feat: nginx cache optimizations, TLS key permissions, and test framework migration - #142
Draft
florentianayuwono wants to merge 11 commits into
Draft
feat: nginx cache optimizations, TLS key permissions, and test framework migration#142florentianayuwono wants to merge 11 commits into
florentianayuwono wants to merge 11 commits into
Conversation
florentianayuwono
requested review from
swetha1654 and
yanksyoon
and removed request for
a team
August 8, 2026 14:10
florentianayuwono
marked this pull request as draft
August 8, 2026 14:10
florentianayuwono
force-pushed
the
feat/optimizations-and-refactorings
branch
3 times, most recently
from
August 8, 2026 16:34
fc56f29 to
d8e598b
Compare
florentianayuwono
force-pushed
the
feat/optimizations-and-refactorings
branch
from
August 8, 2026 18:23
d8e598b to
d9a9b4d
Compare
…ptions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…cache_path Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Rewrote test_charm.py using scenario.Context, scenario.State, and scenario.SubordinateRelation (required for subordinate charm) - Rewrote conftest.py with scenario fixtures (ctx, ctx_leader) - Added ops-scenario>=7.0.0,<9.0.0 to requirements.txt - Fixed try-except-raise pattern in state.py validators to satisfy both DCO051 (flake8) and W0706 (pylint) - All 57 unit tests pass; lint 10.00/10 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ilant - Replace async/await + python-libjuju/pytest-asyncio with sync jubilant - Rewrite conftest.py: juju fixture using jubilant.temp_model(), all fixtures sync, app fixtures return str names instead of Application - Rewrite helpers.py: CacheTester uses jubilant.Juju + app name strings, read_file/get_cache_backends/run_in_unit use juju.exec() - Rewrite test_basic.py, test_healthchecks.py, test_metric.py, test_tls_cert.py: remove async def / await / asyncio.sleep, use juju.wait() predicates, juju.integrate(), juju.remove_relation() - Update tox.ini: replace juju+pytest-asyncio with jubilant>=1.10.0,<2.0.0 - Use correct jubilant API: juju.status() (method), app_status.current, workload_status.current/.message, add_unit(app, num_units=1) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
When ssl_verify=false, nginx should not verify the backend's TLS certificate — neither in healthchecks nor in proxied requests. Previously, proxy_ssl_verify was always set to 'on' whenever a CA bundle existed, regardless of the ssl_verify config value. This caused test_healthchecks_ssl_verify[no_ssl_verify] to fail with 502 because the backend's self-signed cert (not signed by cert_app's CA) could not be verified. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add juju.wait(active) after integrate_config()+setup_config() in test_tls_termination_full_lifecycle. Without this wait, the TLS cert from cache-lego can arrive before config subordinate hooks deliver valid backend data, leaving the charm blocked on 'Waiting for integration with config charm' for the entire 10-min window. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
florentianayuwono
force-pushed
the
feat/optimizations-and-refactorings
branch
from
August 18, 2026 19:04
9a84a36 to
e0ad1d3
Compare
- test_charm.py: use get_cache_backend_url (singular) and cache-backend key (singular plain string) from PR #141; fix mock targets to match current function names (write_ca_bundle, write_certificate) - test_charm.py: patch _get_cache_cert_path in Harness TLS test so _load_nginx_config proceeds past the cert-file guard - test_nginx_manager.py: keep monkeypatch approach for ca_certs and add ssl_verify condition from c2b7ab4 (no proxy_ssl when ssl_verify=false) - helpers.py: get_cache_backends reads cache-backend (singular) key and wraps the plain URL string in a list for backward-compatible callers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
florentianayuwono
force-pushed
the
feat/optimizations-and-refactorings
branch
from
August 18, 2026 19:14
e0ad1d3 to
cd92b4e
Compare
jubilant.deploy(num_units=0) passes --num-units 0 to the Juju CLI which rejects it with 'must be a positive integer'. The original asyncio python-libjuju model.deploy() accepted 0. Remove num_units from the three headless/subordinate deploy calls so jubilant does not add --num-units at all, letting Juju use the default behaviour for each charm type. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jubilant.all_active without arguments checks ALL model apps including subordinate charms (config-alt, metric) that have no units until integrated. These apps always show 'unknown' status and cause juju.wait(all_active) to time out. Replace each bare all_active call with a lambda scoped to only the apps relevant to that test: cache app + currently-integrated config/metric apps. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR implements several nginx cache optimizations, a TLS security hardening, and migrates both unit and integration tests to modern frameworks.
Stories
Story 1 & 2: Configurable
cache-inactiveandcache-max-sizecache-inactiveconfig option (default:10m) tocontent-cache-backends-configcache-max-sizeconfig option (default: empty = no limit) tocontent-cache-backends-configproxy_cache_pathdirectiveStory 3: Always-on
proxy_cache_lockproxy_cache_lock onto all nginx location blocksStory 4: TLS private key permission hardening
os.chmod(pem_file_path, 0o644)→0o640www-datauser/group onlyStory 5: Test framework migration
content-cacheandcontent-cache-backends-configfromops.testing.Harnesstoops-scenario(state-based testing)python-libjuju+pytest-asyncioto syncjubilantCommits
feat(backends-config): add cache-inactive and cache-max-size config optionsfeat(content-cache): wire cache-inactive and cache-max-size to proxy_cache_pathfeat(nginx): add proxy_cache_lock on to all location blocksfix(tls): restrict TLS private key file permissions to 0o640refactor(unit): migrate content-cache unit tests to ops-scenariorefactor(unit): migrate backends-config unit tests to ops-scenariorefactor(integration): migrate content-cache integration tests to jubilant