Merge branch 'erp5' into erp5-z2.13

component/stunnel/buildout.cfg

@@ -17,12 +17,13 @@ filename = stunnel-4-hooks.py
 
 [stunnel-4]
 recipe = slapos.recipe.cmmi
-url = ftp://ftp.stunnel.org/stunnel/archive/4.x/stunnel-4.55.tar.gz
-md5sum = ebe6670368d30c6a01ca33b9c50cb239
+url = https://www.stunnel.org/downloads/stunnel-4.56.tar.gz
+md5sum = ac4c4a30bd7a55b6687cbd62d864054c
 pre-configure-hook = ${stunnel-4-hook-download:location}/${stunnel-4-hook-download:filename}:pre_configure_hook
 configure-options =
   --enable-ipv6
   --disable-libwrap
+  --disable-fips
   --with-ssl=${openssl:location}
 environment =
   CPPFLAGS=-I${zlib:location}/include

slapos/recipe/apache_zope_backend/template/vhost.in

 Listen %(ip)s:%(port)s
 <VirtualHost *:%(port)s>
   %(ssl_enable)s
-  RewriteRule (.*) %(backend)s%(backend-path)s$1 [L,P]
+  RewriteRule ^/(.*) %(backend)s%(backend-path)s/$1 [L,P]
 </VirtualHost>

slapos/recipe/generic_varnish/__init__.py

@@ -39,9 +39,28 @@ class Recipe(GenericSlapRecipe):
     ip = self.options['ip']
     backend_url = self.parameter_dict['tidstorage-url']
     backend_server, backend_port = self._getBackendServer(backend_url)
+    path_list = []
+    if backend_url.startswith('https://'):
+      config = dict(
+        stunnel_binary=self.options['stunnel-binary'],
+        stunnel_server=ip,
+        stunnel_port=int(self.options['stunnel-port']),
+        stunnel_pid_file=self.options['stunnel-pid-file'],
+        stunnel_conf_file=self.options['stunnel-conf-file'],
+        shell_path=self.options['shell-path'],
+        backend_server=backend_server.replace('[', '').replace(']', ''),
+        backend_port=backend_port,
+      )
+      path_list.append(self.createExecutable(self.options['stunnel-wrapper'],
+        self.substituteTemplate(self.getTemplateFilename('stunnel.in'),
+          config)))
+      path_list.append(self.createFile(self.options['stunnel-conf-file'],
+        self.substituteTemplate(self.getTemplateFilename('stunnel.conf.in'),
+          config)))
+      backend_server = ip
+      backend_port = int(self.options['stunnel-port'])
     varnishd_manager_port = int(self.options['manager-port'])
     varnishd_server_port = int(self.options['server-port'])
-    path_list = []
     config = dict(
       varnishd_binary=self.options['varnishd-binary'],
       varnish_ip=ip,

slapos/recipe/generic_varnish/template/stunnel.conf.in

+foreground = yes
+pid = %(stunnel_pid_file)s
+debug = 4
+
+[remote]
+accept = %(stunnel_server)s:%(stunnel_port)s
+client = yes
+connect = %(backend_server)s:%(backend_port)s
+sni = %(stunnel_server)s

slapos/recipe/generic_varnish/template/stunnel.in

+#!%(shell_path)s
+DAEMON_OPTS="%(stunnel_conf_file)s"
+exec %(stunnel_binary)s ${DAEMON_OPTS} 2>&1

slapos/recipe/generic_varnish/template/varnishd.in

@@ -11,6 +11,4 @@ DAEMON_OPTS="-F \
 PIDFILE=%(varnishd_pid_file)s
 # exporting PATH here so that we will pass the PATH variable to the subprocess
 export PATH
-output=$(/bin/tempfile -s.varnish)
-exec %(varnishd_binary)s -P ${PIDFILE} ${DAEMON_OPTS} > ${output} 2>&1
-
+exec %(varnishd_binary)s -P ${PIDFILE} ${DAEMON_OPTS} 2>&1

slapos/recipe/generic_varnish/template/varnishlogd.in

@@ -18,5 +18,4 @@ if [ -z "${VARNISHLOG_ENABLED}" ] || \
   exit 0;
 fi
 
-output=$(/bin/tempfile -s.varnish)
-exec %(varnishlog_binary)s ${DAEMON_OPTS} > ${output} 2>&1
+exec %(varnishlog_binary)s ${DAEMON_OPTS} 2>&1

slapos/recipe/generic_zope/__init__.py

@@ -35,11 +35,22 @@ _isurl = re.compile('([a-zA-Z0-9+.-]+)://').match
 
 # based on Zope2.utilities.mkzopeinstance.write_inituser
 def Zope2InitUser(path, username, password):
+  # Set password only once
+  # Currently, rely on existence of a simple file:
+  # Create it the first time, then next time, detect this file and do no-op.
+  inituser_done_path = '%s_done' % path
+  if os.path.exists(inituser_done_path):
+    return
+
+  if os.path.exists(path):
+    return
   open(path, 'w').write('')
   os.chmod(path, 0600)
-  open(path, "w").write('%s:{SHA}%s\n' % (
+  open(path, 'w').write('%s:{SHA}%s\n' % (
     username,binascii.b2a_base64(hashlib.sha1(password).digest())[:-1]))
 
+  open(inituser_done_path, 'w').write('"inituser" file already created once.')
+
 class Recipe(GenericBaseRecipe):
   def _options(self, options):
     options['password'] = self.generatePassword()

slapos/recipe/generic_zope_zeo_client/__init__.py

@@ -35,11 +35,22 @@ _isurl = re.compile('([a-zA-Z0-9+.-]+)://').match
 
 # based on Zope2.utilities.mkzopeinstance.write_inituser
 def Zope2InitUser(path, username, password):
+  # Set password only once
+  # Currently, rely on existence of a simple file:
+  # Create it the first time, then next time, detect this file and do no-op.
+  inituser_done_path = '%s_done' % path
+  if os.path.exists(inituser_done_path):
+    return
+
+  if os.path.exists(path):
+    return
   open(path, 'w').write('')
   os.chmod(path, 0600)
-  open(path, "w").write('%s:{SHA}%s\n' % (
+  open(path, 'w').write('%s:{SHA}%s\n' % (
     username,binascii.b2a_base64(hashlib.sha1(password).digest())[:-1]))
 
+  open(inituser_done_path, 'w').write('"inituser" file already created once.')
+
 class Recipe(GenericBaseRecipe):
   def _options(self, options):
     options['password'] = self.generatePassword()

stack/erp5/buildout.cfg

@@ -47,6 +47,7 @@ extends =
   ../../component/python-2.7/buildout.cfg
   ../../component/python-ldap-python/buildout.cfg
   ../../component/rdiff-backup/buildout.cfg
+  ../../component/stunnel/buildout.cfg
   ../../component/subversion/buildout.cfg
   ../../component/tesseract/buildout.cfg
   ../../component/varnish/buildout.cfg
@@ -75,6 +76,7 @@ parts =
   graphviz
   haproxy
   jsl
+  stunnel
   varnish-3.0
   w3m
   poppler
@@ -218,7 +220,7 @@ mode = 640
 # XXX: "template.cfg" is hardcoded in instanciation recipe
 filename = template.cfg
 template = ${:_profile_base_location_}/instance.cfg.in
-md5sum = fbb7ea50d7ea6d4e25725801cc3fd5f9
+md5sum = a1a5a9983207e4a8128bab331cbd3cd5
 extra-context =
     key apache_location apache:location
     key aspell_location aspell:location
@@ -257,6 +259,7 @@ extra-context =
     key openssl_location openssl:location
     key poppler_location poppler:location
     key sed_location sed:location
+    key stunnel_location stunnel:location
     key template_cloudooo template-cloudooo:target
     key template_erp5_single template-erp5-single:target
     key template_erp5_cluster template-erp5-cluster:target
@@ -299,7 +302,7 @@ mode = 640
 [template-varnish]
 recipe = slapos.recipe.build:download
 url = ${:_profile_base_location_}/instance-varnish.cfg.in
-md5sum = 728650f5d20ad637d8d824d1968865ca
+md5sum = ae0465591c22c0cb316c1706965c6b18
 mode = 640
 
 [bt5-repository]

stack/erp5/instance-varnish.cfg.in

@@ -28,18 +28,23 @@ recipe = slapos.cookbook:generic.varnish
 ip = ${slap-network-information:local-ipv4}
 server-port = 6001
 manager-port = 6002
+stunnel-port = 6003
 
 # Paths: Running wrappers
 varnishd-wrapper = ${basedirectory:services}/varnishd
 varnishlog-wrapper = ${rootdirectory:bin}/varnishlog
+stunnel-wrapper = ${basedirectory:services}/stunnel
 
 # Binary information
 varnishd-binary = {{ parameter_dict['varnish'] }}/sbin/varnishd
 varnishlog-binary = {{ parameter_dict['varnish'] }}/bin/varnishlog
 shell-path = {{ parameter_dict['dash'] }}/bin/dash
+stunnel-binary = {{ parameter_dict['stunnel'] }}/bin/stunnel
 # Configuration by VCL
 vcl-file = ${rootdirectory:etc}/default.vcl
 pid-file = ${basedirectory:run}/varnishd.pid
+stunnel-conf-file = ${rootdirectory:etc}/stunnel.conf
+stunnel-pid-file = ${basedirectory:run}/stunnel.pid
 varnish-data = ${directory:varnish-data}
 # this will pass at -n option
 varnish-instance-name = ${directory:varnish-instance}

stack/erp5/instance.cfg.in

@@ -99,6 +99,7 @@ dash = {{ dash_location }}
 dcron = {{ dcron_location }}
 gzip =  {{ gzip_location }}
 logrotate = {{ logrotate_location }}
+stunnel = {{ stunnel_location }}
 varnish = {{ varnish_location }}
 wget = {{ wget_location }}
 buildout-bin-directory = {{ buildout_bin_directory }}