Peer proxy for maas-proxy

[Ante Karamatić]

Sometimes MAAS controlled nodes need to use proxy to fetch packages. This can be resolved by adding option of 'Peer cache', which would arrange squid-deb-proxy.conf to use it. Something like:

cache_peer PEER_PROXY_IP parent PEER_PROXY_PORT 0 no-query default
never_direct allow all

[Julian Edwards (julian-edwards)]

Is this a maas bug? Doesn't look like it.

[Ante Karamatić (ivoks)]

Oh, no, it's not a bug, rather a feature request. Since maas-region-controller pulls in squid-deb-proxy and uses it as a proxy, it would be nice if it could configure it. Common deployment is behind a firewall/proxy. Having a GUI option of setting proxy for MAAS's squid-deb-proxy would help a lot.

[Ante Karamatić (ivoks)]

Can we please have SQUID snippets? Without these we need to deploy additional squid (and turn off maas squid). All we need to be able to do is configure peer cache:

acl local-urls dstdomain .local-archive.lan
always_direct allow local-urls
cache_peer proxy.company.com parent 3128 0 default
never_direct allow all

This allows us to host local archives that are not accessible from proxy.company.com, which we *need* to use to get any other object.

[Gavin Panella (allenap)]

Snippets are bad for many reasons and good for few, so can we narrow this down to just the problems that need to be solved and design something around that?

My understanding is: you'd like a way to point MAAS's HTTP proxy at an upstream proxy, but with a list of exceptions, addresses that should be fetched directly by MAAS's proxy.

That should be fairly easy to accomplish, and configurable via MAAS, but it also introduces the idea of MAAS as a general purpose front-end to SQUID, and I don't think that's a road we want to travel.

We could solve this discreetly by adding "include /var/lib/maas/maas-proxy.conf.d/*.conf" to the end of the template we use to generate the proxy configuration. I haven't tried it but, supposing it works, would that be acceptable?

[Ante Karamatić (ivoks)]

Including conf files would be excellent, yes.

On Tue, Mar 14, 2017 at 12:20 PM Gavin Panella <email address hidden>
wrote:

> Snippets are bad for many reasons and good for few, so can we narrow
> this down to just the problems that need to be solved and design
> something around that?
>
> My understanding is: you'd like a way to point MAAS's HTTP proxy at an
> upstream proxy, but with a list of exceptions, addresses that should be
> fetched directly by MAAS's proxy.
>
> That should be fairly easy to accomplish, and configurable via MAAS, but
> it also introduces the idea of MAAS as a general purpose front-end to
> SQUID, and I don't think that's a road we want to travel.
>
> We could solve this discreetly by adding "include /var/lib/maas/maas-
> proxy.conf.d/*.conf" to the end of the template we use to generate the
> proxy configuration. I haven't tried it but, supposing it works, would
> that be acceptable?
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1276945
>
> Title:
> Peer proxy for squid-deb-proxy
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/maas/+bug/1276945/+subscriptions
>
--
Ante Karamatić
<email address hidden>
Canonical

[Gavin Panella (allenap)]

> Including conf files would be excellent, yes.

Thanks.

To anyone wondering how this differs from snippets (hi, future me) there
are a few things to bear in mind:

* This will either remain undocumented or be documented with large
  warnings.

* By not providing UI or API to manipulate extra configuration we are
  signalling that this is not supported by MAAS.

* This is orders of magnitude less work.

Next we need to discuss this as a team. I doubt it'll be controversial,
but you never know. There is a risk that bugs introduced by misuse or
misconfiguration will ultimately reflect badly on MAAS and/or introduce
a support burden.

[Gavin Panella (allenap)]

(Where "snippets" would mean something similar to the DHCP snippets feature already in MAAS, which has UI and API support.)

[Mike Pontillo (mpontillo)]

It seems like we should automatically configure this on the Squid proxy if the user has set up a "Proxy for APT and HTTP/HTTPS" in the global settings.

Or is there a reason that won't work?

[Andres Rodriguez (andreserl)]

No. The user had to specifically select this and there are different
considerations. This has already been discussed before.

On Thu, Apr 27, 2017 at 7:04 PM Mike Pontillo <email address hidden>
wrote:

> It seems like we should automatically configure this on the Squid proxy
> if the user has set up a "Proxy for APT and HTTP/HTTPS" in the global
> settings.
>
> Or is there a reason that won't work?
>
> --
> You received this bug notification because you are subscribed to MAAS.
> https://bugs.launchpad.net/bugs/1276945
>
> Title:
> Peer proxy for squid-deb-proxy
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/maas/+bug/1276945/+subscriptions
>
--
Andres Rodriguez (RoAkSoAx)
Ubuntu Server Developer
MSc. Telecom & Networking
Systems Engineer