riak_api.schema

%%-*- mode: erlang -*-
%% HTTP Listeners
%% @doc listener.http.<name> is an IP address and TCP port that the Riak
%% HTTP interface will bind.
{mapping, "listener.http.$name", "riak_api.http", [
  {default, {"{{web_ip}}",{{web_port}} }},
  {datatype, ip},
  {include_default, "internal"}
]}.

{translation,
 "riak_api.http",
  fun(Conf) ->
      HTTP = cuttlefish_variable:filter_by_prefix("listener.http", Conf),
      [ IP || {_, IP} <- HTTP]
  end
}.

%% @doc listener.protobuf.<name> is an IP address and TCP port that the Riak
%% Protocol Buffers interface will bind.
{mapping, "listener.protobuf.$name", "riak_api.pb", [
  {default, {"{{pb_ip}}",{{pb_port}} }},
  {datatype, ip},
  {include_default, "internal"}
]}.

{translation,
 "riak_api.pb",
 fun(Conf) ->
     PB = cuttlefish_variable:filter_by_prefix("listener.protobuf", Conf),
     [ IP || {_, IP} <- PB]
 end
}.

%% @doc The maximum length to which the queue of pending connections
%% may grow. If set, it must be an integer > 0. If you anticipate a
%% huge number of connections being initialized *simultaneously*, set
%% this number higher.
{mapping, "protobuf.backlog", "riak_api.pb_backlog", [
  {datatype, integer},
  {default, 128},
  {commented, 128},
  {validators, ["greater_than_zero"]}
]}.

{validator,
 "greater_than_zero",
 "must be greater than zero",
 fun(Value) -> Value > 0 end}.

%% @doc Turns off Nagle's algorithm for Protocol Buffers
%% connections. This is equivalent to setting the TCP_NODELAY option
%% on the socket.
{mapping, "protobuf.nagle", "riak_api.disable_pb_nagle", [
  {datatype, {flag, off, on}},
  {default, off},
  hidden
]}.

%% @doc listener.https.<name> is an IP address and TCP port that the Riak
%% HTTPS interface will bind.
{mapping, "listener.https.$name", "riak_api.https", [
  {commented, {"{{web_ip}}",{{web_port}} }},
  {datatype, ip},
  {include_default, "internal"}
]}.

{translation,
 "riak_api.https",
 fun(Conf) ->
     HTTPS = cuttlefish_variable:filter_by_prefix("listener.https", Conf),
     [ IP || {_, IP} <- HTTPS]
 end
}.

%% @doc Whether to prefer the order in which the server lists its
%% ciphers. When set to 'off', the client's preferred cipher order
%% dictates which cipher is chosen.
{mapping, "honor_cipher_order", "riak_api.honor_cipher_order", [
  {datatype, {enum, [on, off]}},
  {default, on},
  hidden
]}.

{translation,
  "riak_api.honor_cipher_order",
   fun(Conf) ->
     OTPVer = erlang:system_info(otp_release),
     CipherOrder = cuttlefish:conf_get("honor_cipher_order", Conf),
     %% This is only available, as of December 2013, in basho patched R16B02,
     %% so disable it if the VM is not patched by basho. This can be revised
     %% for R17, when this patch is expected to be present mainline.
     %% The basho patched OTP can be found at:
     %% https://github.com/basho/otp/tree/OTP_R16B02_basho3
     case {CipherOrder, string:str(OTPVer, "basho")} of
       {_, 0} -> false;
       {on, _} -> true;
       {off, _} -> false
     end
   end
}.

%% @doc Determine which SSL/TLS versions are allowed. By default only TLS 1.2
%% is allowed, but other versions can be enabled if clients don't support the
%% latest TLS standard. It is *strongly* recommended that SSLv3 is not enabled
%% unless absolutely necessary. More than one protocol can be enabled at once.
{mapping, "tls_protocols.sslv3", "riak_api.tls_protocols", [
  {datatype, {enum, [on, off]}},
  {default, off},
  hidden
]}.

%% @see tls_protocols.sslv3
{mapping, "tls_protocols.tlsv1", "riak_api.tls_protocols", [
  {datatype, {enum, [on, off]}},
  {default, off},
  hidden
]}.

%% @see tls_protocols.sslv3
{mapping, "tls_protocols.tlsv1.1", "riak_api.tls_protocols", [
  {datatype, {enum, [on, off]}},
  {default, off},
  hidden
]}.

%% @see tls_protocols.sslv3
{mapping, "tls_protocols.tlsv1.2", "riak_api.tls_protocols", [
  {datatype, {enum, [on, off]}},
  {default, on},
  hidden
]}.

{translation,
 "riak_api.tls_protocols",
 fun(Conf) ->
    Protocols = cuttlefish_variable:filter_by_prefix("tls_protocols", Conf),
    [begin
         case Key of
             ["tls_protocols","sslv3"] ->
                 sslv3;
             ["tls_protocols","tlsv1"] ->
                 tlsv1;
             ["tls_protocols","tlsv1", "1"] ->
                 'tlsv1.1';
             ["tls_protocols","tlsv1", "2"] ->
                 'tlsv1.2'
         end
     end || {Key, Value} <- Protocols, Value == on]
 end
}.

%% @doc Whether to check the CRL of a client certificate. This defaults to
%% on but some CAs may not maintain or define a CRL, so this can be disabled
%% if no CRL is available.
{mapping, "check_crl", "riak_api.check_crl", [
  {datatype, {enum, [on, off]}},
  {default, on},
  hidden
]}.

{translation,
 "riak_api.check_crl",
 fun(Conf) ->
     OTPVer = erlang:system_info(otp_release),
     CheckCRL = cuttlefish:conf_get("check_crl", Conf),
     %% CRL checking is broken in mainline OTP as of R16B02, so Riak will ship
     %% with a patched SSL/public_key to fix it. This means that we don't want
     %% to pass this option to a vanilla OTP.
     %% The basho patched OTP can be found at:
     %% https://github.com/basho/otp/tree/OTP_R16B02_basho3
     case {CheckCRL, string:str(OTPVer, "basho")} of
       {_, 0} -> false;
       {on, _} -> true;
       {off, _} -> false
     end
 end
}.