software/slaprunner: set Host header in nginx proxy

This host header is not passed by default, because we are already using
proxy_set_header, so we need to set it explicitly.

It seems that since we updated some packages in in 279486fe (stack/slapos:
version up some eggs with known vulnerabilties, 2021-01-28) slaprunner was
producing URLs with "localhost" as hostname when using redirect(url_for(...))

software/slaprunner/buildout.hash.cfg

@@ -38,7 +38,7 @@ md5sum = bd0ad0b80d2b39189f9665c48f1b3830
 
 [template_nginx_conf]
 filename = nginx_conf.in
-md5sum = 2b06f7eb9a1d45d250d4b92a944db925
+md5sum = 862aa0e482927e023e63631087f92190
 
 [template_httpd_conf]
 filename = httpd_conf.in

software/slaprunner/nginx_conf.in

@@ -41,6 +41,7 @@ http {
             proxy_set_header   X-Forwarded-Proto $scheme;
             proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
             proxy_set_header   X-Forwarded-Host  $http_host;
+            proxy_set_header   Host              $http_host;
             proxy_set_header   X-Accel-Mapping   /private/;
             proxy_connect_timeout 200;
             proxy_send_timeout    200;
@@ -54,6 +55,7 @@ http {
             proxy_set_header   X-Forwarded-Proto $scheme;
             proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
             proxy_set_header   X-Forwarded-Host  $http_host;
+            proxy_set_header   Host              $http_host;
             proxy_set_header   X-Accel-Mapping   /private/;
 
             proxy_pass http://unix:{{ socket }};

software/slaprunner/test/test.py

@@ -280,6 +280,28 @@ class TestWeb(SlaprunnerTestCase):
     self.assertEqual(requests.codes.ok, resp.status_code)
     self.assertIn('SlapOS', resp.text)
 
+  def test_slaprunner_redirects(self):
+    # redirects also work as expected. In this test we visit stopAllPartition
+    # which should redirect to inspectInstance
+    parameter_dict = self.computer_partition.getConnectionParameterDict()
+    url = parameter_dict['url']
+    resp = requests.get(
+        urljoin(url, '/stopAllPartition'),
+        verify=False,
+        auth=(parameter_dict['init-user'], parameter_dict['init-password']))
+    self.assertEqual(resp.status_code, requests.codes.ok)
+    self.assertEqual(resp.url, urljoin(url, '/inspectInstance'))
+
+    # this also works behind a frontend
+    resp = requests.get(
+        urljoin(url, '/stopAllPartition'),
+        verify=False,
+        allow_redirects=False,
+        headers={'Host': 'example.com:1234'},
+        auth=(parameter_dict['init-user'], parameter_dict['init-password']))
+    self.assertEqual(resp.status_code, requests.codes.found)
+    self.assertEqual(resp.headers['Location'], 'https://example.com:1234/inspectInstance')
+
   def test_shellinabox(self):
     # shellinabox exists at /shellinabox and is password protected
     parameter_dict = self.computer_partition.getConnectionParameterDict()