SSL-Everywhere

SSL-Everywhere

Updates the config-changed hook to python, adds charm helpers
adds configuration options for base64 based config ssl key deployment
adds support for ssl key file deployment
adds support for self signed ssl key generation

https://code.launchpad.net/~lazypower/charms/precise/nagios/ssl-everywhere/+merge/209049

(do not edit description out of merge proposal)

[lazypower, 2014-03-03 12:06:43]

Please take a look.

[lazypower, 2014-03-03 12:28:19]

Please take a look.

[lazypower, 2014-03-03 12:53:03]

Please take a look.

[Marco Ceppi, 2014-03-03 13:58:45]

https://codereview.appspot.com/70750043/diff/30001/README.md
File README.md (right):

https://codereview.appspot.com/70750043/diff/30001/README.md#newcode44
README.md:44: #### workflow:
This workflow doesn't seem to cover how to deploy the charm directly from the
charm store and set values with config, as it's implied in the SSL Configuration
sections.

Ideally, workflow should recommend the easiest, which would be deploy nagios,
gen certs, set configs. Then go in to embedding since embedding will break
upgrades from charm store and forces an entirely different workflow.

https://codereview.appspot.com/70750043/diff/30001/README.md#newcode47
README.md:47: charm get lp:charms/nagios
should just be either charm get nagios or charm get cs:nagios. Nagios might not
always be hosted at lp:

https://codereview.appspot.com/70750043/diff/30001/hooks/upgrade-charm
File hooks/upgrade-charm (right):

https://codereview.appspot.com/70750043/diff/30001/hooks/upgrade-charm#newcode7
hooks/upgrade-charm:7: import os
Don't import os, then do specific imports to calls you need. Either have import
os, then use os.path.exists, os.path.join, etc or do

from os.path import exists, join

https://codereview.appspot.com/70750043/diff/30001/hooks/upgrade-charm#newcode13
hooks/upgrade-charm:13: from charmhelpers.core import hookenv
Combine these in to one line

from charmhelpers.core import hookenv, host

[lazypower, 2014-03-03 14:22:06]

Please take a look.

[lazypower, 2014-03-03 15:20:43]

Please take a look.

[lazypower, 2014-03-03 21:00:42]

Please take a look.

[hazmat, 2014-03-04 12:42:34]

for consistency with other 'ssl' param usage.. values would be on, off, only

[hazmat, 2014-03-04 14:58:56]

https://codereview.appspot.com/70750043/diff/90001/config.yaml
File config.yaml (right):

https://codereview.appspot.com/70750043/diff/90001/config.yaml#newcode14
config.yaml:14: "on", "off", or "forced". The "forced" option disables
for consistency with other charm ssl modes, this should be 'on', 'off', 'only'.

https://codereview.appspot.com/70750043/diff/90001/config.yaml#newcode18
config.yaml:18: type: string
simply leaving this blank should suffice to assume self cert, with ssl value of
'on' or 'only'.

https://codereview.appspot.com/70750043/diff/90001/config.yaml#newcode32
config.yaml:32: ssl_chain:
s/ssl_chain/ssl_ca  for the ca cert chain.

https://codereview.appspot.com/70750043/diff/90001/config.yaml#newcode39
config.yaml:39: type: string
we already know the ip address for self-signed, so we don't need this, we just
use our public ip address from unit-get. Definitely not required.

https://codereview.appspot.com/70750043/diff/90001/hooks/upgrade-charm
File hooks/upgrade-charm (right):

https://codereview.appspot.com/70750043/diff/90001/hooks/upgrade-charm#newcod...
hooks/upgrade-charm:155: update_apache()
if ssl is not configure or turned off at runtime, the apache ssl conf files need
to be removed.

ie. if have set ssl="only" and then do set ssl="off" things should reconfigure
correctly.

[lazypower, 2014-03-04 21:33:59]

Please take a look.

[lazypower, 2014-03-20 13:55:50]

Please take a look.

[lazypower, 2014-03-20 13:59:22]

Please take a look.