Do not use 'generic' prefix for KVM related recipes. Drop legacy kvm_frontend recipe.

setup.py

@@ -58,9 +58,7 @@ setup(name=name,
           'equeue = slapos.recipe.equeue:Recipe',
           'erp5testnode = slapos.recipe.erp5testnode:Recipe',
           'generate.mac = slapos.recipe.generatemac:Recipe',
-          'generic.kvm.frontend = slapos.recipe.generic_kvm_frontend:Recipe',
           'nbdserver = slapos.recipe.nbdserver:Recipe',
-          'generic.novnc = slapos.recipe.generic_novnc:Recipe',
           'generic.onetimeupload = slapos.recipe.generic_onetimeupload:Recipe',
           'helloworld = slapos.recipe.helloworld:Recipe',
           'generic.cloudooo = slapos.recipe.generic_cloudooo:Recipe',
@@ -68,6 +66,7 @@ setup(name=name,
           'java = slapos.recipe.java:Recipe',
           'kumofs = slapos.recipe.kumofs:Recipe',
           'kvm = slapos.recipe.kvm:Recipe',
+          'kvm.frontend = slapos.recipe.kvm_frontend:Recipe',
           'generic.kumofs = slapos.recipe.generic_kumofs:Recipe',
           'haproxy = slapos.recipe.haproxy:Recipe',
           'libcloud = slapos.recipe.libcloud:Recipe',
@@ -83,6 +82,7 @@ setup(name=name,
           'notifier = slapos.recipe.notifier:Recipe',
           'notifier.callback = slapos.recipe.notifier:Callback',
           'notifier.notify = slapos.recipe.notifier:Notify',
+          'novnc = slapos.recipe.novnc:Recipe',
           'lamp = slapos.recipe.lamp:Request',
           'lamp.request = slapos.recipe.lamp:Request',
           'lamp.static = slapos.recipe.lamp:Static',

slapos/recipe/generic_kvm_frontend/__init__.py

-##############################################################################
-#
-# Copyright (c) 2011 Vifib SARL and Contributors. All Rights Reserved.
-#
-# WARNING: This program as such is intended to be used by professional
-# programmers who take the whole responsibility of assessing all potential
-# consequences resulting from its eventual inadequacies and bugs
-# End users who are looking for a ready-to-use solution with commercial
-# guarantees and support are strongly adviced to contract a Free Software
-# Service Company
-#
-# This program is Free Software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License
-# as published by the Free Software Foundation; either version 3
-# of the License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-#
-##############################################################################
-from slapos.recipe.librecipe import GenericBaseRecipe, GenericSlapRecipe
-import json
-import zc.buildout
-
-class Recipe(GenericSlapRecipe):
-  """
-  kvm frontend instance configuration.
-  """
-
-  def _getRewriteRuleContent(self, slave_instance_list):
-    """Generate rewrite rules list from slaves list"""
-    rewrite_rule_list = []
-    for slave_instance in slave_instance_list:
-      self.logger.info("Processing slave instance %s..." %
-          slave_instance['slave_reference'])
-      # Check for mandatory fields
-      if slave_instance.get('host', None) is None:
-        self.logger.warn('No "host" parameter is defined for %s slave'\
-            'instance. Ignoring it.' % slave_instance['slave_reference'])
-        continue
-      if slave_instance.get('port', None) is None:
-        self.logger.warn('No "host" parameter is defined for %s slave'\
-            'instance. Ignoring it.' % slave_instance['slave_reference'])
-        continue
-
-      current_slave_dict = dict()
-
-      # Get host, and if IPv6 address, remove "[" and "]"
-      current_slave_dict['host'] = slave_instance['host'].\
-          replace('[', '').replace(']', '')
-      current_slave_dict['port'] = slave_instance['port']
-
-      # Check if target is https or http
-      current_slave_dict['https'] = slave_instance.get('https', 'true')
-      if current_slave_dict['https'] in GenericBaseRecipe.FALSE_VALUES:
-        current_slave_dict['https'] = 'false'
-      # Set reference and resource url
-      # Reference is raw reference from SlapOS Master, resource is
-      # URL-compatible name
-      reference = slave_instance.get('slave_reference')
-      current_slave_dict['reference'] = reference
-      current_slave_dict['resource'] = reference.replace('-', '')
-      rewrite_rule_list.append(current_slave_dict)
-    return rewrite_rule_list
-
-  def _getProxyTableContent(self, rewrite_rule_list):
-    """Generate proxy table file content from rewrite rules list"""
-    proxy_table = dict()
-    for rewrite_rule in rewrite_rule_list:
-      proxy_table[rewrite_rule['resource']] = {
-          'port': rewrite_rule['port'],
-          'host': rewrite_rule['host'],
-          'https': rewrite_rule['https'],
-      }
-
-    proxy_table_content = json.dumps(proxy_table)
-    return proxy_table_content
-
-  def _install(self):
-    # Check for mandatory field
-    if self.options.get('domain', None) is None:
-      raise zc.buildout.UserError('No domain name specified. Please define '
-          'the "domain" instance parameter.')
-    # Generate rewrite rules
-    rewrite_rule_list = self._getRewriteRuleContent(
-      json.loads(self.options['slave-instance-list']))
-    # Create Map
-    map_content = self._getProxyTableContent(rewrite_rule_list)
-    map_file = self.createFile(self.options['map-path'], map_content)
-
-    # Create configuration
-    conf = open(self.getTemplateFilename('kvm-proxy.js'), 'r')
-    conf_file = self.createFile(self.options['conf-path'], conf.read())
-    conf.close()
-
-    # Do we create http dummy server used to redirect to https?
-    if self.options['http-redirection'] in GenericBaseRecipe.TRUE_VALUES:
-      http_redirect_server = '1'
-    else:
-      http_redirect_server = ''
-
-    config = dict(
-      ip=self.options['ip'],
-      port=self.options['port'],
-      key=self.options['ssl-key-path'],
-      certificate=self.options['ssl-cert-path'],
-      name=self.options['domain'],
-      shell_path=self.options['shell-path'],
-      node_path=self.options['node-binary'],
-      node_env=self.options['node-env'],
-      conf_path=conf_file,
-      map_path=map_file,
-      plain_http=http_redirect_server,
-    )
-
-    runner_path = self.createExecutable(
-      self.options['wrapper-path'],
-      self.substituteTemplate(self.getTemplateFilename('nodejs_run.in'),
-                              config))
-
-    # Send connection parameters of slave instances
-    site_url = "https://%s:%s/" % (self.options['domain'], self.options['port'])
-    for slave in rewrite_rule_list:
-      self.setConnectionDict(
-          dict(url="%s%s" % (site_url, slave['resource']),
-               domainname=self.options['domain'],
-               port=self.options['port'],
-               resource=slave['resource']),
-          slave['reference'])
-
-    return [map_file, conf_file, runner_path]

slapos/recipe/kvm_frontend/__init__.py

 ##############################################################################
 #
-# Copyright (c) 2010 Vifib SARL and Contributors. All Rights Reserved.
+# Copyright (c) 2011 Vifib SARL and Contributors. All Rights Reserved.
 #
 # WARNING: This program as such is intended to be used by professional
 # programmers who take the whole responsibility of assessing all potential
@@ -24,78 +24,114 @@
 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 #
 ##############################################################################
-from slapos.recipe.librecipe import BaseSlapRecipe
-import os
-import pkg_resources
-import hashlib
-import string
-import sys
+from slapos.recipe.librecipe import GenericBaseRecipe, GenericSlapRecipe
+import json
 import zc.buildout
-import zc.recipe.egg
-import ConfigParser
 
-TRUE_VALUE_LIST = ['y', 'yes', '1', 'true']
-FALSE_VALUE_LIST = ['n', 'no', '0', 'false']
+class Recipe(GenericSlapRecipe):
+  """
+  kvm frontend instance configuration.
+  """
 
-class Recipe(BaseSlapRecipe):
+  def _getRewriteRuleContent(self, slave_instance_list):
+    """Generate rewrite rules list from slaves list"""
+    rewrite_rule_list = []
+    for slave_instance in slave_instance_list:
+      self.logger.info("Processing slave instance %s..." %
+          slave_instance['slave_reference'])
+      # Check for mandatory fields
+      if slave_instance.get('host', None) is None:
+        self.logger.warn('No "host" parameter is defined for %s slave'\
+            'instance. Ignoring it.' % slave_instance['slave_reference'])
+        continue
+      if slave_instance.get('port', None) is None:
+        self.logger.warn('No "host" parameter is defined for %s slave'\
+            'instance. Ignoring it.' % slave_instance['slave_reference'])
+        continue
 
-  def getTemplateFilename(self, template_name):
-    return pkg_resources.resource_filename(__name__,
-        'template/%s' % template_name)
+      current_slave_dict = dict()
+
+      # Get host, and if IPv6 address, remove "[" and "]"
+      current_slave_dict['host'] = slave_instance['host'].\
+          replace('[', '').replace(']', '')
+      current_slave_dict['port'] = slave_instance['port']
+
+      # Check if target is https or http
+      current_slave_dict['https'] = slave_instance.get('https', 'true')
+      if current_slave_dict['https'] in GenericBaseRecipe.FALSE_VALUES:
+        current_slave_dict['https'] = 'false'
+      # Set reference and resource url
+      # Reference is raw reference from SlapOS Master, resource is
+      # URL-compatible name
+      reference = slave_instance.get('slave_reference')
+      current_slave_dict['reference'] = reference
+      current_slave_dict['resource'] = reference.replace('-', '')
+      rewrite_rule_list.append(current_slave_dict)
+    return rewrite_rule_list
+
+  def _getProxyTableContent(self, rewrite_rule_list):
+    """Generate proxy table file content from rewrite rules list"""
+    proxy_table = dict()
+    for rewrite_rule in rewrite_rule_list:
+      proxy_table[rewrite_rule['resource']] = {
+          'port': rewrite_rule['port'],
+          'host': rewrite_rule['host'],
+          'https': rewrite_rule['https'],
+      }
+
+    proxy_table_content = json.dumps(proxy_table)
+    return proxy_table_content
 
   def _install(self):
-    self.path_list = []
-    self.requirements, self.ws = self.egg.working_set()
+    # Check for mandatory field
+    if self.options.get('domain', None) is None:
+      raise zc.buildout.UserError('No domain name specified. Please define '
+          'the "domain" instance parameter.')
+    # Generate rewrite rules
+    rewrite_rule_list = self._getRewriteRuleContent(
+      json.loads(self.options['slave-instance-list']))
+    # Create Map
+    map_content = self._getProxyTableContent(rewrite_rule_list)
+    map_file = self.createFile(self.options['map-path'], map_content)
 
-#     frontend_port_number = self.parameter_dict.get("port", 4443)
-#     frontend_domain_name = self.parameter_dict.get("domain",
-#         "host.vifib.net")
+    # Create configuration
+    conf = open(self.getTemplateFilename('kvm-proxy.js'), 'r')
+    conf_file = self.createFile(self.options['conf-path'], conf.read())
+    conf.close()
 
-    # Create http server redirecting (302) to https proxy?
-    redirect_plain_http = self.parameter_dict.get("redirect_plain_http", '')
-    if redirect_plain_http in TRUE_VALUE_LIST:
-      redirect_plain_http = '1'
-    
-    # Cert stuffs
-    valid_certificate_str = self.parameter_dict.get('domain_ssl_ca_cert')
-    valid_key_str = self.parameter_dict.get('domain_ssl_ca_key')
-    if valid_certificate_str is None and valid_key_str is None:
-      ca_conf = self.installCertificateAuthority()
-      key, certificate = self.requestCertificate(frontend_domain_name)
+    # Do we create http dummy server used to redirect to https?
+    if self.options['http-redirection'] in GenericBaseRecipe.TRUE_VALUES:
+      http_redirect_server = '1'
     else:
-      ca_conf = self.installValidCertificateAuthority(
-          frontend_domain_name, valid_certificate_str, valid_key_str)
-      key = ca_conf.pop('key')
-      certificate = ca_conf.pop('certificate')
+      http_redirect_server = ''
 
-    # Install node + js script
-#     node_parameter_dict = self.installFrontendNode(
-#         ip=self.getGlobalIPv6Address(),
-#         port=frontend_port_number,
-#         plain_http=redirect_plain_http,
-#         name=frontend_domain_name,
-#         slave_instance_list=self.parameter_dict.get('slave_instance_list', []),
-#         key=key, certificate=certificate)
+    config = dict(
+      ip=self.options['ip'],
+      port=self.options['port'],
+      key=self.options['ssl-key-path'],
+      certificate=self.options['ssl-cert-path'],
+      name=self.options['domain'],
+      shell_path=self.options['shell-path'],
+      node_path=self.options['node-binary'],
+      node_env=self.options['node-env'],
+      conf_path=conf_file,
+      map_path=map_file,
+      plain_http=http_redirect_server,
+    )
+
+    runner_path = self.createExecutable(
+      self.options['wrapper-path'],
+      self.substituteTemplate(self.getTemplateFilename('nodejs_run.in'),
+                              config))
 
-    # Send connection parameters of master instance
-    site_url = node_parameter_dict['site_url']
-    self.setConnectionDict(
-      dict(site_url=site_url,
-           domain_ipv6_address=self.getGlobalIPv6Address()))
     # Send connection parameters of slave instances
-    for slave in node_parameter_dict['rewrite_rule_list']:
+    site_url = "https://%s:%s/" % (self.options['domain'], self.options['port'])
+    for slave in rewrite_rule_list:
       self.setConnectionDict(
-          dict(site_url="%s%s" % (site_url, slave['resource']),
-               domainname=frontend_domain_name,
-               port=frontend_port_number,
+          dict(url="%s%s" % (site_url, slave['resource']),
+               domainname=self.options['domain'],
+               port=self.options['port'],
                resource=slave['resource']),
           slave['reference'])
 
-    return self.path_list
-
-
-  def installFrontendNode(self, ip, port, key, certificate, plain_http,
-                            name, slave_instance_list):
-
-    return dict(site_url="https://%s:%s/" % (name, port),
-                rewrite_rule_list=rewrite_rule_list)
+    return [map_file, conf_file, runner_path]

slapos/recipe/kvm_frontend/template/logrotate_entry.in

-%(file_list)s {
-  daily
-  dateext
-  rotate 30
-  compress
-  notifempty
-  sharedscripts
-  create
-  postrotate
-    %(postrotate)s
-  endscript
-  olddir %(olddir)s
-}

slapos/recipe/kvm_frontend/template/openssl.cnf.ca.in

-#
-# OpenSSL example configuration file.
-# This is mostly being used for generation of certificate requests.
-#
-
-# This definition stops the following lines choking if HOME isn't
-# defined.
-HOME			= .
-RANDFILE		= $ENV::HOME/.rnd
-
-# Extra OBJECT IDENTIFIER info:
-#oid_file		= $ENV::HOME/.oid
-oid_section		= new_oids
-
-# To use this configuration file with the "-extfile" option of the
-# "openssl x509" utility, name here the section containing the
-# X.509v3 extensions to use:
-# extensions		= 
-# (Alternatively, use a configuration file that has only
-# X.509v3 extensions in its main [= default] section.)
-
-[ new_oids ]
-
-# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
-# Add a simple OID like this:
-# testoid1=1.2.3.4
-# Or use config file substitution like this:
-# testoid2=${testoid1}.5.6
-
-# Policies used by the TSA examples.
-tsa_policy1 = 1.2.3.4.1
-tsa_policy2 = 1.2.3.4.5.6
-tsa_policy3 = 1.2.3.4.5.7
-
-####################################################################
-[ ca ]
-default_ca	= CA_default		# The default ca section
-
-####################################################################
-[ CA_default ]
-
-dir		= %(working_directory)s		# Where everything is kept
-certs		= $dir/certs		# Where the issued certs are kept
-crl_dir		= $dir/crl		# Where the issued crl are kept
-database	= $dir/index.txt	# database index file.
-#unique_subject	= no			# Set to 'no' to allow creation of
-					# several ctificates with same subject.
-new_certs_dir	= $dir/newcerts		# default place for new certs.
-
-certificate	= $dir/cacert.pem 	# The CA certificate
-serial		= $dir/serial 		# The current serial number
-crlnumber	= $dir/crlnumber	# the current crl number
-					# must be commented out to leave a V1 CRL
-crl		= $dir/crl.pem 		# The current CRL
-private_key	= $dir/private/cakey.pem # The private key
-RANDFILE	= $dir/private/.rand	# private random number file
-
-x509_extensions	= usr_cert		# The extentions to add to the cert
-
-# Comment out the following two lines for the "traditional"
-# (and highly broken) format.
-name_opt 	= ca_default		# Subject Name options
-cert_opt 	= ca_default		# Certificate field options
-
-# Extension copying option: use with caution.
-# copy_extensions = copy
-
-# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
-# so this is commented out by default to leave a V1 CRL.
-# crlnumber must also be commented out to leave a V1 CRL.
-# crl_extensions	= crl_ext
-
-default_days	= 3650			# how long to certify for
-default_crl_days= 30			# how long before next CRL
-default_md	= default		# use public key default MD
-preserve	= no			# keep passed DN ordering
-
-# A few difference way of specifying how similar the request should look
-# For type CA, the listed attributes must be the same, and the optional
-# and supplied fields are just that :-)
-policy		= policy_match
-
-# For the CA policy
-[ policy_match ]
-countryName		= match
-stateOrProvinceName	= match
-organizationName	= match
-organizationalUnitName	= optional
-commonName		= supplied
-emailAddress		= optional
-
-# For the 'anything' policy
-# At this point in time, you must list all acceptable 'object'
-# types.
-[ policy_anything ]
-countryName		= optional
-stateOrProvinceName	= optional
-localityName		= optional
-organizationName	= optional
-organizationalUnitName	= optional
-commonName		= supplied
-emailAddress		= optional
-
-####################################################################
-[ req ]
-default_bits		= 2048
-default_md		= sha1
-default_keyfile 	= privkey.pem
-distinguished_name	= req_distinguished_name
-#attributes		= req_attributes
-x509_extensions	= v3_ca	# The extentions to add to the self signed cert
-
-# Passwords for private keys if not present they will be prompted for
-# input_password = secret
-# output_password = secret
-
-# This sets a mask for permitted string types. There are several options. 
-# default: PrintableString, T61String, BMPString.
-# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
-# utf8only: only UTF8Strings (PKIX recommendation after 2004).
-# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
-# MASK:XXXX a literal mask value.
-# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
-string_mask = utf8only
-
-# req_extensions = v3_req # The extensions to add to a certificate request
-
-[ req_distinguished_name ]
-countryName			= Country Name (2 letter code)
-countryName_value		= %(country_code)s
-countryName_min			= 2
-countryName_max			= 2
-
-stateOrProvinceName		= State or Province Name (full name)
-stateOrProvinceName_value	= %(state)s
-
-localityName			= Locality Name (eg, city)
-localityName_value		= %(city)s
-
-0.organizationName		= Organization Name (eg, company)
-0.organizationName_value	= %(company)s
-
-# we can do this but it is not needed normally :-)
-#1.organizationName		= Second Organization Name (eg, company)
-#1.organizationName_default	= World Wide Web Pty Ltd
-
-commonName			= Common Name (eg, your name or your server\'s hostname)
-commonName_max			= 64
-
-emailAddress			= Email Address
-emailAddress_value = %(email_address)s
-emailAddress_max		= 64
-
-# SET-ex3			= SET extension number 3
-
-#[ req_attributes ]
-#challengePassword		= A challenge password
-#challengePassword_min		= 4
-#challengePassword_max		= 20
-#
-#unstructuredName		= An optional company name
-
-[ usr_cert ]
-
-# These extensions are added when 'ca' signs a request.
-
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-
-basicConstraints=CA:FALSE
-
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-
-# This is OK for an SSL server.
-# nsCertType			= server
-
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-
-# For normal client use this is typical
-# nsCertType = client, email
-
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-# This will be displayed in Netscape's comment listbox.
-nsComment			= "OpenSSL Generated Certificate"
-
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-
-# Copy subject details
-# issuerAltName=issuer:copy
-
-#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-
-# This is required for TSA certificates.
-# extendedKeyUsage = critical,timeStamping
-
-[ v3_req ]
-
-# Extensions to add to a certificate request
-
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-[ v3_ca ]
-
-
-# Extensions for a typical CA
-
-
-# PKIX recommendation.
-
-subjectKeyIdentifier=hash
-
-authorityKeyIdentifier=keyid:always,issuer
-
-# This is what PKIX recommends but some broken software chokes on critical
-# extensions.
-#basicConstraints = critical,CA:true
-# So we do this instead.
-basicConstraints = CA:true
-
-# Key usage: this is typical for a CA certificate. However since it will
-# prevent it being used as an test self-signed certificate it is best
-# left out by default.
-# keyUsage = cRLSign, keyCertSign
-
-# Some might want this also
-# nsCertType = sslCA, emailCA
-
-# Include email address in subject alt name: another PKIX recommendation
-# subjectAltName=email:copy
-# Copy issuer details
-# issuerAltName=issuer:copy
-
-# DER hex encoding of an extension: beware experts only!
-# obj=DER:02:03
-# Where 'obj' is a standard or added object
-# You can even override a supported extension:
-# basicConstraints= critical, DER:30:03:01:01:FF
-
-[ crl_ext ]
-
-# CRL extensions.
-# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
-
-# issuerAltName=issuer:copy
-authorityKeyIdentifier=keyid:always
-
-[ proxy_cert_ext ]
-# These extensions should be added when creating a proxy certificate
-
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-
-basicConstraints=CA:FALSE
-
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-
-# This is OK for an SSL server.
-# nsCertType			= server
-
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-
-# For normal client use this is typical
-# nsCertType = client, email
-
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-# This will be displayed in Netscape's comment listbox.
-nsComment			= "OpenSSL Generated Certificate"
-
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-
-# Copy subject details
-# issuerAltName=issuer:copy
-
-#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-
-# This really needs to be in place for it to be a proxy certificate.
-proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
-
-####################################################################
-[ tsa ]
-
-default_tsa = tsa_config1	# the default TSA section
-
-[ tsa_config1 ]
-
-# These are used by the TSA reply generation only.
-dir		= /etc/pki/tls		# TSA root directory
-serial		= $dir/tsaserial	# The current serial number (mandatory)
-crypto_device	= builtin		# OpenSSL engine to use for signing
-signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
-					# (optional)
-certs		= $dir/cacert.pem	# Certificate chain to include in reply
-					# (optional)
-signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
-
-default_policy	= tsa_policy1		# Policy if request did not specify it
-					# (optional)
-other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
-digests		= md5, sha1		# Acceptable message digests (mandatory)
-accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
-clock_precision_digits  = 0	# number of digits after dot. (optional)
-ordering		= yes	# Is ordering defined for timestamps?
-				# (optional, default: no)
-tsa_name		= yes	# Must the TSA name be included in the reply?
-				# (optional, default: no)
-ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
-				# (optional, default: no)

slapos/recipe/kvm_frontend/template/proxytable-vifib-snippet.json.in

-
-  "/hosting": {
-    "port": 15000,
-    "host": "2a01:e35:2e27:460:e2cb:4eff:fed9:ddd6",
-    "https": true
-  }
-

software/kvm/instance-frontend.cfg

@@ -45,7 +45,7 @@ logrotate-backup = $${basedirectory:backup}/logrotate
 logrotate-entries = $${rootdirectory:etc}/logrotate.d
 
 [frontend-instance]
-recipe = slapos.cookbook:generic.kvm.frontend
+recipe = slapos.cookbook:kvm.frontend
 domain = $${ca-frontend:name}
 # port = $${slap-parameter:port}
 ip = $${slap-network-information:global-ipv6}

software/kvm/instance-kvm.cfg

@@ -60,7 +60,7 @@ hostname = $${kvm-instance:vnc-ip}
 port = $${kvm-instance:vnc-port}
 
 [novnc-instance]
-recipe = slapos.cookbook:generic.novnc
+recipe = slapos.cookbook:novnc
 path = $${ca-novnc:executable}
 ip = $${slap-network-information:global-ipv6}
 port = 6080

software/kvm/software.cfg

@@ -169,7 +169,7 @@ command =
 [template-kvm]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-kvm.cfg
-md5sum = 0c2d1307460b177edd24c66e3ed4f23f
+md5sum = 07d32036e08bc03e1d934629ea1af502
 output = ${buildout:directory}/template-kvm.cfg
 mode = 0644
 
@@ -190,7 +190,7 @@ mode = 0644
 [template-frontend]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-frontend.cfg
-md5sum = 47e6b4f1c12d83b95bdf6b1e5dedd907
+md5sum = 123bf4e5bea9e86c03b62e9afb8ca04b
 output = ${buildout:directory}/template-frontend.cfg
 mode = 0644