You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

510 lines
13 KiB

  1. # -*- mode: shell-script -*-
  2. apache_proxy_dir () {
  3. DOMAIN=$(relation-get domain) || {
  4. err "You must specify a ${WHITE}domain$NORMAL option in relation."
  5. return 1
  6. }
  7. proxy=yes apache_vhost_create || return 1
  8. info "Added $DOMAIN as a proxy to $TARGET."
  9. }
  10. export -f apache_proxy_dir
  11. apache_publish_dir () {
  12. DOMAIN=$(relation-get domain) || {
  13. err "You must specify a ${WHITE}domain$NORMAL option in relation."
  14. return 1
  15. }
  16. DOCKER_SITE_PATH="/var/www/${DOMAIN}"
  17. LOCATION=$(relation-get location 2>/dev/null) ||
  18. LOCATION="$DATASTORE/$BASE_CHARM_NAME$DOCKER_SITE_PATH"
  19. apache_vhost_create || return 1
  20. info "Added $DOMAIN apache config."
  21. apache_code_dir || return 1
  22. apache_data_dirs
  23. }
  24. export -f apache_publish_dir
  25. apache_vhost_create () {
  26. export APACHE_CONFIG_LOCATION="$SERVICE_CONFIGSTORE/etc/apache2/sites-enabled"
  27. export SERVER_ALIAS=$(relation-get server-aliases 2>/dev/null) || true
  28. export PROTOCOLS=$(__vhost_cfg_normalize_protocol) || return 1
  29. export SSL_PLUGIN_FUN=$(ssl_get_plugin_fun) || return 1
  30. if is_protocol_enabled https; then
  31. "$SSL_PLUGIN_FUN"_vars "$(relation-get ssl)" || return 1
  32. fi
  33. apache_vhost_statement "$PROTOCOLS" |
  34. file_put "$APACHE_CONFIG_LOCATION/$prefix$DOMAIN.conf" || return 1
  35. __vhost_cfg_creds_enabled=$(relation-get creds 2>/dev/null) || true
  36. if [ "$__vhost_cfg_creds_enabled" ]; then
  37. apache_passwd_file || return 1
  38. fi
  39. "$SSL_PLUGIN_FUN"_prepare "$(relation-get ssl)" || return 1
  40. }
  41. is_protocol_enabled() {
  42. local protocol=$1
  43. [[ "$PROTOCOLS" == *",$protocol,"* ]]
  44. }
  45. export -f is_protocol_enabled
  46. __vhost_cfg_normalize_protocol() {
  47. local protocol
  48. if ! protocol=$(relation-get protocol 2>/dev/null); then
  49. protocol=auto
  50. else
  51. protocol=${protocol:-auto}
  52. fi
  53. case "$protocol" in
  54. auto)
  55. if __vhost_cfg_ssl="$(relation-get ssl 2>/dev/null)"; then
  56. protocol="https"
  57. export __vhost_cfg_ssl
  58. else
  59. protocol="http"
  60. fi
  61. ;;
  62. both)
  63. protocol="https,http"
  64. ;;
  65. ssl|https)
  66. protocol="https"
  67. ;;
  68. http)
  69. protocol="http"
  70. ;;
  71. *)
  72. err "Invalid value '$protocol' for ${WHITE}protocol$NORMAL option (use one of: http, https, both, auto)."
  73. return 1
  74. esac
  75. echo ",$protocol,"
  76. }
  77. ## ssl_plugin_* and ssl_fallback should :
  78. ## - do anything to ensure that
  79. ## - issue config-add to add volumes if necessary
  80. ## - output 3 vars of where to find the 3 files from within the docker apache
  81. ssl_get_plugin_fun() {
  82. local cfg="$(relation-get ssl 2>/dev/null)"
  83. if [[ "$(echo "$cfg" | shyaml get-type 2>/dev/null)" == "str" ]]; then
  84. target_relation=
  85. while read-0 relation_name target_service relation_config tech_dep; do
  86. [ "$target_service" == "$cfg" ] || continue
  87. verb "service ${DARKYELLOW}$target_service${NORMAL} matches" \
  88. "${WHITE}ssl${NORMAL} value: candidate relation is ${DARKBLUE}$relation_name${NORMAL}"
  89. fun="ssl_plugin_${relation_name}"
  90. if declare -F "${fun}_vars" >/dev/null 2>&1 && declare -F "${fun}_prepare" >/dev/null 2>&1; then
  91. verb "Corresponding plugin ${DARKGREEN}found${NORMAL} for relation ${DARKBLUE}$relation_name${NORMAL}"
  92. echo "$fun"
  93. return 0
  94. else
  95. verb "Corresponding plugin ${DARKRED}not found${NORMAL} for relation ${DARKBLUE}$relation_name${NORMAL}"
  96. fi
  97. done < <(get_compose_relations "$SERVICE_NAME") || return 1
  98. err "Invalid ${WHITE}ssl${NORMAL} value: '$cfg' is not a valid linked service through a support relation."
  99. return 1
  100. else
  101. echo ssl_fallback
  102. fi
  103. }
  104. ssl_fallback_vars() {
  105. local cfg="$1" cert key ca_cert
  106. if __vhost_cfg_ssl_cert=$(echo "$cfg" | shyaml get-value cert 2>/dev/null); then
  107. __vhost_cfg_SSL_CERT_LOCATION=/etc/ssl/certs/${DOMAIN}.pem
  108. fi
  109. if __vhost_cfg_ssl_key=$(echo "$cfg" | shyaml get-value key 2>/dev/null); then
  110. __vhost_cfg_SSL_KEY_LOCATION=/etc/ssl/private/${DOMAIN}.key
  111. fi
  112. if __vhost_cfg_ssl_ca_cert=$(echo "$cfg" | shyaml get-value ca-cert 2>/dev/null); then
  113. __vhost_cfg_SSL_CA_CERT_LOCATION=/etc/ssl/certs/${DOMAIN}-ca.pem
  114. fi
  115. }
  116. ssl_fallback_prepare() {
  117. local cfg="$1" cert key ca_cert
  118. dst="$CONFIGSTORE/$BASE_CHARM_NAME"
  119. volumes=""
  120. for label in cert key ca_cert; do
  121. content="$(eval echo "\"\$__vhost_cfg_ssl_$label\"")"
  122. if [ "$content" ]; then
  123. location="$(eval echo "\$__vhost_cfg_SSL_${label^^}_LOCATION")"
  124. echo "$content" | file_put "$dst$location"
  125. volumes="$volumes
  126. - $dst$location:$location:ro"
  127. fi
  128. done
  129. if [ "$volumes" ]; then
  130. config-add "\
  131. $MASTER_TARGET_CHARM_NAME:
  132. volumes:
  133. $volumes
  134. "
  135. fi
  136. }
  137. ssl_plugin_letsencrypt-dns_vars() {
  138. __vhost_cfg_SSL_CERT_LOCATION=/etc/letsencrypt/live/${DOMAIN}/cert.pem
  139. __vhost_cfg_SSL_KEY_LOCATION=/etc/letsencrypt/live/${DOMAIN}/privkey.pem
  140. __vhost_cfg_SSL_CHAIN=/etc/letsencrypt/live/${DOMAIN}/chain.pem
  141. }
  142. ssl_plugin_letsencrypt-dns_prepare() {
  143. local service="$1" letsencrypt_charm
  144. shift
  145. export DEFAULT_COMPOSE_FILE="$COMPOSE_YML_FILE"
  146. run_service_action "$service" add "$DOMAIN" $(echo "$SERVER_ALIAS" | shyaml get-values 2>/dev/null) || return 1
  147. letsencrypt_charm=$(get_service_charm "$service") || return 1
  148. config-add "\
  149. services:
  150. $MASTER_TARGET_CHARM_NAME:
  151. volumes:
  152. - $DATASTORE/${letsencrypt_charm}/etc/letsencrypt:/etc/letsencrypt:ro
  153. " || return 1
  154. }
  155. apache_passwd_file() {
  156. include parse || true
  157. ## XXXvlab: called twice... no better way to do this ?
  158. __vhost_creds_statement >/dev/null
  159. first=
  160. if ! [ -e "$CONFIGSTORE/$MASTER_TARGET_CHARM_NAME$password_file" ]; then
  161. debug "No file $CONFIGSTORE/$MASTER_TARGET_CHARM_NAME$password_file, creating password file." || true
  162. first=c
  163. fi
  164. while read-0 login password; do
  165. debug "htpasswd -b$first '${password_file}' '$login' '$password'"
  166. echo "htpasswd -b$first '${password_file}' '$login' '$password'"
  167. if [ "$first" ]; then
  168. first=
  169. fi
  170. done < <(echo "$__vhost_cfg_creds_enabled" | shyaml key-values-0 2>/dev/null) |
  171. docker run -i --entrypoint "/bin/bash" \
  172. -v "$APACHE_CONFIG_LOCATION:/etc/apache2/sites-enabled" \
  173. "$DOCKER_BASE_IMAGE" || return 1
  174. }
  175. ## Produce the full statements depending on relation-get informations
  176. apache_vhost_statement() {
  177. local vhost_statement
  178. export SERVER_ALIAS=$(relation-get server-aliases 2>/dev/null) || true
  179. export PROTOCOLS="$1"
  180. if is_protocol_enabled http; then
  181. __vhost_full_vhost_statement http
  182. fi
  183. if is_protocol_enabled https; then
  184. export SSL_PLUGIN_FUN=$(ssl_get_plugin_fun) || return 1
  185. "$SSL_PLUGIN_FUN"_vars "$(relation-get ssl 2>/dev/null)"
  186. cat <<EOF
  187. <IfModule mod_ssl.c>
  188. $(__vhost_full_vhost_statement https | prefix " ")
  189. </IfModule>
  190. EOF
  191. fi
  192. }
  193. export -f apache_vhost_statement
  194. apache_code_dir() {
  195. local www_data_gid
  196. www_data_gid=$(cached_cmd_on_base_image apache 'id -g www-data') || {
  197. debug "Failed to query for www-data gid in ${DARKYELLOW}apache${NORMAL} base image."
  198. return 1
  199. }
  200. mkdir -p "$LOCATION" || return 1
  201. setfacl -R -m g:"$www_data_gid":rx "$LOCATION"
  202. info "Set permission for read and traversal on '$LOCATION'."
  203. config-add "
  204. $MASTER_BASE_CHARM_NAME:
  205. volumes:
  206. - $LOCATION:$DOCKER_SITE_PATH
  207. "
  208. }
  209. apache_data_dirs() {
  210. DATA_DIRS=$(relation-get data-dirs 2>/dev/null | shyaml get-values 2>/dev/null) || true
  211. if [ -z "$DATA_DIRS" ]; then
  212. return 0
  213. fi
  214. DST=$DATASTORE/$BASE_CHARM_NAME$DOCKER_SITE_PATH
  215. DATA=()
  216. while IFS="," read -ra ADDR; do
  217. for dir in "${ADDR[@]}"; do
  218. DATA+=($dir)
  219. done
  220. done <<< "$DATA_DIRS"
  221. www_data_gid=$(cached_cmd_on_base_image apache 'id -g www-data') || {
  222. debug "Failed to query for www-data gid in ${DARKYELLOW}apache${NORMAL} base image."
  223. return 1
  224. }
  225. info "www-data gid from ${DARKYELLOW}apache${NORMAL} is '$www_data_gid'"
  226. dirs=()
  227. for d in "${DATA[@]}"; do
  228. dirs+=("$DST/$d")
  229. done
  230. mkdir -p "${dirs[@]}"
  231. setfacl -R -m g:"$www_data_gid":rwx "${dirs[@]}"
  232. setfacl -R -d -m g:"$www_data_gid":rwx "${dirs[@]}"
  233. config-add "
  234. $MASTER_BASE_CHARM_NAME:
  235. volumes:
  236. $(
  237. for d in "${DATA[@]}"; do
  238. echo " - $DST/$d:$DOCKER_SITE_PATH/$d"
  239. done
  240. )"
  241. }
  242. deploy_files() {
  243. local src="$1" dst="$2"
  244. if ! [ -d "$dst" ]; then
  245. err "Destination '$dst' does not exist or is not a directory"
  246. return 1
  247. fi
  248. (
  249. cd "$dst" && info "In $dst:" &&
  250. get_file "$src" | tar xv
  251. )
  252. }
  253. export -f deploy_files
  254. apache_core_rules_add() {
  255. local conf="$1" dst="/etc/apache2/conf-enabled/$BASE_CHARM_NAME.conf"
  256. debug "Adding core rule."
  257. echo "$conf" | file_put "$CONFIGSTORE/$BASE_CHARM_NAME$dst"
  258. config-add "
  259. $MASTER_BASE_CHARM_NAME:
  260. volumes:
  261. - $CONFIGSTORE/$BASE_CHARM_NAME$dst:$dst:ro
  262. "
  263. }
  264. __vhost_ssl_statement() {
  265. ## defaults
  266. __vhost_cfg_SSL_CERT_LOCATION=${__vhost_cfg_SSL_CERT_LOCATION:-/etc/ssl/certs/ssl-cert-snakeoil.pem}
  267. __vhost_cfg_SSL_KEY_LOCATION=${__vhost_cfg_SSL_KEY_LOCATION:-/etc/ssl/private/ssl-cert-snakeoil.key}
  268. cat <<EOF
  269. ##
  270. ## SSL Configuration
  271. ##
  272. SSLEngine On
  273. SSLCertificateFile $__vhost_cfg_SSL_CERT_LOCATION
  274. SSLCertificateKeyFile $__vhost_cfg_SSL_KEY_LOCATION
  275. $([ -z "$__vhost_cfg_SSL_CA_CERT_LOCATION" ] || echo "SSLCACertificateFile $__vhost_cfg_SSL_CA_CERT_LOCATION")
  276. $([ -z "$__vhost_cfg_SSL_CHAIN" ] || echo "SSLCertificateChainFile $__vhost_cfg_SSL_CHAIN")
  277. SSLVerifyClient None
  278. EOF
  279. }
  280. __vhost_creds_statement() {
  281. if ! __vhost_cfg_creds_enabled=$(relation-get creds 2>/dev/null); then
  282. echo "Allow from all"
  283. return 0
  284. fi
  285. password_file=/etc/apache2/sites-enabled/${DOMAIN}.passwd
  286. cat <<EOF
  287. AuthType basic
  288. AuthName "private"
  289. AuthUserFile ${password_file}
  290. Require valid-user
  291. EOF
  292. }
  293. __vhost_head_statement() {
  294. local protocol="$1"
  295. if [ "$protocol" == "https" ]; then
  296. prefix="s-"
  297. else
  298. prefix=
  299. fi
  300. cat <<EOF
  301. ServerAdmin ${ADMIN_MAIL:-contact@$DOMAIN}
  302. ServerName ${DOMAIN}
  303. $(
  304. while read-0 alias; do
  305. echo "ServerAlias $alias"
  306. done < <(echo "$SERVER_ALIAS" | shyaml get-values-0 2>/dev/null)
  307. )
  308. ServerSignature Off
  309. CustomLog /var/log/apache2/${prefix}${DOMAIN}_access.log combined
  310. ErrorLog /var/log/apache2/${prefix}${DOMAIN}_error.log
  311. ErrorLog syslog:local2
  312. EOF
  313. }
  314. __vhost_custom_rules() {
  315. local custom_rules
  316. if custom_rules=$(relation-get apache-custom-rules 2>/dev/null); then
  317. cat <<EOF
  318. ##
  319. ## Custom rules
  320. ##
  321. $custom_rules
  322. EOF
  323. fi
  324. }
  325. __vhost_content_statement() {
  326. if [ "$proxy" ]; then
  327. __vhost_proxy_statement "$@"
  328. else
  329. __vhost_publish_dir_statement "$@"
  330. fi
  331. }
  332. __vhost_proxy_statement() {
  333. local protocol="$1"
  334. TARGET=$(relation-get target 2>/dev/null) || true
  335. if [ -z "$TARGET" ]; then
  336. ## First exposed port:
  337. base_image=$(service_base_docker_image "$BASE_CHARM_NAME") || return 1
  338. first_exposed_port=$(image_exposed_ports_0 "$base_image" | tr '\0' '\n' | head -n 1 | cut -f 1 -d /) || return 1
  339. TARGET=$MASTER_BASE_CHARM_NAME:$first_exposed_port
  340. info "No target was specified, introspection found: $TARGET"
  341. fi
  342. cat <<EOF
  343. ##
  344. ## Proxy declaration towards $TARGET
  345. ##
  346. <IfModule mod_proxy.c>
  347. ProxyRequests Off
  348. <Proxy *>
  349. Order deny,allow
  350. Allow from all
  351. </Proxy>
  352. ProxyVia On
  353. ProxyPass / http://$TARGET/ retry=0
  354. <Location / >
  355. $(__vhost_creds_statement | prefix " ")
  356. ProxyPassReverse /
  357. </Location>
  358. $([ "$protocol" == "https" ] && echo " SSLProxyEngine On")
  359. </IfModule>
  360. RequestHeader set "X-Forwarded-Proto" "$protocol"
  361. ## Fix IE problem (httpapache proxy dav error 408/409)
  362. SetEnv proxy-nokeepalive 1
  363. EOF
  364. }
  365. __vhost_full_vhost_statement() {
  366. local protocol="$1"
  367. case "$protocol" in
  368. https)
  369. PORT=443
  370. ;;
  371. http)
  372. PORT=80
  373. ;;
  374. esac
  375. cat <<EOF
  376. <VirtualHost *:$PORT>
  377. $(__vhost_head_statement "$protocol" | prefix " ")
  378. $(__vhost_content_statement "$protocol" | prefix " ")
  379. ## Forbid any cache, this is only usefull on dev server.
  380. #Header set Cache-Control "no-cache"
  381. #Header set Access-Control-Allow-Origin "*"
  382. #Header set Access-Control-Allow-Methods "POST, GET, OPTIONS"
  383. #Header set Access-Control-Allow-Headers "origin, content-type, accept"
  384. $([ "$protocol" == "https" ] && __vhost_ssl_statement | prefix " ")
  385. $(__vhost_custom_rules | prefix " ")
  386. </VirtualHost>
  387. EOF
  388. }
  389. __vhost_publish_dir_statement() {
  390. cat <<EOF
  391. ##
  392. ## Publish directory $DOCKER_SITE_PATH
  393. ##
  394. DocumentRoot $DOCKER_SITE_PATH
  395. <Directory />
  396. Options FollowSymLinks
  397. AllowOverride None
  398. </Directory>
  399. <Directory $DOCKER_SITE_PATH>
  400. Options Indexes FollowSymLinks MultiViews
  401. AllowOverride all
  402. $(__vhost_creds_statement | prefix " ")
  403. </Directory>
  404. EOF
  405. }