isp data is from https://www.whoismyisp.org/ip
cn-t for china telecom, default one if isp is other value
cn-m for china mobile
cn-u for china unicom

fix rst syntax - second try

fix markdown syntax

from nexedi/slapos!408 (comment 66703)

   bzip.org don't exist anymore, download from fosseis is ok as the md5sum guarantee we still get the same file.

/reviewed-on nexedi/slapos!406

LIBPCRE1_JIT is required to compile git-2.17.1, so we enabled jit in pcre component. Another solution will be to compile git with NO_LIBPCRE1_JIT=1 and keep jit disabled in pcre.

when accessing gitlab URL ex: lab.nexedi.com from renderjs, URL is blocked because there is no CORS.
Set cors header directly in nginx configuration, so that it's not required to create custom slave frontend configuration to include Access-Control-Allow-Origin

Gitlab-ce upgraded to version 8.17.8 with required gitlab-shell version 4.1.1-1 and gitlab-workhorse version 1.3.0.
Configurations and wrapper upgraded to work with the current version.

Each slave rejected by the frontend will report back detailed information
to slave requester in key request-error-list being [json_list_of_found_errors]

Master partition reports information in rejected-slave-dict instead of
rejected-slave-list, which is defined as:

{
  'slave_name': '[json_list_of_found_errors]'
}

Globals were needed to distnc between caddy-frontend and apache-frontend.

kill -SIGXXX works only in bash and not when the shell is e.g. dash, for
example:

	$ kill -SIGUSR1 1
	/bin/sh: 2: kill: Illegal option -S

This way log rotation for slapproxy.log & friends was not properly working.

Fix it by using `kill -XXX` form which is supported everywhere.

/reviewed-on nexedi/slapos!402

Finally, last change in erp5testnode is not needed, it was just required
to fix seleniumrunner software

As Age value can vary and it is not predictable, assert its existence only.

The case of firefox 60 described in the commit messages showed that we should not use `$TMPDIR` instead of `/tmp` in our patch to isolate `$DISPLAY`s.

This introduce a new environment variable `XORG_LOCK_DIR` with clearer semantics.

Softwares relying on this have been updated or removed when not used.

The following softwares where already OK:
 * ERP5 and erp5testnode did not set `$TMPDIR` and were using `/tmp/`
 * cloudooo runs in `--headless` mode

/reviewed-on nexedi/slapos!394

current version failed to build in gcc6
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=811741

Slaves' hostnames (custom_domain or server-alias) can clash, resulting
with stopping the whole frontend.

In order to avoid so assure hostname unicity across whole frontend.

Even if the master partition owner will authorise given slave for custom
configuration reject this slave in case if it does not pass validation for
snippet.

Treat custom configuration as normal condition to reject/accept slave.

This will allow further anaylsis.

If server alias duplicates name of the server or another alias, simply
ignore it.

Default behavior of runUnitTest was to listen on `127.0.0.1`/`localhost`, which is not
allowed for SlapOS instance and caused issues when the used DNS server does not resolve localhost.

Instead, we decided to run the zserver on the partition IP. Because this partition's IP is not seen as a secure origin (as defined in https://goo.gl/Y0ZkNV ) from firefox when running zelenium tests, we also add some entries in apache from balancer partition to act as an https proxy on this zserver and change the testrunners to access the https URL.

See also nexedi/erp5!729 for the erp5 part.

/reviewed-on nexedi/slapos!374

We don't want runUnitTest is to listen on 127.0.0.1, as it is not
allowed for SlapOS instances, runUnitTest wrapper is extended to include
`--zserver` with a pre-assigned ip:port.

runTestSuite starts several test in parrallel (controlled by
`--node_quantity` argument, which is passed by erp5testnode), so we need
to make sure that we provide it with enough ip:port. For this, we
extended runTestSuite with a `--zserver_address_list` argument and we
generate a wrapper with a list of `testrunner.node-count` pre-assigned
ip:ports.

Because zelenium tests needs to access this zserver over a secure origin
(otherwise modern browser features such as service worker are not
available), use an https proxy in the apache from the balancer
partition.

runUnitTest and runTestSuite have been extended with resp.
`--zserver_frontend_url` and `--zserver_frontend_url_list` arguments and
the URLs published by the balancer paritions are set in the wrappers.
For compatibility reasons, runTestSuite pass parameters as environment
variables.

Implementation notes:

This introduces a circular depencency, balancer partition needs to know
the address of the testrunners and zope partitions needs to know the
URLs of the corresponding http proxies on the apache. This is is handled
by `slapos.recipe:publish-early`:

 1. request zope family with an empty `test-runner-apache-url-list`.
    zope is instanciated a first time.
    zope returns `test-runner-address-list` ( a list of (host, port)
    tuples )
 2. request balancer with `test-runner-address-list`
    balancer is instanciated.
    balancer returns `{{ family_name }}-test-runner-url-list` ( a list
    of apache URLs ), which are published in the root partition.
 3. zope family is re-requested with
    updated`test-runner-apache-url-list` information

instance-erp5.cfg.in template was also reorganised to move
`[publish-early]` next to `[publish]` at the bottom of the file because
these sections are semantically related.
Also test runner generation is moved after zope generation, because we
want to allocate test runners ports after zopes, otherwise existing
zopes would get new ports when existing instances are upgraded.

`enable_authentication` parameter of `backend-list`
was not documented.