Skip to content

slapos
slapos
Commit f6b5db04 authored by Łukasz Nowak's avatar Łukasz Nowak
Browse files
Options

rapid-cdn: Workaround typical configuration problem 

Unfortunately real world deployment is using iptables, which is not consistent
regarding the port advertised to in case of UDP, thus it's required to force
the user to set the "virtual" listening port.
parent 30a19c69
Hide whitespace changes
Inline Side-by-side
Showing with 30 additions and 5 deletions
software/rapid-cdn/README.rst
View file @ f6b5db04
......@@ -479,4 +479,6 @@ Experimental QUIC
QUIC with HTTP3 is available as experimental feature. It has to be enabled on each node separately by using ``-frontend-i-experimental-haproxy-quic``. Then given node will reply with proper headers on HTTPS to advertise QUIC. Please note that ``-frontend-i-experimental-haproxy-flavour`` has to be set to ``quic`` on this node too.
Please note that due to limitations of iptables method used to expose low ports, the ``-frontend-i-experimental-quic-port`` is by default ``443``, which is used when advertisting the QUIC/HTTP3 port to the client.
Note that then all frontends will be served with QUIC advertised on such node, so it's important to run such experiments very carefully, for example on same zone/region with DNS.
software/rapid-cdn/buildout.hash.cfg
View file @ f6b5db04
......@@ -22,11 +22,11 @@ md5sum = 5784bea3bd608913769ff9a8afcccb68
[profile-frontend]
filename = instance-frontend.cfg.in
md5sum = daf89318c2c155132c34b91105c68806
md5sum = 08d4476548f21a85a2e4701e5f65154d
[profile-master]
filename = instance-master.cfg.in
md5sum = b026a6df40f3d1090ceaa3451a9293fe
md5sum = 2aaab85bad51136b38f6a16d662a7b3e
[profile-slave-list]
filename = instance-slave-list.cfg.in
......@@ -38,7 +38,7 @@ md5sum = cba4d995962f7fbeae3f61c9372c4181
[template-frontend-haproxy-configuration]
_update_hash_filename_ = templates/frontend-haproxy.cfg.in
md5sum = 4af0e29ac2399aac10de116b4fa3ac25
md5sum = 6f9205190e42841d6e368b8eda710b73
[template-frontend-haproxy-crt-list]
_update_hash_filename_ = templates/frontend-haproxy-crt-list.in
......
software/rapid-cdn/instance-frontend.cfg.in
View file @ f6b5db04
{% import "caucase" as caucase with context %}
{%- set TRUE_VALUES = ['y', 'yes', '1', 'true'] -%}
{%- set QUIC_PORT = instance_parameter_dict.get('configuration.frontend-quic-port', '443') %}
{%- if instance_parameter_dict.get('configuration.frontend-haproxy-flavour', 'basic') == 'quic' %}
{%- set FRONTEND_HAPROXY_EXECUTABLE = software_parameter_dict['haproxy_quic_executable'] %}
{%- if instance_parameter_dict.get('configuration.frontend-haproxy-quic', 'false').lower() in TRUE_VALUES %}
......@@ -485,6 +486,7 @@ local_ipv4 = {{ dumps(instance_parameter_dict['ipv4-random']) }}
version-hash = ${version-hash:value}
node-id = ${frontend-node-id:value}
quic = {{ FRONTEND_HAPROXY_QUIC }}
quic-port = {{ QUIC_PORT }}
# BBB: SlapOS Master non-zero knowledge BEGIN
[get-self-signed-fallback-access]
......
software/rapid-cdn/instance-master.cfg.in
View file @ f6b5db04
......@@ -171,6 +171,8 @@ context =
{% do config_dict.__setitem__('frontend-haproxy-flavour', slapparameter_dict.get(frontend_haproxy_flavour_key) or 'basic') %}
{% set frontend_haproxy_quic_key = "-frontend-%s-experimental-haproxy-quic" % i %}
{% do config_dict.__setitem__('frontend-haproxy-quic', slapparameter_dict.get(frontend_haproxy_quic_key) or 'False') %}
{% set frontend_quic_port_key = "-frontend-%s-experimental-quic-port" % i %}
{% do config_dict.__setitem__('frontend-quic-port', slapparameter_dict.get(frontend_quic_port_key) or '443') %}
# Filling request dict for slave
{% set request_content_dict = {
'config': config_dict,
......
software/rapid-cdn/templates/frontend-haproxy.cfg.in
View file @ f6b5db04
......@@ -82,9 +82,9 @@ frontend https-frontend
{%- if QUIC %}
bind quic4@{{ configuration['local-ipv4'] }}:{{ configuration['https-port'] }} ssl crt-list {{ crt_list }} alpn h3
bind quic6@{{ configuration['global-ipv6'] }}:{{ configuration['https-port'] }} ssl crt-list {{ crt_list }} alpn h3
http-response set-header alt-svc "h3=\":%fp\";ma=900;"
http-response set-header alt-svc "h3=\":{{ configuration['quic-port'] }}\"; ma=900"
{#- Ask Chromium to use QUIC #}
http-response set-header alternate-protocol %fp:quic
http-response set-header alternate-protocol {{ configuration['quic-port'] }}:quic
{%- endif %}
{{ frontend_common() }}
{%- for slave_instance in frontend_slave_list -%}
......
software/rapid-cdn/test/test.py
View file @ f6b5db04
......@@ -6761,6 +6761,7 @@ class TestPassedRequestParameter(HttpFrontendTestCase):
'frontend-haproxy-flavour': 'basic',
'frontend-haproxy-quic': 'False',
'frontend-name': 'caddy-frontend-1',
'frontend-quic-port': '443',
'kedifa-caucase-url': kedifa_caucase_url,
'monitor-cors-domains': 'monitor.app.officejs.com',
'monitor-httpd-port': 8411,
......@@ -6788,6 +6789,7 @@ class TestPassedRequestParameter(HttpFrontendTestCase):
'frontend-haproxy-flavour': 'basic',
'frontend-haproxy-quic': 'False',
'frontend-name': 'caddy-frontend-2',
'frontend-quic-port': '443',
'kedifa-caucase-url': kedifa_caucase_url,
'monitor-cors-domains': 'monitor.app.officejs.com',
'monitor-httpd-port': 8412,
......@@ -6815,6 +6817,7 @@ class TestPassedRequestParameter(HttpFrontendTestCase):
'frontend-haproxy-flavour': 'basic',
'frontend-haproxy-quic': 'False',
'frontend-name': 'caddy-frontend-3',
'frontend-quic-port': '443',
'kedifa-caucase-url': kedifa_caucase_url,
'monitor-cors-domains': 'monitor.app.officejs.com',
'monitor-httpd-port': 8413,
......
software/rapid-cdn/test/test_data/test.TestEnableHttp2ByDefaultDefaultSlave.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -107,6 +107,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestEnableHttp2ByDefaultFalseSlave.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -109,6 +109,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestMasterAIKCDisabledAIBCCDisabledRequest.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -65,6 +65,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestMasterRequest.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -63,6 +63,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestMasterRequestDomain.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -65,6 +65,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestRe6stVerificationUrlDefaultSlave.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -79,6 +79,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestRe6stVerificationUrlSlave.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -79,6 +79,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestReplicateSlave.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -83,6 +83,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......@@ -122,6 +123,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-2",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestSlave.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -790,6 +790,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestSlaveCiphers.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -95,6 +95,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestSlaveHealthCheck.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -284,6 +284,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestSlaveHostHaproxyClash.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -92,6 +92,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestSlaveSlapOSMasterCertificateCompatibility.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -243,6 +243,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestSlaveSlapOSMasterCertificateCompatibilityOverrideMaster.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -83,6 +83,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
software/rapid-cdn/test/test_data/test.TestSlaveSlapOSMasterCertificateCompatibilityUpdate.test00cluster_request_instance_parameter_dict.txt
View file @ f6b5db04
......@@ -83,6 +83,7 @@
"frontend-haproxy-flavour": "basic",
"frontend-haproxy-quic": "False",
"frontend-name": "caddy-frontend-1",
"frontend-quic-port": "443",
"kedifa-caucase-url": "http://[@@_ipv6_address@@]:15090",
"master-key-download-url": "https://[@@_ipv6_address@@]:15080/@@master-key-download-url_endpoint@@",
"monitor-cors-domains": "monitor.app.officejs.com",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7