From 2455516c89dfa662b794e5f75379a5efaafd24d8 Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Thu, 15 Dec 2016 14:22:27 -0800
Subject: [PATCH 1/9] [ADD] clouder_template_red_october: File
 encyption/decryption

---
 clouder_template_red_october/README.rst       |  72 ++++++++
 clouder_template_red_october/__init__.py      |   3 +
 clouder_template_red_october/__manifest__.py  |  28 +++
 .../data/application.xml                      |  42 +++++
 .../data/application_tag.xml                  |  11 ++
 .../data/application_template.xml             |  13 ++
 .../data/application_type.xml                 |  17 ++
 .../data/certificate_policy_use.xml           | 162 ++++++++++++++++++
 clouder_template_red_october/data/image.xml   |  24 +++
 .../data/image_port.xml                       |  15 ++
 .../data/image_template.xml                   |  19 ++
 .../data/image_volume.xml                     |  16 ++
 .../images/data/Dockerfile                    |   4 +
 .../images/data/pki/ca/csr_ca.json            |   4 +
 .../images/exec/Dockerfile                    |  37 ++++
 15 files changed, 467 insertions(+)
 create mode 100644 clouder_template_red_october/README.rst
 create mode 100644 clouder_template_red_october/__init__.py
 create mode 100644 clouder_template_red_october/__manifest__.py
 create mode 100644 clouder_template_red_october/data/application.xml
 create mode 100644 clouder_template_red_october/data/application_tag.xml
 create mode 100644 clouder_template_red_october/data/application_template.xml
 create mode 100644 clouder_template_red_october/data/application_type.xml
 create mode 100644 clouder_template_red_october/data/certificate_policy_use.xml
 create mode 100644 clouder_template_red_october/data/image.xml
 create mode 100644 clouder_template_red_october/data/image_port.xml
 create mode 100644 clouder_template_red_october/data/image_template.xml
 create mode 100644 clouder_template_red_october/data/image_volume.xml
 create mode 100644 clouder_template_red_october/images/data/Dockerfile
 create mode 100644 clouder_template_red_october/images/data/pki/ca/csr_ca.json
 create mode 100644 clouder_template_red_october/images/exec/Dockerfile

diff --git a/clouder_template_red_october/README.rst b/clouder_template_red_october/README.rst
new file mode 100644
index 0000000..7245a98
--- /dev/null
+++ b/clouder_template_red_october/README.rst
@@ -0,0 +1,72 @@
+.. image:: https://img.shields.io/badge/licence-LGPL--3-blue.svg
+   :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
+   :alt: License: LGPL-3
+
+==============================
+Clouder Template - Red October
+==============================
+
+This module provides a Clouder Template for Red Octover.
+
+Red October is a cryptographically-secure implementation of the two-person rule
+to protect sensitive data. From a technical perspective, Red October is a
+software-based encryption and decryption server. The server can be used to
+encrypt a payload in such a way that no one individual can decrypt it. The
+encryption of the payload is cryptographically tied to the credentials of the
+authorized users.
+
+Authorized persons can delegate their credentials to the server for a period of
+time. The server can decrypt any previously-encrypted payloads as long as the
+appropriate number of people have delegated their credentials to the server.
+
+This architecture allows Red October to act as a convenient decryption service.
+Other systems, including CloudFlare’s build system, can use it for decryption
+and users can delegate their credentials to the server via a simple web interface.
+All communication with Red October is encrypted with TLS,
+ensuring that passwords are not sent in the clear.
+
+`Read More on CloudFlare's Blog
+<https://blog.cloudflare.com/red-october-cloudflares-open-source-implementation-of-the-two-man-rule/>`_.
+
+`Browse Red October on Github
+<https://github.com/cloudflare/redoctober>`_.
+
+Configuration
+=============
+
+Clouder configuration instructions are available at https://clouder.readthedocs.io/
+
+Usage
+=====
+
+To use this module, you need to:
+
+#. Create a CFSSL Service in the Clouder Control Panel
+
+Known issues / Roadmap
+======================
+
+* Add more Signature Profile options - https://github.com/cloudflare/redoctober/blob/86ecfbe5750ebf05565e4c80104d0a7919792fee/doc/cmd/redoctober.txt#L113
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues
+<https://github.com/clouder-community/clouder/issues>`_. In case of trouble, please
+check there if your issue has already been reported. If you spotted it first,
+help us smashing it by providing a detailed and welcomed feedback.
+
+Credits
+=======
+
+Contributors
+------------
+
+* Dave Lasley <dave@laslabs.com>
+
+Maintainer
+----------
+
+This module is maintained by Clouder Community.
+
+To contribute to this module, please visit https://github.com/clouder-community/clouder
diff --git a/clouder_template_red_october/__init__.py b/clouder_template_red_october/__init__.py
new file mode 100644
index 0000000..08d9d6b
--- /dev/null
+++ b/clouder_template_red_october/__init__.py
@@ -0,0 +1,3 @@
+# -*- coding: utf-8 -*-
+# Copyright 2016 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
diff --git a/clouder_template_red_october/__manifest__.py b/clouder_template_red_october/__manifest__.py
new file mode 100644
index 0000000..4668990
--- /dev/null
+++ b/clouder_template_red_october/__manifest__.py
@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*-
+# Copyright 2016 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+{
+    'name': 'Clouder Template - Red October',
+    'version': '10.0.10.0.0',
+    'category': 'Clouder',
+    'depends': [
+        'clouder',
+        'clouder_template_proxy',
+    ],
+    'author': 'LasLabs Inc.',
+    'license': 'LGPL-3',
+    'website': 'https://github.com/clouder-community/clouder',
+    'data': [
+        'data/image_template.xml',
+        'data/image.xml',
+        'data/image_port.xml',
+        'data/image_volume.xml',
+        'data/application_tag.xml',
+        'data/application_type.xml',
+        'data/application_template.xml',
+        'data/application.xml',
+    ],
+    'installable': True,
+    'application': False,
+}
diff --git a/clouder_template_red_october/data/application.xml b/clouder_template_red_october/data/application.xml
new file mode 100644
index 0000000..adc051b
--- /dev/null
+++ b/clouder_template_red_october/data/application.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="application_redoctober_data" model="clouder.application">
+        <field name="name">CFSSL Data</field>
+        <field name="code">data</field>
+        <field name="type_id" ref="application_type_redoctober" />
+        <field name="tag_ids" eval="[(4, ref('clouder.tag_data'))]" />
+        <field name="default_image_id" ref="image_redoctober_data" />
+        <field name="sequence">1</field>
+        <field name="required" eval="True"/>
+    </record>
+
+    <record id="application_redoctober_exec" model="clouder.application">
+        <field name="name">CFSSL Exec</field>
+        <field name="code">exec</field>
+        <field name="type_id" ref="application_type_redoctober" />
+        <field name="tag_ids" eval="[(4, ref('clouder.tag_exec'))]" />
+        <field name="default_image_id" ref="image_redoctober_exec" />
+        <field name="sequence">2</field>
+        <field name="required" eval="True"/>
+        <field name="update_strategy">auto</field>
+    </record>
+
+    <record id="application_redoctober" model="clouder.application">
+        <field name="name">CFSSL</field>
+        <field name="code">redoctober</field>
+        <field name="type_id" ref="application_type_redoctober" />
+        <field name="tag_ids" eval="[(4, ref('tag_cert_authority'))]" />
+        <field name="child_ids"
+               eval="[(4, ref('application_redoctober_data')),
+                      (4, ref('application_redoctober_exec')),
+                     ]"
+               />
+        <field name="sequence">1</field>
+        <field name="required" eval="True"/>
+    </record>
+
+</odoo>
diff --git a/clouder_template_red_october/data/application_tag.xml b/clouder_template_red_october/data/application_tag.xml
new file mode 100644
index 0000000..62e887a
--- /dev/null
+++ b/clouder_template_red_october/data/application_tag.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="tag_cert_authority" model="clouder.application.tag">
+        <field name="name">cert_authority</field>
+    </record>
+
+</odoo>
diff --git a/clouder_template_red_october/data/application_template.xml b/clouder_template_red_october/data/application_template.xml
new file mode 100644
index 0000000..1f684eb
--- /dev/null
+++ b/clouder_template_red_october/data/application_template.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+    
+    <record id="application_template_redoctober"
+            model="clouder.application.template"
+            >
+        <field name="name">CFSSL</field>
+    </record>
+    
+</odoo>
diff --git a/clouder_template_red_october/data/application_type.xml b/clouder_template_red_october/data/application_type.xml
new file mode 100644
index 0000000..8a60f66
--- /dev/null
+++ b/clouder_template_red_october/data/application_type.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="application_type_redoctober"
+            model="clouder.application.type"
+            >
+        <field name="name">redoctober</field>
+        <field name="system_user">root</field>
+        <field name="tag_ids"
+               eval="[(6, 0, [ref('tag_cert_authority')])]"
+               />
+    </record>
+    
+</odoo>
diff --git a/clouder_template_red_october/data/certificate_policy_use.xml b/clouder_template_red_october/data/certificate_policy_use.xml
new file mode 100644
index 0000000..46a1a13
--- /dev/null
+++ b/clouder_template_red_october/data/certificate_policy_use.xml
@@ -0,0 +1,162 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     Created from options listed at https://github.com/cloudflare/redoctober/blob/86ecfbe5750ebf05565e4c80104d0a7919792fee/doc/cmd/redoctober.txt#L89
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="certificate_policy_use_cert_sign"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Certificate Signing</field>
+        <field name="code">cert sign</field>
+    </record>
+    
+    <record id="certificate_policy_use_signing"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Signing</field>
+        <field name="code">signing</field>
+    </record>
+    
+    <record id="certificate_policy_use_smime"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">S/MIME</field>
+        <field name="code">s/mime</field>
+    </record>
+    
+    <record id="certificate_policy_use_server_auth"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Server Authentication</field>
+        <field name="code">server auth</field>
+    </record>
+    
+    <record id="certificate_policy_use_client_auth"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Client Authentication</field>
+        <field name="code">client auth</field>
+    </record>
+    
+    <record id="certificate_policy_use_digital_signature"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Digital Signatures</field>
+        <field name="code">digital signature</field>
+    </record>
+    
+    <record id="certificate_policy_use_email_protection"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Email Protection</field>
+        <field name="code">email protection</field>
+    </record>
+    
+    <record id="certificate_policy_use_key_encipherment"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Key Encipherment</field>
+        <field name="code">key encipherment</field>
+    </record>
+    
+    <record id="certificate_policy_use_content_commitment"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Content Commitment</field>
+        <field name="code">content commitment</field>
+    </record>
+    
+    <record id="certificate_policy_use_key_agreement"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Key Agreement</field>
+        <field name="code">key agreement</field>
+    </record>
+    
+    <record id="certificate_policy_use_crl_sign"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">CRL Signing</field>
+        <field name="code">crl sign</field>
+    </record>
+    
+    <record id="certificate_policy_use_encipher_only"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Encipher Only</field>
+        <field name="code">encipher only</field>
+    </record>
+    
+    <record id="certificate_policy_use_decipher_only"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Decipher Only</field>
+        <field name="code">decipher only</field>
+    </record>
+    
+    <record id="certificate_policy_use_any"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Any</field>
+        <field name="code">any</field>
+    </record>
+    
+    <record id="certificate_policy_use_code_signing"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Code Signing</field>
+        <field name="code">code signing</field>
+    </record>
+    
+    <record id="certificate_policy_use_ipsec_end_system"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">IPSEC End System</field>
+        <field name="code">ipsec end system</field>
+    </record>
+    
+    <record id="certificate_policy_use_ipsec_tunnel"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">IPSEC Tunnel</field>
+        <field name="code">ipsec tunnel</field>
+    </record>
+    
+    <record id="certificate_policy_use_ipsec_user"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">IPSEC User</field>
+        <field name="code">ipsec user</field>
+    </record>
+    
+    <record id="certificate_policy_use_timestamping"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Timestamping</field>
+        <field name="code">timestamping</field>
+    </record>
+    
+    <record id="certificate_policy_use_ocscp_signing"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">OCSP Signing</field>
+        <field name="code">ocsp signing</field>
+    </record>
+    
+    <record id="certificate_policy_use_microsoft_sgc"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Microsoft SGC</field>
+        <field name="code">microsoft sgc</field>
+    </record>
+    
+    <record id="certificate_policy_use_netscape_sgc"
+            model="clouder.certificate.policy.use"
+            >
+        <field name="name">Netscape SGC</field>
+        <field name="code">netscape sgc</field>
+    </record>
+    
+</odoo>
diff --git a/clouder_template_red_october/data/image.xml b/clouder_template_red_october/data/image.xml
new file mode 100644
index 0000000..622b767
--- /dev/null
+++ b/clouder_template_red_october/data/image.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="image_redoctober_data" model="clouder.image">
+        <field name="name">image_redoctober_data</field>
+        <field name="template_ids"
+               eval="[(4, [ref('image_template_redoctober_data')])]"
+               />
+        <field name="parent_from">lasley/redoctober-data</field>
+    </record>
+    
+    <record id="image_redoctober_exec" model="clouder.image">
+        <field name="name">image_redoctober_exec</field>
+        <field name="template_ids"
+               eval="[(4, [ref('image_template_redoctober_exec')])]"
+               />
+        <field name="parent_from">lasley/redoctober-exec</field>
+        <field name="volumes_from">data</field>
+    </record>
+
+</odoo>
diff --git a/clouder_template_red_october/data/image_port.xml b/clouder_template_red_october/data/image_port.xml
new file mode 100644
index 0000000..1562dc6
--- /dev/null
+++ b/clouder_template_red_october/data/image_port.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+    
+    <record id="image_port_redoctober_http"
+            model="clouder.image.port"
+            >
+        <field name="template_id" ref="image_template_redoctober_exec" />
+        <field name="name">redoctober-http</field>
+        <field name="local_port">8888</field>
+    </record>
+
+</odoo>
diff --git a/clouder_template_red_october/data/image_template.xml b/clouder_template_red_october/data/image_template.xml
new file mode 100644
index 0000000..6e55bd3
--- /dev/null
+++ b/clouder_template_red_october/data/image_template.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+    
+    <record id="image_template_redoctober_data"
+            model="clouder.image.template"
+            >
+        <field name="name">image_template_redoctober_data</field>
+    </record>
+    
+    <record id="image_template_redoctober_exec"
+            model="clouder.image.template"
+            >
+        <field name="name">image_template_redoctober_exec</field>
+    </record>
+    
+</odoo>
diff --git a/clouder_template_red_october/data/image_volume.xml b/clouder_template_red_october/data/image_volume.xml
new file mode 100644
index 0000000..67c4d10
--- /dev/null
+++ b/clouder_template_red_october/data/image_volume.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="image_volume_redoctober_cert_store"
+            model="clouder.image.volume"
+            >
+        <field name="template_id" ref="image_template_redoctober_data" />
+        <field name="name">cert_store</field>
+        <field name="localpath">/var/pki</field>
+        <field name="user">root</field>
+    </record>
+
+</odoo>
diff --git a/clouder_template_red_october/images/data/Dockerfile b/clouder_template_red_october/images/data/Dockerfile
new file mode 100644
index 0000000..d9d246c
--- /dev/null
+++ b/clouder_template_red_october/images/data/Dockerfile
@@ -0,0 +1,4 @@
+FROM clouder/base:3.4
+MAINTAINER Dave Lasley <dave@laslabs.com>
+
+CMD tail -f /dev/null
diff --git a/clouder_template_red_october/images/data/pki/ca/csr_ca.json b/clouder_template_red_october/images/data/pki/ca/csr_ca.json
new file mode 100644
index 0000000..d9d246c
--- /dev/null
+++ b/clouder_template_red_october/images/data/pki/ca/csr_ca.json
@@ -0,0 +1,4 @@
+FROM clouder/base:3.4
+MAINTAINER Dave Lasley <dave@laslabs.com>
+
+CMD tail -f /dev/null
diff --git a/clouder_template_red_october/images/exec/Dockerfile b/clouder_template_red_october/images/exec/Dockerfile
new file mode 100644
index 0000000..eb4f5c2
--- /dev/null
+++ b/clouder_template_red_october/images/exec/Dockerfile
@@ -0,0 +1,37 @@
+FROM clouder/base:3.4
+MAINTAINER Dave Lasley <dave@laslabs.com>
+
+
+RUN groupadd -r redoctober --gid=999 && useradd -r -g redoctober --uid=999 redoctober
+
+# Install Build Dependencies
+
+ENV buildDeps "build-base \
+               gcc \
+               git \
+               go \
+               libtool \
+               openssl \
+               runit"
+
+RUN apk add --no-cache $buildDeps
+
+# Install Red October
+
+RUN git clone --depth=1 https://github.com/cloudflare/redoctober.git /go/src/github.com/cloudflare/redoctober
+
+RUN go install github.com/cloudflare/redoctober
+
+EXPOSE 8080 8081
+ENV RO_CERTS=/var/lib/redoctober/data/server.crt \
+    RO_KEYS=/var/lib/redoctober/data/server.pem \
+    RO_DATA=/var/lib/redoctober/data \
+    RO_CERTPASSWD=password \
+    RO_COMMONNAME=localhost
+
+ENTRYPOINT ["/go/src/github.com/cloudflare/redoctober/scripts/docker-entrypoint.sh"]
+CMD ["redoctober", \
+    "-addr=:8080", \
+    "-vaultpath=/var/lib/redoctober/data/diskrecord.json", \
+    "-certs=/var/lib/redoctober/data/server.crt", \
+    "-keys=/var/lib/redoctober/data/server.pem"]

From be1aaaad7dbf9c0bb28c8f38346ed57c8aacbd8e Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Tue, 27 Dec 2016 20:35:13 -0800
Subject: [PATCH 2/9] [FIX] clouder_template_red_october: Review fixes * Remove
 data and source from base * Proxy compat * Roadmap notes * Switch user to red
 october * Fix dockerfile * Bugfixes

---
 clouder_template_red_october/README.rst       |   7 +-
 clouder_template_red_october/__init__.py      |   2 +
 clouder_template_red_october/__manifest__.py  |   1 -
 .../data/application.xml                      |   6 +-
 .../data/application_tag.xml                  |  11 --
 .../data/application_template.xml             |   2 +-
 .../data/application_type.xml                 |   5 +-
 .../data/certificate_policy_use.xml           | 162 ------------------
 clouder_template_red_october/data/image.xml   |   2 +-
 .../data/image_port.xml                       |  12 +-
 .../data/image_volume.xml                     |   6 +-
 .../images/data/Dockerfile                    |   4 -
 .../images/data/pki/ca/csr_ca.json            |   4 -
 .../images/exec/Dockerfile                    |  29 ++--
 .../models/__init__.py                        |   5 +
 .../models/container.py                       |  18 ++
 16 files changed, 62 insertions(+), 214 deletions(-)
 delete mode 100644 clouder_template_red_october/data/application_tag.xml
 delete mode 100644 clouder_template_red_october/data/certificate_policy_use.xml
 delete mode 100644 clouder_template_red_october/images/data/Dockerfile
 delete mode 100644 clouder_template_red_october/images/data/pki/ca/csr_ca.json
 create mode 100644 clouder_template_red_october/models/__init__.py
 create mode 100644 clouder_template_red_october/models/container.py

diff --git a/clouder_template_red_october/README.rst b/clouder_template_red_october/README.rst
index 7245a98..2d55b28 100644
--- a/clouder_template_red_october/README.rst
+++ b/clouder_template_red_october/README.rst
@@ -6,7 +6,7 @@
 Clouder Template - Red October
 ==============================
 
-This module provides a Clouder Template for Red Octover.
+This module provides a Clouder Template for Red October.
 
 Red October is a cryptographically-secure implementation of the two-person rule
 to protect sensitive data. From a technical perspective, Red October is a
@@ -41,12 +41,13 @@ Usage
 
 To use this module, you need to:
 
-#. Create a CFSSL Service in the Clouder Control Panel
+#. Create a Red October application in Clouder
 
 Known issues / Roadmap
 ======================
 
-* Add more Signature Profile options - https://github.com/cloudflare/redoctober/blob/86ecfbe5750ebf05565e4c80104d0a7919792fee/doc/cmd/redoctober.txt#L113
+* The container is currently using a self-signed certificate. This should be changed once a CA exists.
+* Runit is being installed via community repos, which are HTTP only. This is insecure.
 
 Bug Tracker
 ===========
diff --git a/clouder_template_red_october/__init__.py b/clouder_template_red_october/__init__.py
index 08d9d6b..6b7b00c 100644
--- a/clouder_template_red_october/__init__.py
+++ b/clouder_template_red_october/__init__.py
@@ -1,3 +1,5 @@
 # -*- coding: utf-8 -*-
 # Copyright 2016 LasLabs Inc.
 # License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+from . import models
diff --git a/clouder_template_red_october/__manifest__.py b/clouder_template_red_october/__manifest__.py
index 4668990..ec0c2bb 100644
--- a/clouder_template_red_october/__manifest__.py
+++ b/clouder_template_red_october/__manifest__.py
@@ -18,7 +18,6 @@
         'data/image.xml',
         'data/image_port.xml',
         'data/image_volume.xml',
-        'data/application_tag.xml',
         'data/application_type.xml',
         'data/application_template.xml',
         'data/application.xml',
diff --git a/clouder_template_red_october/data/application.xml b/clouder_template_red_october/data/application.xml
index adc051b..8370685 100644
--- a/clouder_template_red_october/data/application.xml
+++ b/clouder_template_red_october/data/application.xml
@@ -5,7 +5,7 @@
 <odoo>
 
     <record id="application_redoctober_data" model="clouder.application">
-        <field name="name">CFSSL Data</field>
+        <field name="name">Red October Data</field>
         <field name="code">data</field>
         <field name="type_id" ref="application_type_redoctober" />
         <field name="tag_ids" eval="[(4, ref('clouder.tag_data'))]" />
@@ -15,7 +15,7 @@
     </record>
 
     <record id="application_redoctober_exec" model="clouder.application">
-        <field name="name">CFSSL Exec</field>
+        <field name="name">Red October Exec</field>
         <field name="code">exec</field>
         <field name="type_id" ref="application_type_redoctober" />
         <field name="tag_ids" eval="[(4, ref('clouder.tag_exec'))]" />
@@ -26,7 +26,7 @@
     </record>
 
     <record id="application_redoctober" model="clouder.application">
-        <field name="name">CFSSL</field>
+        <field name="name">Red October</field>
         <field name="code">redoctober</field>
         <field name="type_id" ref="application_type_redoctober" />
         <field name="tag_ids" eval="[(4, ref('tag_cert_authority'))]" />
diff --git a/clouder_template_red_october/data/application_tag.xml b/clouder_template_red_october/data/application_tag.xml
deleted file mode 100644
index 62e887a..0000000
--- a/clouder_template_red_october/data/application_tag.xml
+++ /dev/null
@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright 2016 LasLabs Inc.
-     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
-
-<odoo>
-
-    <record id="tag_cert_authority" model="clouder.application.tag">
-        <field name="name">cert_authority</field>
-    </record>
-
-</odoo>
diff --git a/clouder_template_red_october/data/application_template.xml b/clouder_template_red_october/data/application_template.xml
index 1f684eb..85cebc8 100644
--- a/clouder_template_red_october/data/application_template.xml
+++ b/clouder_template_red_october/data/application_template.xml
@@ -7,7 +7,7 @@
     <record id="application_template_redoctober"
             model="clouder.application.template"
             >
-        <field name="name">CFSSL</field>
+        <field name="name">Red October</field>
     </record>
     
 </odoo>
diff --git a/clouder_template_red_october/data/application_type.xml b/clouder_template_red_october/data/application_type.xml
index 8a60f66..46125fa 100644
--- a/clouder_template_red_october/data/application_type.xml
+++ b/clouder_template_red_october/data/application_type.xml
@@ -8,10 +8,7 @@
             model="clouder.application.type"
             >
         <field name="name">redoctober</field>
-        <field name="system_user">root</field>
-        <field name="tag_ids"
-               eval="[(6, 0, [ref('tag_cert_authority')])]"
-               />
+        <field name="system_user">redoctober</field>
     </record>
     
 </odoo>
diff --git a/clouder_template_red_october/data/certificate_policy_use.xml b/clouder_template_red_october/data/certificate_policy_use.xml
deleted file mode 100644
index 46a1a13..0000000
--- a/clouder_template_red_october/data/certificate_policy_use.xml
+++ /dev/null
@@ -1,162 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright 2016 LasLabs Inc.
-     Created from options listed at https://github.com/cloudflare/redoctober/blob/86ecfbe5750ebf05565e4c80104d0a7919792fee/doc/cmd/redoctober.txt#L89
-     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
-
-<odoo>
-
-    <record id="certificate_policy_use_cert_sign"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Certificate Signing</field>
-        <field name="code">cert sign</field>
-    </record>
-    
-    <record id="certificate_policy_use_signing"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Signing</field>
-        <field name="code">signing</field>
-    </record>
-    
-    <record id="certificate_policy_use_smime"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">S/MIME</field>
-        <field name="code">s/mime</field>
-    </record>
-    
-    <record id="certificate_policy_use_server_auth"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Server Authentication</field>
-        <field name="code">server auth</field>
-    </record>
-    
-    <record id="certificate_policy_use_client_auth"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Client Authentication</field>
-        <field name="code">client auth</field>
-    </record>
-    
-    <record id="certificate_policy_use_digital_signature"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Digital Signatures</field>
-        <field name="code">digital signature</field>
-    </record>
-    
-    <record id="certificate_policy_use_email_protection"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Email Protection</field>
-        <field name="code">email protection</field>
-    </record>
-    
-    <record id="certificate_policy_use_key_encipherment"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Key Encipherment</field>
-        <field name="code">key encipherment</field>
-    </record>
-    
-    <record id="certificate_policy_use_content_commitment"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Content Commitment</field>
-        <field name="code">content commitment</field>
-    </record>
-    
-    <record id="certificate_policy_use_key_agreement"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Key Agreement</field>
-        <field name="code">key agreement</field>
-    </record>
-    
-    <record id="certificate_policy_use_crl_sign"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">CRL Signing</field>
-        <field name="code">crl sign</field>
-    </record>
-    
-    <record id="certificate_policy_use_encipher_only"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Encipher Only</field>
-        <field name="code">encipher only</field>
-    </record>
-    
-    <record id="certificate_policy_use_decipher_only"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Decipher Only</field>
-        <field name="code">decipher only</field>
-    </record>
-    
-    <record id="certificate_policy_use_any"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Any</field>
-        <field name="code">any</field>
-    </record>
-    
-    <record id="certificate_policy_use_code_signing"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Code Signing</field>
-        <field name="code">code signing</field>
-    </record>
-    
-    <record id="certificate_policy_use_ipsec_end_system"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">IPSEC End System</field>
-        <field name="code">ipsec end system</field>
-    </record>
-    
-    <record id="certificate_policy_use_ipsec_tunnel"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">IPSEC Tunnel</field>
-        <field name="code">ipsec tunnel</field>
-    </record>
-    
-    <record id="certificate_policy_use_ipsec_user"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">IPSEC User</field>
-        <field name="code">ipsec user</field>
-    </record>
-    
-    <record id="certificate_policy_use_timestamping"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Timestamping</field>
-        <field name="code">timestamping</field>
-    </record>
-    
-    <record id="certificate_policy_use_ocscp_signing"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">OCSP Signing</field>
-        <field name="code">ocsp signing</field>
-    </record>
-    
-    <record id="certificate_policy_use_microsoft_sgc"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Microsoft SGC</field>
-        <field name="code">microsoft sgc</field>
-    </record>
-    
-    <record id="certificate_policy_use_netscape_sgc"
-            model="clouder.certificate.policy.use"
-            >
-        <field name="name">Netscape SGC</field>
-        <field name="code">netscape sgc</field>
-    </record>
-    
-</odoo>
diff --git a/clouder_template_red_october/data/image.xml b/clouder_template_red_october/data/image.xml
index 622b767..09985e9 100644
--- a/clouder_template_red_october/data/image.xml
+++ b/clouder_template_red_october/data/image.xml
@@ -9,7 +9,7 @@
         <field name="template_ids"
                eval="[(4, [ref('image_template_redoctober_data')])]"
                />
-        <field name="parent_from">lasley/redoctober-data</field>
+        <field name="parent_from">clouder/base:3.4</field>
     </record>
     
     <record id="image_redoctober_exec" model="clouder.image">
diff --git a/clouder_template_red_october/data/image_port.xml b/clouder_template_red_october/data/image_port.xml
index 1562dc6..3c547e3 100644
--- a/clouder_template_red_october/data/image_port.xml
+++ b/clouder_template_red_october/data/image_port.xml
@@ -8,8 +8,16 @@
             model="clouder.image.port"
             >
         <field name="template_id" ref="image_template_redoctober_exec" />
-        <field name="name">redoctober-http</field>
-        <field name="local_port">8888</field>
+        <field name="name">https</field>
+        <field name="local_port">8080</field>
+    </record>
+
+    <record id="image_port_redoctober_comm"
+            model="clouder.image.port"
+            >
+        <field name="template_id" ref="image_template_redoctober_exec" />
+        <field name="name">comm</field>
+        <field name="local_port">8081</field>
     </record>
 
 </odoo>
diff --git a/clouder_template_red_october/data/image_volume.xml b/clouder_template_red_october/data/image_volume.xml
index 67c4d10..7e9e4b6 100644
--- a/clouder_template_red_october/data/image_volume.xml
+++ b/clouder_template_red_october/data/image_volume.xml
@@ -8,9 +8,9 @@
             model="clouder.image.volume"
             >
         <field name="template_id" ref="image_template_redoctober_data" />
-        <field name="name">cert_store</field>
-        <field name="localpath">/var/pki</field>
-        <field name="user">root</field>
+        <field name="name">data</field>
+        <field name="localpath">/var/lib/redoctober/data</field>
+        <field name="user">redoctober</field>
     </record>
 
 </odoo>
diff --git a/clouder_template_red_october/images/data/Dockerfile b/clouder_template_red_october/images/data/Dockerfile
deleted file mode 100644
index d9d246c..0000000
--- a/clouder_template_red_october/images/data/Dockerfile
+++ /dev/null
@@ -1,4 +0,0 @@
-FROM clouder/base:3.4
-MAINTAINER Dave Lasley <dave@laslabs.com>
-
-CMD tail -f /dev/null
diff --git a/clouder_template_red_october/images/data/pki/ca/csr_ca.json b/clouder_template_red_october/images/data/pki/ca/csr_ca.json
deleted file mode 100644
index d9d246c..0000000
--- a/clouder_template_red_october/images/data/pki/ca/csr_ca.json
+++ /dev/null
@@ -1,4 +0,0 @@
-FROM clouder/base:3.4
-MAINTAINER Dave Lasley <dave@laslabs.com>
-
-CMD tail -f /dev/null
diff --git a/clouder_template_red_october/images/exec/Dockerfile b/clouder_template_red_october/images/exec/Dockerfile
index eb4f5c2..695e88c 100644
--- a/clouder_template_red_october/images/exec/Dockerfile
+++ b/clouder_template_red_october/images/exec/Dockerfile
@@ -1,8 +1,8 @@
 FROM clouder/base:3.4
 MAINTAINER Dave Lasley <dave@laslabs.com>
 
-
-RUN groupadd -r redoctober --gid=999 && useradd -r -g redoctober --uid=999 redoctober
+RUN addgroup -S redoctober \
+    && adduser -S -g redoctober redoctober
 
 # Install Build Dependencies
 
@@ -12,26 +12,25 @@ ENV buildDeps "build-base \
                go \
                libtool \
                openssl \
-               runit"
+               runit@community"
+
+RUN echo "@community http://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories
 
 RUN apk add --no-cache $buildDeps
 
 # Install Red October
-
-RUN git clone --depth=1 https://github.com/cloudflare/redoctober.git /go/src/github.com/cloudflare/redoctober
-
+RUN git clone --depth=1 https://github.com/cloudflare/redoctober.git /usr/lib/go/src/github.com/cloudflare/redoctober
 RUN go install github.com/cloudflare/redoctober
 
-EXPOSE 8080 8081
-ENV RO_CERTS=/var/lib/redoctober/data/server.crt \
-    RO_KEYS=/var/lib/redoctober/data/server.pem \
-    RO_DATA=/var/lib/redoctober/data \
-    RO_CERTPASSWD=password \
-    RO_COMMONNAME=localhost
+# Setup Environment
+ENV RO_DATA=/var/lib/redoctober/data \
+    RO_CERTS=$RO_DATA/server.crt \
+    RO_KEYS=$RO_DATA/server.pem
 
 ENTRYPOINT ["/go/src/github.com/cloudflare/redoctober/scripts/docker-entrypoint.sh"]
+
 CMD ["redoctober", \
     "-addr=:8080", \
-    "-vaultpath=/var/lib/redoctober/data/diskrecord.json", \
-    "-certs=/var/lib/redoctober/data/server.crt", \
-    "-keys=/var/lib/redoctober/data/server.pem"]
+    "-vaultpath=$RO_DATA/diskrecord.json", \
+    "-certs=$RO_CERTS", \
+    "-keys=$RO_KEYS"]
diff --git a/clouder_template_red_october/models/__init__.py b/clouder_template_red_october/models/__init__.py
new file mode 100644
index 0000000..4795f83
--- /dev/null
+++ b/clouder_template_red_october/models/__init__.py
@@ -0,0 +1,5 @@
+# -*- coding: utf-8 -*-
+# Copyright 2016 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+from . import container
diff --git a/clouder_template_red_october/models/container.py b/clouder_template_red_october/models/container.py
new file mode 100644
index 0000000..983cef0
--- /dev/null
+++ b/clouder_template_red_october/models/container.py
@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+# Copyright 2016 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+from odoo import api, models
+
+
+class ClouderContainer(models.Model):
+    _inherit = 'clouder.container'
+
+    @api.multi
+    def deploy_post(self):
+        super(ClouderContainer, self).deploy_post()
+        for record in self:
+            if record.application_id.type_id.name == 'redoctober':
+                if record.application_id.code == 'data':
+                    # @TODO: Create a CSR, sign it with the CA, execute echo
+                    pass

From 7bca20be115637b1c3ae758489deddf8a5ac874d Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Thu, 29 Dec 2016 16:43:08 -0800
Subject: [PATCH 3/9] Few fixes

---
 clouder_template_red_october/README.rst                     | 5 +++--
 clouder_template_red_october/data/application.xml           | 1 -
 clouder_template_red_october/models/__init__.py             | 2 +-
 .../models/{container.py => service.py}                     | 6 +++---
 4 files changed, 7 insertions(+), 7 deletions(-)
 rename clouder_template_red_october/models/{container.py => service.py} (78%)

diff --git a/clouder_template_red_october/README.rst b/clouder_template_red_october/README.rst
index 2d55b28..4802fbb 100644
--- a/clouder_template_red_october/README.rst
+++ b/clouder_template_red_october/README.rst
@@ -41,12 +41,13 @@ Usage
 
 To use this module, you need to:
 
-#. Create a Red October application in Clouder
+#. Create a new service in the Clouder Control Panel
+#. Select ``Red October`` as the application & configure everything else to preference
 
 Known issues / Roadmap
 ======================
 
-* The container is currently using a self-signed certificate. This should be changed once a CA exists.
+* The service is currently using a self-signed certificate. This should be changed once a CA exists.
 * Runit is being installed via community repos, which are HTTP only. This is insecure.
 
 Bug Tracker
diff --git a/clouder_template_red_october/data/application.xml b/clouder_template_red_october/data/application.xml
index 8370685..6769286 100644
--- a/clouder_template_red_october/data/application.xml
+++ b/clouder_template_red_october/data/application.xml
@@ -29,7 +29,6 @@
         <field name="name">Red October</field>
         <field name="code">redoctober</field>
         <field name="type_id" ref="application_type_redoctober" />
-        <field name="tag_ids" eval="[(4, ref('tag_cert_authority'))]" />
         <field name="child_ids"
                eval="[(4, ref('application_redoctober_data')),
                       (4, ref('application_redoctober_exec')),
diff --git a/clouder_template_red_october/models/__init__.py b/clouder_template_red_october/models/__init__.py
index 4795f83..4949cfb 100644
--- a/clouder_template_red_october/models/__init__.py
+++ b/clouder_template_red_october/models/__init__.py
@@ -2,4 +2,4 @@
 # Copyright 2016 LasLabs Inc.
 # License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
 
-from . import container
+from . import service
diff --git a/clouder_template_red_october/models/container.py b/clouder_template_red_october/models/service.py
similarity index 78%
rename from clouder_template_red_october/models/container.py
rename to clouder_template_red_october/models/service.py
index 983cef0..8575f27 100644
--- a/clouder_template_red_october/models/container.py
+++ b/clouder_template_red_october/models/service.py
@@ -5,12 +5,12 @@
 from odoo import api, models
 
 
-class ClouderContainer(models.Model):
-    _inherit = 'clouder.container'
+class ClouderService(models.Model):
+    _inherit = 'clouder.service'
 
     @api.multi
     def deploy_post(self):
-        super(ClouderContainer, self).deploy_post()
+        super(ClouderService, self).deploy_post()
         for record in self:
             if record.application_id.type_id.name == 'redoctober':
                 if record.application_id.code == 'data':

From d14d4cdb4624ba3ce35221cefe643de1168c20f3 Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Mon, 2 Jan 2017 11:36:58 -0800
Subject: [PATCH 4/9] Fix Dockerfile and add note about non-persisting gopath

---
 clouder_template_red_october/README.rst       |  5 +++
 .../data/image_port.xml                       |  4 +--
 .../data/image_volume.xml                     |  2 +-
 .../images/exec/Dockerfile                    | 33 +++++++++++++------
 4 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/clouder_template_red_october/README.rst b/clouder_template_red_october/README.rst
index 4802fbb..00c652d 100644
--- a/clouder_template_red_october/README.rst
+++ b/clouder_template_red_october/README.rst
@@ -49,6 +49,11 @@ Known issues / Roadmap
 
 * The service is currently using a self-signed certificate. This should be changed once a CA exists.
 * Runit is being installed via community repos, which are HTTP only. This is insecure.
+* Path isn't persisting so there is a symlink to redoctober being created. This should be fixed at some point,
+  likely in a base Go container instead of here.
+* Image volume is being mounted as root, then chown is happening in the docker entrypoint. This sseems weird,
+  so should investigate further, but is how the CloudFlare people rigged it up so it's possible they're simply
+  smarter than me.
 
 Bug Tracker
 ===========
diff --git a/clouder_template_red_october/data/image_port.xml b/clouder_template_red_october/data/image_port.xml
index 3c547e3..d2a05c6 100644
--- a/clouder_template_red_october/data/image_port.xml
+++ b/clouder_template_red_october/data/image_port.xml
@@ -12,11 +12,11 @@
         <field name="local_port">8080</field>
     </record>
 
-    <record id="image_port_redoctober_comm"
+    <record id="image_port_redoctober_metrics"
             model="clouder.image.port"
             >
         <field name="template_id" ref="image_template_redoctober_exec" />
-        <field name="name">comm</field>
+        <field name="name">metrics</field>
         <field name="local_port">8081</field>
     </record>
 
diff --git a/clouder_template_red_october/data/image_volume.xml b/clouder_template_red_october/data/image_volume.xml
index 7e9e4b6..1ae494f 100644
--- a/clouder_template_red_october/data/image_volume.xml
+++ b/clouder_template_red_october/data/image_volume.xml
@@ -10,7 +10,7 @@
         <field name="template_id" ref="image_template_redoctober_data" />
         <field name="name">data</field>
         <field name="localpath">/var/lib/redoctober/data</field>
-        <field name="user">redoctober</field>
+        <field name="user">root</field>
     </record>
 
 </odoo>
diff --git a/clouder_template_red_october/images/exec/Dockerfile b/clouder_template_red_october/images/exec/Dockerfile
index 695e88c..e1c7091 100644
--- a/clouder_template_red_october/images/exec/Dockerfile
+++ b/clouder_template_red_october/images/exec/Dockerfile
@@ -1,6 +1,9 @@
 FROM clouder/base:3.4
 MAINTAINER Dave Lasley <dave@laslabs.com>
 
+ARG RO_CERTPASSWD="password"
+ARG RO_COMMONNAME="localhost"
+
 RUN addgroup -S redoctober \
     && adduser -S -g redoctober redoctober
 
@@ -19,18 +22,28 @@ RUN echo "@community http://dl-cdn.alpinelinux.org/alpine/edge/community" >> /et
 RUN apk add --no-cache $buildDeps
 
 # Install Red October
-RUN git clone --depth=1 https://github.com/cloudflare/redoctober.git /usr/lib/go/src/github.com/cloudflare/redoctober
-RUN go install github.com/cloudflare/redoctober
+RUN git clone --depth=1 https://github.com/cloudflare/redoctober.git /usr/lib/go/src/github.com/cloudflare/redoctober \
+    && go install github.com/cloudflare/redoctober
+
+ENV GOROOT="/usr/lib/go" \
+    GOPATH="/gopath" \
+    GOBIN="/gopath/bin" \
+    PATH="$PATH:$GOROOT/bin:$GOPATH/bin"
+
+# Path isn't persisting for some reason.
+RUN ln -s "$GOROOT/bin/redoctober" /usr/bin
 
 # Setup Environment
-ENV RO_DATA=/var/lib/redoctober/data \
-    RO_CERTS=$RO_DATA/server.crt \
-    RO_KEYS=$RO_DATA/server.pem
+ENV RO_DATA="/var/lib/redoctober/data"
+ENV RO_CERTS="${RO_DATA}/server.crt" \
+    RO_KEYS="${RO_DATA}/server.pem" \
+    RO_CERTPASSWD="${RO_CERTPASSWD}" \
+    RO_COMMONNAME="${RO_COMMONNAME}"
 
-ENTRYPOINT ["/go/src/github.com/cloudflare/redoctober/scripts/docker-entrypoint.sh"]
+ENTRYPOINT ["/usr/lib/go/src/github.com/cloudflare/redoctober/scripts/docker-entrypoint.sh"]
 
 CMD ["redoctober", \
-    "-addr=:8080", \
-    "-vaultpath=$RO_DATA/diskrecord.json", \
-    "-certs=$RO_CERTS", \
-    "-keys=$RO_KEYS"]
+     "-addr=:8080", \
+     "-vaultpath=/var/lib/redoctober/data/diskrecord.json", \
+     "-certs=/var/lib/redoctober/data/server.crt", \
+     "-keys=/var/lib/redoctober/data/server.pem"]

From bced5ad1b73db723d54a28f9304bbc30d8de9ea1 Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Mon, 2 Jan 2017 12:37:50 -0800
Subject: [PATCH 5/9] Fix metrics interface binding

---
 clouder_template_red_october/README.rst             | 1 +
 clouder_template_red_october/images/exec/Dockerfile | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/clouder_template_red_october/README.rst b/clouder_template_red_october/README.rst
index 00c652d..70383d2 100644
--- a/clouder_template_red_october/README.rst
+++ b/clouder_template_red_october/README.rst
@@ -54,6 +54,7 @@ Known issues / Roadmap
 * Image volume is being mounted as root, then chown is happening in the docker entrypoint. This sseems weird,
   so should investigate further, but is how the CloudFlare people rigged it up so it's possible they're simply
   smarter than me.
+* Add dependency cleanup to Dockerfile.
 
 Bug Tracker
 ===========
diff --git a/clouder_template_red_october/images/exec/Dockerfile b/clouder_template_red_october/images/exec/Dockerfile
index e1c7091..9364047 100644
--- a/clouder_template_red_october/images/exec/Dockerfile
+++ b/clouder_template_red_october/images/exec/Dockerfile
@@ -43,7 +43,9 @@ ENV RO_CERTS="${RO_DATA}/server.crt" \
 ENTRYPOINT ["/usr/lib/go/src/github.com/cloudflare/redoctober/scripts/docker-entrypoint.sh"]
 
 CMD ["redoctober", \
-     "-addr=:8080", \
+     "-addr=0.0.0.0:8080", \
      "-vaultpath=/var/lib/redoctober/data/diskrecord.json", \
      "-certs=/var/lib/redoctober/data/server.crt", \
-     "-keys=/var/lib/redoctober/data/server.pem"]
+     "-keys=/var/lib/redoctober/data/server.pem", \
+     "-metrics-host=0.0.0.0", \
+     "-metrics-port=8081"]

From 77754a4511a3611445a804eecf43d565088abf15 Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Mon, 2 Jan 2017 14:28:20 -0800
Subject: [PATCH 6/9] Allow bases and link www to application

---
 clouder_template_red_october/data/application.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/clouder_template_red_october/data/application.xml b/clouder_template_red_october/data/application.xml
index 6769286..163dfd9 100644
--- a/clouder_template_red_october/data/application.xml
+++ b/clouder_template_red_october/data/application.xml
@@ -28,7 +28,11 @@
     <record id="application_redoctober" model="clouder.application">
         <field name="name">Red October</field>
         <field name="code">redoctober</field>
+        <field name="base" eval="True" />
         <field name="type_id" ref="application_type_redoctober" />
+        <field name="template_ids"
+               eval="[(4, ref('clouder.application_template_base_www'))]"
+               />
         <field name="child_ids"
                eval="[(4, ref('application_redoctober_data')),
                       (4, ref('application_redoctober_exec')),

From f5125b96d38c1109ae2e4bd7daa15043be51e13f Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Mon, 2 Jan 2017 23:51:43 -0800
Subject: [PATCH 7/9] Move dockerfile to repo

---
 clouder_template_red_october/data/image.xml   |  2 +-
 .../images/exec/Dockerfile                    | 51 -------------------
 2 files changed, 1 insertion(+), 52 deletions(-)
 delete mode 100644 clouder_template_red_october/images/exec/Dockerfile

diff --git a/clouder_template_red_october/data/image.xml b/clouder_template_red_october/data/image.xml
index 09985e9..8f40a2d 100644
--- a/clouder_template_red_october/data/image.xml
+++ b/clouder_template_red_october/data/image.xml
@@ -17,7 +17,7 @@
         <field name="template_ids"
                eval="[(4, [ref('image_template_redoctober_exec')])]"
                />
-        <field name="parent_from">lasley/redoctober-exec</field>
+        <field name="parent_from">laslabs/clouder-red-october-exec</field>
         <field name="volumes_from">data</field>
     </record>
 
diff --git a/clouder_template_red_october/images/exec/Dockerfile b/clouder_template_red_october/images/exec/Dockerfile
deleted file mode 100644
index 9364047..0000000
--- a/clouder_template_red_october/images/exec/Dockerfile
+++ /dev/null
@@ -1,51 +0,0 @@
-FROM clouder/base:3.4
-MAINTAINER Dave Lasley <dave@laslabs.com>
-
-ARG RO_CERTPASSWD="password"
-ARG RO_COMMONNAME="localhost"
-
-RUN addgroup -S redoctober \
-    && adduser -S -g redoctober redoctober
-
-# Install Build Dependencies
-
-ENV buildDeps "build-base \
-               gcc \
-               git \
-               go \
-               libtool \
-               openssl \
-               runit@community"
-
-RUN echo "@community http://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories
-
-RUN apk add --no-cache $buildDeps
-
-# Install Red October
-RUN git clone --depth=1 https://github.com/cloudflare/redoctober.git /usr/lib/go/src/github.com/cloudflare/redoctober \
-    && go install github.com/cloudflare/redoctober
-
-ENV GOROOT="/usr/lib/go" \
-    GOPATH="/gopath" \
-    GOBIN="/gopath/bin" \
-    PATH="$PATH:$GOROOT/bin:$GOPATH/bin"
-
-# Path isn't persisting for some reason.
-RUN ln -s "$GOROOT/bin/redoctober" /usr/bin
-
-# Setup Environment
-ENV RO_DATA="/var/lib/redoctober/data"
-ENV RO_CERTS="${RO_DATA}/server.crt" \
-    RO_KEYS="${RO_DATA}/server.pem" \
-    RO_CERTPASSWD="${RO_CERTPASSWD}" \
-    RO_COMMONNAME="${RO_COMMONNAME}"
-
-ENTRYPOINT ["/usr/lib/go/src/github.com/cloudflare/redoctober/scripts/docker-entrypoint.sh"]
-
-CMD ["redoctober", \
-     "-addr=0.0.0.0:8080", \
-     "-vaultpath=/var/lib/redoctober/data/diskrecord.json", \
-     "-certs=/var/lib/redoctober/data/server.crt", \
-     "-keys=/var/lib/redoctober/data/server.pem", \
-     "-metrics-host=0.0.0.0", \
-     "-metrics-port=8081"]

From 73b3fa90a19262dbc817bb2734e66af6611c1145 Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Tue, 17 Jan 2017 15:51:51 -0800
Subject: [PATCH 8/9] Expose ports

---
 clouder_template_red_october/data/image_port.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/clouder_template_red_october/data/image_port.xml b/clouder_template_red_october/data/image_port.xml
index d2a05c6..3a92871 100644
--- a/clouder_template_red_october/data/image_port.xml
+++ b/clouder_template_red_october/data/image_port.xml
@@ -10,6 +10,7 @@
         <field name="template_id" ref="image_template_redoctober_exec" />
         <field name="name">https</field>
         <field name="local_port">8080</field>
+        <field name="expose">local</field>
     </record>
 
     <record id="image_port_redoctober_metrics"
@@ -18,6 +19,7 @@
         <field name="template_id" ref="image_template_redoctober_exec" />
         <field name="name">metrics</field>
         <field name="local_port">8081</field>
+        <field name="expose">local</field>
     </record>
 
 </odoo>

From d07eabd984d61b8bb9e1c1bb5dd6641021ea3905 Mon Sep 17 00:00:00 2001
From: Dave Lasley <dave@laslabs.com>
Date: Wed, 18 Jan 2017 13:16:56 -0800
Subject: [PATCH 9/9] Switch expose to internet

---
 clouder_template_red_october/data/image_port.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/clouder_template_red_october/data/image_port.xml b/clouder_template_red_october/data/image_port.xml
index 3a92871..3cbec4e 100644
--- a/clouder_template_red_october/data/image_port.xml
+++ b/clouder_template_red_october/data/image_port.xml
@@ -10,7 +10,7 @@
         <field name="template_id" ref="image_template_redoctober_exec" />
         <field name="name">https</field>
         <field name="local_port">8080</field>
-        <field name="expose">local</field>
+        <field name="expose">internet</field>
     </record>
 
     <record id="image_port_redoctober_metrics"
@@ -19,7 +19,7 @@
         <field name="template_id" ref="image_template_redoctober_exec" />
         <field name="name">metrics</field>
         <field name="local_port">8081</field>
-        <field name="expose">local</field>
+        <field name="expose">internet</field>
     </record>
 
 </odoo>