Modernise Nginx Push Stream

See merge request nexedi/slapos!1027

component/nginx/buildout.cfg

@@ -85,7 +85,7 @@ revision = 3d3a204177d3a7ab8a2858e04e792a6d11bf133f
 git-executable = ${git:location}/bin/git
 
 [nginx-push-stream]
-<= nginx
+<= nginx-common
 configure-options=
   --with-ipv6
   --with-http_ssl_module

software/caddy-frontend/buildout.hash.cfg

@@ -26,7 +26,7 @@ md5sum = 8507a2ace2f789b92c522cc62ca5aace
 
 [profile-caddy-replicate]
 filename = instance-apache-replicate.cfg.in
-md5sum = 8beb438d06bbb0f917d13e182fb12d17
+md5sum = 1d70899e5bf5309325b18e87f59ecb57
 
 [profile-slave-list]
 _update_hash_filename_ = templates/apache-custom-slave-list.cfg.in
@@ -72,10 +72,6 @@ md5sum = d022455a8610bac2dd51101edb035987
 _update_hash_filename_ = templates/trafficserver/logging.yaml.jinja2
 md5sum = 368b271215a92594ca9e2fa3102d484f
 
-[template-nginx-eventsource-slave-virtualhost]
-_update_hash_filename_ = templates/nginx-eventsource-slave.conf.in
-md5sum = 217a6c801b8330b0b825f7b8b4c77184
-
 [template-caddy-lazy-script-call]
 _update_hash_filename_ = templates/apache-lazy-script-call.sh.in
 md5sum = 77d60840591de67b64ab3572e46273a0

software/caddy-frontend/instance-apache-replicate.cfg.in

@@ -117,9 +117,7 @@ context =
 {%   set slave_warning_list = [] %}
 {%   set slave_server_alias_unclashed = [] %}
 {%   set slave_type = slave.get('type') %}
-{%   if slave_type == 'eventsource' %}
-{%     do slave_error_list.append('type:eventsource is not implemented') %}
-{%   elif slave_type not in [None, '', 'default', 'zope', 'redirect', 'notebook', 'websocket'] %}
+{%   if slave_type not in [None, '', 'default', 'zope', 'redirect', 'notebook', 'websocket'] %}
 {%     do slave_error_list.append('type:%s is not supported' % (slave_type,)) %}
 {%   endif %}
 {#   Check health-check-* #}

software/caddy-frontend/instance-slave-caddy-input-schema.json

@@ -15,14 +15,13 @@
     },
     "type": {
       "default": "",
-      "description": "Type of slave. If redirect, the slave will redirect to the given URL. If zope, the rewrite rules will be compatible with Virtual Host Monster. Implemented are default, zope, redirect, notebook and websocket, not implemneted is eventsource.",
+      "description": "Type of slave. If redirect, the slave will redirect to the given URL. If zope, the rewrite rules will be compatible with Virtual Host Monster.",
       "enum": [
         "",
         "zope",
         "redirect",
         "notebook",
-        "websocket",
-        "eventsource"
+        "websocket"
       ],
       "title": "Backend Type",
       "type": "string"

software/caddy-frontend/instance-slave-caddy-simplified-input-schema.json

@@ -9,7 +9,7 @@
     },
     "type": {
       "default": "",
-      "description": "Type of slave. If redirect, the slave will redirect to the given url. If zope, the rewrite rules will be compatible with Virtual Host Monster. Implemented are default, zope, redirect, notebook and websocket, not implemneted is eventsource.",
+      "description": "Type of slave. If redirect, the slave will redirect to the given url. If zope, the rewrite rules will be compatible with Virtual Host Monster.",
       "enum": [
         "",
         "zope"

software/caddy-frontend/templates/nginx-eventsource-slave.conf.in

-{% set url = slave_parameter.get('url') %}
-{% set https_url = slave_parameter.get('https-url', url) %}
-{% if url.startswith("http://") or url.startswith("https://") %}
-{%   set upstream = url.split("/")[2] %}
-{%   set https_upstream = https_url.split("/")[2] %}
-{%   set protocol = url.split("/")[0] %}
-{%   set https_protocol = https_url.split("/")[0] %}
-{%   set proxy_pass = '%s//%s' % (protocol, slave_parameter.get('slave_reference')) %}
-{%   set https_proxy_pass = '%s//https_%s' % (protocol, slave_parameter.get('slave_reference')) %}
-
-# TODO-Caddy upstream {{ slave_parameter.get('slave_reference') }} {
-# TODO-Caddy  server {{ upstream }};
-# TODO-Caddy 
-
-# TODO-Caddy pstream https_{{ slave_parameter.get('slave_reference') }} {
-# TODO-Caddy  server {{ https_upstream }};
-# TODO-Caddy 
-
-
-# TODO-Caddy server {
-# TODO-Caddy  listen {{ slave_parameter['local_ipv4'] }}:{{ slave_parameter['nginx_http_port'] }};
-# TODO-Caddy 
-# TODO-Caddy  server_name {{ slave_parameter.get('custom_domain') }};
-# TODO-Caddy 
-# TODO-Caddy  error_log {{ slave_parameter.get('error_log') }} error; 
-# TODO-Caddy  access_log {{ slave_parameter.get('access_log') }} custom;
-# TODO-Caddy  
-# TODO-Caddy  location /pub {
-# TODO-Caddy    push_stream_publisher;
-# TODO-Caddy    push_stream_channels_path $arg_id;
-# TODO-Caddy    # store messages in memory
-# TODO-Caddy    push_stream_store_messages  off;
-# TODO-Caddy 
-# TODO-Caddy    # Message size limit
-# TODO-Caddy    # client_max_body_size MUST be equal to client_body_buffer_size or
-# TODO-Caddy    # you will be sorry.
-# TODO-Caddy    client_max_body_size 16k;
-# TODO-Caddy    client_body_buffer_size 16k;
-# TODO-Caddy 
-# TODO-Caddy   }
-# TODO-Caddy 
-# TODO-Caddy   location ~ /sub/(.*) {
-# TODO-Caddy     # activate subscriber mode for this location
-# TODO-Caddy     add_header "Access-Control-Allow-Origin" "*";
-# TODO-Caddy     add_header 'Access-Control-Allow-Credentials' 'false';
-# TODO-Caddy     add_header 'Access-Control-Allow-Methods' 'GET, HEAD, OPTIONS';
-# TODO-Caddy     add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since';
-# TODO-Caddy 
-# TODO-Caddy     push_stream_subscriber eventsource;
-# TODO-Caddy     # positional channel path
-# TODO-Caddy     push_stream_channels_path $1;
-# TODO-Caddy 
-# TODO-Caddy     # content-type
-# TODO-Caddy     default_type "text/event-stream; charset=utf-8";
-# TODO-Caddy  }
-# TODO-Caddy 
-# TODO-Caddy 
-
-# TODO-Caddy server {
-# TODO-Caddy  listen {{ slave_parameter['local_ipv4'] }}:{{ slave_parameter['nginx_https_port'] }} ssl;
-# TODO-Caddy 
-# TODO-Caddy  server_name {{ slave_parameter.get('custom_domain') }};
-# TODO-Caddy 
-# TODO-Caddy  error_log {{ slave_parameter.get('error_log') }} error;
-# TODO-Caddy  access_log {{ slave_parameter.get('access_log') }} custom;
-# TODO-Caddy 
-# TODO-Caddy  ssl on;
-# TODO-Caddy  
-# TODO-Caddy  ssl_session_timeout 5m;
-# TODO-Caddy  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-# TODO-Caddy  ssl_ciphers 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:HIGH:!aNULL:!MD5';
-# TODO-Caddy  ssl_prefer_server_ciphers on;
-# TODO-Caddy  ssl_session_cache shared:SSL:10m;
-
-# TODO-Caddy  location /pub {
-# TODO-Caddy    push_stream_publisher;
-# TODO-Caddy    push_stream_channels_path $arg_id;
-# TODO-Caddy    # store messages in memory
-# TODO-Caddy    push_stream_store_messages  off;
-# TODO-Caddy 
-# TODO-Caddy    # Message size limit
-# TODO-Caddy    # client_max_body_size MUST be equal to client_body_buffer_size or
-# TODO-Caddy    # you will be sorry.
-# TODO-Caddy    client_max_body_size 16k;
-# TODO-Caddy    client_body_buffer_size 16k;
-# TODO-Caddy 
-# TODO-Caddy   }
-# TODO-Caddy 
-# TODO-Caddy   location ~ /sub/(.*) {
-# TODO-Caddy     # activate subscriber mode for this location
-# TODO-Caddy     add_header "Access-Control-Allow-Origin" "*";
-# TODO-Caddy     add_header 'Access-Control-Allow-Credentials' 'false';
-# TODO-Caddy     add_header 'Access-Control-Allow-Methods' 'GET, HEAD, OPTIONS';
-# TODO-Caddy     add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since';
-# TODO-Caddy 
-# TODO-Caddy     push_stream_subscriber eventsource;
-# TODO-Caddy     # positional channel path
-# TODO-Caddy     push_stream_channels_path $1;
-# TODO-Caddy 
-# TODO-Caddy     # content-type
-# TODO-Caddy     default_type "text/event-stream; charset=utf-8";
-# TODO-Caddy  }
-# TODO-Caddy}
-{% endif %}

software/caddy-frontend/test/test.py

@@ -1479,10 +1479,6 @@ class TestSlave(SlaveHttpFrontendTestCase, TestDataMixin):
         'websocket-path-list': '////ws//// /with%20space/',
         'websocket-transparent': 'false',
       },
-      # 'type-eventsource': {
-      #   'url': cls.backend_url,
-      #   'type': 'eventsource',
-      # },
       'type-redirect': {
         'url': cls.backend_url,
         'type': 'redirect',
@@ -3261,54 +3257,6 @@ class TestSlave(SlaveHttpFrontendTestCase, TestDataMixin):
     )
     self.assertFalse('x-real-ip' in j['Incoming Headers'])
 
-  @skip('Feature postponed')
-  def test_type_eventsource(self):
-    # Caddy: For event source, if I understand
-    #        https://github.com/mholt/caddy/issues/1355 correctly, we could use
-    #        Caddy as a proxy in front of nginx-push-stream . If we have a
-    #        "central shared" caddy instance, can it handle keeping connections
-    #        opens for many clients ?
-    parameter_dict = self.parseSlaveParameterDict('type-eventsource')
-    self.assertLogAccessUrlWithPop(parameter_dict)
-    self.assertEqual(
-      {
-        'domain': 'typeeventsource.nginx.example.com',
-        'replication_number': '1',
-        'url': 'http://typeeventsource.nginx.example.com',
-        'site_url': 'http://typeeventsource.nginx.example.com',
-        'secure_access': 'https://typeeventsource.nginx.example.com',
-        'backend-client-caucase-url': 'http://[%s]:8990' % self._ipv6_address,
-      },
-      parameter_dict
-    )
-
-    result = fakeHTTPSResult(
-      parameter_dict['domain'], 'pub',
-      #  NGINX_HTTPS_PORT
-    )
-
-    self.assertEqual(
-      self.certificate_pem,
-      der2pem(result.peercert))
-
-    self.assertEqual(
-      '',
-      result.content
-    )
-    headers = result.headers.copy()
-    self.assertKeyWithPop('Expires', headers)
-    self.assertKeyWithPop('Date', headers)
-    self.assertEqual(
-      {
-        'X-Nginx-PushStream-Explain': 'No channel id provided.',
-        'Content-Length': '0',
-        'Cache-Control': 'no-cache, no-store, must-revalidate',
-        'Connection': 'keep-alive',
-        'Server': 'nginx'
-      },
-      headers
-    )
-
   def test_type_redirect(self):
     parameter_dict = self.assertSlaveBase('type-redirect')
 

software/nginx-push-stream/README.md

+# Nginx Push Stream
+
+This software uses the [HTTP Push Stream](https://www.nginx.com/resources/wiki/modules/push_stream/)
+module of nginx to make a [Server Sent Event](https://html.spec.whatwg.org/multipage/server-sent-events.html)
+server.
+
+Two endpoints are available, published as the following connection parameters:
+
+ - `publisher-url`, which uses`/pub{?id}` format, with `id` being the ID of the channel.
+  Clients can subscribe to this URL and be notified of new messages.
+ - `subscriber-url`, which uses `/sub{/id}` format, with `id` being the ID of the channel.
+  `POST` requests to this URL send new messages to this channel.
+
+

software/nginx-push-stream/buildout.hash.cfg

+[template]
+filename = instance.cfg.in
+md5sum = f9b6d01e29f2edddd9d6f99591976c33
+
+[template-nginx-configuration]
+filename = template-nginx.cfg.in
+md5sum = 022e4b53e1b2db16c4e518fe76f638fa

software/nginx-push-stream/instance-nginx.cfg.in

-[buildout]
-parts =
-  nginx-service
-  htpasswd
-  htpasswd-runner
-  publish-connection-information
-
-eggs-directory = ${buildout:eggs-directory}
-develop-eggs-directory = ${buildout:develop-eggs-directory}
-offline = true
-
-[directory]
-recipe = slapos.cookbook:mkdirectory
-etc = $${buildout:directory}/etc
-bin = $${buildout:directory}/bin
-srv = $${buildout:directory}/srv
-var = $${buildout:directory}/var
-run = $${:var}/run
-log = $${:var}/log
-varnginx = $${:var}/nginx
-services = $${:etc}/service
-cron-entries = $${:etc}/cron.d
-www = $${:srv}/www
-ssl = $${:etc}/ssl
-
-#################################
-# Nginx service
-#################################
-[nginx-service]
-recipe = slapos.recipe.template
-url = ${template-nginx-service:output}
-output = $${directory:services}/nginx
-mode = 0700
-virtual-depends =
-  $${nginx-configuration:ip}
-
-[nginx-configuration]
-recipe = slapos.recipe.template
-url = ${template-nginx-configuration:output}
-output = $${directory:etc}/nginx.cfg
-mode = 0600
-access_log = $${directory:log}/nginx-access.log
-error_log = $${directory:log}/nginx-error.log
-ip = $${slap-network-information:global-ipv6}
-local_ip = $${slap-network-information:local-ipv4}
-port = 9443
-publisher_location_prefix = /pub
-publisher_push_stream_store_messages = off
-publisher_client_max_body_size = 16k
-publisher_client_body_buffer_size = 16k
-
-subscriber_allow_origin = '*'
-subscriber_location_prefix = /sub
-# Prevent to use credential if origin is star
-subscriber_allow_credential = 'false'
-subscriber_allow_methods = 'GET, HEAD, OPTIONS'
-subscriber_allow_headers = 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since'
-
-[htpasswd]
-recipe = slapos.cookbook:generate.password
-storage-path = $${directory:etc}/.pwd
-bytes = 8
-
-[htpasswd-runner]
-recipe = plone.recipe.command
-stop-on-error = true
-htpasswd-path = $${directory:etc}/.htpasswd
-command = if [ ! -f "$${:htpasswd-path}" ]; then ${buildout:bin-directory}/htpasswd -cb $${:htpasswd-path} $${:user} $${:password}; fi
-update-command = $${:command}
-user = admin
-password = $${htpasswd:passwd}
-
-[publish-connection-information]
-recipe = slapos.cookbook:publish
-init-password = $${htpasswd:passwd}
-init-user = $${htpasswd-runner:user}
-publisher-url = http://$${htpasswd-runner:user}:$${htpasswd:passwd}@[$${nginx-configuration:ip}]:$${nginx-configuration:port}$${nginx-configuration:publisher_location_prefix}
-subscriber-url = http://$${htpasswd-runner:user}:$${htpasswd:passwd}@[$${nginx-configuration:ip}]:$${nginx-configuration:port}$${nginx-configuration:subscriber_location_prefix}

software/nginx-push-stream/instance.cfg.in

 [buildout]
 parts =
-  switch-softwaretype
-
+  nginx-service
+  promises
+  publish-connection-information
+extends = ${monitor-template:rendered}
 eggs-directory = ${buildout:eggs-directory}
 develop-eggs-directory = ${buildout:develop-eggs-directory}
 offline = true
 
-[switch-softwaretype]
-recipe = slapos.cookbook:softwaretype
-default = $${:nginx}
-nginx = $${dynamic-template-nginx:rendered}
-
-[dynamic-template-nginx]
-recipe = slapos.recipe.template:jinja2
-template = ${template-nginx:output}
-rendered = $${buildout:parts-directory}/$${:_buildout_section_name_}/$${:filename}
-filename = instance-nginx.cfg
-
-[slap-connection]
-computer-id = $${slap_connection:computer_id}
-partition-id = $${slap_connection:partition_id}
-server-url = $${slap_connection:server_url}
-software-release-url = $${slap_connection:software_release_url}
-key-file = $${slap_connection:key_file}
-cert-file = $${slap_connection:cert_file}
-
-[instance-parameter]
-# Fetches parameters defined in SlapOS Master for this instance.
-# Always the same.
-recipe = slapos.cookbook:slapconfiguration.serialised
-computer = $${slap_connection:computer_id}
-partition = $${slap_connection:partition_id}
-url = $${slap_connection:server_url}
-key = $${slap_connection:key_file}
-cert = $${slap_connection:cert_file}
+[directory]
+recipe = slapos.cookbook:mkdirectory
+etc = $${buildout:directory}/etc
+bin = $${buildout:directory}/bin
+srv = $${buildout:directory}/srv
+var = $${buildout:directory}/var
+run = $${:var}/run
+log = $${:var}/log
+varnginx = $${:var}/nginx
+services = $${:etc}/service
+cron-entries = $${:etc}/cron.d
+www = $${:srv}/www
+ssl = $${:etc}/ssl
+
+[slap-configuration]
+recipe = slapos.cookbook:slapconfiguration
+computer = $${slap-connection:computer-id}
+partition = $${slap-connection:partition-id}
+url = $${slap-connection:server-url}
+key = $${slap-connection:key-file}
+cert = $${slap-connection:cert-file}
+
+#################################
+# Nginx service
+#################################
+[nginx-service]
+recipe = slapos.cookbook:wrapper
+wrapper-path = $${directory:services}/nginx
+command-line =
+  ${nginx-push-stream-output:nginx} -c $${nginx-configuration:output}
+
+[nginx-configuration]
+recipe = slapos.recipe.template
+url = ${template-nginx-configuration:output}
+output = $${directory:etc}/nginx.cfg
+mode = 0600
+access-log = $${directory:log}/nginx-access.log
+error-log = $${directory:log}/nginx-error.log
+ip = $${slap-configuration:ipv6-random}
+local-ip = $${slap-configuration:ipv4-random}
+port = 9443
+base-url = https://[$${nginx-configuration:ip}]:$${nginx-configuration:port}
+
+# Generate a self-signed TLS certificate.
+[nginx-certificate]
+recipe = plone.recipe.command
+command =
+  if [ ! -e $${:key-file} ]
+  then
+    ${openssl:location}/bin/openssl req -x509 -nodes -days 3650 \
+      -subj "/C=AA/ST=X/L=X/O=Dis/CN=$${nginx-configuration:ip}" \
+      -newkey rsa:1024 -keyout $${:key-file} \
+      -out $${:cert-file}
+  fi
+update-command = $${:command}
+key-file = $${directory:ssl}/${:_buildout_section_name_}.key
+cert-file = $${directory:ssl}/${:_buildout_section_name_}.cert
+common-name = $${nginx-configuration:ip}
+stop-on-error = true
+
+[promises]
+recipe =
+promises =
+  $${nginx-available-promise:recipe}
+
+[nginx-available-promise]
+<= monitor-promise-base
+module = check_url_available
+name = $${:_buildout_section_name_}.py
+config-url = $${nginx-configuration:base-url}/status
+
+[publish-connection-information]
+recipe = slapos.cookbook:publish
+# publisher-url and subscriber-url are URITemplates, with an id
+# parameter which is the ID of the channel.
+publisher-url = $${nginx-configuration:base-url}/pub{?id}
+subscriber-url = $${nginx-configuration:base-url}/sub{/id}

software/nginx-push-stream/software.cfg

 [buildout]
 extends =
   ../../stack/slapos.cfg
-  ../../component/dash/buildout.cfg
   ../../component/nginx/buildout.cfg
+  ../../stack/monitor/buildout.cfg
+  ./buildout.hash.cfg
 
 parts =
   slapos-cookbook
@@ -10,36 +11,18 @@ parts =
   nginx-push-stream-module
   nginx-push-stream
   template
-  template-nginx-service
-  template-nginx
+
+[python]
+part = python3
 
 [template]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg.in
-md5sum = eb4c69df9a8dbb94fb76d0a6c11e360f
 output = ${buildout:directory}/template.cfg
 mode = 0644
 
-[template-nginx-service]
-recipe = slapos.recipe.template
-url = ${:_profile_base_location_}/template-nginx-service.sh.in
-md5sum = 90ba5a247c489261d3304528cba56e06
-output = ${buildout:directory}/template-nginx-service.sh.in
-mode = 0644
-
 [template-nginx-configuration]
 recipe = slapos.recipe.template
-url = ${:_profile_base_location_}/template-nginx.cfg.in
-md5sum = f5658154b82282bc1871f18ddf4529d8
+url = ${:_profile_base_location_}/${:filename}
 output = ${buildout:directory}/template-nginx.cfg.in
 mode = 0644
-
-[template-nginx]
-recipe = slapos.recipe.template
-url = ${:_profile_base_location_}/instance-nginx.cfg.in
-md5sum = 936fea88f5548c4f14e287f1b27dc127
-output = ${buildout:directory}/instance-nginx.cfg.in
-mode = 0644
-
-[versions]
-inotifyx = 0.2.2

software/nginx-push-stream/template-nginx-service.sh.in

-#!${dash-output:dash}
-# BEWARE: This file is operated by slapos node
-# BEWARE: It will be overwritten automatically
-
-exec ${nginx-push-stream-output:nginx} \
-  -c $${nginx-configuration:output}

software/nginx-push-stream/template-nginx.cfg.in

@@ -8,7 +8,7 @@ events {
   # multi_accept on;
 }
 
-error_log $${nginx-configuration:error_log};
+error_log $${nginx-configuration:error-log};
 
 http {
 
@@ -33,8 +33,8 @@ http {
   # Logging Settings
   ##
 
-  access_log $${nginx-configuration:access_log};
-  error_log $${nginx-configuration:error_log};
+  access_log $${nginx-configuration:access-log};
+  error_log $${nginx-configuration:error-log};
 
   ##
   # Gzip Settings
@@ -54,9 +54,21 @@ http {
   ##
   push_stream_shared_memory_size                32m;
 
+
 server {
-  listen [$${nginx-configuration:ip}]:$${nginx-configuration:port};
-  listen $${nginx-configuration:local_ip}:$${nginx-configuration:port};
+  listen [$${nginx-configuration:ip}]:$${nginx-configuration:port} ssl http2;
+  listen $${nginx-configuration:local-ip}:$${nginx-configuration:port} ssl http2;
+
+  # generated 2021-08-02, Mozilla Guideline v5.6, nginx 1.19.2, OpenSSL 1.1.1k, modern configuration, no HSTS, no OCSP
+  # https://ssl-config.mozilla.org/#server=nginx&version=1.19.2&config=modern&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6
+  ssl_certificate $${nginx-certificate:cert-file};
+  ssl_certificate_key $${nginx-certificate:key-file};
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:MozSSL:10m;
+  ssl_session_tickets off;
+  ssl_protocols TLSv1.3;
+  ssl_prefer_server_ciphers off;
+
 
   fastcgi_temp_path  $${directory:varnginx} 1 2;
   uwsgi_temp_path  $${directory:varnginx} 1 2;
@@ -65,42 +77,42 @@ server {
   client_body_temp_path $${directory:varnginx} 1 2;
   proxy_temp_path $${directory:varnginx} 1 2;
 
-  auth_basic           "Nginx Access";
-  auth_basic_user_file $${htpasswd-runner:htpasswd-path};
-
   ## Serve an error 204 (No Content) for favicon.ico
   location = /favicon.ico {
     return 204;
   }
 
-  location $${nginx-configuration:publisher_location_prefix} {
-            push_stream_publisher;
+  location = /status {
+    default_type "text/plain";
+    return 200 'OK';
+  }
 
-            push_stream_channels_path               $arg_id;
-            # store messages in memory
-            push_stream_store_messages              $${nginx-configuration:publisher_push_stream_store_messages};
+  location /pub {
+    push_stream_publisher;
 
-            # Message size limit
-            # client_max_body_size MUST be equal to client_body_buffer_size or
-            # you will be sorry.
-            client_max_body_size                    $${nginx-configuration:publisher_client_max_body_size};
-            client_body_buffer_size                 $${nginx-configuration:publisher_client_body_buffer_size};
+    push_stream_channels_path               $arg_id;
+    # store messages in memory
+    push_stream_store_messages              off;
 
-   }
+    # Message size limit
+    client_max_body_size                    16k;
+    client_body_buffer_size                 16k;
+    
+  }
 
-   location ~ $${nginx-configuration:subscriber_location_prefix}/(.*) {
-            # activate subscriber mode for this location
-            add_header "Access-Control-Allow-Origin" $${nginx-configuration:subscriber_allow_origin};
-            add_header 'Access-Control-Allow-Credentials' $${nginx-configuration:subscriber_allow_credential};
-            add_header 'Access-Control-Allow-Methods' $${nginx-configuration:subscriber_allow_methods};
-            add_header 'Access-Control-Allow-Headers' $${nginx-configuration:subscriber_allow_headers};
+  location ~ /sub/(.*) {
+    # activate subscriber mode for this location
+    add_header "Access-Control-Allow-Origin" '*';
+    add_header 'Access-Control-Allow-Credentials' 'false';
+    add_header 'Access-Control-Allow-Methods' 'GET, HEAD, OPTIONS';
+    add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since';
 
-            push_stream_subscriber eventsource;
-            # positional channel path
-            push_stream_channels_path                   $1;
+    push_stream_subscriber eventsource;
+    # positional channel path
+    push_stream_channels_path                   $1;
 
-            # content-type
-            default_type                                "text/event-stream; charset=utf-8";
+    # content-type
+    default_type                                "text/event-stream; charset=utf-8";
   }
 
   location / {

software/nginx-push-stream/test/README.md

+Tests for Nginx Push Stream software release

software/nginx-push-stream/test/setup.py

+##############################################################################
+#
+# Copyright (c) 2021 Nexedi SA and Contributors. All Rights Reserved.
+#
+# WARNING: This program as such is intended to be used by professional
+# programmers who take the whole responsibility of assessing all potential
+# consequences resulting from its eventual inadequacies and bugs
+# End users who are looking for a ready-to-use solution with commercial
+# guarantees and support are strongly adviced to contract a Free Software
+# Service Company
+#
+# This program is Free Software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 3
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+#
+##############################################################################
+from setuptools import setup, find_packages
+
+version = '0.0.1.dev0'
+name = 'slapos.test.nginx_push_stream'
+long_description = open("README.md").read()
+
+setup(
+    name=name,
+    version=version,
+    description="Test for SlapOS' Nginx Push Stream",
+    long_description=long_description,
+    long_description_content_type='text/markdown',
+    maintainer="Nexedi",
+    maintainer_email="info@nexedi.com",
+    url="https://lab.nexedi.com/nexedi/slapos",
+    packages=find_packages(),
+    install_requires=[
+        'slapos.core',
+        'slapos.libnetworkcache',
+        'requests',
+        'uritemplate',
+    ],
+    zip_safe=True,
+    test_suite='test',
+)

software/nginx-push-stream/test/test.py

+##############################################################################
+# coding: utf-8
+# Copyright (c) 2021 Nexedi SA and Contributors. All Rights Reserved.
+#
+# WARNING: This program as such is intended to be used by professional
+# programmers who take the whole responsibility of assessing all potential
+# consequences resulting from its eventual inadequacies and bugs
+# End users who are looking for a ready-to-use solution with commercial
+# guarantees and support are strongly adviced to contract a Free Software
+# Service Company
+#
+# This program is Free Software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 3
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+#
+##############################################################################
+
+import os
+import multiprocessing
+
+import uritemplate
+import requests
+
+from slapos.testing.testcase import makeModuleSetUpAndTestCaseClass
+
+setUpModule, SlapOSInstanceTestCase = makeModuleSetUpAndTestCaseClass(
+    os.path.abspath(
+        os.path.join(os.path.dirname(__file__), '..', 'software.cfg')))
+
+
+class TestNginxPushStream(SlapOSInstanceTestCase):
+  def setUp(self):
+    self.connection_parameters = \
+        self.computer_partition.getConnectionParameterDict()
+
+  def test_push_stream_scenario(self):
+    def process_messages(q):
+      # type:(multiprocessing.Queue[bytes]) -> None
+      req = requests.get(
+          uritemplate.URITemplate(
+              self.connection_parameters['subscriber-url']).expand(
+                  id='channel_id'),
+          verify=False,
+          stream=True,
+      )
+      if not req.ok:
+        q.put(('error: wrong status code %s' % req.status_code).encode())
+      q.put(b'ready')
+      for _, line in zip(range(2), req.iter_lines()):
+        q.put(line)
+
+    q = multiprocessing.Queue()  # type: multiprocessing.Queue[bytes]
+    subscriber = multiprocessing.Process(target=process_messages, args=(q, ))
+    subscriber.start()
+    self.assertEqual(q.get(timeout=30), b'ready')
+
+    resp = requests.post(
+        uritemplate.URITemplate(
+            self.connection_parameters['publisher-url']).expand(
+                id='channel_id'),
+        verify=False,
+        data='Hello',
+        timeout=2,
+    )
+    resp.raise_for_status()
+
+    try:
+      subscriber.join(timeout=30)
+    except multiprocessing.TimeoutError:
+      subscriber.terminate()
+      subscriber.join(timeout=30)
+      self.fail('Process did not terminate')
+
+    self.assertEqual(q.get_nowait(), b': ')
+    self.assertEqual(q.get_nowait(), b'data: Hello')

software/slapos-sr-testing/software.cfg

@@ -149,6 +149,11 @@ setup = ${slapos-repository:location}/software/jupyter/test/
 egg = slapos.test.nextcloud
 setup = ${slapos-repository:location}/software/nextcloud/test/
 
+[slapos.test.nginx-push-stream-setup]
+<= setup-develop-egg
+egg = slapos.test.nginx_push_stream
+setup = ${slapos-repository:location}/software/nginx-push-stream/test/
+
 [slapos.test.turnserver-setup]
 <= setup-develop-egg
 egg = slapos.test.turnserver
@@ -242,6 +247,7 @@ extra-eggs =
   ${slapos.test.slaprunner-setup:egg}
   ${slapos.test.jupyter-setup:egg}
   ${slapos.test.nextcloud-setup:egg}
+  ${slapos.test.nginx-push-stream-setup:egg}
   ${slapos.test.turnserver-setup:egg}
   ${slapos.test.theia-setup:egg}
   ${slapos.test.cloudooo-setup:egg}
@@ -312,6 +318,7 @@ tests =
   slaprunner ${slapos.test.slaprunner-setup:setup}
   theia ${slapos.test.theia-setup:setup}
   metabase ${slapos.test.metabase-setup:setup}
+  nginx-push-stream ${slapos.test.nginx-push-stream-setup:setup}
 ###
   ${:extra}