Merge branch 'erp5' into erp5-z2.13

component/curl/buildout.cfg

@@ -11,8 +11,8 @@ parts =
 
 [curl]
 recipe = slapos.recipe.cmmi
-url = http://curl.haxx.se/download/curl-7.30.0.tar.bz2
-md5sum = 0db5ec03a5001b42a2edc03bf63b5ceb
+url = http://curl.haxx.se/download/curl-7.31.0.tar.bz2
+md5sum = b7bea20579ac2f696338ae03f2c19ba5
 configure-options =
   --disable-static
   --disable-ldap

component/groonga/buildout.cfg

@@ -11,9 +11,9 @@ extends =
 
 [groonga]
 recipe = slapos.recipe.cmmi
-version = 3.0.4
+version = 3.0.5
 url = http://packages.groonga.org/source/groonga/groonga-${:version}.tar.gz
-md5sum = d37e6391f9a7346166e0d1301e88dea5
+md5sum = 2894bbdd2275cb3c62aea14446dc2561
 configure-options =
   --disable-static
   --disable-glibtest
@@ -27,9 +27,9 @@ environment =
 
 [groonga-normalizer-mysql]
 recipe = slapos.recipe.cmmi
-version = 1.0.4
+version = 1.0.5
 url = http://packages.groonga.org/source/groonga-normalizer-mysql/groonga-normalizer-mysql-${:version}.tar.gz
-md5sum = 72c9d9fe5031c2c3af34dbbfcd46a9a9
+md5sum = 88c0ab0d07c761877a5271e4a7f18551
 location = ${groonga:location}
 depends =
   ${groonga:version}

component/gzip/buildout.cfg

@@ -6,7 +6,7 @@ parts =
 
 [gzip]
 recipe = slapos.recipe.cmmi
-url = ftp://ftp.gnu.org/pub/gnu/gzip/gzip-1.5.tar.xz
-md5sum = 2a431e169b6f62f7332ef6d47cc53bae
+url = ftp://ftp.gnu.org/pub/gnu/gzip/gzip-1.6.tar.xz
+md5sum = da981f86677d58a106496e68de6f8995
 environment =
   PATH=${xz-utils:location}/bin:%(PATH)s

component/mariadb/buildout.cfg

@@ -62,8 +62,8 @@ environment =
 # mroonga - a storage engine for MySQL. It provides fast fulltext search feature to all MySQL users.
 # http://mroonga.github.com/
 recipe = slapos.recipe.cmmi
-url = http://packages.groonga.org/source/mroonga/mroonga-3.04.tar.gz
-md5sum = 790d239c5bf5b98a760a78fdfcbe6803
+url = http://packages.groonga.org/source/mroonga/mroonga-3.05.tar.gz
+md5sum = ba4cbd79274d832b9343a0b2fe7d0787
 configure-options =
   --with-mysql-source=${mariadb:location}__compile__/mariadb-${mariadb:version}
   --with-mysql-config=${mariadb:location}/bin/mysql_config

component/python-openssl/buildout.cfg

+[buildout]
+extends =
+  ../openssl/buildout.cfg
+
+parts =
+  python-openssl
+
+[python-openssl]
+recipe = zc.recipe.egg:custom
+egg = pyOpenSSL
+library-dirs =
+  ${openssl:location}/lib/
+rpath =
+  ${openssl:location}/lib/

slapos/recipe/generic_varnish/template/default.vcl.in

@@ -33,149 +33,110 @@ sub vcl_recv {
         req.request != "PURGE" &&
         req.request != "DELETE") {
         /* Non-RFC2616 or CONNECT which is weird. */
-        return(pipe);
+        return (pipe);
     }
-    # Pass anything other than GET and HEAD and PURGE directly.
-    if (req.request != "GET" && req.request != "HEAD" && req.request != "PURGE") {
-        /* We only deal with GET and HEAD by default */
-        return(pass);
+    # Pass anything other than GET and HEAD directly.
+    if (req.request != "GET" && req.request != "HEAD") {
+        return (pass);
     }
     if (req.http.Authorization) {
         /* Not cacheable by default */
         return (pass);
     }
 
-    # no need to have cookies for the resources
-    if (req.url ~ "\.(css|js|ico)$") {
-        unset req.http.cookie;
+    # No need to have cookies for static resources
+    if (req.url ~ "\.(css|gif|ico|jpg|js|png)$") {
+        unset req.http.Cookie;
     }
-    # remove bogus cookies
+    # Remove bogus cookies
     if (req.http.Cookie) {
         set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__utm.=[^;]+;? *", "\1");
         set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__ac_name=\x22\x22;? *", "\1");
         set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__ac=\x22Og.3D.3D\x22;? *", "\1");
     }
     if (req.http.Cookie == "") {
-        remove req.http.Cookie;
+        unset req.http.Cookie;
     }
     if (req.http.Cookie && req.http.Cookie ~ "(^|; ) *__ac=") {
-        /* Not cacheable for authorised users,
-           but KM images are cacheable */
-        if (!(req.url ~ "/km_img/.*\.(png|gif)$")) {
         return (pass);
     }
-    }
-    # XXX Is it OK to remove this of all the case?
-    remove req.http.Set-Cookie;
-
-    if (req.http.Accept-Encoding) {
-        if (req.http.Accept-Encoding ~ "gzip") {
-            set req.http.Accept-Encoding = "gzip";
-        } elsif (req.http.Accept-Encoding ~ "deflate") {
-            set req.http.Accept-Encoding = "deflate";
-        } else {
-            # unkown algorithm
-            remove req.http.Accept-Encoding;
-        }
-    }
-    # We do not care about Accept-Language, this is url controlled
-    remove req.http.Accept-Language;
 
-    ## XXX login form can defer based on __ac_name cookie value
-    if (req.url ~ "/(login_form|WebSite_viewLoginDialog)($|\?)") {
-        return (pass);
-    }
+    # We do not care about Accept-Encoding, because we don't use varnish as the front most HTTP server.
+    unset req.http.Accept-Encoding;
 
     if (req.backend.healthy) {
         set req.grace = 1h;
     } else {
         set req.grace = 1w;
     }
-    return(lookup);
+    return (lookup);
+}
+
+# Run after a pass in vcl_recv OR after a lookup that returned a hitpass
+sub vcl_pass {
+    # unset If-Modified-Since to avoid reusing anonymous's browser cache
+    # after login.
+    unset req.http.If-Modified-Since;
+    return (pass);
 }
 
 # Creates the varnish cache key by the url
 sub vcl_hash {
+    # We use url only for hash.
     hash_data(req.url);
-    return(hash);
+    return (hash);
 }
 
 # Called after a cache lookup if the requested document was found in the cache
 sub vcl_hit {
-    # According Vary Header do not return those headers
-    remove req.http.Accept-Language;
-    remove req.http.Accept-Encoding;
-    remove req.http.Cookie;
-    return(deliver);
+    return (deliver);
 }
 
 # Called after a cache lookup if the requested document was not found in the cache
 sub vcl_miss {
-    return(fetch);
+    return (fetch);
 }
 
 # Called after a document has been successfully retrieved from the backend
 sub vcl_fetch {
-    # we only cache 200 (OK) and 304 (Not Modified) responses.
-    if (beresp.status != 200 && beresp.status != 304) {
-        set beresp.ttl = 0s;
-    }
+    # Unset Expires that is always overridden by Cache-Control.
+    unset beresp.http.Expires;
+
+    # Unset Pragma that is obsolete.
+    unset beresp.http.Pragma;
 
-    if (beresp.http.cache-control ~ "no-cache") {
+    # We only cache 200 (OK) and 304 (Not Modified) responses.
+    if (beresp.status != 200 && beresp.status != 304) {
         set beresp.ttl = 0s;
     }
 
-    if (beresp.ttl == 0s) {
-        unset beresp.http.expires;
-        set beresp.http.cache-control = "no-cache";
-        return(hit_for_pass);
+    # If max-age is 0 or not set, we want no browser cache.
+    if (beresp.ttl <= 0s) {
+        set beresp.http.Cache-Control = "no-store";
+        # Mark as hit_for_pass for the next 2 minutes.
+        set beresp.ttl = 120s;
+        return (hit_for_pass);
     }
 
-    # we don't care haproxy's cookie.
+    # We don't care haproxy's cookie.
     if (beresp.http.Set-Cookie && beresp.http.Set-Cookie !~ "^SERVERID=[^;]+; path=/$") {
-        return(hit_for_pass);
-    }
-
-    if (req.url ~ "\.(css|js|ico)$") {
-        unset beresp.http.set-cookie;
-        set beresp.http.cache-control = regsub(beresp.http.cache-control, "^", "public,");
-        set beresp.http.cache-control = regsub(beresp.http.cache-control, ",$", "");
-    }
-
-    # remove some headers added by caching policy manager to avoid
-    # '304 Not Modified' in case of login <-> logout switching.
-    if (beresp.http.content-type ~ "^text/html") {
-       unset beresp.http.last-modified;
+        return (hit_for_pass);
+    } else {
+        unset beresp.http.Set-Cookie;
     }
 
+    # We set long enough grace for cachable objects.
     set beresp.grace = 1w;
-    /* Never send request to backend even if client ask refreshed content */
-    if (beresp.ttl > 0s) {
-        /* Setup grace period for 30days for all cacheable contents */
-        set beresp.grace = 30d;
-        # /* Set the clients TTL on this object */
-        # set beresp.http.cache-control = "max-age = 300";
-        /* Set how long Varnish will keep it */
-        set beresp.ttl = 1w;
-        /* marker for vcl_deliver to reset Age: */
-        set beresp.http.magicmarker = "1";
-    }
 
-    return(deliver);
+    return (deliver);
 }
 
 # Called before a cached object is delivered to the client
 sub vcl_deliver {
-    if (resp.http.magicmarker) {
-        /* Remove the magic marker */
-        unset resp.http.magicmarker;
-        /* By definition we have a fresh object */
-        set resp.http.age = "0";
-    }
     if (obj.hits > 0) {
         set resp.http.X-Cache = obj.hits;
     } else {
         set resp.http.X-Cache = "MISS";
     }
-    return(deliver);
+    return (deliver);
 }

slapos/recipe/generic_varnish/template/varnishd.in

@@ -3,6 +3,7 @@
 DAEMON_OPTS="-F \
              -a %(varnish_ip)s:%(varnishd_server_port)s \
              -T %(varnish_ip)s:%(varnishd_manager_port)s \
+             -t 0 \
              -n %(varnish_instance_name)s \
              -f %(vcl_file)s \
              -s file,%(varnish_data)s/varnish_storage.bin,1G"

slapos/recipe/logrotate.py

@@ -79,7 +79,7 @@ class Part(GenericBaseRecipe):
     log = self.options['log']
 
     part_path = self.createFile(os.path.join(logrotate_d, self.options['name']),
-                    "%(logfiles)s {\n%(conf)s\n}" % {
+                    "%(logfiles)s {\n%(conf)s\n}\n" % {
                       'logfiles': log,
                       'conf': '\n'.join(conf),
                     }

software/jio/instance.cfg.in

@@ -46,4 +46,6 @@ LD_LIBRARY_PATH = ${libxslt:location}/lib:${libxml2:location}/lib:${zlib:locatio
 recipe = slapos.cookbook:wrapper
 command-line = ${phantomjs:location}/phantomjs-slapos
 wrapper-path = $${directory:bin}/phantomjs
-parameters-extra = true
+# XXX we must use "parameters-extra" (- instead of _)
+# when new slapos.cookbook will be used
+parameters_extra = true

software/jio/software.cfg

@@ -30,7 +30,7 @@ recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg.in
 output = ${buildout:directory}/instance.cfg
 # MD5 checksum can be skipped for development, but must be filled for production
-md5sum = 50fd41ad6f4aa6c49f4c80e3a81df61f
+md5sum = fa9193534c44717eaad226b552523932
 mode = 0644
 
 [jio-repository]

stack/erp5/buildout.cfg

@@ -299,7 +299,7 @@ mode = 640
 [template-varnish]
 recipe = slapos.recipe.build:download
 url = ${:_profile_base_location_}/instance-varnish.cfg.in
-md5sum = 17aee2df57b121343b1fd65f4b51ce80
+md5sum = 728650f5d20ad637d8d824d1968865ca
 mode = 640
 
 [bt5-repository]

stack/erp5/instance-varnish.cfg.in

@@ -10,6 +10,7 @@ parts =
 {% if web_checker_parameter is defined %}
   web-checker
   cron-entry-web-checker
+  logrotate-entry-web-checker
 {% endif %}
 
 eggs-directory = {{ eggs_directory }}
@@ -94,6 +95,17 @@ logrotate-entries = ${directory:logrotate-entries}
 backup = ${directory:logrotate-backup}
 state-file = ${rootdirectory:srv}/logrotate.status
 
+[logrotate-entry-web-checker]
+<= logrotate
+recipe = slapos.cookbook:logrotate.d
+name = web-checker
+log = ${web-checker:web-checker-log}
+frequency = daily
+rotate-num = 30
+sharedscripts = true
+notifempty = true
+create = true
+
 [basedirectory]
 recipe = slapos.cookbook:mkdirectory
 services = ${rootdirectory:etc}/run