Projects
home:rottame:vhosts-ng
rubygem-bender-vhng
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
Expand all
Collapse all
Changes of Revision 30
View file
rubygem-bender-vhng.spec
Changed
@@ -2,7 +2,7 @@ %define mod_full_name %{mod_name}-%{version} Name: rubygem-bender-vhng -Version: 2.1.17 +Version: 2.1.18 Release: 0 Summary: vhng provisioning tool License: Apache-2.0
View file
bender-vhng-2.1.17.gem/checksums.yaml.gz -> bender-vhng-2.1.18.gem/checksums.yaml.gz
Changed
@@ -1,7 +1,7 @@ --- SHA256: - metadata.gz: e95105ca75dbf156a3e2443bf8593eea473f65aeec3683a4ffc606d31747f55c - data.tar.gz: e907edf34fe81310b2a6c470ed85d5445d73d045b3871149b074bd4c2adf1a08 + metadata.gz: 7257c80714ff5d1df5fc4c846643ea17b9886dfa3f776b7b1d3f5eed9e1d8301 + data.tar.gz: 2e2755ea8286085c1ba298159ad8c6d287b21161bfcbecc42be01eb89f54697f SHA512: - metadata.gz: d85748a470477f433b96d5a15747703a7cdd9fd1431ba159b77b7209aa355b58c0b7d79ff22bdf8cac37b519dd1dcc77b3deb4e93438872942ac48da9af6bf96 - data.tar.gz: 7607539edceacab4bafea46fb58f455bdd29a3ed9383621316d4f3a017905578adf659409af1f083155bcd6121010608c90a0966ffaf5e7e71cd5fb294d00745 + metadata.gz: 273f9223dc5342ca61bbe87e029f103ab526b6f29eaefc76ee513a88c22df2b38945257a6a7233af5bcd89b8b8fa482cbd8d3569c1b8a5b06361cb08f7045d5d + data.tar.gz: 1e55baead7233ff963102e705eba15dace5c62bdd65e6ed37a7f50bbe583cd6255aa76dc210e26f4a325e17b40fb100c40f567cd7223b58c2d02e4a20a615a1f
View file
bender-vhng-2.1.17.gem/data/build/rubygem-bender-vhng.changes -> bender-vhng-2.1.18.gem/data/build/rubygem-bender-vhng.changes
Changed
@@ -1,4 +1,10 @@ ------------------------------------------------------------------- +Thu Jul 30 14:29:23 UTC 2026 - Angelo Grossini <rottame@intercom.it> + +- feat: Add proxy configuration options for Cloudflare and Crowdsec + in WebHost model and Docker plugin, along with corresponding tests + +------------------------------------------------------------------- Tue Dec 2 15:30:30 UTC 2025 - Angelo Grossini <rottame@intercom.it> - use the model interface from ygg_provisioner
View file
bender-vhng-2.1.17.gem/data/build/rubygem-bender-vhng.spec -> bender-vhng-2.1.18.gem/data/build/rubygem-bender-vhng.spec
Changed
@@ -2,7 +2,7 @@ %define mod_full_name %{mod_name}-%{version} Name: rubygem-bender-vhng -Version: 2.1.17 +Version: 2.1.18 Release: 0 Summary: vhng provisioning tool License: Apache-2.0
View file
bender-vhng-2.1.17.gem/data/config/webserver.xml -> bender-vhng-2.1.18.gem/data/config/webserver.xml
Changed
@@ -199,7 +199,9 @@ <AccessLog>access.log</AccessLog> <SSLCert>cert.pem</SSLCert> <SSLCertKey>cert.key</SSLCertKey> - <UndefinedQuota>50G</UndefinedQuota> + <UndefinedFsQuota>50G</UndefinedFsQuota> + <UndefinedMemoryQuota>32</UndefinedMemoryQuota> + <UndefinedMemoryHardQuota>4096</UndefinedMemoryHardQuota> <DefaultBodySize>1M</DefaultBodySize> <PHP> <DefaultVersion>php56</DefaultVersion>
View file
bender-vhng-2.1.17.gem/data/lib/bender-vhng/version.rb -> bender-vhng-2.1.18.gem/data/lib/bender-vhng/version.rb
Changed
@@ -1,5 +1,5 @@ module Bender module Vhng - VERSION = "2.1.17" + VERSION = "2.1.18" end end
View file
bender-vhng-2.1.17.gem/data/lib/bender/classes/Models/Webserver/WebHosts.rb -> bender-vhng-2.1.18.gem/data/lib/bender/classes/Models/Webserver/WebHosts.rb
Changed
@@ -138,7 +138,7 @@ protected def normalize(data) - environment = Hashdata:env_vars.map{|e| e:key, e:value} + environment = Hash(data:env_vars || ).map{|e| e:key, e:value} #data = OpenStruct.new(data) ret = { service: { @@ -160,7 +160,6 @@ } }, quota: { - quota_name: data:quota||data:quota_name, enforce: data:enforce_quota, quotas: { cpu: data:quota_cpu, @@ -187,7 +186,7 @@ letsencrypt: data:ssl_enabled && data:ssl_letsencrypt, certs: (data:ssl_certs || ).map { | crt | { - domains: crt:domains.split(',').map(&:strip).reject(&:blank?), + domains: (crt:domains || '').split(',').map(&:strip).reject(&:blank?), crt_id: UUIDTools::UUID.sha1_create(BENDER_NAMESPACE, 'ssl-cert', data:username, crt:id, crt:domains, crt:ssl_cert, crt:ssl_key.join).to_s, crt: crt:ssl_cert_data, key: crt:ssl_key_data, @@ -199,8 +198,8 @@ apache2: { compat: truth(data:httpd_compat), modules: (data:httpd_modules||'').split(',').map(&:strip).reject(&:blank?), - global_options: data:httpd_global_options.split(',').join(' '), - allow_override: data:httpd_allow_override.split(',').join(' '), + global_options: (data:httpd_global_options || '').split(',').join(' '), + allow_override: (data:httpd_allow_override || '').split(',').join(' '), additional: data:httpd_additional || '', } }, @@ -260,7 +259,7 @@ ret:http = {enabled: false} end - ret:ftp += data:ftp_accesses.map do | f | + ret:ftp += (data:ftp_accesses || ).map do | f | { login: f:username, password: f:password, @@ -294,7 +293,11 @@ end def truth(v) - (v||'').to_s.upcase == 'Y' + case v + when true, false then v + else + (v || '').to_s.upcase == 'Y' + end end end end
View file
bender-vhng-2.1.17.gem/data/lib/bender/classes/Plugins/Webserver/01-Filesystems.rb -> bender-vhng-2.1.18.gem/data/lib/bender/classes/Plugins/Webserver/01-Filesystems.rb
Changed
@@ -131,21 +131,9 @@ service.writeConfigFile(prjid_file, projids) end - quota = if host.quota.enforce - q = if host.quota.quota_name - service.mySvcConf("/Quotas/Quota@name='#{host.quota.quota_name}'/Filesystem").to_i - elsif host.quota.quotas.fs - host.quota.quotas.fs.try(:to_i) - end - if q - q += (q/10).to_i - "%sM" % q - end - end - unless quota - quota = service.mySvcConf("/ConfigDefaults/UndefinedQuota") - log.debug " + quota undefined, use default of #{q}" unless host.quota.enforce - log.debug " + do not enforce quota, use default of #{q}" if host.quota.enforce + quota = service.resolve_fs_quota(host) + unless host.quota.enforce && host.quota.quotas.fs.try(:to_i) + log.debug " + quota undefined/not enforced, use default of #{quota}" end mountpoint = getMntPointFor(storagePath)
View file
bender-vhng-2.1.17.gem/data/lib/bender/classes/Plugins/Webserver/05-Mail.rb -> bender-vhng-2.1.18.gem/data/lib/bender/classes/Plugins/Webserver/05-Mail.rb
Changed
@@ -66,7 +66,7 @@ #TODO if host.smtp && env:env_vars'SMTP_SERVER'.blank? - env:env_vars'SMTP_SERVER' = host.smtp.smpt_server + env:env_vars'SMTP_SERVER' = host.smtp.smtp_server if env:env_vars'SMTP_SERVER' env:env_vars'SMTP_PORT' = host.smtp.smtp_port env:env_vars'SMTP_TLS' = host.smtp.smtp_tls
View file
bender-vhng-2.1.17.gem/data/lib/bender/classes/Plugins/Webserver/05-PHPFPM.rb -> bender-vhng-2.1.18.gem/data/lib/bender/classes/Plugins/Webserver/05-PHPFPM.rb
Changed
@@ -72,17 +72,7 @@ _memory_limit = host.php.memory_limit _upload_max_filesize = host.php.upload_max_filesize - _quota_memory = nil - _quota_memory_hard = nil - if host.quota.quota_name.present? - _quota_memory = service.mySvcConf("/Quotas/Quota@name='#{host.quota.quota_name}'/Memory").to_i - _quota_memory_hard = service.mySvcConf("/Quotas/Quota@name='#{host.quota.quota_name}'/MemoryHard").to_i - else - _quota_memory = host.quota.quotas.mem.try(:to_i) - _quota_memory_hard = _quota_memory + 256 if _quota_memory - end - _quota_memory ||= 256 - _quota_memory_hard ||= 4096 + _quota_memory, _quota_memory_hard = service.resolve_memory_quota(host) _memory_limit = service.mySvcConf('/ConfigDefaults/PHP/MemoryLimit') if _memory_limit.blank? _upload_max_filesize = service.mySvcConf('/ConfigDefaults/PHP/UploadMaxFilesize') if _upload_max_filesize.blank? @@ -93,11 +83,11 @@ _upload_max_filesize = _upload_max_filesize.to_i if _upload_max_filesize.to_s =~ /\A0-9/ if _instances == 'AUTO' - _instances = (_quota_memory.to_i / _memory_limit.to_i).floor + _instances = ((_quota_memory_hard.to_i - 256) / _memory_limit.to_i).floor end # limit php max (75%|mem-256) of allocated memory - _maxmem = (_quota_memory_hard*0.75).ceil, (_quota_memory_hard*-256).max + _maxmem = (_quota_memory_hard*0.75).ceil, (_quota_memory_hard - 256).max while _instances * _memory_limit > _maxmem _instances -= 1 _instances = 1 if _instances <= 0
View file
bender-vhng-2.1.17.gem/data/lib/bender/classes/Plugins/Webserver/10-Apache2.rb -> bender-vhng-2.1.18.gem/data/lib/bender/classes/Plugins/Webserver/10-Apache2.rb
Changed
@@ -72,11 +72,14 @@ data:vhostroot = service.containerVHostRoot(host) - data:docroot = unless host.http.apache2.docroot.blank? - File.join(data:vhostroot, host.http.apache2.docroot.strip) - else - File.join(data:vhostroot, service.mySvcConf('/ServicePaths/UserSpace/DocRootPath')) - end + # host.http.apache2.docroot is never set by WebHosts#normalize (not in the + # remote cfg). Keep the default DocRootPath only. + # data:docroot = unless host.http.apache2.docroot.blank? + # File.join(data:vhostroot, host.http.apache2.docroot.strip) + # else + # File.join(data:vhostroot, service.mySvcConf('/ServicePaths/UserSpace/DocRootPath')) + # end + data:docroot = File.join(data:vhostroot, service.mySvcConf('/ServicePaths/UserSpace/DocRootPath')) data:options = unless host.http.apache2.global_options.blank? host.http.apache2.global_options @@ -90,23 +93,23 @@ service.mySvcConf('/ConfigDefaults/AllowOverride') end - # cake needs fileinfo ability - - if host.php && host.php.legacy.cakephp - if(data:options.downcase.include?('none')) - data:options = '' - end - if(data:override.downcase.include?('none')) - data:override = '' - end - - if(!data:options.downcase.include?('followsymlinks')) - data:options += ' +FollowSymLinks' - end - if(!data:override.downcase.include?('fileinfo')) - data:override += ' FileInfo' - end - end + # host.php.legacy.cakephp is never set by WebHosts#normalize (legacy CakePHP + # override; dead). Left commented for reference. + # if host.php && host.php.legacy.cakephp + # if(data:options.downcase.include?('none')) + # data:options = '' + # end + # if(data:override.downcase.include?('none')) + # data:override = '' + # end + # + # if(!data:options.downcase.include?('followsymlinks')) + # data:options += ' +FollowSymLinks' + # end + # if(!data:override.downcase.include?('fileinfo')) + # data:override += ' FileInfo' + # end + # end data:stats_location = service.mySvcConf('/ServicePaths/UserSpace/StatsPath') data:stats_path = File.join(data:vhostroot, service.mySvcConf('/ServicePaths/UserSpace/StatsPath'))
View file
bender-vhng-2.1.17.gem/data/lib/bender/classes/Plugins/Webserver/95-Docker.rb -> bender-vhng-2.1.18.gem/data/lib/bender/classes/Plugins/Webserver/95-Docker.rb
Changed
@@ -68,26 +68,13 @@ overbooking = service.mySvcConf("/QuotaOverbooking").to_i - quota_memory = nil - quota_memory_hard = nil + explicit_mem = host.quota.enforce && host.quota.quotas.mem.try(:to_i) + quota_memory, quota_memory_hard = service.resolve_memory_quota(host) - if host.quota.quota_name - quota_memory = service.mySvcConf("/Quotas/Quota@name='#{host.quota.quota_name}'/Memory").to_i - quota_memory_hard = service.mySvcConf("/Quotas/Quota@name='#{host.quota.quota_name}'/MemoryHard").to_i - else - quota_memory = host.quota.quotas.mem.try(:to_i) - quota_memory_hard = quota_memory + 256 if quota_memory - end - - if quota_memory && overbooking && overbooking > 0 + if explicit_mem && overbooking && overbooking > 0 quota_memory -= quota_memory*overbooking/100 end - unless quota_memory - quota_memory = 32 - quota_memory_hard = 4096 - end - networks = service.serviceConfig.get_string_array(service.mySvcConfPath('/Docker/Compose/Networks/Network')).map{|a| a'Network'} env_vars = env:env_vars.map do |k,v|
View file
bender-vhng-2.1.17.gem/data/lib/bender/classes/ServicesBackend/Webserver.rb -> bender-vhng-2.1.18.gem/data/lib/bender/classes/ServicesBackend/Webserver.rb
Changed
@@ -414,6 +414,34 @@ erb.result bindable.get_binding end + # Disk quota string for xfs_quota bhard. Uses quota_fs when enforce is set, + # otherwise ConfigDefaults/UndefinedFsQuota. + def resolve_fs_quota(host) + if host.quota.enforce + q = host.quota.quotas.fs.try(:to_i) + if q && q > 0 + q += (q / 10).to_i + return "%sM" % q + end + end + mySvcConf('/ConfigDefaults/UndefinedFsQuota') + end + + # Soft/hard memory (MiB). Uses quota_mem when enforce is set, otherwise + # ConfigDefaults/UndefinedMemoryQuota and UndefinedMemoryHardQuota. + def resolve_memory_quota(host) + if host.quota.enforce + mem = host.quota.quotas.mem.try(:to_i) + if mem && mem > 0 + return mem, mem + 256 + end + end + + mySvcConf('/ConfigDefaults/UndefinedMemoryQuota').to_i, + mySvcConf('/ConfigDefaults/UndefinedMemoryHardQuota').to_i + + end + def httpPort(host) if host.service.docker_image.present? mySvcConf('ConfigDefaults/UpstreamBasePort').to_i + host.service.id
View file
bender-vhng-2.1.17.gem/data/lib/bender/templates/webserver/php-fpm.erb -> bender-vhng-2.1.18.gem/data/lib/bender/templates/webserver/php-fpm.erb
Changed
@@ -34,6 +34,16 @@ php_admin_valueupload_max_filesize = <%= upload_max_filesize %>m php_valuedate.timezone = "Europe/Rome" +; CVE-2026-115560 mitigation, until PHP ships the upstream fix. +; php_admin_value locks both settings: neither .user.ini, php_value nor +; ini_set() can change them. +; - session upload progress is disabled, as recommended by PHP; +; - serialize_handler is pinned to the default "php", which blocks the +; runtime handler switch the CVE relies on (apps calling +; ini_set('session.serialize_handler', ...) will get false). +php_admin_valuesession.upload_progress.enabled = 0 +php_admin_valuesession.serialize_handler = php + <% additional.each do | l | -%> <%= l %> <% end if additional && additional.any? %> \ No newline at end of file
View file
bender-vhng-2.1.17.gem/data/spec/bender/classes/Models/Webserver/WebHosts_spec.rb -> bender-vhng-2.1.18.gem/data/spec/bender/classes/Models/Webserver/WebHosts_spec.rb
Changed
@@ -17,7 +17,6 @@ updated_at: '2023-01-02', node_perf: 'standard', quota: 'basic', - quota_name: 'basic', enforce_quota: true, quota_cpu: 100, quota_mem: 512, @@ -444,7 +443,6 @@ end it 'includes quota information' do - expect(subject.quota.quota_name).to eq('basic') expect(subject.quota.enforce).to be true expect(subject.quota.quotas.cpu).to eq(100) expect(subject.quota.quotas.mem).to eq(512) @@ -589,18 +587,28 @@ data:cfg:username = 'accessuser' data:cfg:access_rules = { - location: '/admin', + location: '/', + allow_from_all: true, + deny_from_all: nil, + allow_from: , + deny_from: '1.2.3.4', + auth_credentials: + }, + { + location: '/foo', allow_from_all: false, - allow_from: '192.168.1.0/24', - deny_from: nil, - auth_credentials: nil + deny_from_all: nil, + allow_from: '1.2.3.4', + deny_from: , + auth_credentials: }, { - location: '/public', + location: '/bar', allow_from_all: true, - allow_from: nil, - deny_from: '10.0.0.0/8', - auth_credentials: 'user:pass' + deny_from_all: nil, + allow_from: , + deny_from: , + auth_credentials: { 'username' => 'foo', 'password' => 'foobar' } } data @@ -615,12 +623,29 @@ it 'includes access rules' do expect(subject.http.access_rules).to be_an(Array) - expect(subject.http.access_rules.length).to eq(2) - expect(subject.http.access_rules.first:location).to eq('/admin') - expect(subject.http.access_rules.first:allow_from_all).to be false - expect(subject.http.access_rules.first:allow_from).to eq('192.168.1.0/24') - expect(subject.http.access_rules.last:allow_from_all).to be true - expect(subject.http.access_rules.last:deny_from).to eq('10.0.0.0/8') + expect(subject.http.access_rules.length).to eq(3) + + allow_all = subject.http.access_rules0 + expect(allow_all:location).to eq('/') + expect(allow_all:allow_from_all).to be true + expect(allow_all:allow_from).to be_nil + expect(allow_all:deny_from).to eq('1.2.3.4') + expect(allow_all:auth).to eq() + + deny_all = subject.http.access_rules1 + expect(deny_all:location).to eq('/foo') + expect(deny_all:allow_from_all).to be false + expect(deny_all:allow_from).to eq('1.2.3.4') + expect(deny_all:deny_from).to be_nil + expect(deny_all:auth).to eq() + + with_auth = subject.http.access_rules2 + expect(with_auth:location).to eq('/bar') + expect(with_auth:allow_from_all).to be true + expect(with_auth:deny_from).to eq() + expect(with_auth:auth.length).to eq(1) + expect(with_auth:auth.first.username).to eq('foo') + expect(with_auth:auth.first.password).to eq('foobar') end end @@ -806,6 +831,30 @@ end end + context 'with boolean truth flags from remote' do + let(:test_data_bool_truth) do + data = test_data.dup + data:cfg = data:cfg.dup + data:cfg:id = 'test-id-bool-truth' + data:cfg:username = 'booltruthuser' + data:cfg:php_show_errors = true + data:cfg:httpd_compat = false + data + end + + before do + DbHelper.add_record(db_path, 'test-id-bool-truth', test_data_bool_truth) + described_class.open(db_path) + end + + subject { described_class.find('test-id-bool-truth').data } + + it 'honors boolean true/false for legacy Y/N fields' do + expect(subject.php.show_errors).to be true + expect(subject.http.apache2.compat).to be false + end + end + context 'with empty PHP extensions' do let(:test_data_no_ext) do data = test_data.dup @@ -902,29 +951,6 @@ end end - context 'with quota using quota field instead of quota_name' do - let(:test_data_quota_field) do - data = test_data.dup - data:cfg = data:cfg.dup - data:cfg:id = 'test-id-quota-field' - data:cfg:username = 'quotauser' - data:cfg:quota = 'premium' - data:cfg:quota_name = nil - data - end - - before do - DbHelper.add_record(db_path, 'test-id-quota-field', test_data_quota_field) - described_class.open(db_path) - end - - subject { described_class.find('test-id-quota-field').data } - - it 'uses quota field when quota_name is nil' do - expect(subject.quota.quota_name).to eq('premium') - end - end - context 'with PHP memory_limit default' do let(:test_data_php_memory_default) do data = test_data.dup @@ -1176,6 +1202,45 @@ expect(subject.http.apache2.modules).to eq() end end + + context 'with null optional collections and httpd strings' do + let(:test_data_nulls) do + data = test_data.dup + data:cfg = data:cfg.dup + data:cfg:id = 'test-id-nulls' + data:cfg:username = 'nullsuser' + data:cfg:env_vars = nil + data:cfg:ftp_accesses = nil + data:cfg:httpd_global_options = nil + data:cfg:httpd_allow_override = nil + data:cfg:ssl_certs = + { + id: 'cert-null-domains', + domains: nil, + ssl_cert: 'cert.pem', + ssl_key: 'key.pem', + ssl_cert_data: 'CERT', + ssl_key_data: 'KEY' + } + + data + end + + before do + DbHelper.add_record(db_path, 'test-id-nulls', test_data_nulls) + described_class.open(db_path) + end + + subject { described_class.find('test-id-nulls').data } + + it 'treats nulls as empty without raising' do + expect(subject.service.environment).to eq({}) + expect(subject.ftp.length).to eq(1) + expect(subject.http.apache2.global_options).to eq('') + expect(subject.http.apache2.allow_override).to eq('') + expect(subject.ssl.certs.first:domains).to eq() + end + end end describe 'RecordNotFound exception' do
View file
bender-vhng-2.1.17.gem/metadata.gz -> bender-vhng-2.1.18.gem/metadata.gz
Changed
@@ -1,15 +1,14 @@ --- !ruby/object:Gem::Specification name: bender-vhng version: !ruby/object:Gem::Version - version: 2.1.17 + version: 2.1.18 platform: ruby authors: - Lele Forzani - Angelo Grossini -autorequire: bindir: bin cert_chain: -date: 2026-07-30 00:00:00.000000000 Z +date: 1980-01-02 00:00:00.000000000 Z dependencies: - !ruby/object:Gem::Dependency name: mail @@ -336,7 +335,6 @@ licenses: - MIT metadata: {} -post_install_message: rdoc_options: require_paths: - lib @@ -351,8 +349,7 @@ - !ruby/object:Gem::Version version: '0' requirements: -rubygems_version: 3.4.20 -signing_key: +rubygems_version: 3.6.7 specification_version: 4 summary: Tool for provisioning vhosts on the Intercom VHNG platform test_files:
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.