instance.cfg.in

{% import "caucase" as caucase with context %}

[buildout]
parts =
  promises
  publish-connection-parameter
extends =
  {{ template_monitor }}

eggs-directory = {{ buildout['eggs-directory'] }}
develop-eggs-directory = {{ buildout['develop-eggs-directory'] }}
offline = true


[instance-parameter]
recipe = slapos.cookbook:slapconfiguration
computer = ${slap-connection:computer-id}
partition = ${slap-connection:partition-id}
url = ${slap-connection:server-url}
key = ${slap-connection:key-file}
cert = ${slap-connection:cert-file}

[slap-configuration]
# frontend reads from from a part named [slap-configuration]
recipe = slapos.cookbook:slapconfiguration.serialised
computer = ${slap-connection:computer-id}
partition = ${slap-connection:partition-id}
url = ${slap-connection:server-url}
key = ${slap-connection:key-file}
cert = ${slap-connection:cert-file}

[directory]
recipe = slapos.cookbook:mkdirectory
home = ${buildout:directory}
etc = ${:home}/etc
var = ${:home}/var
srv = ${:home}/srv
tmp = ${:home}/tmp
var-log = ${:var}/log
service = ${:etc}/service
promise = ${:etc}/promise
rest-server-data-dir = ${:srv}/restic
backup-caucased = ${:srv}/backup/caucased/

# Macros
[check-port-listening-promise]
recipe = slapos.cookbook:check_port_listening
path = ${directory:promise}/${:_buildout_section_name_}

[check-url-available-promise]
recipe = slapos.cookbook:check_url_available
path = ${directory:promise}/${:_buildout_section_name_}
dash_path = {{ dash_bin }}
curl_path = {{ curl_bin }}

# Caucase
[rest-server-certificate]
key-file = ${directory:etc}/${:_buildout_section_name_}.key
cert-file = ${directory:etc}/${:_buildout_section_name_}.crt
common-name = ${:_buildout_section_name_}
ca-file = ${directory:etc}/${:_buildout_section_name_}.ca.crt
crl-file = ${directory:etc}/${:_buildout_section_name_}.crl

{{
caucase.updater(
    prefix='rest-server-certificate',
    buildout_bin_directory=buildout['bin-directory'],
    updater_path='${directory:service}/rest-server-certificate-updater',
    url='${caucased:url}',
    data_dir='${directory:srv}/caucase-updater',
    crt_path='${rest-server-certificate:cert-file}',
    ca_path='${rest-server-certificate:ca-file}',
    crl_path='${rest-server-certificate:crl-file}',
    key_path='${rest-server-certificate:key-file}',
    template_csr='${rest-server-certificate-prepare-csr:csr}',
    openssl=openssl_bin,
)}}

[rest-server-certificate-csr-config]
recipe = slapos.recipe.template
inline =
  [req]
  prompt = no
  req_extensions = req_ext
  distinguished_name = dn
  [ dn ]
  CN = restic-rest-server
  [ req_ext ]
  subjectAltName = @alt_names
  [ alt_names ]
  IP.1 = ${instance-parameter:ipv4-random}
  IP.2 = ${instance-parameter:ipv6-random}

output = ${buildout:parts-directory}/${:_buildout_section_name_}/${:_buildout_section_name_}.txt

[rest-server-certificate-prepare-csr]
recipe = plone.recipe.command
command =
  if [ ! -f '${:csr}' ] ; then
   {{ openssl_bin }} req \
      -newkey rsa:2048 \
      -batch \
      -new \
      -nodes \
      -keyout /dev/null \
      -config '${rest-server-certificate-csr-config:output}' \
      -out '${:csr}'
  fi
stop-on-error = true
csr = ${directory:srv}/${:_buildout_section_name_}.csr.pem

[caucased]
port = 18080
ip = ${instance-parameter:ipv6-random}
netloc = [${:ip}]:${:port}
url = http://${:netloc}/

{{
caucase.caucased(
    prefix='caucased',
    buildout_bin_directory=buildout['bin-directory'],
    caucased_path='${directory:service}/caucased',
    backup_dir='${directory:backup-caucased}',
    data_dir='${directory:srv}/caucased',
    netloc='${caucased:netloc}',
    tmp='${directory:tmp}',
    service_auto_approve_count=1,
    user_auto_approve_count=0,
    key_len=2048,
)}}

[rest-server-password]
recipe = slapos.cookbook:generate.password
user = backup

[rest-server-htpassword]
recipe = plone.recipe.command
command =
  if [ ! -f '${:htpassword}' ] ; then
    {{ htpasswd_bin }} \
      -b \
      -B \
      -c ${:htpassword} \
      ${rest-server-password:user} \
      ${rest-server-password:passwd}
  fi
htpassword = ${directory:rest-server-data-dir}/.htpasswd
stop-on-error = true

[rest-server]
recipe = slapos.cookbook:wrapper
command-line =
  {{ gowork_bin }}/rest-server \
    --listen [${:ip}]:${:port}
    --log ${directory:var-log}/${:_buildout_section_name_}-access.log
    --path ${directory:rest-server-data-dir}
    --tls
    --tls-cert ${rest-server-certificate:cert-file}
    --tls-key ${rest-server-certificate:key-file}
    --prometheus
wrapper-path = ${directory:service}/rest-server

port = 19080
ip = ${instance-parameter:ipv6-random}
url = https://[${:ip}]:${:port}
depends =
  ${rest-server-htpassword:recipe}

[rest-server-listen-promise]
<= check-port-listening-promise
hostname= ${rest-server:ip}
port = ${rest-server:port}

[frontend]
<= slap-connection
recipe = slapos.cookbook:requestoptional
name = Rest Server Frontend
# XXX We have hardcoded SR URL here.
software-url = http://git.erp5.org/gitweb/slapos.git/blob_plain/HEAD:/software/apache-frontend/software.cfg
slave = true
config-url = ${rest-server:url}
return = domain secure_access

[frontend-available-promise]
<= check-url-available-promise
url = ${frontend:connection-secure_access}
check-secure = 1


[promises]
recipe =
instance-promises =
  ${caucased-promise:recipe}
  ${rest-server-certificate-promise:recipe}
  ${rest-server-listen-promise:path}
  ${frontend-available-promise:path}

[publish-connection-parameter]
recipe = slapos.cookbook:publish
rest-server-user = ${rest-server-password:user}
rest-server-password = ${rest-server-password:passwd}
url = ${frontend:connection-secure_access}
caucase-url = ${caucased:url}