File stud.spec of Package stud

# vim: set sw=4 ts=4 et nu:

%bcond_with        shared_cache

Name:               stud
Version:            0.3
%define ghtag       976c3a9
%define ghdltag     %{ghtag}
%define pkg_home    /var/lib/%{name}
Release:            0
Summary:            The Scalable TLS Unwrapping Daemon
Source:             https://download.github.com/bumptech-stud-%{version}-0-g%{ghdltag}.tar.gz
Source1:            stud.init
Source2:            stud.sysconfig
Source3:            usr.sbin.stud
Patch1:             stud-makefile.patch
Patch2:             2eb433bbc760a2f56292076436984d0789c3d6ad.patch
Patch3:             stud-out_of_tree_ebtree.patch
URL:                https://github.com/bumptech/stud
Group:              Productivity/Networking/Security
License:            BSD License (revised)
BuildRoot:          %{_tmppath}/build-%{name}-%{version}
BuildRequires:      openssl-devel
BuildRequires:      libev-devel
BuildRequires:      gcc make glibc-devel
%if %{with shared_cache}
BuildRequires:      ebtree-devel-static
%endif
%description
stud is a network proxy that terminates TLS/SSL connections and forwards the
unencrypted traffic to some backend. It's designed to handle 10s of thousands
of connections efficiently on multicore machines.

It follows a process-per-core model; a parent process spawns N children who
each accept() on a common socket to distribute connected clients among them.
Within each child, asynchronous socket I/O is conducted across the local
connections using libev and OpenSSL's nonblocking API. By default, stud has an
overhead of ~200KB per connection--it preallocates some buffer space for data
in flight between frontend in backend.

stud has very few features--it's designed to be paired with an intelligent
backend like haproxy or nginx. It maintains a strict 1:1 connection pattern
with this backend handler so that the backend can dictate throttling behavior,
maxmium connection behavior, availability of service, etc.

stud has one "cool trick"--it will optionally write the client IP address as
the first few octets (depending on IPv4 or IPv6) to the backend. In this way,
backends who care about the client IP can still access it even though stud
itself appears to be the connected client.

%prep
%setup -q -n "bumptech-stud-%{ghtag}"
%patch1
%patch2 -p1
%if %{with shared_cache}
%patch3
%endif

%build
%__make %{?_smp_flags}     \
    %if %{with shared_cache}
    USE_SHARED_CACHE=1     \
    %endif
    OPTFLAGS="%{optflags}" \

%install
%makeinstall PREFIX="%{_prefix}" BINDIR="%{_sbindir}"
%{__install} -d -m 0750 %{buildroot}%{pkg_home}

#
# init script
#
%{__install} -D -m 0755 %{S:1} \
    %{buildroot}%{_sysconfdir}/init.d/%{name}
%{__ln_s} -f %{_sysconfdir}/init.d/%{name} %{buildroot}%{_sbindir}/rc%{name}
#
# sysconfig template
#
%{__install} -D -m 0644 %{S:2} \
    %{buildroot}/var/adm/fillup-templates/sysconfig.%{name}
#
# apparmor profile
#
%{__install} -D -m 0644 %{S:3} \
    %{buildroot}/etc/apparmor.d/usr.sbin.stud

%clean
%{?buildroot:%__rm -rf "%{buildroot}"}

%pre
#
# e.g. adding user
#
/usr/sbin/groupadd -r %{name} &>/dev/null ||:
/usr/sbin/useradd  -g %{name} -s /bin/false -r -c "user for %{name}" -d %{pkg_home} %{name} &>/dev/null ||:

%post
%fillup_only %{name}

%preun
%stop_on_removal %{name}

%postun
%restart_on_update %{name}
%{insserv_cleanup}


%files
%defattr(-,root,root)
%doc LICENSE README.md
%{_sbindir}/stud
%{_mandir}/man8/stud.8*
%dir %attr(755,%{name},%{name}) %{pkg_home}
%dir /etc/apparmor.d/
%config(noreplace) /etc/apparmor.d/usr.sbin.stud
#
%config(noreplace) %{_sysconfdir}/init.d/%{name}
%{_sbindir}/rc%{name}
/var/adm/fillup-templates/sysconfig.%{name}

%changelog