
 config-ip-list =
-{% if sla_parameter_dict -%}
+{% if sla_parameter_dict == {} -%}
+sla = mode
+sla-mode = unique_by_network
+{% else %}
 {%   set sla_key_main = "-sla-%s%s-" % (namebase, id) -%}
 {%   set sla_key_secondary = "-sla-%s-" % (id) -%}
 {%   set sla_key_main_length = sla_key_main | length -%}
@@ -107,9 +119,9 @@ sla-{{ key }} = {{ value }}
 {%   endif %}
 {% endif %}
 
-
 {% endfor -%}
 
+
 [iplist]
 config-ip-list = ${request-{{namebase}}:connection-ip}{% for j in range(1,nbbackup|int) %} ${request-{{namebase}}-pseudo-replicating-{{j}}:connection-ip}{% endfor %}
 
@@ -117,11 +129,37 @@ config-ip-list = ${request-{{namebase}}:connection-ip}{% for j in range(1,nbback
 <= request-{{namebase}}
    iplist
 
+[resilient-request-{{namebase}}-public-key-promise]
+# Check that public-key-value parameter exists and is not empty
+# XXX: maybe we should consider empty values to be non-nexistent.
+recipe = collective.recipe.template
+# XXX: don't use system executable
+input = inline:#!/bin/sh
+  PUBLIC_KEY_CONTENT="${request-{{namebase}}-2:connection-ssh-public-key})"
+  if [[ ! -n "$PUBLIC_KEY_CONTENT" || "$PUBLIC_KEY_CONTENT" == *None* ]]; then
+    exit 1
+  fi
+output = ${resilient-directory:promise}/resilient-request-{{namebase}}-public-key
+mode = 700
+
 {% for id in range(1,nbbackup|int) %}
 [request-{{namebase}}-pseudo-replicating-{{id}}-2]
 <= request-{{namebase}}-pseudo-replicating-{{id}}
    iplist
 
+[resilient-request-{{namebase}}-pseudo-replicating-{{id}}-public-key-promise]
+# Check that public-key-value parameter exists and is not empty
+# XXX: maybe we should consider empty values to be non-nexistent.
+recipe = collective.recipe.template
+# XXX: don't use system executable
+input = inline:#!/bin/sh
+  PUBLIC_KEY_CONTENT="${request-{{namebase}}-pseudo-replicating-{{id}}-2:connection-ssh-public-key})"
+  if [[ ! -n "$PUBLIC_KEY_CONTENT" || "$PUBLIC_KEY_CONTENT" == *None* ]]; then
+    exit 1
+  fi
+output = ${resilient-directory:promise}/resilient-request-{{namebase}}-pseudo-replicating-{{id}}-public-key
+mode = 700
+
 {% endfor %}
 
 
@@ -133,8 +171,6 @@ config-ip-list = ${request-{{namebase}}:connection-ip}{% for j in range(1,nbback
 ## Having 3 backups pulling from the same PBS provides
 ##only availability, not resiliency
 
-## WARNING : SLAVES ARE ALLOCATED AT RANDOM, THIS NEEDS TO BE FIXED.
-
 [request-pbs-common]
 <= slap-connection
 recipe = slapos.cookbook:request
@@ -148,7 +184,10 @@ software-type = pull-backup
 name = PBS ({{namebase}} / {{id}})
 return = ssh-key notification-url feeds-url
 slave = false
-{% if sla_parameter_dict -%}
+{% if sla_parameter_dict == {} -%}
+sla = mode
+sla-mode = unique_by_network
+{% else %}
 {%   set sla_key_main = "-sla-%s%s-" % ("pbs", id) -%}
 {%   set sla_key_secondary = "-sla-%s-" % (id) -%}
 {%   set sla_key_main_length = sla_key_main | length -%}
@@ -169,19 +208,33 @@ sla-{{ key }} = {{ value }}
 {%   endif %}
 {% endif %}
 
+[resilient-request-pbs-{{namebase}}-{{id}}-public-key-promise]
+# Check that public-key-value parameter exists and is not empty
+# XXX: maybe we should consider empty values to be non-nexistent.
+recipe = collective.recipe.template
+# XXX: don't use system executable
+input = inline:#!/bin/sh
+  PUBLIC_KEY_CONTENT="${request-pbs-{{namebase}}-{{id}}:connection-ssh-key}:connection-ssh-key})"
+  if [[ ! -n "$PUBLIC_KEY_CONTENT" || "$PUBLIC_KEY_CONTENT" == *None* ]]; then
+    exit 1
+  fi
+output = ${resilient-directory:promise}/resilient-request-{{namebase}}-pseudo-replicating-{{id}}-public-key
+mode = 700
+
 
 [request-pull-backup-server-{{namebase}}-{{id}}]
 <= request-pbs-common
 name = PBS {{id}} pulling from ${request-{{namebase}}:name}
-config = url name type server-key on-notification notify notification-id title
+config = url name type server-key on-notification notify notification-id title remove-backup-older-than
 config-url = ${request-{{namebase}}:connection-ssh-url}
-config-name = ${slap-connection:computer-id}-${slap-connection:partition-id}-{{namebase}}-{{id}}
 config-type = pull
 config-server-key = ${request-{{namebase}}:connection-ssh-public-key}
 config-on-notification = ${request-{{namebase}}:connection-notification-id}
 config-notify = ${request-pbs-{{namebase}}-{{id}}:connection-notification-url}
 config-notification-id = ${slap-connection:computer-id}-${slap-connection:partition-id}-{{namebase}}-{{id}}-pull
+config-name = ${slap-connection:computer-id}-${slap-connection:partition-id}-{{namebase}}-{{id}}
 config-title = Pulling from {{namebase}}
+config-remove-backup-older-than = {{ slapparameter_dict.get('remove-backup-older-than', '2W') }}
 slave = true
 sla = instance_guid
 sla-instance_guid = ${request-pbs-{{namebase}}-{{id}}:instance_guid}
@@ -191,12 +244,12 @@ sla-instance_guid = ${request-pbs-{{namebase}}-{{id}}:instance_guid}
 name = PBS pushing on ${request-{{namebase}}-pseudo-replicating-{{id}}:name}
 config = url name type server-key on-notification notify notification-id title
 config-url = ${request-{{namebase}}-pseudo-replicating-{{id}}:connection-ssh-url}
-config-name = ${request-pull-backup-server-{{namebase}}-{{id}}:config-name}
 config-type = push
 config-server-key = ${request-{{namebase}}-pseudo-replicating-{{id}}:connection-ssh-public-key}
 config-on-notification = ${request-pbs-{{namebase}}-{{id}}:connection-feeds-url}${request-pull-backup-server-{{namebase}}-{{id}}:config-notification-id}
 config-notify = ${request-{{namebase}}-pseudo-replicating-{{id}}:connection-notification-url}
 config-notification-id = ${request-{{namebase}}-pseudo-replicating-{{id}}:pbs-notification-id}
+config-name = ${slap-connection:computer-id}-${slap-connection:partition-id}-{{namebase}}-{{id}}
 config-title = Pushing to {{namebase}} backup {{id}}
 slave = true
 sla = instance_guid

stack/slapos.cfg

@@ -12,6 +12,7 @@ extensions +=
 # Use shacache and lxml
 extends =
   ../component/lxml-python/buildout.cfg
+  ../component/python-openssl/buildout.cfg
 
 # Separate from site eggs
 allowed-eggs-from-site-packages =
@@ -59,6 +60,7 @@ networkcache-section = networkcache
 recipe = zc.recipe.egg
 eggs =
   ${lxml-python:egg}
+  ${python-openssl:egg}
   slapos.cookbook
   cliff
   hexagonit.recipe.download
@@ -81,6 +83,8 @@ hexagonit.recipe.download = 1.7nxd002
 # Use pinned version of setuptools. Other versions work, but changing
 # version makes buildout recompile everything. Developers' nightmare.
 setuptools = 0.9.8
+# Official egg of prettytable has permission problems in EGG-INFO.
+prettytable = 0.7.3-nxd001
 
 [networkcache]
 download-cache-url = http://www.shacache.org/shacache