dotcloud/hipache — pull request #128 by dmp42 (2014-04-21 13:18:05+00:00)
Title: 0.4

**NOT READY FOR MERGE. This is rather a call for comments.**

Full changelog below - details in individual tickets:

Configuration:
* we now support -d (or --dry) command line argument to just load the config and exit without starting Hipache
* Configuration is now a class (with defaults, errors and legacy)
* defaults for empty configuration are now that hipache binds http on 127.0.0.1 port 80 (see defaults for more)
* configuration instantiation is now asynchronous
* configuration class now validate *some parts* of the config (bogus cert/key, etc)
* we support old syntaxes mapping via the `legacy` class

We now support a new binding syntax with much more granularity when binding

* can now bind independently to any ip address
* can specify for each interface http and/or https
* can specify for each interface and protocol the desired port (or use the default)
* can specify different certificates for different interfaces (https)

We now support dropping privileges. The behavior is:

* if running as non-root, do nothing
* if running as root, and there is no "user" statement in the config, scream and drop dead
* if running as root and want to stay as root, config MUST specify user: "root" (or user: 0)
* if running as root and config specifies a user, will:
* drop priv in the workers as soon as we bind on the port
* drop to `group` as well - if not specified, drop to `group` named by the username (same as nginx)

Https now supports:
* key passphrase
* specifying CA additional certs to load
* experimental (don't want to document that for now): cipher and protocol settings

Overall, the idea is still to keep things dry:
* an empty configuration does the job, with sane defaults
* a very simple configuration does what it does before
* though, if people want complex per-address setup, they can have it

**This is not ready to be merged**:
* we need to release 0.3 first
* I need to update the documentation
* I would like to get some feedback on this
* I need to fix the tests and travis build

Here is an example config in the new format:

```
{
server: {
// Everything else in the server section will use defaults values
workers: 2
},
http: {
// If not specifying a general http port, will fallback on 80
port: 1080,
bind: [
// No port specified, inherits http.port
'127.0.0.1',
// Override http.port for this interface
{
address: '::1',
port: 1082
}
]
},
https: {
// If not specifying a general https port, will fallback on 443
port: 1443,
// If specifying a general key / cert, these will get automatically loaded for each interface, unless overriden
key: 'some_path',
cert: 'some_path',
passphrase: 'key password',
ca: ['additional_ca_certificate'],
bind: [
// No port specified, inherits https.port and key/cert/ca
'127.0.0.1',
// Override https.port for this interface
{
address: '::1',
port: 1082
},
// Override key and cert for this interface
{
address: '192.68.1.2',
port: 1084,
key: 'someotherkey',
cert: 'someothercert',
}
]
}
}
```

And ah, I'm going to add SNI support as well, soon (see https://github.com/dotcloud/hipache/wiki/SNI-support).

All in all this PR will fix:
* #10
* #7
* #4 (the non SNI part - that is: different cert/key per ip)

Enhance the situation on:
* #122