caddy-frontend: Stabilise passed parameters to nodes

software/caddy-frontend/buildout.hash.cfg

@@ -26,7 +26,7 @@ md5sum = 91fce5ebea302e9c9ccc20c140b76608
 
 [profile-caddy-replicate]
 filename = instance-apache-replicate.cfg.in
-md5sum = 26b21124b898158c4f409a798eb253ad
+md5sum = ab85ee7bd22e559d87bb214bb22a0e9e
 
 [profile-slave-list]
 _update_hash_filename_ = templates/apache-custom-slave-list.cfg.in

software/caddy-frontend/instance-apache-replicate.cfg.in

@@ -5,6 +5,25 @@
 {%- set SERVER_POLLUTED_KEY_LIST = ['connection-parameter-hash', 'timestamp', 'slave_title', 'slap_software_type'] -%}
 {%- set TRUE_VALUES = ['y', 'yes', '1', 'true'] -%}
 {%- set GOOD_CIPHER_LIST = ['ECDHE-ECDSA-AES256-GCM-SHA384', 'ECDHE-RSA-AES256-GCM-SHA384', 'ECDHE-ECDSA-AES128-GCM-SHA256', 'ECDHE-RSA-AES128-GCM-SHA256', 'ECDHE-ECDSA-WITH-CHACHA20-POLY1305', 'ECDHE-RSA-WITH-CHACHA20-POLY1305', 'ECDHE-RSA-AES256-CBC-SHA', 'ECDHE-RSA-AES128-CBC-SHA', 'ECDHE-ECDSA-AES256-CBC-SHA', 'ECDHE-ECDSA-AES128-CBC-SHA', 'RSA-AES256-CBC-SHA', 'RSA-AES128-CBC-SHA', 'ECDHE-RSA-3DES-EDE-CBC-SHA', 'RSA-3DES-EDE-CBC-SHA'] %}
+{#- Allow to pass only some parameters to frontend nodes #}
+{%- set FRONTEND_NODE_PASSED_KEY_LIST = [
+        'plain_http_port',
+        'port',
+        'apache-certificate',
+        'apache-key',
+        'domain',
+        'enable-http2-by-default',
+        'global-disable-http2',
+        'mpm-graceful-shutdown-timeout',
+        'public-ipv4',
+        're6st-verification-url',
+        'backend-connect-timeout',
+        'backend-connect-retries',
+        'ciphers',
+        'request-timeout',
+        'authenticate-to-backend',
+    ]
+%}
 {% set aikc_enabled = slapparameter_dict.get('automatic-internal-kedifa-caucase-csr', 'true').lower() in TRUE_VALUES %}
 {% set aibcc_enabled = slapparameter_dict.get('automatic-internal-backend-client-caucase-csr', 'true').lower() in TRUE_VALUES %}
 {# Ports 8401, 8402 and 8410+1..N are reserved for monitor ports on various partitions #}
@@ -217,6 +236,13 @@ config-monitor-password = ${monitor-htpasswd:passwd}
 software-type = {{frontend_type}}
 return = private-ipv4 public-ipv4 slave-instance-information-list monitor-base-url backend-client-csr_id-url csr_id-url csr_id-certificate backend-haproxy-statistic-url
 
+{#- Send only needed parameters to frontend nodes #}
+{%- set base_node_configuration_dict = {} %}
+{%- for key in FRONTEND_NODE_PASSED_KEY_LIST %}
+{%-   if key in slapparameter_dict %}
+{%-     do base_node_configuration_dict.__setitem__(key,  slapparameter_dict[key]) %}
+{%-   endif %}
+{%- endfor %}
 {% for section, frontend_request in request_dict.iteritems() %}
 {%   set state = frontend_request.get('state', '') %}
 [{{section}}]
@@ -233,12 +259,15 @@ config-master-key-download-url = ${request-kedifa:connection-master-key-download
 config-cluster-identification = {{ instance_parameter_dict['root-instance-title'] }}
 {#   Do not send additional parameters for destroyed nodes #}
 {%   if state != 'destroyed' %}
-{%     set slave_configuration_dict = slapparameter_dict %}
-{%     do slave_configuration_dict.update(frontend_request.get('config')) %}
+{%     set node_configuration_dict = {} %}
+{%     do node_configuration_dict.update(frontend_request.get('config')) %}
 {# sort_keys are important in order to avoid shuffling parameters on each run #}
-{%     do slave_configuration_dict.__setitem__(slave_list_name, json_module.dumps(authorized_slave_list, sort_keys=True)) %}
-{%     do slave_configuration_dict.__setitem__("frontend-name", frontend_request.get('name')) %}
-{%-     for config_key, config_value in slave_configuration_dict.iteritems() %}
+{%     do node_configuration_dict.__setitem__(slave_list_name, json_module.dumps(authorized_slave_list, sort_keys=True)) %}
+{%     do node_configuration_dict.__setitem__("frontend-name", frontend_request.get('name')) %}
+{%-     for config_key, config_value in node_configuration_dict.iteritems() %}
+config-{{ config_key }} = {{ dumps(config_value) }}
+{%     endfor -%}
+{%-     for config_key, config_value in base_node_configuration_dict.iteritems() %}
 config-{{ config_key }} = {{ dumps(config_value) }}
 {%     endfor -%}
 {%   endif %}