passenger 5.1.12 → 5.2.0

data/src/agent/Core/ApplicationPool/Implementation.cpp

@@ -303,11 +303,13 @@ void processAndLogNewSpawnException(SpawnException &e, const Options &options,
 	stream << "  Message from application: " << appMessage << "\n";
 	P_ERROR(stream.str());
 
-	if (config->agentsOptions != NULL) {
+	ScopedLock l(config->agentConfigSyncher);
+	if (!config->agentConfig.isNull()) {
 		HookScriptOptions hOptions;
 		hOptions.name = "spawn_failed";
-		hOptions.spec = config->agentsOptions->get("hook_spawn_failed", false);
-		hOptions.agentsOptions = config->agentsOptions;
+		hOptions.spec = config->agentConfig.get("hook_spawn_failed", Json::Value()).asString();
+		hOptions.agentConfig = config->agentConfig;
+		l.unlock();
 		hOptions.environment.push_back(make_pair("PASSENGER_APP_ROOT", options.appRoot));
 		hOptions.environment.push_back(make_pair("PASSENGER_APP_GROUP_NAME", options.getAppGroupName()));
 		hOptions.environment.push_back(make_pair("PASSENGER_ERROR_MESSAGE", e.what()));

data/src/agent/Core/ApplicationPool/Options.h

@@ -35,6 +35,7 @@
 #include <Constants.h>
 #include <ResourceLocator.h>
 #include <StaticString.h>
+#include <FileTools/PathManip.h>
 #include <Utils.h>
 #include <Core/UnionStation/Context.h>
 #include <Core/UnionStation/Transaction.h>
@@ -190,14 +191,12 @@ public:
 	StaticString startCommand;
 
 	/** Filename of the application's startup file. Only actually used for
-	 * determining user switching info. Only used during spawning and only
-	 * if appType.empty(). */
+	 * determining user switching info. Only used during spawning. */
 	StaticString startupFile;
 
 	/** The process title to assign to the application process. Only used
 	 * during spawning. May be empty in which case no particular process
-	 * title is assigned. Only used during spawning and only if
-	 * appType.empty(). */
+	 * title is assigned. Only used during spawning. */
 	StaticString processTitle;
 
 	/**
@@ -472,7 +471,7 @@ public:
 	 */
 	Options()
 		: logLevel(DEFAULT_LOG_LEVEL),
-		  startTimeout(90 * 1000),
+		  startTimeout(DEFAULT_START_TIMEOUT),
 		  environment(DEFAULT_APP_ENV, sizeof(DEFAULT_APP_ENV) - 1),
 		  baseURI("/", 1),
 		  spawnMethod(DEFAULT_SPAWN_METHOD, sizeof(DEFAULT_SPAWN_METHOD) - 1),
@@ -494,7 +493,7 @@ public:
 		  maxProcesses(0),
 		  maxPreloaderIdleTime(-1),
 		  maxOutOfBandWorkInstances(1),
-		  maxRequestQueueSize(100),
+		  maxRequestQueueSize(DEFAULT_MAX_REQUEST_QUEUE_SIZE),
 		  abortWebsocketsOnProcessShutdown(true),
 
 		  stickySessionId(0),

data/src/agent/Core/ApplicationPool/Pool.h

@@ -49,6 +49,7 @@
 #include <sys/types.h>
 #include <MemoryKit/palloc.h>
 #include <LoggingKit/LoggingKit.h>
+#include <ConfigKit/ConfigKit.h>
 #include <Exceptions.h>
 #include <Hooks.h>
 #include <Utils/Lock.h>
@@ -126,6 +127,11 @@ public:
 			  verbose(options.getBool("verbose", false, false))
 			{ }
 
+		InspectOptions(const Json::Value &options)
+			: colorize(options.get("colorize", false).asBool()),
+			  verbose(options.get("verbose", false).asBool())
+			{ }
+
 		static InspectOptions makeAuthorized() {
 			InspectOptions options;
 			options.apiKey = ApiKey::makeSuper();
@@ -151,6 +157,48 @@ public:
 		}
 	};
 
+	struct ToJsonOptions: public AuthenticationOptions {
+		bool hasApplicationIdsFilter;
+		StringKeyTable<bool> applicationIdsFilter;
+
+		ToJsonOptions()
+			: hasApplicationIdsFilter(false),
+			  applicationIdsFilter(0, 0)
+			{ }
+
+		void set(const Json::Value &_options) {
+			ConfigKit::Schema schema = createSchema();
+			ConfigKit::Store options(schema, _options);
+
+			if (!options["application_ids"].isNull()) {
+				hasApplicationIdsFilter = true;
+				applicationIdsFilter = StringKeyTable<bool>();
+
+				const Json::Value subdoc = options["application_ids"];
+				Json::Value::const_iterator it, end = subdoc.end();
+				for (it = subdoc.begin(); it != end; it++) {
+					applicationIdsFilter.insert(it->asString(), true);
+				}
+			}
+		}
+
+		static ConfigKit::Schema createSchema() {
+			using namespace ConfigKit;
+			ConfigKit::Schema schema;
+
+			schema.add("application_ids", STRING_ARRAY_TYPE, OPTIONAL);
+
+			schema.finalize();
+			return schema;
+		}
+
+		static ToJsonOptions makeAuthorized() {
+			ToJsonOptions options;
+			options.apiKey = ApiKey::makeSuper();
+			return options;
+		}
+	};
+
 
 // Actually private, but marked public so that unit tests can access the fields.
 public:
@@ -225,7 +273,7 @@ public:
 	 */
 	vector<GetWaiter> getWaitlist;
 
-	const VariantMap *agentsOptions;
+	Json::Value agentConfig;
 
 // Actually private, but marked public so that unit tests can access the fields.
 public:
@@ -381,6 +429,12 @@ public:
 
 	/****** State inspection ******/
 
+	static Json::Value makeSingleValueJsonConfigFormat(const Json::Value &v,
+		const Json::Value &defaultValue = Json::Value());
+	static Json::Value makeSingleStrValueJsonConfigFormat(const StaticString &val);
+	static Json::Value makeSingleStrValueJsonConfigFormat(const StaticString &val,
+		const StaticString &defaultValue);
+	static Json::Value makeSingleNonEmptyStrValueJsonConfigFormat(const StaticString &val);
 	unsigned int capacityUsedUnlocked() const;
 	bool atFullCapacityUnlocked() const;
 	void inspectProcessList(const InspectOptions &options, stringstream &result,
@@ -394,7 +448,7 @@ public:
 	/****** Initialization and shutdown ******/
 
 	Pool(const SpawningKit::FactoryPtr &spawningKitFactory,
-		const VariantMap *agentsOptions = NULL);
+		const Json::Value &agentConfig = Json::Value());
 	~Pool();
 	void initialize();
 	void initDebugging();
@@ -445,6 +499,8 @@ public:
 		bool lock = true) const;
 	string toXml(const ToXmlOptions &options = ToXmlOptions::makeAuthorized(),
 		bool lock = true) const;
+	Json::Value inspectPropertiesInAdminPanelFormat(const ToJsonOptions &options = ToJsonOptions::makeAuthorized()) const;
+	Json::Value inspectConfigInAdminPanelFormat(const ToJsonOptions &options = ToJsonOptions::makeAuthorized()) const;
 
 
 	/****** Miscellaneous ******/
@@ -454,6 +510,7 @@ public:
 	void setMax(unsigned int max);
 	void setMaxIdleTime(unsigned long long value);
 	void enableSelfChecking(bool enabled);
+	void setAgentConfig(const Json::Value &agentConfig);
 	bool isSpawning(bool lock = true) const;
 	bool authorizeByApiKey(const ApiKey &key, bool lock = true) const;
 	bool authorizeByUid(uid_t uid, bool lock = true) const;

data/src/agent/Core/ApplicationPool/Pool/GeneralUtils.cpp

@@ -80,12 +80,12 @@ bool
 Pool::runHookScripts(const char *name,
 	const boost::function<void (HookScriptOptions &)> &setup) const
 {
-	if (agentsOptions != NULL) {
+	if (!agentConfig.isNull()) {
 		string hookName = string("hook_") + name;
-		string spec = agentsOptions->get(hookName, false);
+		string spec = agentConfig.get(hookName, Json::Value()).asString();
 		if (!spec.empty()) {
 			HookScriptOptions options;
-			options.agentsOptions = agentsOptions;
+			options.agentConfig = agentConfig;
 			options.name = name;
 			options.spec = spec;
 			setup(options);

data/src/agent/Core/ApplicationPool/Pool/InitializationAndShutdown.cpp

@@ -39,13 +39,13 @@ using namespace boost;
 
 
 Pool::Pool(const SpawningKit::FactoryPtr &spawningKitFactory,
-	const VariantMap *agentsOptions)
+	const Json::Value &agentConfig)
 	: abortLongRunningConnectionsCallback(NULL)
 {
 	context.setSpawningKitFactory(spawningKitFactory);
 	context.finalize();
 
-	this->agentsOptions = agentsOptions;
+	this->agentConfig = agentConfig;
 
 	try {
 		systemMetricsCollector.collect(systemMetrics);

data/src/agent/Core/ApplicationPool/Pool/Miscellaneous.cpp

@@ -250,6 +250,12 @@ Pool::isSpawning(bool lock) const {
 	return false;
 }
 
+void
+Pool::setAgentConfig(const Json::Value &agentConfig) {
+	LockGuard l(syncher);
+	this->agentConfig = agentConfig;
+}
+
 bool
 Pool::authorizeByApiKey(const ApiKey &key, bool lock) const {
 	return key.isSuper() || findGroupByApiKey(key.toStaticString(), lock) != NULL;

data/src/agent/Core/ApplicationPool/Pool/StateInspection.cpp

@@ -258,6 +258,135 @@ Pool::toXml(const ToXmlOptions &options, bool lock) const {
 	return result.str();
 }
 
+Json::Value
+Pool::inspectPropertiesInAdminPanelFormat(const ToJsonOptions &options) const {
+	ScopedLock l(syncher);
+	Json::Value result(Json::objectValue);
+	GroupMap::ConstIterator g_it(groups);
+	ProcessList::const_iterator p_it;
+
+	if (!authorizeByUid(options.uid, false)
+	 && !authorizeByApiKey(options.apiKey, false))
+	{
+		throw SecurityException("Operation unauthorized");
+	}
+
+	while (*g_it != NULL) {
+		const GroupPtr &group = g_it.getValue();
+
+		if (options.hasApplicationIdsFilter) {
+			const bool *tmp;
+			if (!options.applicationIdsFilter.lookup(group->info.name, &tmp)) {
+				g_it.next();
+				continue;
+			}
+		}
+
+		if (!group->authorizeByUid(options.uid)
+		 && !group->authorizeByApiKey(options.apiKey))
+		{
+			g_it.next();
+			continue;
+		}
+
+		Json::Value groupDoc(Json::objectValue);
+		group->inspectPropertiesInAdminPanelFormat(groupDoc);
+		result[group->info.name] = groupDoc;
+
+		g_it.next();
+	}
+
+	return result;
+}
+
+Json::Value
+Pool::inspectConfigInAdminPanelFormat(const ToJsonOptions &options) const {
+	ScopedLock l(syncher);
+	Json::Value result(Json::objectValue);
+	GroupMap::ConstIterator g_it(groups);
+	ProcessList::const_iterator p_it;
+
+	if (!authorizeByUid(options.uid, false)
+	 && !authorizeByApiKey(options.apiKey, false))
+	{
+		throw SecurityException("Operation unauthorized");
+	}
+
+	while (*g_it != NULL) {
+		const GroupPtr &group = g_it.getValue();
+
+		if (options.hasApplicationIdsFilter) {
+			const bool *tmp;
+			if (!options.applicationIdsFilter.lookup(group->info.name, &tmp)) {
+				g_it.next();
+				continue;
+			}
+		}
+
+		if (!group->authorizeByUid(options.uid)
+		 && !group->authorizeByApiKey(options.apiKey))
+		{
+			g_it.next();
+			continue;
+		}
+
+		Json::Value groupDoc(Json::objectValue);
+		group->inspectConfigInAdminPanelFormat(groupDoc);
+		result[group->info.name] = groupDoc;
+
+		g_it.next();
+	}
+
+	return result;
+}
+
+
+Json::Value
+Pool::makeSingleValueJsonConfigFormat(const Json::Value &val, const Json::Value &defaultValue) {
+	Json::Value ary(Json::arrayValue);
+
+	if (val != defaultValue) {
+		Json::Value entry;
+
+		entry["value"] = val;
+		entry["source"]["type"] = "ephemeral";
+
+		ary.append(entry);
+	}
+
+	if (!defaultValue.isNull()) {
+		Json::Value entry;
+
+		entry["value"] = defaultValue;
+		entry["source"]["type"] = "default";
+
+		ary.append(entry);
+	}
+
+	return ary;
+}
+
+Json::Value
+Pool::makeSingleStrValueJsonConfigFormat(const StaticString &val) {
+	return makeSingleValueJsonConfigFormat(
+		Json::Value(val.data(), val.data() + val.size()));
+}
+
+Json::Value
+Pool::makeSingleStrValueJsonConfigFormat(const StaticString &val, const StaticString &defaultValue) {
+	return makeSingleValueJsonConfigFormat(
+		Json::Value(val.data(), val.data() + val.size()),
+		Json::Value(defaultValue.data(), defaultValue.data() + defaultValue.size()));
+}
+
+Json::Value
+Pool::makeSingleNonEmptyStrValueJsonConfigFormat(const StaticString &val) {
+	if (val.empty()) {
+		return Json::arrayValue;
+	} else {
+		return makeSingleStrValueJsonConfigFormat(val);
+	}
+}
 
 unsigned int
 Pool::capacityUsed() const {

data/src/agent/Core/Config.h

@@ -0,0 +1,475 @@
+/*
+ *  Phusion Passenger - https://www.phusionpassenger.com/
+ *  Copyright (c) 2011-2017 Phusion Holding B.V.
+ *
+ *  "Passenger", "Phusion Passenger" and "Union Station" are registered
+ *  trademarks of Phusion Holding B.V.
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ *  in the Software without restriction, including without limitation the rights
+ *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ *  copies of the Software, and to permit persons to whom the Software is
+ *  furnished to do so, subject to the following conditions:
+ *
+ *  The above copyright notice and this permission notice shall be included in
+ *  all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ *  THE SOFTWARE.
+ */
+
+#ifndef _PASSENGER_CORE_CONFIG_H_
+#define _PASSENGER_CORE_CONFIG_H_
+
+#include <string>
+#include <vector>
+
+#include <boost/bind.hpp>
+#include <boost/foreach.hpp>
+
+#include <LoggingKit/LoggingKit.h>
+#include <LoggingKit/Config.h>
+#include <LoggingKit/Context.h>
+#include <ConfigKit/Schema.h>
+#include <ConfigKit/TableTranslator.h>
+#include <ConfigKit/PrefixTranslator.h>
+#include <ServerKit/Context.h>
+#include <ServerKit/HttpServer.h>
+#include <Core/Controller/Config.h>
+#include <Core/SecurityUpdateChecker.h>
+#include <Core/ApiServer.h>
+#include <Core/AdminPanelConnector.h>
+#include <Shared/ApiAccountUtils.h>
+#include <Constants.h>
+#include <Utils.h>
+#include <Utils/IOUtils.h>
+
+namespace Passenger {
+namespace Core {
+
+using namespace std;
+
+
+/*
+ * BEGIN ConfigKit schema: Passenger::Core::Schema
+ * (do not edit: following text is automatically generated
+ * by 'rake configkit_schemas_inline_comments')
+ *
+ *   admin_panel_authentication                                      object             -          secret
+ *   admin_panel_close_timeout                                       float              -          default(10.0)
+ *   admin_panel_connect_timeout                                     float              -          default(30.0)
+ *   admin_panel_data_debug                                          boolean            -          default(false)
+ *   admin_panel_ping_interval                                       float              -          default(30.0)
+ *   admin_panel_ping_timeout                                        float              -          default(30.0)
+ *   admin_panel_proxy_password                                      string             -          secret
+ *   admin_panel_proxy_timeout                                       float              -          default(30.0)
+ *   admin_panel_proxy_url                                           string             -          -
+ *   admin_panel_proxy_username                                      string             -          -
+ *   admin_panel_reconnect_timeout                                   float              -          default(5.0)
+ *   admin_panel_url                                                 string             -          read_only
+ *   admin_panel_websocketpp_debug_access                            boolean            -          default(false)
+ *   admin_panel_websocketpp_debug_error                             boolean            -          default(false)
+ *   api_server_accept_burst_count                                   unsigned integer   -          default(32)
+ *   api_server_addresses                                            array of strings   -          default([]),read_only
+ *   api_server_authorizations                                       array              -          default("[FILTERED]"),secret
+ *   api_server_client_freelist_limit                                unsigned integer   -          default(0)
+ *   api_server_file_buffered_channel_auto_start_mover               boolean            -          default(true)
+ *   api_server_file_buffered_channel_auto_truncate_file             boolean            -          default(true)
+ *   api_server_file_buffered_channel_buffer_dir                     string             -          default
+ *   api_server_file_buffered_channel_delay_in_file_mode_switching   unsigned integer   -          default(0)
+ *   api_server_file_buffered_channel_max_disk_chunk_read_size       unsigned integer   -          default(0)
+ *   api_server_file_buffered_channel_threshold                      unsigned integer   -          default(131072)
+ *   api_server_mbuf_block_chunk_size                                unsigned integer   -          default(4096),read_only
+ *   api_server_min_spare_clients                                    unsigned integer   -          default(0)
+ *   api_server_request_freelist_limit                               unsigned integer   -          default(1024)
+ *   api_server_start_reading_after_accept                           boolean            -          default(true)
+ *   app_output_log_level                                            string             -          default("notice")
+ *   benchmark_mode                                                  string             -          -
+ *   config_manifest                                                 object             -          read_only
+ *   controller_accept_burst_count                                   unsigned integer   -          default(32)
+ *   controller_addresses                                            array of strings   -          default(["tcp://127.0.0.1:3000"]),read_only
+ *   controller_client_freelist_limit                                unsigned integer   -          default(0)
+ *   controller_cpu_affine                                           boolean            -          default(false),read_only
+ *   controller_file_buffered_channel_auto_start_mover               boolean            -          default(true)
+ *   controller_file_buffered_channel_auto_truncate_file             boolean            -          default(true)
+ *   controller_file_buffered_channel_buffer_dir                     string             -          default
+ *   controller_file_buffered_channel_delay_in_file_mode_switching   unsigned integer   -          default(0)
+ *   controller_file_buffered_channel_max_disk_chunk_read_size       unsigned integer   -          default(0)
+ *   controller_file_buffered_channel_threshold                      unsigned integer   -          default(131072)
+ *   controller_mbuf_block_chunk_size                                unsigned integer   -          default(4096),read_only
+ *   controller_min_spare_clients                                    unsigned integer   -          default(0)
+ *   controller_request_freelist_limit                               unsigned integer   -          default(1024)
+ *   controller_secure_headers_password                              any                -          secret
+ *   controller_socket_backlog                                       unsigned integer   -          default(2048),read_only
+ *   controller_start_reading_after_accept                           boolean            -          default(true)
+ *   controller_threads                                              unsigned integer   -          default,read_only
+ *   default_abort_websockets_on_process_shutdown                    boolean            -          default(true)
+ *   default_app_file_descriptor_ulimit                              unsigned integer   -          -
+ *   default_environment                                             string             -          default("production")
+ *   default_force_max_concurrent_requests_per_process               integer            -          default(-1)
+ *   default_friendly_error_pages                                    string             -          default("auto")
+ *   default_group                                                   string             -          default
+ *   default_load_shell_envvars                                      boolean            -          default(false)
+ *   default_max_preloader_idle_time                                 unsigned integer   -          default(300)
+ *   default_max_request_queue_size                                  unsigned integer   -          default(100)
+ *   default_max_requests                                            unsigned integer   -          default(0)
+ *   default_meteor_app_settings                                     string             -          -
+ *   default_min_instances                                           unsigned integer   -          default(1)
+ *   default_nodejs                                                  string             -          default("node")
+ *   default_python                                                  string             -          default("python")
+ *   default_ruby                                                    string             -          default("ruby")
+ *   default_server_name                                             string             -          default
+ *   default_server_port                                             unsigned integer   -          default
+ *   default_spawn_method                                            string             -          default("smart")
+ *   default_sticky_sessions                                         boolean            -          default(false)
+ *   default_sticky_sessions_cookie_name                             string             -          default("_passenger_route")
+ *   default_user                                                    string             -          default("nobody")
+ *   file_descriptor_log_target                                      any                -          -
+ *   file_descriptor_ulimit                                          unsigned integer   -          default(0),read_only
+ *   graceful_exit                                                   boolean            -          default(true)
+ *   instance_dir                                                    string             -          read_only
+ *   integration_mode                                                string             -          default("standalone")
+ *   log_level                                                       string             -          default("notice")
+ *   log_target                                                      any                -          default({"stderr": true})
+ *   max_pool_size                                                   unsigned integer   -          default(6)
+ *   multi_app                                                       boolean            -          default(false),read_only
+ *   passenger_root                                                  string             required   read_only
+ *   pid_file                                                        string             -          read_only
+ *   pool_idle_time                                                  unsigned integer   -          default(300)
+ *   pool_selfchecks                                                 boolean            -          default(false)
+ *   prestart_urls                                                   array of strings   -          default([]),read_only
+ *   response_buffer_high_watermark                                  unsigned integer   -          default(134217728)
+ *   security_update_checker_certificate_path                        string             -          -
+ *   security_update_checker_disabled                                boolean            -          default(false)
+ *   security_update_checker_interval                                unsigned integer   -          default(86400)
+ *   security_update_checker_proxy_url                               string             -          -
+ *   security_update_checker_url                                     string             -          default("https://securitycheck.phusionpassenger.com/v1/check.json")
+ *   server_software                                                 string             -          default("Phusion_Passenger/5.2.0")
+ *   show_version_in_header                                          boolean            -          default(true)
+ *   single_app_mode_app_root                                        string             -          default,read_only
+ *   single_app_mode_app_type                                        string             -          read_only
+ *   single_app_mode_startup_file                                    string             -          read_only
+ *   standalone_engine                                               string             -          default
+ *   stat_throttle_rate                                              unsigned integer   -          default(10)
+ *   turbocaching                                                    boolean            -          default(true),read_only
+ *   user_switching                                                  boolean            -          default(true)
+ *   ust_router_address                                              string             -          -
+ *   ust_router_password                                             string             -          secret
+ *   vary_turbocache_by_cookie                                       string             -          -
+ *   watchdog_fd_passing_password                                    string             -          secret
+ *   web_server_module_version                                       string             -          read_only
+ *   web_server_version                                              string             -          read_only
+ *
+ * END
+ */
+class Schema: public ConfigKit::Schema {
+private:
+	// Prefix config options that come from the given schema
+	template<typename SchemaType>
+	static void addSubSchemaPrefixTranslations(ConfigKit::TableTranslator &translator,
+		const StaticString &prefix)
+	{
+		vector<string> keys = SchemaType().inspect().getMemberNames();
+		vector<string>::const_iterator it, end = keys.end();
+		for (it = keys.begin(); it != end; it++) {
+			translator.add(prefix + *it, *it);
+		}
+	}
+
+	static Json::Value getDefaultServerName(const ConfigKit::Store &store) {
+		Json::Value addresses = store["controller_addresses"];
+		if (addresses.size() > 0) {
+			string firstAddress = addresses[0].asString();
+			if (getSocketAddressType(firstAddress) == SAT_TCP) {
+				string host;
+				unsigned short port;
+
+				parseTcpSocketAddress(firstAddress, host, port);
+				return host;
+			}
+		}
+		return "localhost";
+	}
+
+	static Json::Value getDefaultServerPort(const ConfigKit::Store &store) {
+		Json::Value addresses = store["controller_addresses"];
+		if (addresses.size() > 0) {
+			string firstAddress = addresses[0].asString();
+			if (getSocketAddressType(firstAddress) == SAT_TCP) {
+				string host;
+				unsigned short port;
+
+				parseTcpSocketAddress(firstAddress, host, port);
+				return port;
+			}
+		}
+		return 80;
+	}
+
+	static Json::Value getDefaultThreads(const ConfigKit::Store &store) {
+		return Json::UInt(boost::thread::hardware_concurrency());
+	}
+
+	static Json::Value getDefaultControllerAddresses() {
+		Json::Value doc;
+		doc.append(DEFAULT_HTTP_SERVER_LISTEN_ADDRESS);
+		return doc;
+	}
+
+	static void validateMultiAppMode(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
+		typedef ConfigKit::Error Error;
+
+		if (!config["multi_app"].asBool()) {
+			return;
+		}
+
+		if (!config["single_app_mode_app_type"].isNull()) {
+			errors.push_back(Error("If '{{multi_app_mode}}' is set,"
+				" then '{{single_app_mode_app_type}}' may not be set"));
+		}
+		if (!config["single_app_mode_startup_file"].isNull()) {
+			errors.push_back(Error("If '{{multi_app_mode}}' is set,"
+				" then '{{single_app_mode_startup_file}}' may not be set"));
+		}
+	}
+
+	static void validateSingleAppMode(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
+		typedef ConfigKit::Error Error;
+
+		if (config["multi_app"].asBool()) {
+			return;
+		}
+
+		// single_app_mode_app_type and single_app_mode_startup_file are
+		// autodetected in initializeSingleAppMode()
+
+		ControllerSingleAppModeSchema::validateAppType("single_app_mode_app_type", config, errors);
+	}
+
+	static void validateControllerSecureHeadersPassword(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
+		typedef ConfigKit::Error Error;
+
+		Json::Value password = config["controller_secure_headers_password"];
+		if (password.isNull()) {
+			return;
+		}
+
+		if (!password.isString() && !password.isObject()) {
+			errors.push_back(Error("'{{controller_secure_headers_password}}' must be a string or an object"));
+			return;
+		}
+
+		if (password.isObject()) {
+			if (!password.isMember("path")) {
+				errors.push_back(Error("If '{{controller_secure_headers_password}}' is an object, then it must contain a 'path' option"));
+			} else if (!password["path"].isString()) {
+				errors.push_back(Error("If '{{controller_secure_headers_password}}' is an object, then its 'path' option must be a string"));
+			}
+		}
+	}
+
+	static void validateApplicationPool(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
+		typedef ConfigKit::Error Error;
+
+		if (config["max_pool_size"].asUInt() < 1) {
+			errors.push_back(Error("'{{max_pool_size}}' must be at least 1"));
+		}
+		if (config["pool_idle_time"].asUInt() < 1) {
+			errors.push_back(Error("'{{pool_idle_time}}' must be at least 1"));
+		}
+	}
+
+	static void validateController(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
+		typedef ConfigKit::Error Error;
+
+		if (config["controller_threads"].asUInt() < 1) {
+			errors.push_back(Error("'{{controller_threads}}' must be at least 1"));
+		}
+	}
+
+	static void validateAddresses(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
+		typedef ConfigKit::Error Error;
+
+		if (config["controller_addresses"].empty()) {
+			errors.push_back(Error("'{{controller_addresses}}' must contain at least 1 item"));
+		} else if (config["controller_addresses"].size() > SERVER_KIT_MAX_SERVER_ENDPOINTS) {
+			errors.push_back(Error("'{{controller_addresses}}' may contain at most "
+				+ toString(SERVER_KIT_MAX_SERVER_ENDPOINTS) + " items"));
+		}
+
+		if (config["api_server_addresses"].size() > SERVER_KIT_MAX_SERVER_ENDPOINTS) {
+			errors.push_back(Error("'{{api_server_addresses}}' may contain at most "
+				+ toString(SERVER_KIT_MAX_SERVER_ENDPOINTS) + " items"));
+		}
+	}
+
+	/*****************/
+	/*****************/
+
+	static Json::Value normalizeSingleAppMode(const Json::Value &effectiveValues) {
+		if (effectiveValues["multi_app"].asBool()) {
+			return Json::Value();
+		}
+
+		Json::Value updates;
+		updates["single_app_mode_app_root"] = absolutizePath(
+			effectiveValues["single_app_mode_app_root"].asString());
+		if (!effectiveValues["single_app_mode_startup_file"].isNull()) {
+			updates["single_app_mode_startup_file"] = absolutizePath(
+				effectiveValues["single_app_mode_startup_file"].asString());
+		}
+		return updates;
+	}
+
+	static Json::Value normalizeServerSoftware(const Json::Value &effectiveValues) {
+		string serverSoftware = effectiveValues["server_software"].asString();
+		if (serverSoftware.find(SERVER_TOKEN_NAME) == string::npos
+		 && serverSoftware.find(FLYING_PASSENGER_NAME) == string::npos)
+		{
+			serverSoftware.append(" " SERVER_TOKEN_NAME "/" PASSENGER_VERSION);
+		}
+
+		Json::Value updates;
+		updates["server_software"] = serverSoftware;
+		return updates;
+	}
+
+public:
+	struct {
+		LoggingKit::Schema schema;
+		ConfigKit::TableTranslator translator;
+	} loggingKit;
+	struct {
+		ControllerSchema schema;
+		ConfigKit::TableTranslator translator;
+	} controller;
+	struct {
+		ControllerSingleAppModeSchema schema;
+		ConfigKit::PrefixTranslator translator;
+	} controllerSingleAppMode;
+	struct {
+		ServerKit::Schema schema;
+		ConfigKit::PrefixTranslator translator;
+	} controllerServerKit;
+	struct {
+		SecurityUpdateChecker::Schema schema;
+		ConfigKit::PrefixTranslator translator;
+	} securityUpdateChecker;
+	struct {
+		ApiServer::Schema schema;
+		ConfigKit::TableTranslator translator;
+	} apiServer;
+	struct {
+		ServerKit::Schema schema;
+		ConfigKit::PrefixTranslator translator;
+	} apiServerKit;
+	struct {
+		AdminPanelConnector::Schema schema;
+		ConfigKit::TableTranslator translator;
+	} adminPanelConnector;
+
+	Schema() {
+		using namespace ConfigKit;
+
+		// Add subschema: loggingKit
+		loggingKit.translator.add("log_level", "level");
+		loggingKit.translator.add("log_target", "target");
+		loggingKit.translator.finalize();
+		addSubSchema(loggingKit.schema, loggingKit.translator);
+		erase("redirect_stderr");
+
+		// Add subschema: controller
+		addSubSchemaPrefixTranslations<ServerKit::HttpServerSchema>(
+			controller.translator, "controller_");
+		controller.translator.finalize();
+		addSubSchema(controller.schema, controller.translator);
+		erase("thread_number");
+
+		// Add subschema: controller (single app mode)
+		controllerSingleAppMode.translator.setPrefixAndFinalize("single_app_mode_");
+		addWithDynamicDefault("single_app_mode_app_root",
+			STRING_TYPE, OPTIONAL | READ_ONLY | CACHE_DEFAULT_VALUE,
+			ControllerSingleAppModeSchema::getDefaultAppRoot);
+		add("single_app_mode_app_type", STRING_TYPE, OPTIONAL | READ_ONLY);
+		add("single_app_mode_startup_file", STRING_TYPE, OPTIONAL | READ_ONLY);
+
+		// Add subschema: controllerServerKit
+		controllerServerKit.translator.setPrefixAndFinalize("controller_");
+		addSubSchema(controllerServerKit.schema, controllerServerKit.translator);
+		erase("controller_secure_mode_password");
+
+		// Add subschema: securityUpdateChecker
+		securityUpdateChecker.translator.setPrefixAndFinalize("security_update_checker_");
+		addSubSchema(securityUpdateChecker.schema, securityUpdateChecker.translator);
+		erase("security_update_checker_server_identifier");
+		erase("security_update_checker_web_server_version");
+
+		// Add subschema: apiServer
+		apiServer.translator.add("api_server_authorizations", "authorizations");
+		addSubSchemaPrefixTranslations<ServerKit::HttpServerSchema>(
+			apiServer.translator, "api_server_");
+		apiServer.translator.finalize();
+		addSubSchema(apiServer.schema, apiServer.translator);
+
+		// Add subschema: apiServerKit
+		apiServerKit.translator.setPrefixAndFinalize("api_server_");
+		addSubSchema(apiServerKit.schema, apiServerKit.translator);
+		erase("api_server_secure_mode_password");
+
+		// Add subschema: adminPanelConnector
+		addSubSchemaPrefixTranslations<WebSocketCommandReverseServer::Schema>(
+			adminPanelConnector.translator, "admin_panel_");
+		adminPanelConnector.translator.finalize();
+		addSubSchema(adminPanelConnector.schema, adminPanelConnector.translator);
+		erase("admin_panel_log_prefix");
+		erase("ruby");
+
+		override("admin_panel_url", STRING_TYPE, OPTIONAL | READ_ONLY);
+		override("instance_dir", STRING_TYPE, OPTIONAL | READ_ONLY);
+		override("multi_app", BOOL_TYPE, OPTIONAL | READ_ONLY, false);
+		overrideWithDynamicDefault("default_server_name", STRING_TYPE, OPTIONAL, getDefaultServerName);
+		overrideWithDynamicDefault("default_server_port", UINT_TYPE, OPTIONAL, getDefaultServerPort);
+
+		add("passenger_root", STRING_TYPE, REQUIRED | READ_ONLY);
+		add("config_manifest", OBJECT_TYPE, OPTIONAL | READ_ONLY);
+		add("pid_file", STRING_TYPE, OPTIONAL | READ_ONLY);
+		add("web_server_version", STRING_TYPE, OPTIONAL | READ_ONLY);
+		addWithDynamicDefault("controller_threads", UINT_TYPE, OPTIONAL | READ_ONLY, getDefaultThreads);
+		add("max_pool_size", UINT_TYPE, OPTIONAL, DEFAULT_MAX_POOL_SIZE);
+		add("pool_idle_time", UINT_TYPE, OPTIONAL, Json::UInt(DEFAULT_POOL_IDLE_TIME));
+		add("pool_selfchecks", BOOL_TYPE, OPTIONAL, false);
+		add("prestart_urls", STRING_ARRAY_TYPE, OPTIONAL | READ_ONLY, Json::arrayValue);
+		add("controller_secure_headers_password", ANY_TYPE, OPTIONAL | SECRET);
+		add("controller_socket_backlog", UINT_TYPE, OPTIONAL | READ_ONLY, DEFAULT_SOCKET_BACKLOG);
+		add("controller_addresses", STRING_ARRAY_TYPE, OPTIONAL | READ_ONLY, getDefaultControllerAddresses());
+		add("api_server_addresses", STRING_ARRAY_TYPE, OPTIONAL | READ_ONLY, Json::arrayValue);
+		add("controller_cpu_affine", BOOL_TYPE, OPTIONAL | READ_ONLY, false);
+		add("file_descriptor_ulimit", UINT_TYPE, OPTIONAL | READ_ONLY, 0);
+
+		addValidator(validateMultiAppMode);
+		addValidator(validateSingleAppMode);
+		addValidator(validateControllerSecureHeadersPassword);
+		addValidator(validateApplicationPool);
+		addValidator(validateController);
+		addValidator(validateAddresses);
+		addNormalizer(normalizeSingleAppMode);
+		addNormalizer(normalizeServerSoftware);
+
+		/*******************/
+		/*******************/
+
+		finalize();
+	}
+};
+
+
+} // namespace Core
+} // namespace Passenger
+
+#endif /* _PASSENGER_CORE_CONFIG_H_ */