passenger 5.1.12 → 5.2.0

data/src/agent/Core/OptionParser.h

@@ -29,12 +29,15 @@
 #include <boost/thread.hpp>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <Constants.h>
+#include <JsonTools/Autocast.h>
 #include <Utils.h>
-#include <Utils/VariantMap.h>
 #include <Utils/OptionParsing.h>
 #include <Utils/StrIntUtils.h>
 
+#include <jsoncpp/json.h>
+
 namespace Passenger {
 
 using namespace std;
@@ -197,6 +200,10 @@ coreUsage() {
 	printf("      --cpu-affine          Enable per-thread CPU affinity (Linux only)\n");
 	printf("      --core-file-descriptor-ulimit NUMBER\n");
 	printf("                            Set custom file descriptor ulimit for the core\n");
+	printf("      --admin-panel-url URL\n");
+	printf("                            Connect to an admin panel through this service\n");
+	printf("                            connector URL\n");
+	printf("      --ctl NAME=VALUE      Set low-level config option directly\n");
 	printf("  -h, --help                Show this help\n");
 	printf("\n");
 	printf("API account privilege levels (ordered from most to least privileges):\n");
@@ -205,22 +212,21 @@ coreUsage() {
 }
 
 inline bool
-parseCoreOption(int argc, const char *argv[], int &i, VariantMap &options) {
+parseCoreOption(int argc, const char *argv[], int &i, Json::Value &updates) {
 	OptionParser p(coreUsage);
 
 	if (p.isValueFlag(argc, i, argv[i], '\0', "--passenger-root")) {
-		options.set("passenger_root", argv[i + 1]);
+		updates["passenger_root"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], 'l', "--listen")) {
 		if (getSocketAddressType(argv[i + 1]) != SAT_UNKNOWN) {
-			vector<string> addresses = options.getStrSet("core_addresses", false);
+			Json::Value &addresses = updates["controller_addresses"];
 			if (addresses.size() == SERVER_KIT_MAX_SERVER_ENDPOINTS) {
 				fprintf(stderr, "ERROR: you may specify up to %u --listen addresses.\n",
 					SERVER_KIT_MAX_SERVER_ENDPOINTS);
 				exit(1);
 			}
-			addresses.push_back(argv[i + 1]);
-			options.setStrSet("core_addresses", addresses);
+			addresses.append(argv[i + 1]);
 			i += 2;
 		} else {
 			fprintf(stderr, "ERROR: invalid address format for --listen. The address "
@@ -230,15 +236,13 @@ parseCoreOption(int argc, const char *argv[], int &i, VariantMap &options) {
 		}
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--api-listen")) {
 		if (getSocketAddressType(argv[i + 1]) != SAT_UNKNOWN) {
-			vector<string> addresses = options.getStrSet("core_api_addresses",
-				false);
+			Json::Value &addresses = updates["api_server_addresses"];
 			if (addresses.size() == SERVER_KIT_MAX_SERVER_ENDPOINTS) {
 				fprintf(stderr, "ERROR: you may specify up to %u --api-listen addresses.\n",
 					SERVER_KIT_MAX_SERVER_ENDPOINTS);
 				exit(1);
 			}
-			addresses.push_back(argv[i + 1]);
-			options.setStrSet("core_api_addresses", addresses);
+			addresses.append(argv[i + 1]);
 			i += 2;
 		} else {
 			fprintf(stderr, "ERROR: invalid address format for --api-listen. The address "
@@ -247,13 +251,10 @@ parseCoreOption(int argc, const char *argv[], int &i, VariantMap &options) {
 			exit(1);
 		}
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--pid-file")) {
-		options.set("core_pid_file", argv[i + 1]);
+		updates["pid_file"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--authorize")) {
 		vector<string> args;
-		vector<string> authorizations = options.getStrSet("core_authorizations",
-				false);
-
 		split(argv[i + 1], ':', args);
 		if (args.size() < 2 || args.size() > 3) {
 			fprintf(stderr, "ERROR: invalid format for --authorize. The syntax "
@@ -261,168 +262,153 @@ parseCoreOption(int argc, const char *argv[], int &i, VariantMap &options) {
 			exit(1);
 		}
 
-		authorizations.push_back(argv[i + 1]);
-		options.setStrSet("core_authorizations", authorizations);
+		updates["api_server_authorizations"].append(argv[i + 1]);
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--socket-backlog")) {
-		options.setInt("socket_backlog", atoi(argv[i + 1]));
+		updates["controller_socket_backlog"] = argv[i + 1];
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--no-user-switching")) {
-		options.setBool("user_switching", false);
+		updates["user_switching"] = false;
 		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--default-user")) {
-		options.set("default_user", argv[i + 1]);
+		updates["default_user"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--default-group")) {
-		options.set("default_group", argv[i + 1]);
+		updates["default_group"] = argv[i + 1];
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--disable-security-update-check")) {
-		options.setBool("disable_security_update_check", true);
-		i += 2;
+		updates["security_update_checker_disabled"] = true;
+		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--security-update-check-proxy")) {
-		options.set("security_update_check_proxy", argv[i + 1]);
+		updates["security_update_checker_proxy_url"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--max-pool-size")) {
-		options.setInt("max_pool_size", atoi(argv[i + 1]));
+		updates["max_pool_size"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--pool-idle-time")) {
-		options.setInt("pool_idle_time", atoi(argv[i + 1]));
+		updates["pool_idle_time"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--max-preloader-idle-time")) {
-		options.setInt("max_preloader_idle_time", atoi(argv[i + 1]));
+		updates["default_max_preloader_idle_time"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--force-max-concurrent-requests-per-process")) {
-		options.setInt("force_max_concurrent_requests_per_process", atoi(argv[i + 1]));
+		updates["default_force_max_concurrent_requests_per_process"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--min-instances")) {
-		options.setInt("min_instances", atoi(argv[i + 1]));
-		i += 2;
-	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--memory-limit")) {
-		options.setInt("memory_limit", atoi(argv[i + 1]));
+		updates["default_min_instances"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], 'e', "--environment")) {
-		options.set("environment", argv[i + 1]);
+		updates["default_environment"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--app-type")) {
-		options.set("app_type", argv[i + 1]);
+		updates["single_app_mode_app_type"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--startup-file")) {
-		options.set("startup_file", argv[i + 1]);
+		updates["single_app_mode_startup_file"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--spawn-method")) {
-		options.set("spawn_method", argv[i + 1]);
+		updates["default_spawn_method"] = argv[i + 1];
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--load-shell-envvars")) {
-		options.setBool("load_shell_envvars", true);
+		updates["default_load_shell_envvars"] = true;
 		i++;
-	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--concurrency-model")) {
-		options.set("concurrency_model", argv[i + 1]);
-		i += 2;
-	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--app-thread-count")) {
-		options.setInt("app_thread_count", atoi(argv[i + 1]));
-		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--multi-app")) {
-		options.setBool("multi_app", true);
+		updates["multi_app"] = true;
 		i++;
 	} else if (p.isFlag(argv[i], '\0', "--force-friendly-error-pages")) {
-		options.setBool("friendly_error_pages", true);
+		updates["default_friendly_error_pages"] = true;
 		i++;
 	} else if (p.isFlag(argv[i], '\0', "--disable-friendly-error-pages")) {
-		options.setBool("friendly_error_pages", false);
+		updates["default_friendly_error_pages"] = false;
 		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--max-requests")) {
-		options.setInt("max_requests", atoi(argv[i + 1]));
-		i += 2;
-	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--max-request-time")) {
-		options.setInt("max_request_time", atoi(argv[i + 1]));
+		updates["default_max_requests"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--max-request-queue-size")) {
-		options.setInt("max_request_queue_size", atoi(argv[i + 1]));
+		updates["default_max_request_queue_size"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--sticky-sessions")) {
-		options.setBool("sticky_sessions", true);
+		updates["default_sticky_sessions"] = true;
 		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--sticky-sessions-cookie-name")) {
-		options.set("sticky_sessions_cookie_name", argv[i + 1]);
+		updates["default_sticky_sessions_cookie_name"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--vary-turbocache-by-cookie")) {
-		options.set("vary_turbocache_by_cookie", argv[i + 1]);
+		updates["vary_turbocache_by_cookie"] = argv[i + 1];
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--disable-turbocaching")) {
-		options.setBool("turbocaching", false);
+		updates["turbocaching"] = false;
 		i++;
 	} else if (p.isFlag(argv[i], '\0', "--no-abort-websockets-on-process-shutdown")) {
-		options.setBool("abort_websockets_on_process_shutdown", false);
+		updates["default_abort_websockets_on_process_shutdown"] = false;
 		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--ruby")) {
-		options.set("default_ruby", argv[i + 1]);
+		updates["default_ruby"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--nodejs")) {
-		options.set("default_nodejs", argv[i + 1]);
+		updates["default_nodejs"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--python")) {
-		options.set("default_python", argv[i + 1]);
+		updates["default_python"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--meteor-app-settings")) {
-		options.set("meteor_app_settings", argv[i + 1]);
+		updates["default_meteor_app_settings"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--app-file-descriptor-ulimit")) {
-		options.setUint("app_file_descriptor_ulimit", atoi(argv[i + 1]));
+		updates["default_app_file_descriptor_ulimit"] = atoi(argv[i + 1]);
 		i += 2;
-	} else if (p.isFlag(argv[i], '\0', "--debugger")) {
-		options.setBool("debugger", true);
-		i++;
-	} else if (p.isFlag(argv[i], '\0', "--rolling-restarts")) {
-		options.setBool("rolling_restarts", true);
-		i++;
-	} else if (p.isFlag(argv[i], '\0', "--resist-deployment-errors")) {
-		options.setBool("resist_deployment_errors", true);
-		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--log-level")) {
-		// We do not set log_level because, when this function is called from
-		// the Watchdog, we don't want to affect the Watchdog's own log level.
-		options.setInt("core_log_level", atoi(argv[i + 1]));
+		updates["log_level"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--log-file")) {
-		// We do not set log_file because, when this function is called from
-		// the Watchdog, we don't want to affect the Watchdog's own log file.
-		options.set("core_log_file", argv[i + 1]);
+		updates["log_target"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--fd-log-file")) {
-		// We do not set file_descriptor_log_file because, when this function is called from
-		// the Watchdog, we don't want to affect the Watchdog's own log file.
-		options.set("core_file_descriptor_log_file", argv[i + 1]);
+		updates["file_descriptor_log_target"] = argv[i + 1];
 		i += 2;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--stat-throttle-rate")) {
-		options.setInt("stat_throttle_rate", atoi(argv[i + 1]));
+		updates["stat_throttle_rate"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--no-show-version-in-header")) {
-		options.setBool("show_version_in_header", false);
+		updates["show_version_in_header"] = false;
 		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--data-buffer-dir")) {
-		options.setInt("data_buffer_dir", atoi(argv[i + 1]));
+		updates["controller_file_buffered_channel_buffer_dir"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--no-graceful-exit")) {
-		options.setBool("core_graceful_exit", false);
+		updates["graceful_exit"] = false;
 		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--benchmark")) {
-		options.set("benchmark_mode", argv[i + 1]);
+		updates["benchmark_mode"] = argv[i + 1];
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--disable-selfchecks")) {
-		options.setBool("selfchecks", false);
+		updates["pool_selfchecks"] = false;
 		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--threads")) {
-		options.setInt("core_threads", atoi(argv[i + 1]));
+		updates["controller_threads"] = atoi(argv[i + 1]);
 		i += 2;
 	} else if (p.isFlag(argv[i], '\0', "--cpu-affine")) {
-		options.setBool("core_cpu_affine", true);
+		updates["controller_cpu_affine"] = true;
 		i++;
 	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--core-file-descriptor-ulimit")) {
-		options.setUint("core_file_descriptor_ulimit", atoi(argv[i + 1]));
+		updates["file_descriptor_ulimit"] = atoi(argv[i + 1]);
+		i += 2;
+	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--admin-panel-url")) {
+		updates["admin_panel_url"] = argv[i + 1];
+		i += 2;
+	} else if (p.isValueFlag(argc, i, argv[i], '\0', "--ctl")) {
+		const char *sep = strchr(argv[i + 1], '=');
+		if (sep == NULL) {
+			fprintf(stderr, "ERROR: invalid --ctl format: %s\n", argv[i + 1]);
+			exit(1);
+		}
+		string name(argv[i + 1], sep - argv[i + 1]);
+		string value(sep + 1);
+		updates[name] = autocastValueToJson(value);
 		i += 2;
 	} else if (!startsWith(argv[i], "-")) {
-		if (!options.has("app_root")) {
-			options.set("app_root", argv[i]);
+		if (!updates.isMember("single_app_mode_app_root")) {
+			updates["single_app_mode_app_root"] = argv[i];
 			i++;
 		} else {
 			fprintf(stderr, "ERROR: you may not pass multiple application directories. "

data/src/agent/Core/SecurityUpdateChecker.h

@@ -27,10 +27,17 @@
 #define _PASSENGER_SECURITY_UPDATE_CHECKER_H_
 
 #include <string>
+#include <cassert>
+#include <boost/config.hpp>
+#include <boost/scoped_ptr.hpp>
 #include <oxt/thread.hpp>
 #include <oxt/backtrace.hpp>
 
 #include <Crypto.h>
+#include <ResourceLocator.h>
+#include <Exceptions.h>
+#include <StaticString.h>
+#include <ConfigKit/ConfigKit.h>
 #include <Utils/Curl.h>
 #include <modp_b64.h>
 
@@ -45,9 +52,6 @@ using namespace std;
 using namespace oxt;
 
 
-#define CHECK_HOST_DEFAULT "securitycheck.phusionpassenger.com"
-
-#define CHECK_URL_DEFAULT "https://" CHECK_HOST_DEFAULT ":443/v1/check.json"
 #define MIN_CHECK_BACKOFF_SEC (12 * 60 * 60)
 #define MAX_CHECK_BACKOFF_SEC (7 * 24 * 60 * 60)
 
@@ -66,21 +70,126 @@ using namespace oxt;
  * no auto-update mechanism).
  */
 class SecurityUpdateChecker {
+public:
+	/*
+	 * BEGIN ConfigKit schema: Passenger::SecurityUpdateChecker::Schema
+	 * (do not edit: following text is automatically generated
+	 * by 'rake configkit_schemas_inline_comments')
+	 *
+	 *   certificate_path     string             -          -
+	 *   disabled             boolean            -          default(false)
+	 *   interval             unsigned integer   -          default(86400)
+	 *   proxy_url            string             -          -
+	 *   server_identifier    string             required   -
+	 *   url                  string             -          default("https://securitycheck.phusionpassenger.com/v1/check.json")
+	 *   web_server_version   string             -          -
+	 *
+	 * END
+	 */
+	class Schema: public ConfigKit::Schema {
+	private:
+		static void validateInterval(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
+			unsigned int interval = config["interval"].asUInt();
+			if (interval < MIN_CHECK_BACKOFF_SEC || interval > MAX_CHECK_BACKOFF_SEC) {
+				errors.push_back(ConfigKit::Error("'{{interval}}' must be between " +
+					toString(MIN_CHECK_BACKOFF_SEC) + " and " + toString(MAX_CHECK_BACKOFF_SEC)));
+			}
+		}
+
+		static void validateProxyUrl(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
+			if (config["proxy_url"].isNull()) {
+				return;
+			}
+			if (config["proxy_url"].asString().empty()) {
+				errors.push_back(ConfigKit::Error("'{{proxy_url}}', if specified, may not be empty"));
+				return;
+			}
+
+			try {
+				prepareCurlProxy(config["proxy_url"].asString());
+			} catch (const ArgumentException &e) {
+				errors.push_back(ConfigKit::Error(
+					P_STATIC_STRING("'{{proxy_url}}': ")
+					+ e.what()));
+			}
+		}
+
+	public:
+		Schema() {
+			using namespace ConfigKit;
+
+			add("disabled", BOOL_TYPE, OPTIONAL, false);
+			add("url", STRING_TYPE, OPTIONAL, "https://securitycheck.phusionpassenger.com/v1/check.json");
+			// Should be in the form: scheme://user:password@proxy_host:proxy_port
+			add("proxy_url", STRING_TYPE, OPTIONAL);
+			add("certificate_path", STRING_TYPE, OPTIONAL);
+			add("interval", UINT_TYPE, OPTIONAL, 24 * 60 * 60);
+			// Should be one of { nginx, apache, standalone nginx, standalone builtin }
+			add("server_identifier", STRING_TYPE, REQUIRED);
+			// The version of Nginx or Apache, if relevant (otherwise empty)
+			add("web_server_version", STRING_TYPE, OPTIONAL);
+
+			addValidator(validateInterval);
+			addValidator(validateProxyUrl);
+
+			finalize();
+		}
+	};
+
+	struct ConfigRealization {
+		CurlProxyInfo proxyInfo;
+		string url;
+		string certificatePath;
+
+		ConfigRealization(const ConfigKit::Store &config)
+			: proxyInfo(prepareCurlProxy(config["proxy_url"].asString())),
+			  url(config["url"].asString()),
+			  certificatePath(config["certificate_path"].asString())
+			{ }
+
+		void swap(ConfigRealization &other) BOOST_NOEXCEPT_OR_NOTHROW {
+			proxyInfo.swap(other.proxyInfo);
+			url.swap(other.url);
+			certificatePath.swap(other.certificatePath);
+		}
+	};
+
+	struct ConfigChangeRequest {
+		boost::scoped_ptr<ConfigKit::Store> config;
+		boost::scoped_ptr<ConfigRealization> configRlz;
+	};
 
 private:
+	/*
+	 * Since the security update checker runs in a separate thread,
+	 * and the configuration can change while the checker is active,
+	 * we make a copy of the current configuration at the beginning
+	 * of each check.
+	 */
+	struct SessionState {
+		ConfigKit::Store config;
+		ConfigRealization configRlz;
+
+		SessionState(const ConfigKit::Store &currentConfig,
+			const ConfigRealization &currentConfigRlz)
+			: config(currentConfig),
+			  configRlz(currentConfigRlz)
+			{ }
+	};
+
+	mutable boost::mutex configSyncher;
+	ConfigKit::Store config;
+	ConfigRealization configRlz;
+
 	oxt::thread *updateCheckThread;
-	long checkIntervalSec;
 	string clientCertPath; // client cert (PKCS#12), checked by server
 	string serverPubKeyPath; // for checking signature
-	string proxyAddress;
-	string serverIntegration;
-	string serverVersion;
-	CurlProxyInfo proxyInfo;
-	Crypto *crypto;
+	Crypto crypto;
 
 	void threadMain() {
 		TRACE_POINT();
-		// Sleep for a short while to allow interruption during the Apache integration double startup procedure, this prevents running the update check twice
+		// Sleep for a short while to allow interruption during the Apache integration
+		// double startup procedure, this prevents running the update check twice
 		boost::this_thread::sleep_for(boost::chrono::seconds(2));
 		while (!boost::this_thread::interruption_requested()) {
 			UPDATE_TRACE_POINT();
@@ -90,7 +199,13 @@ private:
 			} catch (const tracable_exception &e) {
 				P_ERROR(e.what() << "\n" << e.backtrace());
 			}
+
 			UPDATE_TRACE_POINT();
+			unsigned int checkIntervalSec;
+			{
+				boost::lock_guard<boost::mutex> l(configSyncher);
+				checkIntervalSec = config["interval"].asUInt();
+			}
 			long backoffSec = checkIntervalSec + (backoffMin * 60);
 			if (backoffSec < MIN_CHECK_BACKOFF_SEC) {
 				backoffSec = MIN_CHECK_BACKOFF_SEC;
@@ -103,7 +218,7 @@ private:
 	}
 
 
-	void logUpdateFailCurl(CURLcode code) {
+	void logUpdateFailCurl(const SessionState &sessionState, CURLcode code) {
 		// At this point anything could be wrong, from unloadable certificates to server not found, etc.
 		// Let's try to enrich the log message in case there are known solutions or workarounds (e.g. "use proxy").
 		string error = curl_easy_strerror(code);
@@ -114,20 +229,21 @@ private:
 				break;
 
 			case CURLE_COULDNT_RESOLVE_HOST:
-				error.append(" while connecting to " CHECK_HOST_DEFAULT " (check your DNS)");
+				error.append(" while connecting to " + sessionState.configRlz.url + " (check your DNS)");
 				break;
 
 			case CURLE_COULDNT_CONNECT:
-				if (proxyAddress.empty()) {
-					error.append(" for " CHECK_URL_DEFAULT " " POSSIBLE_MITM_RESOLUTION);
+				if (sessionState.config["proxy_url"].isNull()) {
+					error.append(" for " + sessionState.configRlz.url + " " POSSIBLE_MITM_RESOLUTION);
 				} else {
-					error.append(" for " CHECK_URL_DEFAULT " using proxy " + proxyAddress +
+					error.append(" for " + sessionState.configRlz.url + " using proxy "
+						+ sessionState.config["proxy_url"].asString() +
 						" (if this error persists check your firewall and/or proxy settings)");
 				}
 				break;
 
 			case CURLE_COULDNT_RESOLVE_PROXY:
-				error.append(" for proxy address " + proxyAddress);
+				error.append(" for proxy address " + sessionState.config["proxy_url"].asString());
 				break;
 
 			case CURLE_SSL_CACERT:
@@ -135,15 +251,22 @@ private:
 				// for MITM but could also be a truststore issue.
 			case CURLE_PEER_FAILED_VERIFICATION:
 				// The remote server's SSL certificate or SSH md5 fingerprint was deemed not OK.
-				error.append(" while connecting to " CHECK_HOST_DEFAULT "; check that your connection is secure and that the "
-						"truststore is valid. If the problem persists, you can also try upgrading or reinstalling " SHORT_PROGRAM_NAME);
+				error.append(" while connecting to " + sessionState.configRlz.url
+					+ "; check that your connection is secure and that the"
+					" truststore is valid. If the problem persists, you can also try upgrading"
+					" or reinstalling " PROGRAM_NAME);
 				break;
 
 			case CURLE_SSL_CACERT_BADFILE:
-				error.append(" while connecting to " CHECK_URL_DEFAULT " " +
-						(proxyAddress.empty() ? "" : "using proxy " + proxyAddress) + "; this might happen if the nss backend "
-						"is installed for libcurl instead of GnuTLS or OpenSSL. If the problem persists, you can also try upgrading "
-						"or reinstalling " SHORT_PROGRAM_NAME);
+				error.append(" while connecting to " + sessionState.configRlz.url + " ");
+				if (!sessionState.config["proxy_url"].isNull()) {
+					error.append("using proxy ");
+					error.append(sessionState.config["proxy_url"].asString());
+					error.append(" ");
+				}
+				error.append("; this might happen if the nss backend is installed for"
+					" libcurl instead of GnuTLS or OpenSSL. If the problem persists, you can also try upgrading"
+					" or reinstalling " PROGRAM_NAME);
 				break;
 
 			// Fallthroughs to default:
@@ -154,8 +277,13 @@ private:
 				// This is not a normal connect timeout, there are some refs to it occurring while downloading large
 				// files, but we don't do that so fall through to default.
 			default:
-				error.append(" while connecting to " CHECK_URL_DEFAULT " " +
-						(proxyAddress.empty() ? "" : "using proxy " + proxyAddress) + " " POSSIBLE_MITM_RESOLUTION);
+				error.append(" while connecting to " + sessionState.configRlz.url + " ");
+				if (!sessionState.config["proxy_url"].isNull()) {
+					error.append("using proxy ");
+					error.append(sessionState.config["proxy_url"].asString());
+					error.append(" ");
+				}
+				error.append(POSSIBLE_MITM_RESOLUTION);
 				break;
 		}
 
@@ -164,21 +292,22 @@ private:
 #if !BOOST_OS_MACOS
 		unsigned long cryptoErrorCode = ERR_get_error();
 		if (cryptoErrorCode == 0) {
-			logUpdateFailAdditional("CURLcode" + to_string(code));
+			logUpdateFailAdditional("CURLcode" + toString(code));
 		} else {
 			char buf[500];
 			ERR_error_string(cryptoErrorCode, buf);
-			logUpdateFailAdditional("CURLcode: " + to_string(code) + ", Crypto: " + to_string(cryptoErrorCode) + " " + buf);
+			logUpdateFailAdditional("CURLcode: " + toString(code) + ", Crypto: " + toString(cryptoErrorCode)
+				+ " " + buf);
 		}
 #endif
 	}
 
-	void logUpdateFailHttp(int httpCode) {
+	void logUpdateFailHttp(const SessionState &sessionState, int httpCode) {
 		string error;
 
 		switch (httpCode) {
 			case 404:
-				error.append("url not found: " CHECK_URL_DEFAULT " " POSSIBLE_MITM_RESOLUTION);
+				error.append("url not found: " + sessionState.configRlz.url + " " POSSIBLE_MITM_RESOLUTION);
 				break;
 			case 403:
 				error.append("connection denied by server " POSSIBLE_MITM_RESOLUTION);
@@ -196,7 +325,8 @@ private:
 				error.append("request content was corrupted or not understood " POSSIBLE_MITM_RESOLUTION);
 				break;
 			default:
-				error = "HTTP " + to_string(httpCode) + " while connecting to " CHECK_URL_DEFAULT " " POSSIBLE_MITM_RESOLUTION;
+				error = "HTTP " + toString(httpCode) + " while connecting to " + sessionState.configRlz.url
+					+ " " POSSIBLE_MITM_RESOLUTION;
 			break;
 		}
 		logUpdateFail(error);
@@ -214,7 +344,9 @@ private:
 	 *
 	 * May allocate chunk data for setting Content-Type, receiver should deallocate with curl_slist_free_all().
 	 */
-	CURLcode prepareCurlPOST(CURL *curl, string &bodyJsonString, string *responseData, struct curl_slist **chunk) {
+	CURLcode prepareCurlPOST(CURL *curl, SessionState &sessionState, const string &bodyJsonString,
+		string *responseData, struct curl_slist **chunk)
+	{
 		CURLcode code;
 
 		// Hint for advanced debugging: curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
@@ -222,7 +354,7 @@ private:
 		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1))) {
 			return code;
 		}
-		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_URL, CHECK_URL_DEFAULT))) {
+		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_URL, sessionState.configRlz.url.c_str()))) {
 			return code;
 		}
 		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_HTTPGET, 0))) {
@@ -241,7 +373,7 @@ private:
 
 #if BOOST_OS_MACOS
 		// preauth the security update check key in the user's keychain (this is for libcurl's benefit because they don't bother to authorize themselves to use the keys they import)
-		if (!crypto->preAuthKey(clientCertPath.c_str(), CLIENT_CERT_PWD, CLIENT_CERT_LABEL)) {
+		if (!crypto.preAuthKey(clientCertPath.c_str(), CLIENT_CERT_PWD, CLIENT_CERT_LABEL)) {
 			return CURLE_SSL_CERTPROBLEM;
 		}
 		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "P12"))) {
@@ -278,7 +410,7 @@ private:
 		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_WRITEDATA, responseData))) {
 			return code;
 		}
-		if (CURLE_OK != (code = setCurlProxy(curl, proxyInfo))) {
+		if (CURLE_OK != (code = setCurlProxy(curl, sessionState.configRlz.proxyInfo))) {
 			return code;
 		}
 
@@ -297,69 +429,70 @@ private:
 		return true;
 	}
 
+	static size_t receiveResponseBytes(void *buffer, size_t size, size_t nmemb, void *userData) {
+		string *responseData = (string *) userData;
+		responseData->append((const char *) buffer, size * nmemb);
+		return size * nmemb;
+	}
+
 public:
+	// Dependencies
+	ResourceLocator *resourceLocator;
 
-	/**
-	 * proxy is optional and should be in the form: scheme://user:password@proxy_host:proxy_port
-	 *
-	 * serverIntegration should be one of { nginx, apache, standalone nginx, standalone builtin }, whereby
-	 * serverVersion is the version of Nginx or Apache, if relevant (otherwise empty)
-	 */
-	SecurityUpdateChecker(const ResourceLocator &locator, const string &proxy, const string &serverIntegration, const string &serverVersion, const string &instancePath) {
-		crypto = new Crypto();
-		updateCheckThread = NULL;
-		checkIntervalSec = 0;
-#if BOOST_OS_MACOS
-		clientCertPath = locator.getResourcesDir() + "/update_check_client_cert.p12";
-#else
-		clientCertPath = locator.getResourcesDir() + "/update_check_client_cert.pem";
-#endif
-		serverPubKeyPath = locator.getResourcesDir() + "/update_check_server_pubkey.pem";
-		proxyAddress = proxy;
-		this->serverIntegration = serverIntegration;
-		this->serverVersion = serverVersion;
-		try {
-			proxyInfo = prepareCurlProxy(proxyAddress);
-		} catch (const ArgumentException &e) {
-			assert(!proxyInfo.valid);
-			proxyAddress = "Invalid proxy address for security update check: \"" +
-					proxyAddress + "\": " + e.what();
-		}
-	}
+	SecurityUpdateChecker(const Schema &schema, const Json::Value &initialConfig,
+		const ConfigKit::Translator &translator = ConfigKit::DummyTranslator())
+		: config(schema, initialConfig, translator),
+		  configRlz(config),
+		  updateCheckThread(NULL),
+		  resourceLocator(NULL)
+		{ }
 
 	virtual ~SecurityUpdateChecker() {
 		if (updateCheckThread != NULL) {
 			updateCheckThread->interrupt_and_join();
 			delete updateCheckThread;
-			updateCheckThread = NULL;
 		}
-		if (crypto) {
-			delete crypto;
+	}
+
+	void initialize() {
+		if (resourceLocator == NULL) {
+			throw RuntimeException("resourceLocator must be non-NULL");
 		}
+
+		#if BOOST_OS_MACOS
+			clientCertPath = resourceLocator->getResourcesDir() + "/update_check_client_cert.p12";
+		#else
+			clientCertPath = resourceLocator->getResourcesDir() + "/update_check_client_cert.pem";
+		#endif
+		serverPubKeyPath = resourceLocator->getResourcesDir() + "/update_check_server_pubkey.pem";
 	}
 
 	/**
-	 * Starts a periodic check at every checkIntervalSec. For each check, the server may increase/decrease
-	 * (within limits) the period until the next check (using the backoff parameter in the response).
+	 * Starts a periodic check, as dictated by the "interval" config option. For each check, the
+	 * server may increase/decrease (within limits) the period until the next check (using the
+	 * backoff parameter in the response).
 	 *
 	 * Assumes curl_global_init() was already performed.
 	 */
-	void start(long checkIntervalSec) {
-		this->checkIntervalSec = checkIntervalSec;
-
-		assert(checkIntervalSec >= MIN_CHECK_BACKOFF_SEC && checkIntervalSec <= MAX_CHECK_BACKOFF_SEC);
+	void start() {
 		updateCheckThread = new oxt::thread(
-				boost::bind(&SecurityUpdateChecker::threadMain, this),
-				"Security update checker",
-				1024 * 512
-			);
+			boost::bind(&SecurityUpdateChecker::threadMain, this),
+			"Security update checker",
+			1024 * 512
+		);
 	}
 
 	/**
 	 * All error log methods eventually lead here, except for the additional below.
 	 */
 	virtual void logUpdateFail(string error) {
-		P_ERROR("Security update check failed: " << error << " (next check in " << (checkIntervalSec / (60*60)) << " hours)");
+		unsigned int checkIntervalSec;
+		{
+			boost::lock_guard<boost::mutex> l(configSyncher);
+			checkIntervalSec = config["interval"].asUInt();
+		}
+		P_ERROR("Security update check failed: " << error << " (next check in "
+			<< (checkIntervalSec / (60*60)) << " hours)");
 	}
 
 	/**
@@ -390,11 +523,11 @@ public:
 	}
 
 	virtual bool fillNonce(string &nonce) {
-		return crypto->generateAndAppendNonce(nonce);
+		return crypto.generateAndAppendNonce(nonce);
 	}
 
 	/**
-	 * Sends POST to CHECK_URL_DEFAULT (via SSL, with client cert) containing:
+	 * Sends POST to the configured URL (via SSL, with client cert) containing:
 	 * {"version":"<passenger version>", "nonce":"<random nonce>"}
 	 * The response will be:
 	 * {"data":base64(data), "signature":base64(signature)}, where:
@@ -408,13 +541,23 @@ public:
 	int checkAndLogSecurityUpdate() {
 		int backoffMin = 0;
 
+		// 0. Copy current configuration
+		boost::unique_lock<boost::mutex> l(configSyncher);
+		SessionState sessionState(config, configRlz);
+		l.unlock();
+
+		if (sessionState.config["disabled"].asBool()) {
+			P_INFO("Security update checking disabled; skipping check");
+			return backoffMin;
+		}
+
 		// 1. Assemble data to send
 		Json::Value bodyJson;
 
 		bodyJson["passenger_version"] = PASSENGER_VERSION;
 
-		bodyJson["server_integration"] = serverIntegration;
-		bodyJson["server_version"] = serverVersion;
+		bodyJson["server_integration"] = sessionState.config["server_identifier"];
+		bodyJson["server_version"] = sessionState.config["web_server_version"];
 		bodyJson["curl_static"] = isCurlStaticallyLinked();
 
 		string nonce;
@@ -445,34 +588,31 @@ public:
 			}
 
 			if (CURLE_OK != (code = setCurlDefaultCaInfo(curl))) {
-				logUpdateFailCurl(code);
+				logUpdateFailCurl(sessionState, code);
 				break;
 			}
 
-			// string localApprovedCert = "/your/ca.crt"; // for testing against a local server
-			// curl_easy_setopt(curl, CURLOPT_CAINFO, localApprovedCert.c_str());
-
-			if (!proxyInfo.valid) {
-				// special case: delayed error in proxyAddress
-				logUpdateFail(proxyAddress);
-				break;
+			if (!sessionState.configRlz.certificatePath.empty()) {
+				curl_easy_setopt(curl, CURLOPT_CAINFO, sessionState.configRlz.certificatePath.c_str());
 			}
 
 			string bodyJsonString = bodyJson.toStyledString();
-			if (CURLE_OK != (code = prepareCurlPOST(curl, bodyJsonString, &responseData, &chunk))) {
-				logUpdateFailCurl(code);
+			if (CURLE_OK != (code = prepareCurlPOST(curl, sessionState, bodyJsonString,
+				&responseData, &chunk)))
+			{
+				logUpdateFailCurl(sessionState, code);
 				break;
 			}
 
 			P_DEBUG("sending: " << bodyJsonString);
 			if (CURLE_OK != (code = sendAndReceive(curl, &responseData, &responseCode))) {
-				logUpdateFailCurl(code);
+				logUpdateFailCurl(sessionState, code);
 				break;
 			}
 
 			// 3a. Verify response: HTTP code
 			if (responseCode != 200) {
-				logUpdateFailHttp((int) responseCode);
+				logUpdateFailHttp(sessionState, (int) responseCode);
 				break;
 			}
 
@@ -506,7 +646,7 @@ public:
 				break;
 			}
 
-			if (!crypto->verifySignature(serverPubKeyPath, signatureChars, signatureLen, data64)) {
+			if (!crypto.verifySignature(serverPubKeyPath, signatureChars, signatureLen, data64)) {
 				logUpdateFailResponse("untrusted or forged signature", responseData);
 				break;
 			}
@@ -550,10 +690,16 @@ public:
 			}
 
 			if (update == 0) {
-				logUpdateSuccess(update, "Security update check: no update found (next check in " + toString(checkIntervalSec / (60*60)) + " hours)");
+				unsigned int checkIntervalSec;
+				{
+					boost::lock_guard<boost::mutex> l(configSyncher);
+					checkIntervalSec = config["interval"].asUInt();
+				}
+				logUpdateSuccess(update, "Security update check: no update found (next check in "
+					+ toString(checkIntervalSec / (60*60)) + " hours)");
 			} else {
 				logUpdateSuccess(update, "A security update is available for your version (" PASSENGER_VERSION
-					") of Passenger, we strongly recommend upgrading to version " +
+					") of " PROGRAM_NAME ". We strongly recommend upgrading to version " +
 					responseDataJson["version"].asString() + ".");
 			}
 
@@ -562,14 +708,14 @@ public:
 			if (responseDataJson["log"].isString()) {
 				string additional = responseDataJson["log"].asString();
 				if (additional.length() > 0) {
-					logUpdateSuccessAdditional(" Additional information: " + additional);
+					logUpdateSuccessAdditional("Additional security update check information: " + additional);
 				}
 			}
-		} while (0);
+		} while (false);
 
 #if BOOST_OS_MACOS
 		// remove the security update check key from the user's keychain so that if we are stopped/crash and are upgraded or reinstalled before restarting we don't have permission problems
-		crypto->killKey(CLIENT_CERT_LABEL);
+		crypto.killKey(CLIENT_CERT_LABEL);
 #endif
 
 		if (signatureChars) {
@@ -584,12 +730,29 @@ public:
 		return backoffMin;
 	}
 
-	static size_t receiveResponseBytes(void *buffer, size_t size, size_t nmemb, void *userData) {
-		string *responseData = (string *) userData;
-		responseData->append((const char *) buffer, size * nmemb);
-		return size * nmemb;
+	bool prepareConfigChange(const Json::Value &updates,
+		vector<ConfigKit::Error> &errors, ConfigChangeRequest &req)
+	{
+		{
+			boost::lock_guard<boost::mutex> l(configSyncher);
+			req.config.reset(new ConfigKit::Store(config, updates, errors));
+		}
+		if (errors.empty()) {
+			req.configRlz.reset(new ConfigRealization(*req.config));
+		}
+		return errors.empty();
 	}
 
+	void commitConfigChange(ConfigChangeRequest &req) BOOST_NOEXCEPT_OR_NOTHROW {
+		boost::lock_guard<boost::mutex> l(configSyncher);
+		config.swap(*req.config);
+		configRlz.swap(*req.configRlz);
+	}
+
+	Json::Value inspectConfig() const {
+		boost::lock_guard<boost::mutex> l(configSyncher);
+		return config.inspect();
+	}
 };
 
 } // namespace Passenger