Cache generation of the SSH authentication keyfile for sshd

Summary:
Ref T11469. This isn't directly related, but has been on my radar for a while: building SSH keyfiles (particular for installs with a lot of keys, like ours) can be fairly slow.

At least one cluster instance is making multiple clone requests per second. While that should probably be rate limited separately, caching this should mitigate the impact of these requests.

This is pretty straightforward to cache since it's exactly the same every time, and only changes when users modify SSH keys (which is rare).

Test Plan:
  - Ran `bin/auth-ssh`, saw authfile generate.
  - Ran it again, saw it read from cache.
  - Changed an SSH key.
  - Ran it again, saw it regenerate.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T11469

Differential Revision: https://secure.phabricator.com/D16744

scripts/ssh/ssh-auth.php

@@ -4,6 +4,11 @@
 $root = dirname(dirname(dirname(__FILE__)));
 require_once $root.'/scripts/__init_script__.php';
 
+$cache = PhabricatorCaches::getMutableCache();
+$authfile_key = PhabricatorAuthSSHKeyQuery::AUTHFILE_CACHEKEY;
+$authfile = $cache->getKey($authfile_key);
+
+if ($authfile === null) {
   $keys = id(new PhabricatorAuthSSHKeyQuery())
     ->setViewer(PhabricatorUser::getOmnipotentUser())
     ->withIsActive(true)
@@ -73,5 +78,10 @@ foreach ($keys as $ssh_key) {
     $lines[] = $options.' '.$type.' '.$key."\n";
   }
 
-echo implode('', $lines);
+  $authfile = implode('', $lines);
+  $ttl = phutil_units('24 hours in seconds');
+  $cache->setKey($authfile_key, $authfile, $ttl);
+}
+
+echo $authfile;
 exit(0);

src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php

@@ -191,6 +191,20 @@ final class PhabricatorAuthSSHKeyEditor
     return 'ssh-key-'.$object->getPHID();
   }
 
+  protected function applyFinalEffects(
+    PhabricatorLiskDAO $object,
+    array $xactions) {
+
+    // After making any change to an SSH key, drop the authfile cache so it
+    // is regenerated the next time anyone authenticates.
+    $cache = PhabricatorCaches::getMutableCache();
+    $authfile_key = PhabricatorAuthSSHKeyQuery::AUTHFILE_CACHEKEY;
+    $cache->deleteKey($authfile_key);
+
+    return $xactions;
+  }
+
+
   protected function getMailTo(PhabricatorLiskDAO $object) {
     return $object->getObject()->getSSHKeyNotifyPHIDs();
   }

src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php

@@ -3,6 +3,8 @@
 final class PhabricatorAuthSSHKeyQuery
   extends PhabricatorCursorPagedPolicyAwareQuery {
 
+  const AUTHFILE_CACHEKEY = 'ssh.authfile';
+
   private $ids;
   private $phids;
   private $objectPHIDs;

src/applications/cache/PhabricatorCaches.php

@@ -99,6 +99,23 @@ final class PhabricatorCaches extends Phobject {
     return $caches;
   }
 
+  public static function getMutableCache() {
+    static $cache;
+    if (!$cache) {
+      $caches = self::buildMutableCaches();
+      $cache = self::newStackFromCaches($caches);
+    }
+    return $cache;
+  }
+
+  private static function buildMutableCaches() {
+    $caches = array();
+
+    $caches[] = new PhabricatorKeyValueDatabaseCache();
+
+    return $caches;
+  }
+
 
 /* -(  Repository Graph Cache  )--------------------------------------------- */
 

src/applications/cache/PhabricatorKeyValueDatabaseCache.php

@@ -98,7 +98,7 @@ final class PhabricatorKeyValueDatabaseCache
         $this->establishConnection('w'),
         'DELETE FROM %T WHERE cacheKeyHash IN (%Ls)',
         $this->getTableName(),
-        $keys);
+        $map);
     }
 
     return $this;