Setup encrypted conn. to the API environment

Setup encrypted conn. to the API environment

Pass the same certificate and private key used by nginx to the
API environment, so that the websocket connection can use WSS.

https://code.launchpad.net/~teknico/charms/precise/juju-gui/encrypt-api-env-connection/+merge/141107

(do not edit description out of merge proposal)

[teknico, 2012-12-21 18:16:34]

Please take a look.

[teknico, 2013-01-03 20:18:52]

*** Submitted:

Setup encrypted conn. to the API environment

Pass the same certificate and private key used by nginx to the
API environment, so that the websocket connection can use WSS.

R=
CC=
https://codereview.appspot.com/7007045

[teknico, 2013-01-04 09:40:32]

Please take a look.

[frankban, 2013-01-04 11:27:56]

Land with changes.

This branch looks good Nicola: it's nice to see everything's working with TLS
enabled. Tests pass. 
Please take a look at my comments below: especially the config-changed issue
needs to be addressed IMHO.

https://codereview.appspot.com/7007045/diff/6002/HACKING.md
File HACKING.md (right):

https://codereview.appspot.com/7007045/diff/6002/HACKING.md#newcode128
HACKING.md:128: /var/lib/juju/units/[NAME OF UNIT].  There is a charm.log file
to investigate,
Good catch, thank you.

https://codereview.appspot.com/7007045/diff/6002/hooks/config-changed
File hooks/config-changed (right):

https://codereview.appspot.com/7007045/diff/6002/hooks/config-changed#newcode88
hooks/config-changed:88: start_improv(
The improv and the api agent services now depend on the certificates path, and
need to be restarted if the ssl-cert-path is changed. AFAICT, currently this is
not handled here. E.g., if the user run ``juju set juju-gui
ssl-cert-path=/tmp/juju-gui``, the services are not restarted and the GUI ends
up in a broken state.

https://codereview.appspot.com/7007045/diff/6002/hooks/config-changed#newcode106
hooks/config-changed:106: start_agent(
See above.

https://codereview.appspot.com/7007045/diff/6002/hooks/utils.py
File hooks/utils.py (right):

https://codereview.appspot.com/7007045/diff/6002/hooks/utils.py#newcode59
hooks/utils.py:59: SSL_CERT_PATH = '/etc/ssl/juju-gui'
Here the config default is redefined, and this value is used as default for the
functions below needing the tls keys path.
Is this really required? I believe that the default value is never used, i.e.
each time we call start_improv, start_agent etc., we always pass the value taken
from config. Moreover, it seems to me that if, in the future, we want to change
the default path, we will need to change the same value in two different places.

https://codereview.appspot.com/7007045/diff/6002/hooks/utils.py#newcode339
hooks/utils.py:339: crt_path = os.path.join(ssl_cert_path, 'juju.crt')
I like how you renamed the keys.

[teknico, 2013-01-04 11:52:44]

Thanks for the review, very useful.

https://codereview.appspot.com/7007045/diff/6002/hooks/config-changed
File hooks/config-changed (right):

https://codereview.appspot.com/7007045/diff/6002/hooks/config-changed#newcode88
hooks/config-changed:88: start_improv(
frankban wrote:
> The improv and the api agent services now depend on the certificates
> path, and need to be restarted if the ssl-cert-path is changed.
> AFAICT, currently this is not handled here.

You are right, I will add ssl-cert-path to the checked properties.

https://codereview.appspot.com/7007045/diff/6002/hooks/config-changed#newcode106
hooks/config-changed:106: start_agent(
frankban wrote:
> See above.

Ditto.

https://codereview.appspot.com/7007045/diff/6002/hooks/utils.py
File hooks/utils.py (right):

https://codereview.appspot.com/7007045/diff/6002/hooks/utils.py#newcode59
hooks/utils.py:59: SSL_CERT_PATH = '/etc/ssl/juju-gui'
frankban wrote:
> I believe that the default value is never used, i.e. each time we call
> start_improv, start_agent etc., we always pass the value taken from config.

Indeed. I foolishly unified the defaults into the constant, forgetting that the
value comes from the config anyway, and the defaults do not really make sense.
I'll remove them.

https://codereview.appspot.com/7007045/diff/6002/hooks/utils.py#newcode339
hooks/utils.py:339: crt_path = os.path.join(ssl_cert_path, 'juju.crt')
frankban wrote:
> I like how you renamed the keys.

Well, I had to. :-) The --keys Juju option only passes the certificates
directory, not the filenames: they are hardwired.

[teknico, 2013-01-04 15:22:04]

Please take a look.

[teknico, 2013-01-04 16:51:10]

Please take a look.

[gary.poster, 2013-01-04 17:11:09]

Land as is.

Thanks, Nicola.  Looks very good to me.

Gary

[teknico, 2013-01-04 17:13:28]

*** Submitted:

Setup encrypted conn. to the API environment

Pass the same certificate and private key used by nginx to the
API environment, so that the websocket connection can use WSS.

R=frankban, gary.poster
CC=
https://codereview.appspot.com/7007045