made TLS client certificate request from the server configurable

added Jacoco test report

.gitea/workflows/build.yaml

@@ -9,11 +9,6 @@ jobs:
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: graalvm
-          java-version: 21
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v3
       - name: Execute Gradle build

Dockerfile

@@ -1,2 +0,0 @@
-FROM gitea.woggioni.net/woggioni/gbcs:memcached
-COPY --chown=luser:luser conf/gbcs-memcached.xml /home/luser/.config/gbcs/gbcs.xml

benchmark/build.gradle

@@ -1,26 +0,0 @@
-plugins {
-    alias catalog.plugins.gradle.jmh
-    alias catalog.plugins.lombok
-}
-
-import me.champeau.jmh.JMHTask
-
-dependencies {
-    implementation rootProject
-
-    implementation catalog.jwo
-    implementation catalog.xz
-    implementation catalog.jackson.databind
-
-    jmhAnnotationProcessor catalog.lombok
-}
-
-jmh {
-    threads = 4
-    iterations = 2
-    fork = 1
-    warmupIterations = 1
-    warmupForks = 0
-    resultFormat = 'JSON'
-}
-

benchmark/src/jmh/java/net/woggioni/gbcs/benchmark/Main.java

@@ -1,170 +0,0 @@
-package net.woggioni.gbcs.benchmark;
-
-import lombok.Getter;
-import lombok.SneakyThrows;
-import org.openjdk.jmh.annotations.Benchmark;
-import org.openjdk.jmh.annotations.BenchmarkMode;
-import org.openjdk.jmh.annotations.Level;
-import org.openjdk.jmh.annotations.Mode;
-import org.openjdk.jmh.annotations.OutputTimeUnit;
-import org.openjdk.jmh.annotations.Scope;
-import org.openjdk.jmh.annotations.Setup;
-import org.openjdk.jmh.annotations.State;
-
-import java.net.URI;
-import java.net.http.HttpClient;
-import java.net.http.HttpRequest;
-import java.net.http.HttpResponse;
-import java.nio.charset.StandardCharsets;
-import java.util.Arrays;
-import java.util.Base64;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.Map;
-import java.util.Optional;
-import java.util.Properties;
-import java.util.Random;
-import java.util.concurrent.TimeUnit;
-import java.util.function.Predicate;
-
-public class Main {
-
-    @SneakyThrows
-    private static Properties loadProperties() {
-        Properties properties = new Properties();
-        try (final var is = Main.class.getResourceAsStream("/benchmark.properties")) {
-            properties.load(is);
-        }
-        return properties;
-    }
-
-    private static final Properties properties = loadProperties();
-
-    @State(Scope.Thread)
-    public static class ExecutionPlan {
-        private final Random random = new Random(101325);
-
-        @Getter
-        private final HttpClient client = HttpClient.newHttpClient();
-
-        private final Map<String, byte[]> entries = new HashMap<>();
-
-        public final Map<String, byte[]> getEntries() {
-            return Collections.unmodifiableMap(entries);
-        }
-
-        public Map.Entry<String, byte[]> newEntry() {
-            final var keyBuffer = new byte[0x20];
-            random.nextBytes(keyBuffer);
-            final var key = Base64.getUrlEncoder().encodeToString(keyBuffer);
-            final var value = new byte[0x1000];
-            random.nextBytes(value);
-            return Map.entry(key, value);
-        }
-
-        @SneakyThrows
-        public HttpRequest.Builder newRequestBuilder(String key) {
-            final var requestBuilder = HttpRequest.newBuilder()
-                    .uri(getServerURI().resolve(key));
-            String user = getUser();
-            if (user != null) {
-                requestBuilder.header("Authorization", buildAuthorizationHeader(user, getPassword()));
-            }
-            return requestBuilder;
-        }
-
-        @SneakyThrows
-        public URI getServerURI() {
-            return new URI(properties.getProperty("gbcs.server.url"));
-        }
-
-        @SneakyThrows
-        public String getUser() {
-            return Optional.ofNullable(properties.getProperty("gbcs.server.username"))
-                    .filter(Predicate.not(String::isEmpty))
-                    .orElse(null);
-
-        }
-
-        @SneakyThrows
-        public String getPassword() {
-            return Optional.ofNullable(properties.getProperty("gbcs.server.password"))
-                    .filter(Predicate.not(String::isEmpty))
-                    .orElse(null);
-        }
-
-        private String buildAuthorizationHeader(String user, String password) {
-            final var b64 = Base64.getEncoder().encode(String.format("%s:%s", user, password).getBytes(StandardCharsets.UTF_8));
-            return "Basic " + new String(b64);
-        }
-
-
-        @SneakyThrows
-        @Setup(Level.Trial)
-        public void setUp() {
-            try (final var client = HttpClient.newHttpClient()) {
-                for (int i = 0; i < 10000; i++) {
-                    final var pair = newEntry();
-                    final var requestBuilder = newRequestBuilder(pair.getKey())
-                            .header("Content-Type", "application/octet-stream")
-                            .PUT(HttpRequest.BodyPublishers.ofByteArray(pair.getValue()));
-                    final var response = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString());
-                    if (201 != response.statusCode()) {
-                        throw new IllegalStateException(Integer.toString(response.statusCode()));
-                    } else {
-                        entries.put(pair.getKey(), pair.getValue());
-                    }
-                }
-            }
-        }
-
-        private Iterator<Map.Entry<String, byte[]>> it = null;
-
-        private Map.Entry<String, byte[]> nextEntry() {
-            if (it == null || !it.hasNext()) {
-                it = getEntries().entrySet().iterator();
-            }
-            return it.next();
-        }
-    }
-
-    @SneakyThrows
-    @Benchmark
-    @BenchmarkMode(Mode.Throughput)
-    @OutputTimeUnit(TimeUnit.SECONDS)
-    public void get(ExecutionPlan plan) {
-        final var client = plan.getClient();
-        final var entry = plan.nextEntry();
-        final var requestBuilder = plan.newRequestBuilder(entry.getKey())
-                .header("Accept", "application/octet-stream")
-                .GET();
-        final var response = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray());
-        if (200 != response.statusCode()) {
-            throw new IllegalStateException(Integer.toString(response.statusCode()));
-        } else {
-            if (!Arrays.equals(entry.getValue(), response.body())) {
-                throw new IllegalStateException("Retrieved unexpected value");
-            }
-        }
-    }
-
-
-    @SneakyThrows
-    @Benchmark
-    @BenchmarkMode(Mode.Throughput)
-    @OutputTimeUnit(TimeUnit.SECONDS)
-    public void put(Main.ExecutionPlan plan) {
-        final var client = plan.getClient();
-        final var entry = plan.nextEntry();
-
-        final var requestBuilder = plan.newRequestBuilder(entry.getKey())
-                .header("Content-Type", "application/octet-stream")
-                .PUT(HttpRequest.BodyPublishers.ofByteArray(entry.getValue()));
-
-        final var response = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray());
-        if (201 != response.statusCode()) {
-            throw new IllegalStateException(Integer.toString(response.statusCode()));
-        }
-    }
-}

benchmark/src/jmh/resources/benchmark.properties

@@ -1 +0,0 @@
-gbcs.server.url= http://localhost:8080

build.gradle

@@ -1,14 +1,12 @@
 plugins {
-    id 'java-library'
-    alias catalog.plugins.kotlin.jvm
+    alias catalog.plugins.kotlin.jvm apply false
     alias catalog.plugins.sambal
-    alias catalog.plugins.lombok
-    id 'maven-publish'
+    alias catalog.plugins.lombok apply false
 }
 
-import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
-import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
 
 allprojects { subproject ->
     group = 'net.woggioni'
@@ -48,6 +46,12 @@ allprojects { subproject ->
             }
         }
 
+        dependencies {
+            testImplementation catalog.junit.jupiter.api
+            testImplementation catalog.junit.jupiter.params
+            testRuntimeOnly catalog.junit.jupiter.engine
+        }
+
         test {
             useJUnitPlatform()
         }
@@ -68,6 +72,15 @@ allprojects { subproject ->
         }
     }
 
+    pluginManager.withPlugin('jacoco') {
+        test {
+            finalizedBy jacocoTestReport
+        }
+        jacocoTestReport {
+            dependsOn test
+        }
+    }
+
     pluginManager.withPlugin(catalog.plugins.kotlin.jvm.get().pluginId) {
         tasks.withType(KotlinCompile.class) {
             compilerOptions.jvmTarget = JvmTarget.JVM_21
@@ -102,34 +115,6 @@ allprojects { subproject ->
     }
 }
 
-dependencies {
-    implementation catalog.jwo
-    implementation catalog.slf4j.api
-    implementation catalog.netty.codec.http
-
-    api project('gbcs-base')
-    api project('gbcs-api')
-
-//    runtimeOnly catalog.slf4j.jdk14
-    testRuntimeOnly catalog.logback.classic
-
-    testImplementation catalog.bcprov.jdk18on
-    testImplementation catalog.bcpkix.jdk18on
-    testImplementation catalog.junit.jupiter.api
-    testImplementation catalog.junit.jupiter.params
-    testRuntimeOnly catalog.junit.jupiter.engine
-
-    testRuntimeOnly project("gbcs-memcached")
-}
-
-publishing {
-    publications {
-        maven(MavenPublication) {
-            from(components["java"])
-        }
-    }
-}
-
 tasks.register('version') {
     doLast {
         println("VERSION=$version")

conf/gbcs-memcached.xml

@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<gbcs:server useVirtualThreads="true" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
-             xmlns:gbcs="urn:net.woggioni.gbcs"
-             xmlns:gbcs-memcached="urn:net.woggioni.gbcs-memcached"
-             xs:schemaLocation="urn:net.woggioni.gbcs-memcached jpms://net.woggioni.gbcs.memcached/net/woggioni/gbcs/memcached/schema/gbcs-memcached.xsd urn:net.woggioni.gbcs jpms://net.woggioni.gbcs/net/woggioni/gbcs/schema/gbcs.xsd">
-    <bind host="0.0.0.0" port="13080" />
-    <cache xs:type="gbcs-memcached:memcachedCacheType" max-age="P7D" max-size="16777216" compression-mode="zip">
-        <server host="memcached" port="11211"/>
-    </cache>
-    <authentication>
-        <none/>
-    </authentication>
-</gbcs:server>

docker-compose.yml

@@ -1,36 +0,0 @@
-networks:
-  default:
-    external: false
-    ipam:
-      driver: default
-      config:
-        - subnet: 172.118.0.0/16
-          ip_range: 172.118.0.0/16
-          gateway: 172.118.0.254
-services:
-  gbcs:
-    build:
-      context: .
-    container_name: gbcs
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:8080:13080"
-      - "[::1]:8080:13080"
-    depends_on:
-      memcached:
-        condition: service_started
-    deploy:
-      resources:
-        limits:
-          cpus: "2.00"
-          memory: 256M
-  memcached:
-    image: memcached
-    container_name: memcached
-    restart: unless-stopped
-    command: -I 64m -m 900m
-    deploy:
-      resources:
-        limits:
-          cpus: "1.00"
-          memory: 1G

docker/Dockerfile

@@ -1,21 +1,16 @@
-FROM alpine:latest AS base-release
-RUN --mount=type=cache,target=/var/cache/apk apk update
-RUN --mount=type=cache,target=/var/cache/apk apk add openjdk21-jre
+FROM eclipse-temurin:21-jre-alpine AS base-release
 RUN adduser -D luser
 USER luser
 WORKDIR /home/luser
 
 FROM base-release AS release
 ADD gbcs-cli-envelope-*.jar gbcs.jar
-ENTRYPOINT ["java", "-jar", "/home/luser/gbcs.jar"]
+ENTRYPOINT ["java", "-jar", "/home/luser/gbcs.jar", "server"]
 
 FROM base-release AS release-memcached
 ADD --chown=luser:luser gbcs-cli-envelope-*.jar gbcs.jar
 RUN mkdir plugins
 WORKDIR /home/luser/plugins
-RUN --mount=type=bind,source=.,target=/build/distributions tar -xf /build/distributions/gbcs-memcached*.tar
+RUN --mount=type=bind,source=.,target=/build/distributions tar -xf /build/distributions/gbcs-server-memcached*.tar
 WORKDIR /home/luser
-ENTRYPOINT ["java", "-jar", "/home/luser/gbcs.jar"]
-
-FROM release-memcached as compose
-COPY --chown=luser:luser conf/gbcs-memcached.xml /home/luser/.config/gbcs/gbcs.xml
+ENTRYPOINT ["java", "-jar", "/home/luser/gbcs.jar", "server"]

docker/build.gradle

@@ -19,7 +19,7 @@ configurations {
 
 dependencies {
     docker project(path: ':gbcs-cli', configuration: 'release')
-    docker project(path: ':gbcs-memcached', configuration: 'release')
+    docker project(path: ':gbcs-server-memcached', configuration: 'release')
 }
 
 Provider<Task> cleanTaskProvider = tasks.named(BasePlugin.CLEAN_TASK_NAME) {}

gbcs-api/src/main/java/net/woggioni/gbcs/api/Cache.java

@@ -4,6 +4,7 @@ import net.woggioni.gbcs.api.exception.ContentTooLargeException;
 
 import java.nio.channels.ReadableByteChannel;
 
+
 public interface Cache extends AutoCloseable {
     ReadableByteChannel get(String key);
 

gbcs-api/src/main/java/net/woggioni/gbcs/api/Configuration.java

@@ -2,10 +2,12 @@ package net.woggioni.gbcs.api;
 
 
 import lombok.EqualsAndHashCode;
+import lombok.NonNull;
 import lombok.Value;
 
 import java.nio.file.Path;
 import java.security.cert.X509Certificate;
+import java.time.Duration;
 import java.util.Map;
 import java.util.Set;
 import java.util.stream.Collectors;
@@ -14,19 +16,47 @@ import java.util.stream.Collectors;
 public class Configuration {
     String host;
     int port;
+    int incomingConnectionsBacklogSize;
     String serverPath;
+    @NonNull
+    EventExecutor eventExecutor;
+    @NonNull
+    Connection connection;
     Map<String, User> users;
     Map<String, Group> groups;
     Cache cache;
     Authentication authentication;
     Tls tls;
-    boolean useVirtualThread;
+
+    @Value
+    public static class EventExecutor {
+        boolean useVirtualThreads;
+    }
+
+    @Value
+    public static class Connection {
+        Duration readTimeout;
+        Duration writeTimeout;
+        Duration idleTimeout;
+        Duration readIdleTimeout;
+        Duration writeIdleTimeout;
+        int maxRequestSize;
+    }
+
+    @Value
+    public static class Quota {
+        long calls;
+        Duration period;
+        long initialAvailableCalls;
+        long maxAvailableCalls;
+    }
 
     @Value
     public static class Group {
         @EqualsAndHashCode.Include
         String name;
         Set<Role> roles;
+        Quota quota;
     }
 
     @Value
@@ -35,7 +65,7 @@ public class Configuration {
         String name;
         String password;
         Set<Group> groups;
-
+        Quota quota;
 
         public Set<Role> getRoles() {
             return groups.stream()
@@ -55,12 +85,22 @@ public class Configuration {
     }
 
     @Value
-    public static class Tls {
+    public static class Throttling {
         KeyStore keyStore;
         TrustStore trustStore;
         boolean verifyClients;
     }
 
+    public enum ClientCertificate {
+        REQUIRED, OPTIONAL
+    }
+
+    @Value
+    public static class Tls {
+        KeyStore keyStore;
+        TrustStore trustStore;
+    }
+
     @Value
     public static class KeyStore {
         Path file;
@@ -74,6 +114,7 @@ public class Configuration {
         Path file;
         String password;
         boolean checkCertificateStatus;
+        boolean requireClientCertificate;
     }
 
     @Value
@@ -101,24 +142,28 @@ public class Configuration {
     public static Configuration of(
             String host,
             int port,
+            int incomingConnectionsBacklogSize,
             String serverPath,
+            EventExecutor eventExecutor,
+            Connection connection,
             Map<String, User> users,
             Map<String, Group> groups,
             Cache cache,
             Authentication authentication,
-            Tls tls,
-            boolean useVirtualThread
+            Tls tls
     ) {
         return new Configuration(
                 host,
                 port,
+                incomingConnectionsBacklogSize,
                 serverPath != null && !serverPath.isEmpty() && !serverPath.equals("/") ? serverPath : null,
+                eventExecutor,
+                connection,
                 users,
                 groups,
                 cache,
                 authentication,
-                tls,
-                useVirtualThread
+                tls
         );
     }
 }

gbcs-api/src/main/java/net/woggioni/gbcs/api/exception/CacheException.java

@@ -0,0 +1,11 @@
+package net.woggioni.gbcs.api.exception;
+
+public class CacheException extends GbcsException {
+    public CacheException(String message, Throwable cause) {
+        super(message, cause);
+    }
+
+    public CacheException(String message) {
+        this(message, null);
+    }
+}

gbcs-api/src/main/java/net/woggioni/gbcs/api/exception/ConfigurationException.java

@@ -0,0 +1,11 @@
+package net.woggioni.gbcs.api.exception;
+
+public class ConfigurationException extends GbcsException {
+    public ConfigurationException(String message, Throwable cause) {
+        super(message, cause);
+    }
+
+    public ConfigurationException(String message) {
+        this(message, null);
+    }
+}

gbcs-base/src/main/java/module-info.java

@@ -1,8 +0,0 @@
-module net.woggioni.gbcs.base {
-    requires java.xml;
-    requires java.logging;
-    requires org.slf4j;
-    requires kotlin.stdlib;
-
-    exports net.woggioni.gbcs.base;
-}

gbcs-cli/build.gradle

@@ -4,16 +4,20 @@ plugins {
     alias catalog.plugins.envelope
     alias catalog.plugins.sambal
     alias catalog.plugins.graalvm.native.image
+    alias catalog.plugins.graalvm.jlink
+    alias catalog.plugins.jpms.check
     id 'maven-publish'
 }
 
 import net.woggioni.gradle.envelope.EnvelopeJarTask
+import net.woggioni.gradle.graalvm.NativeImageConfigurationTask
 import net.woggioni.gradle.graalvm.NativeImagePlugin
 import net.woggioni.gradle.graalvm.NativeImageTask
-import net.woggioni.gradle.graalvm.NativeImageConfigurationTask
-import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
-import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import net.woggioni.gradle.graalvm.JlinkPlugin
+import net.woggioni.gradle.graalvm.JlinkTask
 
+Property<String> mainModuleName = objects.property(String.class)
+mainModuleName.set('net.woggioni.gbcs.cli')
 Property<String> mainClassName = objects.property(String.class)
 mainClassName.set('net.woggioni.gbcs.cli.GradleBuildCacheServerCli')
 
@@ -31,7 +35,7 @@ configurations {
 }
 
 envelopeJar {
-    mainModule = 'net.woggioni.gbcs.cli'
+    mainModule = mainModuleName
     mainClass = mainClassName
 
     extraClasspath = ["plugins"]
@@ -43,28 +47,45 @@ dependencies {
     implementation catalog.netty.codec.http
     implementation catalog.picocli
 
-    implementation rootProject
+    implementation project(':gbcs-client')
+    implementation project(':gbcs-server')
 
 //    runtimeOnly catalog.slf4j.jdk14
     runtimeOnly catalog.logback.classic
+//    runtimeOnly catalog.slf4j.simple
 }
 
 Provider<EnvelopeJarTask> envelopeJarTaskProvider = tasks.named('envelopeJar', EnvelopeJarTask.class) {
 //    systemProperties['java.util.logging.config.class'] = 'net.woggioni.gbcs.LoggingConfig'
-//    systemProperties['log.config.source'] = 'logging.properties'
+//    systemProperties['log.config.source'] = 'net/woggioni/gbcs/cli/logging.properties'
+//    systemProperties['java.util.logging.config.file'] = 'classpath:net/woggioni/gbcs/cli/logging.properties'
     systemProperties['logback.configurationFile'] = 'classpath:net/woggioni/gbcs/cli/logback.xml'
+    systemProperties['io.netty.leakDetectionLevel'] = 'DISABLED'
+
+//    systemProperties['org.slf4j.simpleLogger.showDateTime'] = 'true'
+//    systemProperties['org.slf4j.simpleLogger.defaultLogLevel'] = 'debug'
+//    systemProperties['org.slf4j.simpleLogger.log.com.google.code.yanf4j'] = 'warn'
+//    systemProperties['org.slf4j.simpleLogger.log.net.rubyeye.xmemcached'] = 'warn'
+//    systemProperties['org.slf4j.simpleLogger.dateTimeFormat'] = 'yyyy-MM-dd\'T\'HH:mm:ss.SSSZ'
 }
 
 tasks.named(NativeImagePlugin.CONFIGURE_NATIVE_IMAGE_TASK_NAME, NativeImageConfigurationTask) {
-    mainClass = 'net.woggioni.gbcs.GraalNativeImageConfiguration'
+    mainClass = mainClassName
+    mainModule = mainModuleName
 }
 
 tasks.named(NativeImagePlugin.NATIVE_IMAGE_TASK_NAME, NativeImageTask) {
-    mainClass = 'net.woggioni.gbcs.GradleBuildCacheServer'
+    mainClass = mainClassName
+    mainModule = mainModuleName
     useMusl = true
     buildStaticImage = true
 }
 
+tasks.named(JlinkPlugin.JLINK_TASK_NAME, JlinkTask) {
+    mainClass = mainClassName
+    mainModule = 'net.woggioni.gbcs.cli'
+}
+
 artifacts {
     release(envelopeJarTaskProvider)
 }

gbcs-cli/native-image/native-image.properties

@@ -1,2 +1,2 @@
-Args=-H:Optimize=3 --gc=serial
+Args=-H:Optimize=3 --gc=serial --initialize-at-run-time=io.netty
 #-H:TraceClassInitialization=io.netty.handler.ssl.BouncyCastleAlpnSslUtils

gbcs-cli/src/main/java/module-info.java

@@ -1,15 +1,17 @@
 module net.woggioni.gbcs.cli {
     requires org.slf4j;
-    requires net.woggioni.gbcs;
+    requires net.woggioni.gbcs.server;
     requires info.picocli;
-    requires net.woggioni.gbcs.base;
+    requires net.woggioni.gbcs.common;
+    requires net.woggioni.gbcs.client;
     requires kotlin.stdlib;
     requires net.woggioni.jwo;
+    requires net.woggioni.gbcs.api;
 
     exports net.woggioni.gbcs.cli.impl.converters to info.picocli;
     opens net.woggioni.gbcs.cli.impl.commands to info.picocli;
     opens net.woggioni.gbcs.cli.impl to info.picocli;
-    opens net.woggioni.gbcs.cli to info.picocli, net.woggioni.gbcs.base;
+    opens net.woggioni.gbcs.cli to info.picocli, net.woggioni.gbcs.common;
 
     exports net.woggioni.gbcs.cli;
 }

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/GradleBuildCacheServerCli.kt

@@ -1,28 +1,25 @@
 package net.woggioni.gbcs.cli
 
-import net.woggioni.gbcs.GradleBuildCacheServer
-import net.woggioni.gbcs.GradleBuildCacheServer.Companion.DEFAULT_CONFIGURATION_URL
-import net.woggioni.gbcs.base.GbcsUrlStreamHandlerFactory
-import net.woggioni.gbcs.base.contextLogger
-import net.woggioni.gbcs.base.debug
-import net.woggioni.gbcs.base.info
+import net.woggioni.gbcs.common.GbcsUrlStreamHandlerFactory
+import net.woggioni.gbcs.common.contextLogger
 import net.woggioni.gbcs.cli.impl.AbstractVersionProvider
 import net.woggioni.gbcs.cli.impl.GbcsCommand
+import net.woggioni.gbcs.cli.impl.commands.BenchmarkCommand
+import net.woggioni.gbcs.cli.impl.commands.ClientCommand
+import net.woggioni.gbcs.cli.impl.commands.GetCommand
 import net.woggioni.gbcs.cli.impl.commands.PasswordHashCommand
+import net.woggioni.gbcs.cli.impl.commands.PutCommand
+import net.woggioni.gbcs.cli.impl.commands.ServerCommand
 import net.woggioni.jwo.Application
-import net.woggioni.jwo.JWO
-import org.slf4j.Logger
 import picocli.CommandLine
 import picocli.CommandLine.Model.CommandSpec
-import java.io.ByteArrayOutputStream
-import java.nio.file.Files
-import java.nio.file.Path
+import java.net.URI
 
 
 @CommandLine.Command(
     name = "gbcs", versionProvider = GradleBuildCacheServerCli.VersionProvider::class
 )
-class GradleBuildCacheServerCli(application : Application, private val log : Logger) : GbcsCommand() {
+class GradleBuildCacheServerCli : GbcsCommand() {
 
     class VersionProvider : AbstractVersionProvider()
     companion object {
@@ -35,24 +32,24 @@ class GradleBuildCacheServerCli(application : Application, private val log : Log
                 .configurationDirectoryEnvVar("GBCS_CONFIGURATION_DIR")
                 .configurationDirectoryPropertyKey("net.woggioni.gbcs.conf.dir")
                 .build()
-            val gbcsCli = GradleBuildCacheServerCli(app, log)
+            val gbcsCli = GradleBuildCacheServerCli()
             val commandLine = CommandLine(gbcsCli)
             commandLine.setExecutionExceptionHandler { ex, cl, parseResult ->
                 log.error(ex.message, ex)
                 CommandLine.ExitCode.SOFTWARE
             }
+            commandLine.addSubcommand(ServerCommand(app))
             commandLine.addSubcommand(PasswordHashCommand())
+            commandLine.addSubcommand(
+                CommandLine(ClientCommand(app)).apply {
+                    addSubcommand(BenchmarkCommand())
+                    addSubcommand(PutCommand())
+                    addSubcommand(GetCommand())
+                })
             System.exit(commandLine.execute(*args))
         }
     }
 
-    @CommandLine.Option(
-        names = ["-c", "--config-file"],
-        description = ["Read the application configuration from this file"],
-        paramLabel = "CONFIG_FILE"
-    )
-    private var configurationFile: Path = findConfigurationFile(application)
-
     @CommandLine.Option(names = ["-V", "--version"], versionHelp = true)
     var versionHelp = false
         private set
@@ -60,40 +57,8 @@ class GradleBuildCacheServerCli(application : Application, private val log : Log
     @CommandLine.Spec
     private lateinit var spec: CommandSpec
 
-    private fun findConfigurationFile(app : Application): Path {
-        val confDir = app.computeConfigurationDirectory()
-        val configurationFile = confDir.resolve("gbcs.xml")
-        return configurationFile
-    }
-
-    private fun createDefaultConfigurationFile(configurationFile : Path) {
-        log.info {
-            "Creating default configuration file at '$configurationFile'"
-        }
-        val defaultConfigurationFileResource = DEFAULT_CONFIGURATION_URL
-        Files.newOutputStream(configurationFile).use { outputStream ->
-            defaultConfigurationFileResource.openStream().use { inputStream ->
-                JWO.copy(inputStream, outputStream)
-            }
-        }
-    }
 
     override fun run() {
-        if (!Files.exists(configurationFile)) {
-            Files.createDirectories(configurationFile.parent)
-            createDefaultConfigurationFile(configurationFile)
-        }
-
-        val configuration = GradleBuildCacheServer.loadConfiguration(configurationFile)
-        log.debug {
-            ByteArrayOutputStream().also {
-                GradleBuildCacheServer.dumpConfiguration(configuration, it)
-            }.let {
-                "Server configuration:\n${String(it.toByteArray())}"
-            }
-        }
-        val server = GradleBuildCacheServer(configuration)
-        server.run().use {
-        }
+        spec.commandLine().usage(System.out);
     }
 }

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/AbstractVersionProvider.kt

@@ -1,8 +1,6 @@
 package net.woggioni.gbcs.cli.impl
 
 import picocli.CommandLine
-import java.net.URL
-import java.util.Enumeration
 import java.util.jar.Attributes
 import java.util.jar.JarFile
 import java.util.jar.Manifest

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/GbcsCommand.kt

@@ -1,6 +1,8 @@
 package net.woggioni.gbcs.cli.impl
 
+import net.woggioni.jwo.Application
 import picocli.CommandLine
+import java.nio.file.Path
 
 
 abstract class GbcsCommand : Runnable {
@@ -8,4 +10,10 @@ abstract class GbcsCommand : Runnable {
     @CommandLine.Option(names = ["-h", "--help"], usageHelp = true)
     var usageHelp = false
         private set
+
+    protected fun findConfigurationFile(app: Application, fileName : String): Path {
+        val confDir = app.computeConfigurationDirectory()
+        val configurationFile = confDir.resolve(fileName)
+        return configurationFile
+    }
 }

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/commands/BenchmarkCommand.kt

@@ -0,0 +1,134 @@
+package net.woggioni.gbcs.cli.impl.commands
+
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.common.error
+import net.woggioni.gbcs.common.info
+import net.woggioni.gbcs.cli.impl.GbcsCommand
+import net.woggioni.gbcs.client.GradleBuildCacheClient
+import net.woggioni.jwo.JWO
+import picocli.CommandLine
+import java.security.SecureRandom
+import java.time.Duration
+import java.time.Instant
+import java.util.Base64
+import java.util.concurrent.ExecutionException
+import java.util.concurrent.Future
+import java.util.concurrent.LinkedBlockingQueue
+import java.util.concurrent.atomic.AtomicLong
+import kotlin.random.Random
+
+@CommandLine.Command(
+    name = "benchmark",
+    description = ["Run a load test against the server"],
+    showDefaultValues = true
+)
+class BenchmarkCommand : GbcsCommand() {
+    private val log = contextLogger()
+
+    @CommandLine.Spec
+    private lateinit var spec: CommandLine.Model.CommandSpec
+
+    @CommandLine.Option(
+        names = ["-e", "--entries"],
+        description = ["Total number of elements to be added to the cache"],
+        paramLabel = "NUMBER_OF_ENTRIES"
+    )
+    private var numberOfEntries = 1000
+
+    override fun run() {
+        val clientCommand = spec.parent().userObject() as ClientCommand
+        val profile = clientCommand.profileName.let { profileName ->
+            clientCommand.configuration.profiles[profileName]
+                ?: throw IllegalArgumentException("Profile $profileName does not exist in configuration")
+        }
+        val client = GradleBuildCacheClient(profile)
+
+        val entryGenerator = sequence {
+            val random = Random(SecureRandom.getInstance("NativePRNGNonBlocking").nextLong())
+            while (true) {
+                val key = JWO.bytesToHex(random.nextBytes(16))
+                val content = random.nextInt().toByte()
+                val value = ByteArray(0x1000, { _ -> content })
+                yield(key to value)
+            }
+        }
+
+        val entries = let {
+            val completionQueue = LinkedBlockingQueue<Future<Pair<String, ByteArray>>>(numberOfEntries)
+            val start = Instant.now()
+            val totalElapsedTime = AtomicLong(0)
+            entryGenerator.take(numberOfEntries).forEach { entry ->
+                val requestStart = System.nanoTime()
+                val future = client.put(entry.first, entry.second).thenApply { entry }
+                future.whenComplete { _, _ ->
+                    totalElapsedTime.addAndGet((System.nanoTime() - requestStart))
+                    completionQueue.put(future)
+                }
+            }
+
+            val inserted = sequence<Pair<String, ByteArray>> {
+                var completionCounter = 0
+                while (completionCounter < numberOfEntries) {
+                    val future = completionQueue.take()
+                    try {
+                        yield(future.get())
+                    } catch (ee: ExecutionException) {
+                        val cause = ee.cause ?: ee
+                        log.error(cause.message, cause)
+                    }
+                    completionCounter += 1
+                }
+            }.toList()
+            val end = Instant.now()
+            log.info {
+                val elapsed = Duration.between(start, end).toMillis()
+                "Insertion rate: ${numberOfEntries.toDouble() / elapsed * 1000} ops/s"
+            }
+            log.info {
+                "Average time per insertion: ${totalElapsedTime.get() / numberOfEntries.toDouble() * 1000} ms"
+            }
+            inserted
+        }
+        log.info {
+            "Inserted ${entries.size} entries"
+        }
+        if (entries.isNotEmpty()) {
+            val completionQueue = LinkedBlockingQueue<Future<Unit>>(entries.size)
+            val start = Instant.now()
+            val totalElapsedTime = AtomicLong(0)
+            entries.forEach { entry ->
+                val requestStart = System.nanoTime()
+                val future = client.get(entry.first).thenApply {
+                    totalElapsedTime.addAndGet((System.nanoTime() - requestStart))
+                    if (it == null) {
+                        log.error {
+                            "Missing entry for key '${entry.first}'"
+                        }
+                    } else if (!entry.second.contentEquals(it)) {
+                        log.error {
+                            "Retrieved a value different from what was inserted for key '${entry.first}'"
+                        }
+                    }
+                }
+                future.whenComplete { _, _ ->
+                    completionQueue.put(future)
+                }
+            }
+            var completionCounter = 0
+            while (completionCounter < entries.size) {
+                completionQueue.take()
+                completionCounter += 1
+            }
+            val end = Instant.now()
+            log.info {
+                val elapsed = Duration.between(start, end).toMillis()
+                "Retrieval rate: ${entries.size.toDouble() / elapsed * 1000} ops/s"
+            }
+            log.info {
+                "Average time per retrieval: ${totalElapsedTime.get() / numberOfEntries.toDouble() * 1e6} ms"
+            }
+        } else {
+            log.error("Skipping retrieval benchmark as it was not possible to insert any entry in the cache")
+        }
+    }
+}

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/commands/ClientCommand.kt

@@ -0,0 +1,41 @@
+package net.woggioni.gbcs.cli.impl.commands
+
+import net.woggioni.gbcs.cli.impl.GbcsCommand
+import net.woggioni.gbcs.client.GradleBuildCacheClient
+import net.woggioni.jwo.Application
+import picocli.CommandLine
+import java.nio.file.Path
+
+@CommandLine.Command(
+    name = "client",
+    description = ["GBCS client"],
+    showDefaultValues = true
+)
+class ClientCommand(app : Application) : GbcsCommand() {
+
+    @CommandLine.Option(
+        names = ["-c", "--configuration"],
+        description = ["Path to the client configuration file"],
+        paramLabel = "CONFIGURATION_FILE"
+    )
+    private var configurationFile : Path = findConfigurationFile(app, "gbcs-client.xml")
+
+    @CommandLine.Option(
+        names = ["-p", "--profile"],
+        description = ["Name of the client profile to be used"],
+        paramLabel = "PROFILE",
+        required = true
+    )
+    var profileName : String? = null
+
+    val configuration : GradleBuildCacheClient.Configuration by lazy {
+        GradleBuildCacheClient.Configuration.parse(configurationFile)
+    }
+
+    override fun run() {
+        println("Available profiles:")
+        configuration.profiles.forEach { (profileName, _) ->
+            println(profileName)
+        }
+    }
+}

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/commands/GetCommand.kt

@@ -0,0 +1,51 @@
+package net.woggioni.gbcs.cli.impl.commands
+
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.cli.impl.GbcsCommand
+import net.woggioni.gbcs.client.GradleBuildCacheClient
+import picocli.CommandLine
+import java.nio.file.Files
+import java.nio.file.Path
+
+@CommandLine.Command(
+    name = "get",
+    description = ["Fetch a value from the cache with the specified key"],
+    showDefaultValues = true
+)
+class GetCommand : GbcsCommand() {
+    private val log = contextLogger()
+
+    @CommandLine.Spec
+    private lateinit var spec: CommandLine.Model.CommandSpec
+
+    @CommandLine.Option(
+        names = ["-k", "--key"],
+        description = ["The key for the new value"],
+        paramLabel = "KEY"
+    )
+    private var key : String = ""
+
+    @CommandLine.Option(
+        names = ["-v", "--value"],
+        description = ["Path to a file where the retrieved value will be written (defaults to stdout)"],
+        paramLabel = "VALUE_FILE",
+    )
+    private var output : Path? = null
+
+    override fun run() {
+        val clientCommand = spec.parent().userObject() as ClientCommand
+        val profile = clientCommand.profileName.let { profileName ->
+            clientCommand.configuration.profiles[profileName]
+                ?: throw IllegalArgumentException("Profile $profileName does not exist in configuration")
+        }
+        GradleBuildCacheClient(profile).use { client ->
+            client.get(key).thenApply { value ->
+                value?.let {
+                    (output?.let(Files::newOutputStream) ?: System.out).use {
+                        it.write(value)
+                    }
+                } ?: throw NoSuchElementException("No value found for key $key")
+            }.get()
+        }
+    }
+}

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/commands/PasswordHashCommand.kt

@@ -1,13 +1,13 @@
 package net.woggioni.gbcs.cli.impl.commands
 
-import net.woggioni.gbcs.base.PasswordSecurity.hashPassword
+import net.woggioni.gbcs.common.PasswordSecurity.hashPassword
 import net.woggioni.gbcs.cli.impl.GbcsCommand
 import net.woggioni.gbcs.cli.impl.converters.OutputStreamConverter
 import net.woggioni.jwo.UncloseableOutputStream
 import picocli.CommandLine
-import java.io.BufferedWriter
 import java.io.OutputStream
 import java.io.OutputStreamWriter
+import java.io.PrintWriter
 
 
 @CommandLine.Command(
@@ -20,7 +20,7 @@ class PasswordHashCommand : GbcsCommand() {
         names = ["-o", "--output-file"],
         description = ["Write the output to a file instead of stdout"],
         converter = [OutputStreamConverter::class],
-        defaultValue = "stdout",
+        showDefaultValue = CommandLine.Help.Visibility.NEVER,
         paramLabel = "OUTPUT_FILE"
     )
     private var outputStream: OutputStream = UncloseableOutputStream(System.out)
@@ -30,9 +30,8 @@ class PasswordHashCommand : GbcsCommand() {
         val password2 = String(System.console().readPassword("Type your password again for confirmation:"))
         if(password1 != password2) throw IllegalArgumentException("Passwords do not match")
 
-        BufferedWriter(OutputStreamWriter(outputStream, Charsets.UTF_8)).use {
-            it.write(hashPassword(password1))
-            it.newLine()
+        PrintWriter(OutputStreamWriter(outputStream, Charsets.UTF_8)).use {
+            it.println(hashPassword(password1))
         }
     }
 }

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/commands/PutCommand.kt

@@ -0,0 +1,48 @@
+package net.woggioni.gbcs.cli.impl.commands
+
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.cli.impl.GbcsCommand
+import net.woggioni.gbcs.cli.impl.converters.InputStreamConverter
+import net.woggioni.gbcs.client.GradleBuildCacheClient
+import picocli.CommandLine
+import java.io.InputStream
+
+@CommandLine.Command(
+    name = "put",
+    description = ["Add or replace a value to the cache with the specified key"],
+    showDefaultValues = true
+)
+class PutCommand : GbcsCommand() {
+    private val log = contextLogger()
+
+    @CommandLine.Spec
+    private lateinit var spec: CommandLine.Model.CommandSpec
+
+    @CommandLine.Option(
+        names = ["-k", "--key"],
+        description = ["The key for the new value"],
+        paramLabel = "KEY"
+    )
+    private var key : String = ""
+
+    @CommandLine.Option(
+        names = ["-v", "--value"],
+        description = ["Path to a file containing the value to be added (defaults to stdin)"],
+        paramLabel = "VALUE_FILE",
+        converter = [InputStreamConverter::class]
+    )
+    private var value : InputStream = System.`in`
+
+    override fun run() {
+        val clientCommand = spec.parent().userObject() as ClientCommand
+        val profile = clientCommand.profileName.let { profileName ->
+            clientCommand.configuration.profiles[profileName]
+                ?: throw IllegalArgumentException("Profile $profileName does not exist in configuration")
+        }
+        GradleBuildCacheClient(profile).use { client ->
+            value.use {
+                client.put(key, it.readAllBytes())
+            }.get()
+        }
+    }
+}

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/commands/ServerCommand.kt

@@ -0,0 +1,67 @@
+package net.woggioni.gbcs.cli.impl.commands
+
+import net.woggioni.gbcs.server.GradleBuildCacheServer
+import net.woggioni.gbcs.server.GradleBuildCacheServer.Companion.DEFAULT_CONFIGURATION_URL
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.common.debug
+import net.woggioni.gbcs.common.info
+import net.woggioni.gbcs.cli.impl.GbcsCommand
+import net.woggioni.jwo.Application
+import net.woggioni.jwo.JWO
+import picocli.CommandLine
+import java.io.ByteArrayOutputStream
+import java.nio.file.Files
+import java.nio.file.Path
+
+@CommandLine.Command(
+    name = "server",
+    description = ["GBCS server"],
+    showDefaultValues = true
+)
+class ServerCommand(app : Application) : GbcsCommand() {
+
+    private val log = contextLogger()
+
+    private fun createDefaultConfigurationFile(configurationFile: Path) {
+        log.info {
+            "Creating default configuration file at '$configurationFile'"
+        }
+        val defaultConfigurationFileResource = DEFAULT_CONFIGURATION_URL
+        Files.newOutputStream(configurationFile).use { outputStream ->
+            defaultConfigurationFileResource.openStream().use { inputStream ->
+                JWO.copy(inputStream, outputStream)
+            }
+        }
+    }
+
+    @CommandLine.Option(
+        names = ["-c", "--config-file"],
+        description = ["Read the application configuration from this file"],
+        paramLabel = "CONFIG_FILE"
+    )
+    private var configurationFile: Path = findConfigurationFile(app, "gbcs-server.xml")
+
+    val configuration : Configuration by lazy {
+        GradleBuildCacheServer.loadConfiguration(configurationFile)
+    }
+
+    override fun run() {
+        if (!Files.exists(configurationFile)) {
+            Files.createDirectories(configurationFile.parent)
+            createDefaultConfigurationFile(configurationFile)
+        }
+
+        val configuration = GradleBuildCacheServer.loadConfiguration(configurationFile)
+        log.debug {
+            ByteArrayOutputStream().also {
+                GradleBuildCacheServer.dumpConfiguration(configuration, it)
+            }.let {
+                "Server configuration:\n${String(it.toByteArray())}"
+            }
+        }
+        val server = GradleBuildCacheServer(configuration)
+        server.run().use {
+        }
+    }
+}

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/converters/InputStreamConverter.kt

@@ -0,0 +1,13 @@
+package net.woggioni.gbcs.cli.impl.converters
+
+import picocli.CommandLine
+import java.io.InputStream
+import java.nio.file.Files
+import java.nio.file.Paths
+
+
+class InputStreamConverter : CommandLine.ITypeConverter<InputStream> {
+    override fun convert(value: String): InputStream {
+        return Files.newInputStream(Paths.get(value))
+    }
+}

gbcs-cli/src/main/resources/net/woggioni/gbcs/cli/logback.xml

@@ -12,10 +12,9 @@
         </encoder>
     </appender>
 
-    <root level="debug">
+    <root level="info">
         <appender-ref ref="console"/>
     </root>
-    <logger name="io.netty" level="debug"/>
     <logger name="com.google.code.yanf4j" level="warn"/>
     <logger name="net.rubyeye.xmemcached" level="warn"/>
 </configuration>

gbcs-client/build.gradle

@@ -0,0 +1,17 @@
+plugins {
+    id 'java-library'
+    alias catalog.plugins.kotlin.jvm
+}
+
+dependencies {
+    implementation project(':gbcs-api')
+    implementation project(':gbcs-common')
+    implementation catalog.picocli
+    implementation catalog.slf4j.api
+    implementation catalog.netty.buffer
+    implementation catalog.netty.codec.http
+
+    testRuntimeOnly catalog.logback.classic
+}
+
+

gbcs-client/src/main/java/module-info.java

@@ -0,0 +1,17 @@
+module net.woggioni.gbcs.client {
+    requires io.netty.handler;
+    requires io.netty.codec.http;
+    requires io.netty.transport;
+    requires kotlin.stdlib;
+    requires io.netty.common;
+    requires io.netty.buffer;
+    requires java.xml;
+    requires net.woggioni.gbcs.common;
+    requires net.woggioni.gbcs.api;
+    requires io.netty.codec;
+    requires org.slf4j;
+
+    exports net.woggioni.gbcs.client;
+
+    opens net.woggioni.gbcs.client.schema;
+}

gbcs-client/src/main/kotlin/net/woggioni/gbcs/client/Client.kt

@@ -0,0 +1,325 @@
+package net.woggioni.gbcs.client
+
+import io.netty.bootstrap.Bootstrap
+import io.netty.buffer.ByteBuf
+import io.netty.buffer.Unpooled
+import io.netty.channel.Channel
+import io.netty.channel.ChannelHandlerContext
+import io.netty.channel.ChannelOption
+import io.netty.channel.ChannelPipeline
+import io.netty.channel.SimpleChannelInboundHandler
+import io.netty.channel.nio.NioEventLoopGroup
+import io.netty.channel.pool.AbstractChannelPoolHandler
+import io.netty.channel.pool.ChannelPool
+import io.netty.channel.pool.FixedChannelPool
+import io.netty.channel.socket.nio.NioSocketChannel
+import io.netty.handler.codec.DecoderException
+import io.netty.handler.codec.http.DefaultFullHttpRequest
+import io.netty.handler.codec.http.FullHttpRequest
+import io.netty.handler.codec.http.FullHttpResponse
+import io.netty.handler.codec.http.HttpClientCodec
+import io.netty.handler.codec.http.HttpContentDecompressor
+import io.netty.handler.codec.http.HttpHeaderNames
+import io.netty.handler.codec.http.HttpHeaderValues
+import io.netty.handler.codec.http.HttpMethod
+import io.netty.handler.codec.http.HttpObjectAggregator
+import io.netty.handler.codec.http.HttpResponseStatus
+import io.netty.handler.codec.http.HttpVersion
+import io.netty.handler.ssl.SslContext
+import io.netty.handler.ssl.SslContextBuilder
+import io.netty.handler.stream.ChunkedWriteHandler
+import io.netty.util.concurrent.Future
+import io.netty.util.concurrent.GenericFutureListener
+import net.woggioni.gbcs.client.impl.Parser
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.common.debug
+import net.woggioni.gbcs.common.trace
+import java.net.InetSocketAddress
+import java.net.URI
+import java.nio.file.Files
+import java.nio.file.Path
+import java.security.PrivateKey
+import java.security.cert.X509Certificate
+import java.time.Duration
+import java.util.Base64
+import java.util.concurrent.CompletableFuture
+import java.util.concurrent.atomic.AtomicInteger
+import io.netty.util.concurrent.Future as NettyFuture
+
+
+class GradleBuildCacheClient(private val profile: Configuration.Profile) : AutoCloseable {
+    private val group: NioEventLoopGroup
+    private var sslContext: SslContext
+    private val log = contextLogger()
+    private val pool: ChannelPool
+
+    data class Configuration(
+        val profiles: Map<String, Profile>
+    ) {
+        sealed class Authentication {
+            data class TlsClientAuthenticationCredentials(
+                val key: PrivateKey,
+                val certificateChain: Array<X509Certificate>
+            ) : Authentication()
+
+            data class BasicAuthenticationCredentials(val username: String, val password: String) : Authentication()
+        }
+
+        class RetryPolicy(
+            val maxAttempts: Int,
+            val initialDelayMillis: Long,
+            val exp: Double
+        )
+
+        data class Profile(
+            val serverURI: URI,
+            val authentication: Authentication?,
+            val connectionTimeout: Duration?,
+            val maxConnections: Int,
+            val retryPolicy: RetryPolicy?,
+        )
+
+        companion object {
+            fun parse(path: Path): Configuration {
+                return Files.newInputStream(path).use {
+                    Xml.parseXml(path.toUri().toURL(), it)
+                }.let(Parser::parse)
+            }
+        }
+    }
+
+    init {
+        group = NioEventLoopGroup()
+        sslContext = SslContextBuilder.forClient().also { builder ->
+            (profile.authentication as? Configuration.Authentication.TlsClientAuthenticationCredentials)?.let { tlsClientAuthenticationCredentials ->
+                builder.keyManager(
+                    tlsClientAuthenticationCredentials.key,
+                    *tlsClientAuthenticationCredentials.certificateChain
+                )
+            }
+        }.build()
+
+        val (scheme, host, port) = profile.serverURI.run {
+            Triple(
+                if (scheme == null) "http" else profile.serverURI.scheme,
+                host,
+                port.takeIf { it > 0 } ?: if ("https" == scheme.lowercase()) 443 else 80
+            )
+        }
+
+        val bootstrap = Bootstrap().apply {
+            group(group)
+            channel(NioSocketChannel::class.java)
+            option(ChannelOption.TCP_NODELAY, true)
+            option(ChannelOption.SO_KEEPALIVE, true)
+            remoteAddress(InetSocketAddress(host, port))
+            profile.connectionTimeout?.let {
+                option(ChannelOption.CONNECT_TIMEOUT_MILLIS, it.toMillis().toInt())
+            }
+        }
+        val channelPoolHandler = object : AbstractChannelPoolHandler() {
+
+            @Volatile
+            private var connectionCount = AtomicInteger()
+
+            @Volatile
+            private var leaseCount = AtomicInteger()
+
+            override fun channelReleased(ch: Channel) {
+                val activeLeases = leaseCount.decrementAndGet()
+                log.trace {
+                    "Released channel ${ch.id().asShortText()}, number of active leases: $activeLeases"
+                }
+            }
+
+            override fun channelAcquired(ch: Channel) {
+                val activeLeases = leaseCount.getAndIncrement()
+                log.trace {
+                    "Acquired channel ${ch.id().asShortText()}, number of active leases: $activeLeases"
+                }
+            }
+
+            override fun channelCreated(ch: Channel) {
+                val connectionId = connectionCount.getAndIncrement()
+                log.debug {
+                    "Created connection $connectionId, total number of active connections: $connectionId"
+                }
+                ch.closeFuture().addListener {
+                    val activeConnections = connectionCount.decrementAndGet()
+                    log.debug {
+                        "Closed connection $connectionId, total number of active connections: $activeConnections"
+                    }
+                }
+                val pipeline: ChannelPipeline = ch.pipeline()
+
+                // Add SSL handler if needed
+                if ("https".equals(scheme, ignoreCase = true)) {
+                    pipeline.addLast("ssl", sslContext.newHandler(ch.alloc(), host, port))
+                }
+
+                // HTTP handlers
+                pipeline.addLast("codec", HttpClientCodec())
+                pipeline.addLast("decompressor", HttpContentDecompressor())
+                pipeline.addLast("aggregator", HttpObjectAggregator(134217728))
+                pipeline.addLast("chunked", ChunkedWriteHandler())
+            }
+        }
+        pool = FixedChannelPool(bootstrap, channelPoolHandler, profile.maxConnections)
+    }
+
+    private fun executeWithRetry(operation: () -> CompletableFuture<FullHttpResponse>): CompletableFuture<FullHttpResponse> {
+        val retryPolicy = profile.retryPolicy
+        return if (retryPolicy != null) {
+            val outcomeHandler = OutcomeHandler<FullHttpResponse> { outcome ->
+                when (outcome) {
+                    is OperationOutcome.Success -> {
+                        val response = outcome.result
+                        val status = response.status()
+                        when (status) {
+                            HttpResponseStatus.TOO_MANY_REQUESTS -> {
+                                val retryAfter = response.headers()[HttpHeaderNames.RETRY_AFTER]?.let { headerValue ->
+                                    try {
+                                        headerValue.toLong() * 1000
+                                    } catch (nfe: NumberFormatException) {
+                                        null
+                                    }
+                                }
+                                OutcomeHandlerResult.Retry(retryAfter)
+                            }
+
+                            HttpResponseStatus.INTERNAL_SERVER_ERROR, HttpResponseStatus.SERVICE_UNAVAILABLE ->
+                                OutcomeHandlerResult.Retry()
+
+                            else -> OutcomeHandlerResult.DoNotRetry()
+                        }
+                    }
+
+                    is OperationOutcome.Failure -> {
+                        OutcomeHandlerResult.Retry()
+                    }
+                }
+            }
+            executeWithRetry(
+                group,
+                retryPolicy.maxAttempts,
+                retryPolicy.initialDelayMillis.toDouble(),
+                retryPolicy.exp,
+                outcomeHandler,
+                operation
+            )
+        } else {
+            operation()
+        }
+    }
+
+    fun get(key: String): CompletableFuture<ByteArray?> {
+        return executeWithRetry {
+            sendRequest(profile.serverURI.resolve(key), HttpMethod.GET, null)
+        }.thenApply {
+            val status = it.status()
+            if (it.status() == HttpResponseStatus.NOT_FOUND) {
+                null
+            } else if (it.status() != HttpResponseStatus.OK) {
+                throw HttpException(status)
+            } else {
+                it.content()
+            }
+        }.thenApply { maybeByteBuf ->
+            maybeByteBuf?.let {
+                val result = ByteArray(it.readableBytes())
+                it.getBytes(0, result)
+                result
+            }
+        }
+    }
+
+    fun put(key: String, content: ByteArray): CompletableFuture<Unit> {
+        return executeWithRetry {
+            sendRequest(profile.serverURI.resolve(key), HttpMethod.PUT, content)
+        }.thenApply {
+            val status = it.status()
+            if (it.status() != HttpResponseStatus.CREATED && it.status() != HttpResponseStatus.OK) {
+                throw HttpException(status)
+            }
+        }
+    }
+
+    private fun sendRequest(uri: URI, method: HttpMethod, body: ByteArray?): CompletableFuture<FullHttpResponse> {
+        val responseFuture = CompletableFuture<FullHttpResponse>()
+        // Custom handler for processing responses
+        pool.acquire().addListener(object : GenericFutureListener<NettyFuture<Channel>> {
+            override fun operationComplete(channelFuture: Future<Channel>) {
+                if (channelFuture.isSuccess) {
+                    val channel = channelFuture.now
+                    val pipeline = channel.pipeline()
+                    channel.pipeline().addLast("handler", object : SimpleChannelInboundHandler<FullHttpResponse>() {
+                        override fun channelRead0(
+                            ctx: ChannelHandlerContext,
+                            response: FullHttpResponse
+                        ) {
+                            pipeline.removeLast()
+                            pool.release(channel)
+                            responseFuture.complete(response)
+                        }
+
+                        override fun exceptionCaught(ctx: ChannelHandlerContext, cause: Throwable) {
+                            val ex = when (cause) {
+                                is DecoderException -> cause.cause
+                                else -> cause
+                            }
+                            responseFuture.completeExceptionally(ex)
+                            ctx.close()
+                            pipeline.removeLast()
+                            pool.release(channel)
+                        }
+                    })
+                    // Prepare the HTTP request
+                    val request: FullHttpRequest = let {
+                        val content: ByteBuf? = body?.takeIf(ByteArray::isNotEmpty)?.let(Unpooled::wrappedBuffer)
+                        DefaultFullHttpRequest(
+                            HttpVersion.HTTP_1_1,
+                            method,
+                            uri.rawPath,
+                            content ?: Unpooled.buffer(0)
+                        ).apply {
+                            headers().apply {
+                                if (content != null) {
+                                    set(HttpHeaderNames.CONTENT_TYPE, HttpHeaderValues.APPLICATION_OCTET_STREAM)
+                                    set(HttpHeaderNames.CONTENT_LENGTH, content.readableBytes())
+                                }
+                                set(HttpHeaderNames.HOST, profile.serverURI.host)
+                                set(HttpHeaderNames.CONNECTION, HttpHeaderValues.KEEP_ALIVE)
+                                set(
+                                    HttpHeaderNames.ACCEPT_ENCODING,
+                                    HttpHeaderValues.GZIP.toString() + "," + HttpHeaderValues.DEFLATE.toString()
+                                )
+                                // Add basic auth if configured
+                                (profile.authentication as? Configuration.Authentication.BasicAuthenticationCredentials)?.let { credentials ->
+                                    val auth = "${credentials.username}:${credentials.password}"
+                                    val encodedAuth = Base64.getEncoder().encodeToString(auth.toByteArray())
+                                    set(HttpHeaderNames.AUTHORIZATION, "Basic $encodedAuth")
+                                }
+                            }
+                        }
+                    }
+
+                    // Set headers
+                    // Send the request
+                    channel.writeAndFlush(request)
+                } else {
+                    responseFuture.completeExceptionally(channelFuture.cause())
+                }
+            }
+        })
+        return responseFuture
+    }
+
+    fun shutDown(): NettyFuture<*> {
+        return group.shutdownGracefully()
+    }
+
+    override fun close() {
+        shutDown().sync()
+    }
+}

gbcs-client/src/main/kotlin/net/woggioni/gbcs/client/Exception.kt

@@ -0,0 +1,9 @@
+package net.woggioni.gbcs.client
+
+import io.netty.handler.codec.http.HttpResponseStatus
+
+class HttpException(private val status : HttpResponseStatus) : RuntimeException(status.reasonPhrase()) {
+
+    override val message: String
+        get() = "Http status ${status.code()}: ${status.reasonPhrase()}"
+}

gbcs-client/src/main/kotlin/net/woggioni/gbcs/client/impl/Parser.kt

@@ -0,0 +1,108 @@
+package net.woggioni.gbcs.client.impl
+
+import net.woggioni.gbcs.api.exception.ConfigurationException
+import net.woggioni.gbcs.common.Xml.Companion.asIterable
+import net.woggioni.gbcs.common.Xml.Companion.renderAttribute
+import net.woggioni.gbcs.client.GradleBuildCacheClient
+import org.w3c.dom.Document
+import java.net.URI
+import java.nio.file.Files
+import java.nio.file.Path
+import java.security.KeyStore
+import java.security.PrivateKey
+import java.security.cert.X509Certificate
+import java.time.Duration
+
+object Parser {
+
+    fun parse(document: Document): GradleBuildCacheClient.Configuration {
+        val root = document.documentElement
+        val profiles = mutableMapOf<String, GradleBuildCacheClient.Configuration.Profile>()
+
+        for (child in root.asIterable()) {
+            val tagName = child.localName
+            when (tagName) {
+                "profile" -> {
+                    val name =
+                        child.renderAttribute("name") ?: throw ConfigurationException("name attribute is required")
+                    val uri = child.renderAttribute("base-url")?.let(::URI)
+                        ?: throw ConfigurationException("base-url attribute is required")
+                    var authentication: GradleBuildCacheClient.Configuration.Authentication? = null
+                    var retryPolicy: GradleBuildCacheClient.Configuration.RetryPolicy? = null
+                    for (gchild in child.asIterable()) {
+                        when (gchild.localName) {
+                            "tls-client-auth" -> {
+                                val keyStoreFile = gchild.renderAttribute("key-store-file")
+                                val keyStorePassword =
+                                    gchild.renderAttribute("key-store-password")
+                                val keyAlias = gchild.renderAttribute("key-alias")
+                                val keyPassword = gchild.renderAttribute("key-password")
+
+                                val keystore = KeyStore.getInstance("PKCS12").apply {
+                                    Files.newInputStream(Path.of(keyStoreFile)).use {
+                                        load(it, keyStorePassword?.toCharArray())
+                                    }
+                                }
+                                val key = keystore.getKey(keyAlias, keyPassword?.toCharArray()) as PrivateKey
+                                val certChain = keystore.getCertificateChain(keyAlias).asSequence()
+                                    .map { it as X509Certificate }
+                                    .toList()
+                                    .toTypedArray()
+                                authentication =
+                                    GradleBuildCacheClient.Configuration.Authentication.TlsClientAuthenticationCredentials(
+                                        key,
+                                        certChain
+                                    )
+                            }
+
+                            "basic-auth" -> {
+                                val username = gchild.renderAttribute("user")
+                                    ?: throw ConfigurationException("username attribute is required")
+                                val password = gchild.renderAttribute("password")
+                                    ?: throw ConfigurationException("password attribute is required")
+                                authentication =
+                                    GradleBuildCacheClient.Configuration.Authentication.BasicAuthenticationCredentials(
+                                        username,
+                                        password
+                                    )
+                            }
+
+                            "retry-policy" -> {
+                                val maxAttempts =
+                                    gchild.renderAttribute("max-attempts")
+                                        ?.let(String::toInt)
+                                        ?: throw ConfigurationException("max-attempts attribute is required")
+                                val initialDelay =
+                                    gchild.renderAttribute("initial-delay")
+                                        ?.let(Duration::parse)
+                                        ?: Duration.ofSeconds(1)
+                                val exp =
+                                    gchild.renderAttribute("exp")
+                                        ?.let(String::toDouble)
+                                        ?: 2.0f
+                                retryPolicy = GradleBuildCacheClient.Configuration.RetryPolicy(
+                                    maxAttempts,
+                                    initialDelay.toMillis(),
+                                    exp.toDouble()
+                                )
+                            }
+                        }
+                    }
+                    val maxConnections = child.renderAttribute("max-connections")
+                        ?.let(String::toInt)
+                        ?: 50
+                    val connectionTimeout = child.renderAttribute("connection-timeout")
+                        ?.let(Duration::parse)
+                    profiles[name] = GradleBuildCacheClient.Configuration.Profile(
+                        uri,
+                        authentication,
+                        connectionTimeout,
+                        maxConnections,
+                        retryPolicy
+                    )
+                }
+            }
+        }
+        return GradleBuildCacheClient.Configuration(profiles)
+    }
+}

gbcs-client/src/main/kotlin/net/woggioni/gbcs/client/retry.kt

@@ -0,0 +1,75 @@
+package net.woggioni.gbcs.client
+
+import io.netty.util.concurrent.EventExecutorGroup
+import java.util.concurrent.CompletableFuture
+import java.util.concurrent.TimeUnit
+
+sealed class OperationOutcome<T> {
+    class Success<T>(val result: T) : OperationOutcome<T>()
+    class Failure<T>(val ex: Throwable) : OperationOutcome<T>()
+}
+
+sealed class OutcomeHandlerResult {
+    class Retry(val suggestedDelayMillis: Long? = null) : OutcomeHandlerResult()
+    class DoNotRetry : OutcomeHandlerResult()
+}
+
+fun interface OutcomeHandler<T> {
+    fun shouldRetry(result: OperationOutcome<T>): OutcomeHandlerResult
+}
+
+fun <T> executeWithRetry(
+    eventExecutorGroup: EventExecutorGroup,
+    maxAttempts: Int,
+    initialDelay: Double,
+    exp: Double,
+    outcomeHandler: OutcomeHandler<T>,
+    cb: () -> CompletableFuture<T>
+): CompletableFuture<T> {
+    val finalResult = cb()
+    var future = finalResult
+    var shortCircuit = false
+    for (i in 1 until maxAttempts) {
+        future = future.handle { result, ex ->
+            val operationOutcome = if (ex == null) {
+                OperationOutcome.Success(result)
+            } else {
+                OperationOutcome.Failure(ex.cause ?: ex)
+            }
+            if (shortCircuit) {
+                when(operationOutcome) {
+                    is OperationOutcome.Failure -> throw operationOutcome.ex
+                    is OperationOutcome.Success -> CompletableFuture.completedFuture(operationOutcome.result)
+                }
+            } else {
+                when(val outcomeHandlerResult = outcomeHandler.shouldRetry(operationOutcome)) {
+                    is OutcomeHandlerResult.Retry -> {
+                        val res = CompletableFuture<T>()
+                        val delay = run {
+                            val scheduledDelay = (initialDelay * Math.pow(exp, i.toDouble())).toLong()
+                            outcomeHandlerResult.suggestedDelayMillis?.coerceAtMost(scheduledDelay) ?: scheduledDelay
+                        }
+                        eventExecutorGroup.schedule({
+                            cb().handle { result, ex ->
+                                if (ex == null) {
+                                    res.complete(result)
+                                } else {
+                                    res.completeExceptionally(ex)
+                                }
+                            }
+                        }, delay, TimeUnit.MILLISECONDS)
+                        res
+                    }
+                    is OutcomeHandlerResult.DoNotRetry -> {
+                        shortCircuit = true
+                        when(operationOutcome) {
+                            is OperationOutcome.Failure -> throw operationOutcome.ex
+                            is OperationOutcome.Success -> CompletableFuture.completedFuture(operationOutcome.result)
+                        }
+                    }
+                }
+            }
+        }.thenCompose { it }
+    }
+    return future
+}

gbcs-client/src/main/resources/net/woggioni/gbcs/client/schema/gbcs-client.xsd

@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<xs:schema targetNamespace="urn:net.woggioni.gbcs.client"
+           xmlns:xs="http://www.w3.org/2001/XMLSchema"
+           xmlns:gbcs-client="urn:net.woggioni.gbcs.client"
+           elementFormDefault="unqualified"
+>
+    <xs:element name="profiles" type="gbcs-client:profilesType"/>
+
+    <xs:complexType name="profilesType">
+        <xs:sequence minOccurs="0">
+            <xs:element name="profile" type="gbcs-client:profileType" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="profileType">
+        <xs:sequence>
+            <xs:choice>
+                <xs:element name="no-auth" type="gbcs-client:noAuthType"/>
+                <xs:element name="basic-auth" type="gbcs-client:basicAuthType"/>
+                <xs:element name="tls-client-auth" type="gbcs-client:tlsClientAuthType"/>
+            </xs:choice>
+            <xs:element name="retry-policy" type="gbcs-client:retryType" minOccurs="0"/>
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:token" use="required"/>
+        <xs:attribute name="base-url" type="xs:anyURI" use="required"/>
+        <xs:attribute name="max-connections" type="xs:positiveInteger" default="50"/>
+        <xs:attribute name="connection-timeout" type="xs:duration"/>
+    </xs:complexType>
+
+    <xs:complexType name="noAuthType"/>
+
+    <xs:complexType name="basicAuthType">
+        <xs:attribute name="user" type="xs:token" use="required"/>
+        <xs:attribute name="password" type="xs:string" use="required"/>
+    </xs:complexType>
+
+    <xs:complexType name="tlsClientAuthType">
+        <xs:attribute name="key-store-file" type="xs:anyURI" use="required"/>
+        <xs:attribute name="key-store-password" type="xs:string" use="required"/>
+        <xs:attribute name="key-alias" type="xs:token" use="required"/>
+        <xs:attribute name="key-password" type="xs:string" use="optional"/>
+    </xs:complexType>
+
+    <xs:complexType name="retryType">
+        <xs:attribute name="max-attempts" type="xs:positiveInteger" use="required"/>
+        <xs:attribute name="initial-delay" type="xs:duration" default="PT1S"/>
+        <xs:attribute name="exp" type="xs:double" default="2.0"/>
+    </xs:complexType>
+
+</xs:schema>

gbcs-client/src/test/kotlin/net/woggioni/gbcs/client/RetryTest.kt

@@ -0,0 +1,149 @@
+package net.woggioni.gbcs.client
+
+import io.netty.util.concurrent.DefaultEventExecutorGroup
+import io.netty.util.concurrent.EventExecutorGroup
+import net.woggioni.gbcs.common.contextLogger
+import org.junit.jupiter.api.Assertions
+import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.extension.ExtensionContext
+import org.junit.jupiter.params.ParameterizedTest
+import org.junit.jupiter.params.provider.Arguments
+import org.junit.jupiter.params.provider.ArgumentsProvider
+import org.junit.jupiter.params.provider.ArgumentsSource
+import java.util.concurrent.CompletableFuture
+import java.util.stream.Stream
+import kotlin.random.Random
+
+class RetryTest {
+
+    data class TestArgs(
+        val seed: Int,
+        val maxAttempt: Int,
+        val initialDelay: Double,
+        val exp: Double,
+    )
+
+    class TestArguments : ArgumentsProvider {
+        override fun provideArguments(context: ExtensionContext): Stream<out Arguments> {
+            return Stream.of(
+                TestArgs(
+                    seed = 101325,
+                    maxAttempt = 5,
+                    initialDelay = 50.0,
+                    exp = 2.0,
+                ),
+                TestArgs(
+                    seed = 101325,
+                    maxAttempt = 20,
+                    initialDelay = 100.0,
+                    exp = 1.1,
+                ),
+                TestArgs(
+                    seed = 123487,
+                    maxAttempt = 20,
+                    initialDelay = 100.0,
+                    exp = 2.0,
+                ),
+                TestArgs(
+                    seed = 20082024,
+                    maxAttempt = 10,
+                    initialDelay = 100.0,
+                    exp = 2.0,
+                )
+            ).map {
+                object: Arguments {
+                    override fun get() = arrayOf(it)
+                }
+            }
+        }
+    }
+
+    @ArgumentsSource(TestArguments::class)
+    @ParameterizedTest
+    fun test(testArgs: TestArgs) {
+        val log = contextLogger()
+        log.debug("Start")
+        val executor: EventExecutorGroup = DefaultEventExecutorGroup(1)
+        val attempts = mutableListOf<Pair<Long, OperationOutcome<Int>>>()
+        val outcomeHandler = OutcomeHandler<Int> { outcome ->
+            when(outcome) {
+                is OperationOutcome.Success -> {
+                    if(outcome.result % 10 == 0) {
+                        OutcomeHandlerResult.DoNotRetry()
+                    } else {
+                        OutcomeHandlerResult.Retry(null)
+                    }
+                }
+                is OperationOutcome.Failure -> {
+                    when(outcome.ex) {
+                        is IllegalStateException -> {
+                            log.debug(outcome.ex.message, outcome.ex)
+                            OutcomeHandlerResult.Retry(null)
+                        }
+                        else -> {
+                            OutcomeHandlerResult.DoNotRetry()
+                        }
+                    }
+                }
+            }
+        }
+        val random = Random(testArgs.seed)
+
+        val future =
+            executeWithRetry(executor, testArgs.maxAttempt, testArgs.initialDelay, testArgs.exp, outcomeHandler) {
+                val now = System.nanoTime()
+                val result = CompletableFuture<Int>()
+                executor.submit {
+                    val n = random.nextInt(0, Integer.MAX_VALUE)
+                    log.debug("Got new number: {}", n)
+                    if(n % 3 == 0) {
+                        val ex = IllegalStateException("Value $n can be divided by 3")
+                        result.completeExceptionally(ex)
+                        attempts += now to OperationOutcome.Failure(ex)
+                    } else if(n % 7 == 0) {
+                        val ex = RuntimeException("Value $n can be divided by 7")
+                        result.completeExceptionally(ex)
+                        attempts += now to OperationOutcome.Failure(ex)
+                    } else {
+                        result.complete(n)
+                        attempts += now to OperationOutcome.Success(n)
+                    }
+                }
+                result
+            }
+        Assertions.assertTrue(attempts.size <= testArgs.maxAttempt)
+        val result = future.handle { res, ex ->
+            if(ex != null) {
+                val err = ex.cause ?: ex
+                log.debug(err.message, err)
+                OperationOutcome.Failure(err)
+            } else {
+                OperationOutcome.Success(res)
+            }
+        }.get()
+        for ((index, attempt) in attempts.withIndex()) {
+            val (timestamp, value) = attempt
+            if (index > 0) {
+                /* Check the delay for subsequent attempts is correct */
+                val previousAttempt = attempts[index - 1]
+                val expectedTimestamp =
+                    previousAttempt.first + testArgs.initialDelay * Math.pow(testArgs.exp, index.toDouble()) * 1e6
+                val actualTimestamp = timestamp
+                val err = Math.abs(expectedTimestamp - actualTimestamp) / expectedTimestamp
+                Assertions.assertTrue(err < 1e-3)
+            }
+            if (index == attempts.size - 1 && index < testArgs.maxAttempt - 1) {
+                /*
+                 * If the last attempt index is lower than the maximum number of attempts, then
+                 * check the outcome handler returns DoNotRetry
+                 */
+                Assertions.assertTrue(outcomeHandler.shouldRetry(value) is OutcomeHandlerResult.DoNotRetry)
+            } else if (index < attempts.size - 1) {
+                /*
+                 * If the attempt is not the last attempt check the outcome handler returns Retry
+                 */
+                Assertions.assertTrue(outcomeHandler.shouldRetry(value) is OutcomeHandlerResult.Retry)
+            }
+        }
+    }
+}

gbcs-client/src/test/resources/logback.xml

@@ -15,7 +15,7 @@
     <root level="info">
         <appender-ref ref="console"/>
     </root>
-    <logger name="io.netty" level="debug"/>
+    <logger name="io.netty" level="info"/>
     <logger name="com.google.code.yanf4j" level="warn"/>
     <logger name="net.rubyeye.xmemcached" level="warn"/>
 </configuration>

gbcs-client/src/test/resources/net/woggioni/gbcs/client/test/gbcs-client.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs-client:profiles xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+                      xmlns:gbcs-client="urn:net.woggioni.gbcs.client"
+                      xs:schemaLocation="urn:net.woggioni.gbcs.client jms://net.woggioni.gbcs.client/net/woggioni/gbcs/client/schema/gbcs-client.xsd"
+                      >
+    <profile name="profile1" base-url="https://gbcs1.example.com/">
+        <tls-client-auth
+                key-store-file="keystore.pfx"
+                key-store-password="password"
+                key-alias="woggioni@c962475fa38"
+                key-password="key-password"/>
+    </profile>
+    <profile name="profile2" base-url="https://gbcs2.example.com/">
+        <basic-auth user="user" password="password"/>
+    </profile>
+</gbcs-client:profiles>

gbcs-common/build.gradle

@@ -6,8 +6,9 @@ plugins {
 }
 
 dependencies {
-    compileOnly project(':gbcs-api')
-    compileOnly catalog.slf4j.api
+    implementation project(':gbcs-api')
+    implementation catalog.slf4j.api
+    implementation catalog.jwo
 }
 
 publishing {

gbcs-common/src/main/java/module-info.java

@@ -0,0 +1,10 @@
+module net.woggioni.gbcs.common {
+    requires java.xml;
+    requires java.logging;
+    requires org.slf4j;
+    requires kotlin.stdlib;
+    requires net.woggioni.jwo;
+
+    provides java.net.spi.URLStreamHandlerProvider with net.woggioni.gbcs.common.GbcsUrlStreamHandlerFactory;
+    exports net.woggioni.gbcs.common;
+}

gbcs-common/src/main/kotlin/net/woggioni/gbcs/common/GBCS.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.base
+package net.woggioni.gbcs.common
 
 import java.net.URI
 import java.net.URL
@@ -6,7 +6,7 @@ import java.net.URL
 object GBCS {
     fun String.toUrl() : URL = URL.of(URI(this), null)
 
-    const val GBCS_NAMESPACE_URI: String = "urn:net.woggioni.gbcs"
+    const val GBCS_NAMESPACE_URI: String = "urn:net.woggioni.gbcs.server"
     const val GBCS_PREFIX: String = "gbcs"
     const val XML_SCHEMA_NAMESPACE_URI = "http://www.w3.org/2001/XMLSchema-instance"
 }

gbcs-common/src/main/kotlin/net/woggioni/gbcs/common/GbcsUrlStreamHandlerFactory.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.base
+package net.woggioni.gbcs.common
 
 import java.io.IOException
 import java.io.InputStream
@@ -6,12 +6,13 @@ import java.net.URL
 import java.net.URLConnection
 import java.net.URLStreamHandler
 import java.net.URLStreamHandlerFactory
+import java.net.spi.URLStreamHandlerProvider
 import java.util.Optional
 import java.util.concurrent.atomic.AtomicBoolean
 import java.util.stream.Collectors
 
 
-class GbcsUrlStreamHandlerFactory : URLStreamHandlerFactory {
+class GbcsUrlStreamHandlerFactory : URLStreamHandlerProvider() {
 
     private class ClasspathHandler(private val classLoader: ClassLoader = GbcsUrlStreamHandlerFactory::class.java.classLoader) :
         URLStreamHandler() {

gbcs-common/src/main/kotlin/net/woggioni/gbcs/common/HostAndPort.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.base
+package net.woggioni.gbcs.common
 
 
 data class HostAndPort(val host: String, val port: Int = 0) {

gbcs-common/src/main/kotlin/net/woggioni/gbcs/common/Logging.kt

@@ -1,7 +1,8 @@
-package net.woggioni.gbcs.base
+package net.woggioni.gbcs.common
 
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
+import org.slf4j.event.Level
 import java.nio.file.Files
 import java.nio.file.Path
 import java.util.logging.LogManager
@@ -52,6 +53,12 @@ inline fun log(log : Logger,
     }
 }
 
+inline fun Logger.log(level : Level, messageBuilder : () -> String) {
+    if(isEnabledForLevel(level)) {
+        makeLoggingEventBuilder(level).log(messageBuilder())
+    }
+}
+
 inline fun Logger.trace(messageBuilder : () -> String) {
     if(isTraceEnabled) {
         trace(messageBuilder())

gbcs-common/src/main/kotlin/net/woggioni/gbcs/common/PasswordSecurity.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.base
+package net.woggioni.gbcs.common
 
 import java.security.SecureRandom
 import java.security.spec.KeySpec

gbcs-common/src/main/kotlin/net/woggioni/gbcs/common/Xml.kt

@@ -1,6 +1,8 @@
-package net.woggioni.gbcs.base
+package net.woggioni.gbcs.common
 
+import net.woggioni.jwo.JWO
 import org.slf4j.LoggerFactory
+import org.slf4j.event.Level
 import org.w3c.dom.Document
 import org.w3c.dom.Element
 import org.w3c.dom.Node
@@ -80,31 +82,36 @@ class Xml(val doc: Document, val element: Element) {
             private val log = LoggerFactory.getLogger(ErrorHandler::class.java)
         }
 
-        override fun warning(ex: SAXParseException) {
-            log.warn(
-                "Problem at {}:{}:{} parsing deployment configuration: {}",
-                fileURL, ex.lineNumber, ex.columnNumber, ex.message
-            )
-        }
+         override fun warning(ex: SAXParseException)= err(ex, Level.WARN)
 
-        override fun error(ex: SAXParseException) {
-            log.error(
-                "Problem at {}:{}:{} parsing deployment configuration: {}",
-                fileURL, ex.lineNumber, ex.columnNumber, ex.message
-            )
+        private fun err(ex: SAXParseException, level: Level) {
+            log.log(level) {
+                "Problem at ${fileURL}:${ex.lineNumber}:${ex.columnNumber} parsing deployment configuration: ${ex.message}"
+            }
             throw ex
         }
 
-        override fun fatalError(ex: SAXParseException) {
-            log.error(
-                "Problem at {}:{}:{} parsing deployment configuration: {}",
-                fileURL, ex.lineNumber, ex.columnNumber, ex.message
-            )
-            throw ex
-        }
+        override fun error(ex: SAXParseException) = err(ex, Level.ERROR)
+        override fun fatalError(ex: SAXParseException) = err(ex, Level.ERROR)
     }
 
     companion object {
+        private val dictMap: Map<String, Map<String, Any>> = sequenceOf(
+            "env" to System.getenv().asSequence().map { (k, v) -> k to (v as Any) }.toMap(),
+            "sys" to System.getProperties().asSequence().map { (k, v) -> k as String to (v as Any) }.toMap()
+        ).toMap()
+
+        private fun renderConfigurationTemplate(template: String): String {
+            return JWO.renderTemplate(template, emptyMap(), dictMap).replace("$$", "$")
+        }
+
+        fun Element.renderAttribute(name : String, namespaceURI: String? = null) = if(namespaceURI == null) {
+            getAttribute(name)
+        } else {
+            getAttributeNS(name, namespaceURI)
+        }.takeIf(String::isNotEmpty)?.let(Companion::renderConfigurationTemplate)
+
+
         fun Element.asIterable() = Iterable { ElementIterator(this, null) }
         fun NodeList.asIterable() = Iterable { NodeListIterator(this) }
 
@@ -146,29 +153,29 @@ class Xml(val doc: Document, val element: Element) {
             dbf.isExpandEntityReferences = true
             dbf.isIgnoringComments = true
             dbf.isNamespaceAware = true
-            dbf.isValidating = false
-            dbf.setFeature("http://apache.org/xml/features/validation/schema", true);
+            dbf.isValidating = schemaResourceURL == null
+            dbf.setFeature("http://apache.org/xml/features/validation/schema", true)
             schemaResourceURL?.let {
                 dbf.schema = getSchema(it)
             }
             return dbf
         }
 
-    fun newDocumentBuilder(resource: URL, schemaResourceURL: URL?): DocumentBuilder {
-        val db = newDocumentBuilderFactory(schemaResourceURL).newDocumentBuilder()
-        db.setErrorHandler(ErrorHandler(resource))
-        return db
-    }
+        fun newDocumentBuilder(resource: URL, schemaResourceURL: URL?): DocumentBuilder {
+            val db = newDocumentBuilderFactory(schemaResourceURL).newDocumentBuilder()
+            db.setErrorHandler(ErrorHandler(resource))
+            return db
+        }
 
-    fun parseXmlResource(resource: URL, schemaResourceURL: URL?): Document {
-        val db = newDocumentBuilder(resource, schemaResourceURL)
-        return resource.openStream().use(db::parse)
-    }
+        fun parseXmlResource(resource: URL, schemaResourceURL: URL?): Document {
+            val db = newDocumentBuilder(resource, schemaResourceURL)
+            return resource.openStream().use(db::parse)
+        }
 
-    fun parseXml(sourceURL : URL, sourceStream: InputStream? = null, schemaResourceURL: URL? = null): Document {
-        val db = newDocumentBuilder(sourceURL, schemaResourceURL)
-        return sourceStream?.let(db::parse) ?: sourceURL.openStream().use(db::parse)
-    }
+        fun parseXml(sourceURL: URL, sourceStream: InputStream? = null, schemaResourceURL: URL? = null): Document {
+            val db = newDocumentBuilder(sourceURL, schemaResourceURL)
+            return sourceStream?.let(db::parse) ?: sourceURL.openStream().use(db::parse)
+        }
 
         fun write(doc: Document, output: OutputStream) {
             val transformerFactory = TransformerFactory.newInstance()
@@ -183,7 +190,12 @@ class Xml(val doc: Document, val element: Element) {
             transformer.transform(source, result)
         }
 
-        fun of(namespaceURI: String, qualifiedName: String, schemaResourceURL: URL? = null, cb: Xml.(el: Element) -> Unit): Document {
+        fun of(
+            namespaceURI: String,
+            qualifiedName: String,
+            schemaResourceURL: URL? = null,
+            cb: Xml.(el: Element) -> Unit
+        ): Document {
             val dbf = newDocumentBuilderFactory(schemaResourceURL)
             val db = dbf.newDocumentBuilder()
             val doc = db.newDocument()
@@ -207,7 +219,7 @@ class Xml(val doc: Document, val element: Element) {
 
     fun node(
         name: String,
-        namespaceURI : String? = null,
+        namespaceURI: String? = null,
         attrs: Map<String, String> = emptyMap(),
         cb: Xml.(el: Element) -> Unit = {}
     ): Element {
@@ -222,7 +234,7 @@ class Xml(val doc: Document, val element: Element) {
             }
     }
 
-    fun attr(key: String, value: String, namespaceURI : String? = null) {
+    fun attr(key: String, value: String, namespaceURI: String? = null) {
         element.setAttributeNS(namespaceURI, key, value)
     }
 

gbcs-common/src/main/resources/META-INF/services/java.net.spi.URLStreamHandlerProvider

@@ -0,0 +1 @@
+net.woggioni.gbcs.common.GbcsUrlStreamHandlerFactory

gbcs-memcached/src/main/java/module-info.java

@@ -1,14 +0,0 @@
-import net.woggioni.gbcs.api.CacheProvider;
-
-module net.woggioni.gbcs.memcached {
-    requires net.woggioni.gbcs.base;
-    requires net.woggioni.gbcs.api;
-    requires com.googlecode.xmemcached;
-    requires net.woggioni.jwo;
-    requires java.xml;
-    requires kotlin.stdlib;
-
-    provides CacheProvider with net.woggioni.gbcs.memcached.MemcachedCacheProvider;
-
-    opens net.woggioni.gbcs.memcached.schema;
-}

gbcs-memcached/src/main/kotlin/net/woggioni/gbcs/memcached/MemcachedCacheProvider.kt

@@ -1,85 +0,0 @@
-package net.woggioni.gbcs.memcached
-
-import net.rubyeye.xmemcached.transcoders.CompressionMode
-import net.woggioni.gbcs.api.CacheProvider
-import net.woggioni.gbcs.base.GBCS
-import net.woggioni.gbcs.base.HostAndPort
-import net.woggioni.gbcs.base.Xml
-import net.woggioni.gbcs.base.Xml.Companion.asIterable
-import org.w3c.dom.Document
-import org.w3c.dom.Element
-import java.time.Duration
-import java.util.zip.Deflater
-
-class MemcachedCacheProvider : CacheProvider<MemcachedCacheConfiguration> {
-    override fun getXmlSchemaLocation() = "classpath:net/woggioni/gbcs/memcached/schema/gbcs-memcached.xsd"
-
-    override fun getXmlType() = "memcachedCacheType"
-
-    override fun getXmlNamespace()= "urn:net.woggioni.gbcs-memcached"
-
-    override fun deserialize(el: Element): MemcachedCacheConfiguration {
-        val servers = mutableListOf<HostAndPort>()
-        val maxAge = el.getAttribute("max-age")
-            .takeIf(String::isNotEmpty)
-            ?.let(Duration::parse)
-            ?: Duration.ofDays(1)
-        val maxSize = el.getAttribute("max-size")
-            .takeIf(String::isNotEmpty)
-            ?.let(String::toInt)
-            ?: 0x100000
-        val enableCompression = el.getAttribute("enable-compression")
-            .takeIf(String::isNotEmpty)
-            ?.let(String::toBoolean)
-            ?: false
-        val compressionMode = el.getAttribute("compression-mode")
-            .takeIf(String::isNotEmpty)
-            ?.let {
-                when(it) {
-                    "gzip" -> CompressionMode.GZIP
-                    "zip" -> CompressionMode.ZIP
-                    else -> CompressionMode.ZIP
-                }
-            }
-            ?: CompressionMode.ZIP
-        val digestAlgorithm = el.getAttribute("digest").takeIf(String::isNotEmpty)
-        for (child in el.asIterable()) {
-            when (child.nodeName) {
-                "server" -> {
-                    servers.add(HostAndPort(child.getAttribute("host"), child.getAttribute("port").toInt()))
-                }
-            }
-        }
-
-        return MemcachedCacheConfiguration(
-            servers,
-            maxAge,
-            maxSize,
-            digestAlgorithm,
-            compressionMode,
-        )
-    }
-
-    override fun serialize(doc: Document, cache : MemcachedCacheConfiguration) = cache.run {
-        val result = doc.createElementNS(xmlNamespace,"cache")
-        Xml.of(doc, result) {
-            attr("xs:type", xmlType, GBCS.XML_SCHEMA_NAMESPACE_URI)
-            for (server in servers) {
-                node("server", xmlNamespace) {
-                    attr("host", server.host)
-                    attr("port", server.port.toString())
-                }
-            }
-            attr("max-age", maxAge.toString())
-            attr("max-size", maxSize.toString())
-            digestAlgorithm?.let { digestAlgorithm ->
-                attr("digest", digestAlgorithm)
-            }
-            attr("compression-mode", when(compressionMode) {
-                CompressionMode.GZIP -> "gzip"
-                CompressionMode.ZIP -> "zip"
-            })
-        }
-        result
-    }
-}

gbcs-memcached/src/main/resources/META-INF/services/net.woggioni.gbcs.api.CacheProvider

@@ -1 +0,0 @@
-net.woggioni.gbcs.memcached.MemcachedCacheProvider

gbcs-server-memcached/build.gradle

@@ -1,6 +1,3 @@
-import org.jetbrains.kotlin.gradle.dsl.JvmTarget
-import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
-
 plugins {
     id 'java-library'
     id 'maven-publish'
@@ -32,7 +29,7 @@ configurations {
 }
 
 dependencies {
-    compileOnly project(':gbcs-base')
+    compileOnly project(':gbcs-common')
     compileOnly project(':gbcs-api')
     compileOnly catalog.jwo
     implementation catalog.xmemcached

gbcs-server-memcached/src/main/java/module-info.java

@@ -0,0 +1,14 @@
+import net.woggioni.gbcs.api.CacheProvider;
+
+module net.woggioni.gbcs.server.memcached {
+    requires net.woggioni.gbcs.common;
+    requires net.woggioni.gbcs.api;
+    requires com.googlecode.xmemcached;
+    requires net.woggioni.jwo;
+    requires java.xml;
+    requires kotlin.stdlib;
+
+    provides CacheProvider with net.woggioni.gbcs.server.memcached.MemcachedCacheProvider;
+
+    opens net.woggioni.gbcs.server.memcached.schema;
+}

gbcs-server-memcached/src/main/kotlin/net/woggioni/gbcs/server/memcached/MemcachedCache.kt

@@ -1,13 +1,12 @@
-package net.woggioni.gbcs.memcached
+package net.woggioni.gbcs.server.memcached
 
-import net.rubyeye.xmemcached.MemcachedClient
 import net.rubyeye.xmemcached.XMemcachedClientBuilder
 import net.rubyeye.xmemcached.command.BinaryCommandFactory
 import net.rubyeye.xmemcached.transcoders.CompressionMode
 import net.rubyeye.xmemcached.transcoders.SerializingTranscoder
 import net.woggioni.gbcs.api.Cache
 import net.woggioni.gbcs.api.exception.ContentTooLargeException
-import net.woggioni.gbcs.base.HostAndPort
+import net.woggioni.gbcs.common.HostAndPort
 import net.woggioni.jwo.JWO
 import java.io.ByteArrayInputStream
 import java.net.InetSocketAddress

gbcs-server-memcached/src/main/kotlin/net/woggioni/gbcs/server/memcached/MemcachedCacheConfiguration.kt

@@ -1,8 +1,8 @@
-package net.woggioni.gbcs.memcached
+package net.woggioni.gbcs.server.memcached
 
 import net.rubyeye.xmemcached.transcoders.CompressionMode
 import net.woggioni.gbcs.api.Configuration
-import net.woggioni.gbcs.base.HostAndPort
+import net.woggioni.gbcs.common.HostAndPort
 import java.time.Duration
 
 data class MemcachedCacheConfiguration(
@@ -20,7 +20,7 @@ data class MemcachedCacheConfiguration(
         compressionMode
     )
 
-    override fun getNamespaceURI() = "urn:net.woggioni.gbcs-memcached"
+    override fun getNamespaceURI() = "urn:net.woggioni.gbcs.server.memcached"
 
     override fun getTypeName() = "memcachedCacheType"
 }

gbcs-server-memcached/src/main/kotlin/net/woggioni/gbcs/server/memcached/MemcachedCacheProvider.kt

@@ -0,0 +1,88 @@
+package net.woggioni.gbcs.server.memcached
+
+import net.rubyeye.xmemcached.transcoders.CompressionMode
+import net.woggioni.gbcs.api.CacheProvider
+import net.woggioni.gbcs.api.exception.ConfigurationException
+import net.woggioni.gbcs.common.GBCS
+import net.woggioni.gbcs.common.HostAndPort
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.common.Xml.Companion.asIterable
+import net.woggioni.gbcs.common.Xml.Companion.renderAttribute
+import org.w3c.dom.Document
+import org.w3c.dom.Element
+import java.time.Duration
+
+class MemcachedCacheProvider : CacheProvider<MemcachedCacheConfiguration> {
+    override fun getXmlSchemaLocation() = "jpms://net.woggioni.gbcs.server.memcached/net/woggioni/gbcs/server/memcached/schema/gbcs-memcached.xsd"
+
+    override fun getXmlType() = "memcachedCacheType"
+
+    override fun getXmlNamespace() = "urn:net.woggioni.gbcs.server.memcached"
+
+    val xmlNamespacePrefix : String
+        get() = "gbcs-memcached"
+
+    override fun deserialize(el: Element): MemcachedCacheConfiguration {
+        val servers = mutableListOf<HostAndPort>()
+        val maxAge = el.renderAttribute("max-age")
+            ?.let(Duration::parse)
+            ?: Duration.ofDays(1)
+        val maxSize = el.renderAttribute("max-size")
+            ?.let(String::toInt)
+            ?: 0x100000
+        val compressionMode = el.renderAttribute("compression-mode")
+            ?.let {
+                when (it) {
+                    "gzip" -> CompressionMode.GZIP
+                    "zip" -> CompressionMode.ZIP
+                    else -> CompressionMode.ZIP
+                }
+            }
+            ?: CompressionMode.ZIP
+        val digestAlgorithm = el.renderAttribute("digest")
+        for (child in el.asIterable()) {
+            when (child.nodeName) {
+                "server" -> {
+                    val host = child.renderAttribute("host") ?: throw ConfigurationException("host attribute is required")
+                    val port = child.renderAttribute("port")?.toInt() ?: throw ConfigurationException("port attribute is required")
+                    servers.add(HostAndPort(host, port))
+                }
+            }
+        }
+
+        return MemcachedCacheConfiguration(
+            servers,
+            maxAge,
+            maxSize,
+            digestAlgorithm,
+            compressionMode,
+        )
+    }
+
+    override fun serialize(doc: Document, cache: MemcachedCacheConfiguration) = cache.run {
+        val result = doc.createElement("cache")
+        Xml.of(doc, result) {
+            attr("xmlns:${xmlNamespacePrefix}", xmlNamespace, namespaceURI = "http://www.w3.org/2000/xmlns/")
+
+            attr("xs:type", "${xmlNamespacePrefix}:$xmlType", GBCS.XML_SCHEMA_NAMESPACE_URI)
+            for (server in servers) {
+                node("server") {
+                    attr("host", server.host)
+                    attr("port", server.port.toString())
+                }
+            }
+            attr("max-age", maxAge.toString())
+            attr("max-size", maxSize.toString())
+            digestAlgorithm?.let { digestAlgorithm ->
+                attr("digest", digestAlgorithm)
+            }
+            attr(
+                "compression-mode", when (compressionMode) {
+                    CompressionMode.GZIP -> "gzip"
+                    CompressionMode.ZIP -> "zip"
+                }
+            )
+        }
+        result
+    }
+}

gbcs-server-memcached/src/main/resources/META-INF/services/net.woggioni.gbcs.api.CacheProvider

@@ -0,0 +1 @@
+net.woggioni.gbcs.server.memcached.MemcachedCacheProvider

gbcs-server-memcached/src/main/resources/net/woggioni/gbcs/server/memcached/schema/gbcs-memcached.xsd

@@ -1,13 +1,13 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<xs:schema targetNamespace="urn:net.woggioni.gbcs-memcached"
-           xmlns:gbcs-memcached="urn:net.woggioni.gbcs-memcached"
-           xmlns:gbcs="urn:net.woggioni.gbcs"
+<xs:schema targetNamespace="urn:net.woggioni.gbcs.server.memcached"
+           xmlns:gbcs-memcached="urn:net.woggioni.gbcs.server.memcached"
+           xmlns:gbcs="urn:net.woggioni.gbcs.server"
            xmlns:xs="http://www.w3.org/2001/XMLSchema">
 
-    <xs:import schemaLocation="classpath:net/woggioni/gbcs/schema/gbcs.xsd" namespace="urn:net.woggioni.gbcs"/>
+    <xs:import schemaLocation="jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd" namespace="urn:net.woggioni.gbcs.server"/>
 
     <xs:complexType name="memcachedServerType">
-        <xs:attribute name="host" type="xs:string" use="required"/>
+        <xs:attribute name="host" type="xs:token" use="required"/>
         <xs:attribute name="port" type="xs:positiveInteger" use="required"/>
     </xs:complexType>
 
@@ -20,14 +20,14 @@
                 <xs:attribute name="max-age" type="xs:duration" default="P1D"/>
                 <xs:attribute name="max-size" type="xs:unsignedInt" default="1048576"/>
                 <xs:attribute name="digest" type="xs:token" />
-                <xs:attribute name="compression-type" type="gbcs-memcached:compressionType" default="deflate"/>
+                <xs:attribute name="compression-mode" type="gbcs-memcached:compressionType" default="zip"/>
             </xs:extension>
         </xs:complexContent>
     </xs:complexType>
 
     <xs:simpleType name="compressionType">
         <xs:restriction base="xs:token">
-            <xs:enumeration value="deflate"/>
+            <xs:enumeration value="zip"/>
             <xs:enumeration value="gzip"/>
         </xs:restriction>
     </xs:simpleType>

gbcs-server/build.gradle

@@ -0,0 +1,38 @@
+plugins {
+    id 'java-library'
+    alias catalog.plugins.kotlin.jvm
+    id 'jacoco'
+    id 'maven-publish'
+}
+
+dependencies {
+    implementation catalog.jwo
+    implementation catalog.slf4j.api
+    implementation catalog.netty.codec.http
+
+    api project(':gbcs-common')
+    api project(':gbcs-api')
+
+//    runtimeOnly catalog.slf4j.jdk14
+    testRuntimeOnly catalog.logback.classic
+
+    testImplementation catalog.bcprov.jdk18on
+    testImplementation catalog.bcpkix.jdk18on
+
+    testRuntimeOnly project(":gbcs-server-memcached")
+}
+
+test {
+    systemProperty("io.netty.leakDetectionLevel", "PARANOID")
+    systemProperty("jdk.httpclient.redirects.retrylimit", "1")
+}
+
+publishing {
+    publications {
+        maven(MavenPublication) {
+            from(components["java"])
+        }
+    }
+}
+
+

gbcs-server/src/main/java/module-info.java

@@ -1,7 +1,8 @@
 import net.woggioni.gbcs.api.CacheProvider;
-import net.woggioni.gbcs.cache.FileSystemCacheProvider;
+import net.woggioni.gbcs.server.cache.FileSystemCacheProvider;
+import net.woggioni.gbcs.server.cache.InMemoryCacheProvider;
 
-module net.woggioni.gbcs {
+module net.woggioni.gbcs.server {
     requires java.sql;
     requires java.xml;
     requires java.logging;
@@ -15,14 +16,14 @@ module net.woggioni.gbcs {
     requires io.netty.codec;
     requires org.slf4j;
     requires net.woggioni.jwo;
-    requires net.woggioni.gbcs.base;
+    requires net.woggioni.gbcs.common;
     requires net.woggioni.gbcs.api;
 
-    exports net.woggioni.gbcs;
+    exports net.woggioni.gbcs.server;
 
-    opens net.woggioni.gbcs;
-    opens net.woggioni.gbcs.schema;
+    opens net.woggioni.gbcs.server;
+    opens net.woggioni.gbcs.server.schema;
 
     uses CacheProvider;
-    provides CacheProvider with FileSystemCacheProvider;
+    provides CacheProvider with FileSystemCacheProvider, InMemoryCacheProvider;
 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/GradleBuildCacheServer.kt

@@ -1,67 +1,57 @@
-package net.woggioni.gbcs
+package net.woggioni.gbcs.server
 
 import io.netty.bootstrap.ServerBootstrap
 import io.netty.buffer.ByteBuf
-import io.netty.buffer.Unpooled
 import io.netty.channel.Channel
-import io.netty.channel.ChannelDuplexHandler
 import io.netty.channel.ChannelFuture
-import io.netty.channel.ChannelFutureListener
+import io.netty.channel.ChannelHandler.Sharable
 import io.netty.channel.ChannelHandlerContext
+import io.netty.channel.ChannelInboundHandlerAdapter
 import io.netty.channel.ChannelInitializer
 import io.netty.channel.ChannelOption
 import io.netty.channel.ChannelPromise
-import io.netty.channel.DefaultFileRegion
-import io.netty.channel.SimpleChannelInboundHandler
 import io.netty.channel.nio.NioEventLoopGroup
 import io.netty.channel.socket.nio.NioServerSocketChannel
-import io.netty.handler.codec.DecoderException
 import io.netty.handler.codec.compression.CompressionOptions
-import io.netty.handler.codec.http.DefaultFullHttpResponse
 import io.netty.handler.codec.http.DefaultHttpContent
-import io.netty.handler.codec.http.DefaultHttpResponse
-import io.netty.handler.codec.http.FullHttpRequest
-import io.netty.handler.codec.http.FullHttpResponse
 import io.netty.handler.codec.http.HttpContentCompressor
 import io.netty.handler.codec.http.HttpHeaderNames
-import io.netty.handler.codec.http.HttpHeaderValues
-import io.netty.handler.codec.http.HttpMethod
 import io.netty.handler.codec.http.HttpObjectAggregator
 import io.netty.handler.codec.http.HttpRequest
-import io.netty.handler.codec.http.HttpResponseStatus
 import io.netty.handler.codec.http.HttpServerCodec
-import io.netty.handler.codec.http.HttpUtil
-import io.netty.handler.codec.http.HttpVersion
-import io.netty.handler.codec.http.LastHttpContent
 import io.netty.handler.ssl.ClientAuth
 import io.netty.handler.ssl.SslContext
 import io.netty.handler.ssl.SslContextBuilder
-import io.netty.handler.stream.ChunkedNioFile
-import io.netty.handler.stream.ChunkedNioStream
+import io.netty.handler.ssl.SslHandler
 import io.netty.handler.stream.ChunkedWriteHandler
+import io.netty.handler.timeout.IdleState
+import io.netty.handler.timeout.IdleStateEvent
+import io.netty.handler.timeout.IdleStateHandler
+import io.netty.util.AttributeKey
 import io.netty.util.concurrent.DefaultEventExecutorGroup
 import io.netty.util.concurrent.EventExecutorGroup
-import net.woggioni.gbcs.api.Cache
 import net.woggioni.gbcs.api.Configuration
-import net.woggioni.gbcs.api.Role
-import net.woggioni.gbcs.api.exception.ContentTooLargeException
-import net.woggioni.gbcs.auth.AbstractNettyHttpAuthenticator
-import net.woggioni.gbcs.auth.Authorizer
-import net.woggioni.gbcs.auth.ClientCertificateValidator
-import net.woggioni.gbcs.auth.RoleAuthorizer
-import net.woggioni.gbcs.base.GBCS.toUrl
-import net.woggioni.gbcs.base.PasswordSecurity.decodePasswordHash
-import net.woggioni.gbcs.base.PasswordSecurity.hashPassword
-import net.woggioni.gbcs.base.Xml
-import net.woggioni.gbcs.base.contextLogger
-import net.woggioni.gbcs.base.info
-import net.woggioni.gbcs.configuration.Parser
-import net.woggioni.gbcs.configuration.Serializer
+import net.woggioni.gbcs.api.exception.ConfigurationException
+import net.woggioni.gbcs.common.GBCS.toUrl
+import net.woggioni.gbcs.common.PasswordSecurity.decodePasswordHash
+import net.woggioni.gbcs.common.PasswordSecurity.hashPassword
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.common.debug
+import net.woggioni.gbcs.common.info
+import net.woggioni.gbcs.server.auth.AbstractNettyHttpAuthenticator
+import net.woggioni.gbcs.server.auth.Authorizer
+import net.woggioni.gbcs.server.auth.ClientCertificateValidator
+import net.woggioni.gbcs.server.auth.RoleAuthorizer
+import net.woggioni.gbcs.server.configuration.Parser
+import net.woggioni.gbcs.server.configuration.Serializer
+import net.woggioni.gbcs.server.exception.ExceptionHandler
+import net.woggioni.gbcs.server.handler.ServerHandler
+import net.woggioni.gbcs.server.throttling.ThrottlingHandler
 import net.woggioni.jwo.JWO
 import net.woggioni.jwo.Tuple2
 import java.io.OutputStream
 import java.net.InetSocketAddress
-import java.nio.channels.FileChannel
 import java.nio.file.Files
 import java.nio.file.Path
 import java.security.KeyStore
@@ -69,14 +59,34 @@ import java.security.PrivateKey
 import java.security.cert.X509Certificate
 import java.util.Arrays
 import java.util.Base64
+import java.util.concurrent.TimeUnit
 import java.util.regex.Matcher
 import java.util.regex.Pattern
 import javax.naming.ldap.LdapName
-import javax.net.ssl.SSLEngine
 import javax.net.ssl.SSLPeerUnverifiedException
 
-
 class GradleBuildCacheServer(private val cfg: Configuration) {
+    private val log = contextLogger()
+
+    companion object {
+
+        val userAttribute: AttributeKey<Configuration.User> = AttributeKey.valueOf("user")
+        val groupAttribute: AttributeKey<Set<Configuration.Group>> = AttributeKey.valueOf("group")
+
+        val DEFAULT_CONFIGURATION_URL by lazy { "classpath:net/woggioni/gbcs/gbcs-default.xml".toUrl() }
+        private const val SSL_HANDLER_NAME = "sslHandler"
+
+        fun loadConfiguration(configurationFile: Path): Configuration {
+            val doc = Files.newInputStream(configurationFile).use {
+                Xml.parseXml(configurationFile.toUri().toURL(), it)
+            }
+            return Parser.parse(doc)
+        }
+
+        fun dumpConfiguration(conf: Configuration, outputStream: OutputStream) {
+            Xml.write(Serializer.serialize(conf), outputStream)
+        }
+    }
 
     private class HttpChunkContentCompressor(
         threshold: Int,
@@ -99,61 +109,60 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         }
     }
 
+    @Sharable
     private class ClientCertificateAuthenticator(
         authorizer: Authorizer,
-        private val sslEngine: SSLEngine,
+        private val anonymousUserGroups: Set<Configuration.Group>?,
         private val userExtractor: Configuration.UserExtractor?,
         private val groupExtractor: Configuration.GroupExtractor?,
     ) : AbstractNettyHttpAuthenticator(authorizer) {
 
-        companion object {
-            private val log = contextLogger()
-        }
-
-        override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): Set<Role>? {
+        override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): AuthenticationResult? {
             return try {
-                sslEngine.session.peerCertificates
+                val sslHandler = (ctx.pipeline().get(SSL_HANDLER_NAME) as? SslHandler)
+                    ?: throw ConfigurationException("Client certificate authentication cannot be used when TLS is disabled")
+                val sslEngine = sslHandler.engine()
+                sslEngine.session.peerCertificates.takeIf {
+                    it.isNotEmpty()
+                }?.let { peerCertificates ->
+                    val clientCertificate = peerCertificates.first() as X509Certificate
+                    val user = userExtractor?.extract(clientCertificate)
+                    val group = groupExtractor?.extract(clientCertificate)
+                    val allGroups = ((user?.groups ?: emptySet()).asSequence() + sequenceOf(group).filterNotNull()).toSet()
+                    AuthenticationResult(user, allGroups)
+                } ?: anonymousUserGroups?.let{ AuthenticationResult(null, it) }
             } catch (es: SSLPeerUnverifiedException) {
-                null
-            }?.takeIf {
-                it.isNotEmpty()
-            }?.let { peerCertificates ->
-                val clientCertificate = peerCertificates.first() as X509Certificate
-                val user = userExtractor?.extract(clientCertificate)
-                val group = groupExtractor?.extract(clientCertificate)
-                (group?.roles ?: emptySet()) + (user?.roles ?: emptySet())
+                anonymousUserGroups?.let{ AuthenticationResult(null, it) }
             }
         }
     }
 
+    @Sharable
     private class NettyHttpBasicAuthenticator(
         private val users: Map<String, Configuration.User>, authorizer: Authorizer
     ) : AbstractNettyHttpAuthenticator(authorizer) {
+        private val log = contextLogger()
 
-        companion object {
-            private val log = contextLogger()
-        }
-
-        override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): Set<Role>? {
+        override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): AuthenticationResult? {
             val authorizationHeader = req.headers()[HttpHeaderNames.AUTHORIZATION] ?: let {
                 log.debug(ctx) {
                     "Missing Authorization header"
                 }
-                return null
+                return users[""]?.let { AuthenticationResult(it, it.groups) }
             }
             val cursor = authorizationHeader.indexOf(' ')
             if (cursor < 0) {
                 log.debug(ctx) {
                     "Invalid Authorization header: '$authorizationHeader'"
                 }
-                return null
+                return users[""]?.let { AuthenticationResult(it, it.groups) }
             }
             val authenticationType = authorizationHeader.substring(0, cursor)
             if ("Basic" != authenticationType) {
                 log.debug(ctx) {
                     "Invalid authentication type header: '$authenticationType'"
                 }
-                return null
+                return users[""]?.let { AuthenticationResult(it, it.groups) }
             }
             val (username, password) = Base64.getDecoder().decode(authorizationHeader.substring(cursor + 1))
                 .let(::String)
@@ -173,7 +182,9 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
                     val (_, salt) = decodePasswordHash(passwordAndSalt)
                     hashPassword(password, Base64.getEncoder().encodeToString(salt)) == passwordAndSalt
                 } ?: false
-            }?.roles
+            }?.let { user ->
+                AuthenticationResult(user, user.groups)
+            }
         }
     }
 
@@ -197,16 +208,15 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
                             .map { it as X509Certificate }
                             .toArray { size -> Array<X509Certificate?>(size) { null } }
                     SslContextBuilder.forServer(serverKey, *serverCert).apply {
-                        if (tls.isVerifyClients) {
-                            clientAuth(ClientAuth.OPTIONAL)
-                            val trustStore = tls.trustStore
-                            if (trustStore != null) {
-                                val ts = loadKeystore(trustStore.file, trustStore.password)
-                                trustManager(
-                                    ClientCertificateValidator.getTrustManager(ts, trustStore.isCheckCertificateStatus)
-                                )
-                            }
-                        }
+                        val clientAuth = tls.trustStore?.let { trustStore ->
+                            val ts = loadKeystore(trustStore.file, trustStore.password)
+                            trustManager(
+                                ClientCertificateValidator.getTrustManager(ts, trustStore.isCheckCertificateStatus)
+                            )
+                            if(trustStore.isRequireClientCertificate) ClientAuth.REQUIRE
+                            else ClientAuth.OPTIONAL
+                        } ?: ClientAuth.NONE
+                        clientAuth(clientAuth)
                     }.build()
                 }
             }
@@ -233,6 +243,31 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
             }
         }
 
+        private val log = contextLogger()
+
+        private val serverHandler = let {
+            val cacheImplementation = cfg.cache.materialize()
+            val prefix = Path.of("/").resolve(Path.of(cfg.serverPath ?: "/"))
+            ServerHandler(cacheImplementation, prefix)
+        }
+
+        private val exceptionHandler = ExceptionHandler()
+        private val throttlingHandler = ThrottlingHandler(cfg)
+
+        private val authenticator = when (val auth = cfg.authentication) {
+            is Configuration.BasicAuthentication -> NettyHttpBasicAuthenticator(cfg.users, RoleAuthorizer())
+            is Configuration.ClientCertificateAuthentication -> {
+                ClientCertificateAuthenticator(
+                    RoleAuthorizer(),
+                    cfg.users[""]?.groups,
+                    userExtractor(auth),
+                    groupExtractor(auth)
+                )
+            }
+
+            else -> null
+        }
+
         private val sslContext: SslContext? = cfg.tls?.let(Companion::createSslCtx)
 
         private fun userExtractor(authentication: Configuration.ClientCertificateAuthentication) =
@@ -264,193 +299,86 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
             }
 
         override fun initChannel(ch: Channel) {
-            val pipeline = ch.pipeline()
-            val auth = cfg.authentication
-            var authenticator: AbstractNettyHttpAuthenticator? = null
-            if (auth is Configuration.BasicAuthentication) {
-                val roleAuthorizer = RoleAuthorizer()
-                authenticator = (NettyHttpBasicAuthenticator(cfg.users, roleAuthorizer))
+            log.debug {
+                "Created connection ${ch.id().asShortText()} with ${ch.remoteAddress()}"
             }
-            if (sslContext != null) {
-                val sslHandler = sslContext.newHandler(ch.alloc())
-                pipeline.addLast(sslHandler)
-
-                if (auth is Configuration.ClientCertificateAuthentication) {
-                    val roleAuthorizer = RoleAuthorizer()
-                    authenticator = ClientCertificateAuthenticator(
-                        roleAuthorizer,
-                        sslHandler.engine(),
-                        userExtractor(auth),
-                        groupExtractor(auth)
+            ch.closeFuture().addListener {
+                log.debug {
+                    "Closed connection ${ch.id().asShortText()} with ${ch.remoteAddress()}"
+                }
+            }
+            val pipeline = ch.pipeline()
+            cfg.connection.also { conn ->
+                val readTimeout = conn.readTimeout.toMillis()
+                val writeTimeout = conn.writeTimeout.toMillis()
+                if(readTimeout > 0 || writeTimeout > 0) {
+                    pipeline.addLast(
+                        IdleStateHandler(
+                            false,
+                            readTimeout,
+                            writeTimeout,
+                            0,
+                            TimeUnit.MILLISECONDS
+                        )
                     )
                 }
+                val readIdleTimeout = conn.readIdleTimeout.toMillis()
+                val writeIdleTimeout = conn.writeIdleTimeout.toMillis()
+                val idleTimeout = conn.idleTimeout.toMillis()
+                if(readIdleTimeout > 0 || writeIdleTimeout > 0 || idleTimeout > 0) {
+                    pipeline.addLast(
+                        IdleStateHandler(
+                            true,
+                            readIdleTimeout,
+                            writeIdleTimeout,
+                            idleTimeout,
+                            TimeUnit.MILLISECONDS
+                        )
+                    )
+                }
+            }
+            pipeline.addLast(object : ChannelInboundHandlerAdapter() {
+                override fun userEventTriggered(ctx: ChannelHandlerContext, evt: Any) {
+                    if (evt is IdleStateEvent) {
+                        when(evt.state()) {
+                            IdleState.READER_IDLE -> log.debug {
+                                "Read timeout reached on channel ${ch.id().asShortText()}, closing the connection"
+                            }
+                            IdleState.WRITER_IDLE -> log.debug {
+                                "Write timeout reached on channel ${ch.id().asShortText()}, closing the connection"
+                            }
+                            IdleState.ALL_IDLE -> log.debug {
+                                "Idle timeout reached on channel ${ch.id().asShortText()}, closing the connection"
+                            }
+                            null -> throw IllegalStateException("This should never happen")
+                        }
+                        ctx.close()
+                    }
+                }
+            })
+            sslContext?.newHandler(ch.alloc())?.also {
+                pipeline.addLast(SSL_HANDLER_NAME, it)
             }
             pipeline.addLast(HttpServerCodec())
             pipeline.addLast(HttpChunkContentCompressor(1024))
             pipeline.addLast(ChunkedWriteHandler())
-            pipeline.addLast(HttpObjectAggregator(Int.MAX_VALUE))
+            pipeline.addLast(HttpObjectAggregator(cfg.connection.maxRequestSize))
             authenticator?.let {
                 pipeline.addLast(it)
             }
-            val cacheImplementation = cfg.cache.materialize()
-            val prefix = Path.of("/").resolve(Path.of(cfg.serverPath ?: "/"))
-            pipeline.addLast(eventExecutorGroup, ServerHandler(cacheImplementation, prefix))
-            pipeline.addLast(ExceptionHandler())
-        }
-    }
-
-    private class ExceptionHandler : ChannelDuplexHandler() {
-        private val log = contextLogger()
-
-        private val NOT_AUTHORIZED: FullHttpResponse = DefaultFullHttpResponse(
-            HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER
-        ).apply {
-            headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
-        }
-
-        private val TOO_BIG: FullHttpResponse = DefaultFullHttpResponse(
-            HttpVersion.HTTP_1_1, HttpResponseStatus.REQUEST_ENTITY_TOO_LARGE, Unpooled.EMPTY_BUFFER
-        ).apply {
-            headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
-        }
-
-        override fun exceptionCaught(ctx: ChannelHandlerContext, cause: Throwable) {
-            when (cause) {
-                is DecoderException -> {
-                    log.error(cause.message, cause)
-                    ctx.close()
-                }
-
-                is SSLPeerUnverifiedException -> {
-                    ctx.writeAndFlush(NOT_AUTHORIZED.retainedDuplicate())
-                        .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
-                }
-
-                is ContentTooLargeException -> {
-                    ctx.writeAndFlush(TOO_BIG.retainedDuplicate())
-                        .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
-                }
-
-                else -> {
-                    log.error(cause.message, cause)
-                    ctx.close()
-                }
-            }
-        }
-    }
-
-    private class ServerHandler(private val cache: Cache, private val serverPrefix: Path) :
-        SimpleChannelInboundHandler<FullHttpRequest>() {
-
-        companion object {
-            private val log = contextLogger()
-        }
-
-        override fun channelRead0(ctx: ChannelHandlerContext, msg: FullHttpRequest) {
-            val keepAlive: Boolean = HttpUtil.isKeepAlive(msg)
-            val method = msg.method()
-            if (method === HttpMethod.GET) {
-                val path = Path.of(msg.uri())
-                val prefix = path.parent
-                val key = path.fileName.toString()
-                if (serverPrefix == prefix) {
-                    cache.get(key)?.let { channel ->
-                        log.debug(ctx) {
-                            "Cache hit for key '$key'"
-                        }
-                        val response = DefaultHttpResponse(msg.protocolVersion(), HttpResponseStatus.OK)
-                        response.headers()[HttpHeaderNames.CONTENT_TYPE] = HttpHeaderValues.APPLICATION_OCTET_STREAM
-                        if (!keepAlive) {
-                            response.headers().set(HttpHeaderNames.CONNECTION, HttpHeaderValues.CLOSE)
-                            response.headers().set(HttpHeaderNames.TRANSFER_ENCODING, HttpHeaderValues.IDENTITY)
-                        } else {
-                            response.headers().set(HttpHeaderNames.CONNECTION, HttpHeaderValues.KEEP_ALIVE)
-                            response.headers().set(HttpHeaderNames.TRANSFER_ENCODING, HttpHeaderValues.CHUNKED)
-                        }
-                        ctx.write(response)
-                        when (channel) {
-                            is FileChannel -> {
-                                if (keepAlive) {
-                                    ctx.write(ChunkedNioFile(channel))
-                                    ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT)
-                                } else {
-                                    ctx.writeAndFlush(DefaultFileRegion(channel, 0, channel.size()))
-                                        .addListener(ChannelFutureListener.CLOSE)
-                                }
-                            }
-
-                            else -> {
-                                ctx.write(ChunkedNioStream(channel))
-                                ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT)
-                            }
-                        }
-                    } ?: let {
-                        log.debug(ctx) {
-                            "Cache miss for key '$key'"
-                        }
-                        val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.NOT_FOUND)
-                        response.headers()[HttpHeaderNames.CONTENT_LENGTH] = 0
-                        ctx.writeAndFlush(response)
-                    }
-                } else {
-                    log.warn(ctx) {
-                        "Got request for unhandled path '${msg.uri()}'"
-                    }
-                    val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.BAD_REQUEST)
-                    response.headers()[HttpHeaderNames.CONTENT_LENGTH] = 0
-                    ctx.writeAndFlush(response)
-                }
-            } else if (method === HttpMethod.PUT) {
-                val path = Path.of(msg.uri())
-                val prefix = path.parent
-                val key = path.fileName.toString()
-
-                if (serverPrefix == prefix) {
-                    log.debug(ctx) {
-                        "Added value for key '$key' to build cache"
-                    }
-                    val bodyBytes = msg.content().run {
-                        if (isDirect) {
-                            ByteArray(readableBytes()).also {
-                                readBytes(it)
-                            }
-                        } else {
-                            array()
-                        }
-                    }
-                    cache.put(key, bodyBytes)
-                    val response = DefaultFullHttpResponse(
-                        msg.protocolVersion(), HttpResponseStatus.CREATED,
-                        Unpooled.copiedBuffer(key.toByteArray())
-                    )
-                    response.headers()[HttpHeaderNames.CONTENT_LENGTH] = response.content().readableBytes()
-                    ctx.writeAndFlush(response)
-                } else {
-                    log.warn(ctx) {
-                        "Got request for unhandled path '${msg.uri()}'"
-                    }
-                    val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.BAD_REQUEST)
-                    response.headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
-                    ctx.writeAndFlush(response)
-                }
-            } else {
-                log.warn(ctx) {
-                    "Got request with unhandled method '${msg.method().name()}'"
-                }
-                val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.BAD_REQUEST)
-                response.headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
-                ctx.writeAndFlush(response)
-            }
+            pipeline.addLast(throttlingHandler)
+            pipeline.addLast(eventExecutorGroup, serverHandler)
+            pipeline.addLast(exceptionHandler)
         }
     }
 
     class ServerHandle(
         httpChannelFuture: ChannelFuture,
-        private val executorGroups : Iterable<EventExecutorGroup>
+        private val executorGroups: Iterable<EventExecutorGroup>
     ) : AutoCloseable {
         private val httpChannel: Channel = httpChannelFuture.channel()
-
         private val closeFuture: ChannelFuture = httpChannel.closeFuture()
+        private val log = contextLogger()
 
         fun shutdown(): ChannelFuture {
             return httpChannel.close()
@@ -476,20 +404,19 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         val serverSocketChannel = NioServerSocketChannel::class.java
         val workerGroup = bossGroup
         val eventExecutorGroup = run {
-            val threadFactory = if(cfg.isUseVirtualThread) {
+            val threadFactory = if (cfg.eventExecutor.isUseVirtualThreads) {
                 Thread.ofVirtual().factory()
             } else {
                 null
             }
             DefaultEventExecutorGroup(Runtime.getRuntime().availableProcessors(), threadFactory)
         }
-        // A helper class that simplifies server configuration
         val bootstrap = ServerBootstrap().apply {
             // Configure the server
             group(bossGroup, workerGroup)
             channel(serverSocketChannel)
             childHandler(ServerInitializer(cfg, eventExecutorGroup))
-            option(ChannelOption.SO_BACKLOG, 128)
+            option(ChannelOption.SO_BACKLOG, cfg.incomingConnectionsBacklogSize)
             childOption(ChannelOption.SO_KEEPALIVE, true)
         }
 
@@ -502,22 +429,4 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         }
         return ServerHandle(httpChannel, setOf(bossGroup, workerGroup, eventExecutorGroup))
     }
-
-    companion object {
-
-        val DEFAULT_CONFIGURATION_URL by lazy { "classpath:net/woggioni/gbcs/gbcs-default.xml".toUrl() }
-
-        fun loadConfiguration(configurationFile: Path): Configuration {
-            val dbf = Xml.newDocumentBuilderFactory(null)
-            val db = dbf.newDocumentBuilder()
-            val doc = Files.newInputStream(configurationFile).use(db::parse)
-            return Parser.parse(doc)
-        }
-
-        fun dumpConfiguration(conf: Configuration, outputStream: OutputStream) {
-            Xml.write(Serializer.serialize(conf), outputStream)
-        }
-
-        private val log = contextLogger()
-    }
 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/Logging.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs
+package net.woggioni.gbcs.server
 
 import io.netty.channel.ChannelHandlerContext
 import org.slf4j.Logger

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/auth/Authenticator.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.auth
+package net.woggioni.gbcs.server.auth
 
 import io.netty.buffer.Unpooled
 import io.netty.channel.ChannelFutureListener
@@ -11,32 +11,48 @@ import io.netty.handler.codec.http.HttpRequest
 import io.netty.handler.codec.http.HttpResponseStatus
 import io.netty.handler.codec.http.HttpVersion
 import io.netty.util.ReferenceCountUtil
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.api.Configuration.Group
 import net.woggioni.gbcs.api.Role
+import net.woggioni.gbcs.server.GradleBuildCacheServer
 
 
-abstract class AbstractNettyHttpAuthenticator(private val authorizer : Authorizer)
-        : ChannelInboundHandlerAdapter() {
+abstract class AbstractNettyHttpAuthenticator(private val authorizer: Authorizer) : ChannelInboundHandlerAdapter() {
 
     companion object {
         private val AUTHENTICATION_FAILED: FullHttpResponse = DefaultFullHttpResponse(
-                HttpVersion.HTTP_1_1, HttpResponseStatus.UNAUTHORIZED, Unpooled.EMPTY_BUFFER).apply {
+            HttpVersion.HTTP_1_1, HttpResponseStatus.UNAUTHORIZED, Unpooled.EMPTY_BUFFER
+        ).apply {
             headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
         }
 
         private val NOT_AUTHORIZED: FullHttpResponse = DefaultFullHttpResponse(
-                HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER).apply {
+            HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER
+        ).apply {
             headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
         }
     }
 
+    class AuthenticationResult(val user: Configuration.User?, val groups: Set<Group>)
 
-    abstract fun authenticate(ctx : ChannelHandlerContext, req : HttpRequest) : Set<Role>?
+    abstract fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): AuthenticationResult?
 
     override fun channelRead(ctx: ChannelHandlerContext, msg: Any) {
-        if(msg is HttpRequest) {
-            val roles = authenticate(ctx, msg) ?: return authenticationFailure(ctx, msg)
+        if (msg is HttpRequest) {
+            val result = authenticate(ctx, msg) ?: return authenticationFailure(ctx, msg)
+            ctx.channel().attr(GradleBuildCacheServer.userAttribute).set(result.user)
+            ctx.channel().attr(GradleBuildCacheServer.groupAttribute).set(result.groups)
+
+            val roles = (
+                (result.user?.let { user ->
+                    user.groups.asSequence().flatMap { group ->
+                        group.roles.asSequence()
+                    }
+                } ?: emptySequence<Role>()) +
+                        result.groups.asSequence().flatMap { it.roles.asSequence() }
+            ).toSet()
             val authorized = authorizer.authorize(roles, msg)
-            if(authorized) {
+            if (authorized) {
                 super.channelRead(ctx, msg)
             } else {
                 authorizationFailure(ctx, msg)

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/auth/Authorizer.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.auth
+package net.woggioni.gbcs.server.auth
 
 import io.netty.handler.codec.http.HttpRequest
 import net.woggioni.gbcs.api.Role

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/auth/ClientCertificateValidator.kt

@@ -1,24 +1,27 @@
-package net.woggioni.gbcs.auth
+package net.woggioni.gbcs.server.auth
 
+import io.netty.channel.ChannelHandlerContext
+import io.netty.channel.ChannelInboundHandlerAdapter
+import io.netty.handler.ssl.SslHandler
+import io.netty.handler.ssl.SslHandshakeCompletionEvent
 import java.security.KeyStore
 import java.security.cert.CertPathValidator
+import java.security.cert.CertPathValidatorException
+import java.security.cert.CertificateException
 import java.security.cert.CertificateFactory
 import java.security.cert.PKIXParameters
 import java.security.cert.PKIXRevocationChecker
 import java.security.cert.X509Certificate
 import java.util.EnumSet
-import io.netty.channel.ChannelHandlerContext
-import io.netty.channel.ChannelInboundHandlerAdapter
-import io.netty.handler.ssl.SslHandler
-import io.netty.handler.ssl.SslHandshakeCompletionEvent
 import javax.net.ssl.SSLSession
 import javax.net.ssl.TrustManagerFactory
 import javax.net.ssl.X509TrustManager
 
 
 class ClientCertificateValidator private constructor(
-    private val sslHandler : SslHandler,
-    private val x509TrustManager: X509TrustManager) : ChannelInboundHandlerAdapter() {
+    private val sslHandler: SslHandler,
+    private val x509TrustManager: X509TrustManager
+) : ChannelInboundHandlerAdapter() {
     override fun userEventTriggered(ctx: ChannelHandlerContext, evt: Any) {
         if (evt is SslHandshakeCompletionEvent) {
             if (evt.isSuccess) {
@@ -34,13 +37,14 @@ class ClientCertificateValidator private constructor(
     }
 
     companion object {
-        fun getTrustManager(trustStore : KeyStore?, certificateRevocationEnabled : Boolean) : X509TrustManager {
-            return if(trustStore != null) {
+        fun getTrustManager(trustStore: KeyStore?, certificateRevocationEnabled: Boolean): X509TrustManager {
+            return if (trustStore != null) {
                 val certificateFactory = CertificateFactory.getInstance("X.509")
                 val validator = CertPathValidator.getInstance("PKIX").apply {
                     val rc = revocationChecker as PKIXRevocationChecker
                     rc.options = EnumSet.of(
-                        PKIXRevocationChecker.Option.NO_FALLBACK)
+                        PKIXRevocationChecker.Option.NO_FALLBACK
+                    )
                 }
                 val params = PKIXParameters(trustStore).apply {
                     isRevocationEnabled = certificateRevocationEnabled
@@ -48,7 +52,11 @@ class ClientCertificateValidator private constructor(
                 object : X509TrustManager {
                     override fun checkClientTrusted(chain: Array<out X509Certificate>, authType: String) {
                         val clientCertificateChain = certificateFactory.generateCertPath(chain.toList())
-                        validator.validate(clientCertificateChain, params)
+                        try {
+                            validator.validate(clientCertificateChain, params)
+                        } catch (ex: CertPathValidatorException) {
+                            throw CertificateException(ex)
+                        }
                     }
 
                     override fun checkServerTrusted(chain: Array<out X509Certificate>, authType: String) {
@@ -56,7 +64,7 @@ class ClientCertificateValidator private constructor(
                     }
 
                     private val acceptedIssuers = trustStore.aliases().asSequence()
-                        .filter (trustStore::isCertificateEntry)
+                        .filter(trustStore::isCertificateEntry)
                         .map(trustStore::getCertificate)
                         .map { it as X509Certificate }
                         .toList()
@@ -66,11 +74,16 @@ class ClientCertificateValidator private constructor(
                 }
             } else {
                 val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
-                trustManagerFactory.trustManagers.asSequence().filter { it is X509TrustManager }.single() as X509TrustManager
+                trustManagerFactory.trustManagers.asSequence().filter { it is X509TrustManager }
+                    .single() as X509TrustManager
             }
         }
 
-        fun of(sslHandler : SslHandler, trustStore : KeyStore?, certificateRevocationEnabled : Boolean) : ClientCertificateValidator {
+        fun of(
+            sslHandler: SslHandler,
+            trustStore: KeyStore?,
+            certificateRevocationEnabled: Boolean
+        ): ClientCertificateValidator {
             return ClientCertificateValidator(sslHandler, getTrustManager(trustStore, certificateRevocationEnabled))
         }
     }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/auth/UserAuthorizer.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.auth
+package net.woggioni.gbcs.server.auth
 
 import io.netty.handler.codec.http.HttpMethod
 import io.netty.handler.codec.http.HttpRequest
@@ -8,7 +8,7 @@ class RoleAuthorizer : Authorizer {
 
     companion object {
         private val METHOD_MAP = mapOf(
-            Role.Reader to setOf(HttpMethod.GET, HttpMethod.HEAD),
+            Role.Reader to setOf(HttpMethod.GET, HttpMethod.HEAD, HttpMethod.TRACE),
             Role.Writer to setOf(HttpMethod.PUT, HttpMethod.POST)
         )
     }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/CacheUtils.kt

@@ -0,0 +1,21 @@
+package net.woggioni.gbcs.server.cache
+
+import net.woggioni.jwo.JWO
+import java.security.MessageDigest
+
+object CacheUtils {
+    fun digest(
+        data: ByteArray,
+        md: MessageDigest = MessageDigest.getInstance("MD5")
+    ): ByteArray {
+        md.update(data)
+        return md.digest()
+    }
+
+    fun digestString(
+        data: ByteArray,
+        md: MessageDigest = MessageDigest.getInstance("MD5")
+    ): String {
+        return JWO.bytesToHex(digest(data, md))
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/FileSystemCache.kt

@@ -1,7 +1,8 @@
-package net.woggioni.gbcs.cache
+package net.woggioni.gbcs.server.cache
 
 import net.woggioni.gbcs.api.Cache
-import net.woggioni.jwo.JWO
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.server.cache.CacheUtils.digestString
 import net.woggioni.jwo.LockFile
 import java.nio.channels.Channels
 import java.nio.channels.FileChannel
@@ -19,7 +20,6 @@ import java.util.zip.DeflaterOutputStream
 import java.util.zip.Inflater
 import java.util.zip.InflaterInputStream
 
-
 class FileSystemCache(
     val root: Path,
     val maxAge: Duration,
@@ -28,7 +28,7 @@ class FileSystemCache(
     val compressionLevel: Int
 ) : Cache {
 
-    private fun lockFilePath(key: String): Path = root.resolve("$key.lock")
+    private val log = contextLogger()
 
     init {
         Files.createDirectories(root)
@@ -41,18 +41,28 @@ class FileSystemCache(
         ?.let { md ->
             digestString(key.toByteArray(), md)
         } ?: key).let { digest ->
-        LockFile.acquire(lockFilePath(digest), true).use {
-            root.resolve(digest).takeIf(Files::exists)?.let { file ->
-                if (compressionEnabled) {
-                    val inflater = Inflater()
-                    Channels.newChannel(InflaterInputStream(Files.newInputStream(file), inflater))
-                } else {
-                    FileChannel.open(file, StandardOpenOption.READ)
+        root.resolve(digest).takeIf(Files::exists)
+            ?.let { file ->
+                file.takeIf(Files::exists)?.let { file ->
+                    if (compressionEnabled) {
+                        val inflater = Inflater()
+                        Channels.newChannel(
+                            InflaterInputStream(
+                                Channels.newInputStream(
+                                    FileChannel.open(
+                                        file,
+                                        StandardOpenOption.READ
+                                    )
+                                ), inflater
+                            )
+                        )
+                    } else {
+                        FileChannel.open(file, StandardOpenOption.READ)
+                    }
                 }
+            }.also {
+                gc()
             }
-        }.also {
-            gc()
-        }
     }
 
     override fun put(key: String, content: ByteArray) {
@@ -61,25 +71,23 @@ class FileSystemCache(
             ?.let { md ->
                 digestString(key.toByteArray(), md)
             } ?: key).let { digest ->
-            LockFile.acquire(lockFilePath(digest), false).use {
-                val file = root.resolve(digest)
-                val tmpFile = Files.createTempFile(root, null, ".tmp")
-                try {
-                    Files.newOutputStream(tmpFile).let {
-                        if (compressionEnabled) {
-                            val deflater = Deflater(compressionLevel)
-                            DeflaterOutputStream(it, deflater)
-                        } else {
-                            it
-                        }
-                    }.use {
-                        it.write(content)
+            val file = root.resolve(digest)
+            val tmpFile = Files.createTempFile(root, null, ".tmp")
+            try {
+                Files.newOutputStream(tmpFile).let {
+                    if (compressionEnabled) {
+                        val deflater = Deflater(compressionLevel)
+                        DeflaterOutputStream(it, deflater)
+                    } else {
+                        it
                     }
-                    Files.move(tmpFile, file, StandardCopyOption.ATOMIC_MOVE)
-                } catch (t: Throwable) {
-                    Files.delete(tmpFile)
-                    throw t
+                }.use {
+                    it.write(content)
                 }
+                Files.move(tmpFile, file, StandardCopyOption.ATOMIC_MOVE)
+            } catch (t: Throwable) {
+                Files.delete(tmpFile)
+                throw t
             }
         }.also {
             gc()
@@ -97,37 +105,16 @@ class FileSystemCache(
     @Synchronized
     private fun actualGc(now: Instant) {
         Files.list(root).filter {
-            !it.fileName.toString().endsWith(".lock")
-        }.filter {
             val creationTimeStamp = Files.readAttributes(it, BasicFileAttributes::class.java)
                 .creationTime()
                 .toInstant()
             now > creationTimeStamp.plus(maxAge)
         }.forEach { file ->
-            val lockFile = lockFilePath(file.fileName.toString())
-            LockFile.acquire(lockFile, false).use {
+            LockFile.acquire(file, false).use {
                 Files.delete(file)
             }
-            Files.delete(lockFile)
         }
     }
 
     override fun close() {}
-
-    companion object {
-        fun digest(
-            data: ByteArray,
-            md: MessageDigest = MessageDigest.getInstance("MD5")
-        ): ByteArray {
-            md.update(data)
-            return md.digest()
-        }
-
-        fun digestString(
-            data: ByteArray,
-            md: MessageDigest = MessageDigest.getInstance("MD5")
-        ): String {
-            return JWO.bytesToHex(digest(data, md))
-        }
-    }
 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/FileSystemCacheConfiguration.kt

@@ -1,7 +1,7 @@
-package net.woggioni.gbcs.cache
+package net.woggioni.gbcs.server.cache
 
 import net.woggioni.gbcs.api.Configuration
-import net.woggioni.gbcs.base.GBCS
+import net.woggioni.gbcs.common.GBCS
 import net.woggioni.jwo.Application
 import java.nio.file.Path
 import java.time.Duration

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/FileSystemCacheProvider.kt

@@ -1,8 +1,9 @@
-package net.woggioni.gbcs.cache
+package net.woggioni.gbcs.server.cache
 
 import net.woggioni.gbcs.api.CacheProvider
-import net.woggioni.gbcs.base.GBCS
-import net.woggioni.gbcs.base.Xml
+import net.woggioni.gbcs.common.GBCS
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.common.Xml.Companion.renderAttribute
 import org.w3c.dom.Document
 import org.w3c.dom.Element
 import java.nio.file.Path
@@ -11,29 +12,25 @@ import java.util.zip.Deflater
 
 class FileSystemCacheProvider : CacheProvider<FileSystemCacheConfiguration> {
 
-    override fun getXmlSchemaLocation() = "classpath:net/woggioni/gbcs/schema/gbcs.xsd"
+    override fun getXmlSchemaLocation() = "classpath:net/woggioni/gbcs/server/schema/gbcs.xsd"
 
     override fun getXmlType() = "fileSystemCacheType"
 
-    override fun getXmlNamespace() = "urn:net.woggioni.gbcs"
+    override fun getXmlNamespace() = "urn:net.woggioni.gbcs.server"
 
     override fun deserialize(el: Element): FileSystemCacheConfiguration {
-        val path = el.getAttribute("path")
-            .takeIf(String::isNotEmpty)
+        val path = el.renderAttribute("path")
             ?.let(Path::of)
-        val maxAge = el.getAttribute("max-age")
-            .takeIf(String::isNotEmpty)
+        val maxAge = el.renderAttribute("max-age")
             ?.let(Duration::parse)
             ?: Duration.ofDays(1)
-        val enableCompression = el.getAttribute("enable-compression")
-            .takeIf(String::isNotEmpty)
+        val enableCompression = el.renderAttribute("enable-compression")
             ?.let(String::toBoolean)
             ?: true
-        val compressionLevel = el.getAttribute("compression-level")
-            .takeIf(String::isNotEmpty)
+        val compressionLevel = el.renderAttribute("compression-level")
             ?.let(String::toInt)
             ?: Deflater.DEFAULT_COMPRESSION
-        val digestAlgorithm = el.getAttribute("digest").takeIf(String::isNotEmpty) ?: "MD5"
+        val digestAlgorithm = el.renderAttribute("digest") ?: "MD5"
 
         return FileSystemCacheConfiguration(
             path,

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/InMemoryCache.kt

@@ -0,0 +1,106 @@
+package net.woggioni.gbcs.server.cache
+
+import net.woggioni.gbcs.api.Cache
+import net.woggioni.gbcs.server.cache.CacheUtils.digestString
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
+import java.nio.ByteBuffer
+import java.nio.channels.Channels
+import java.security.MessageDigest
+import java.time.Duration
+import java.time.Instant
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.PriorityBlockingQueue
+import java.util.concurrent.atomic.AtomicInteger
+import java.util.concurrent.atomic.AtomicReference
+import java.util.zip.Deflater
+import java.util.zip.DeflaterOutputStream
+import java.util.zip.Inflater
+import java.util.zip.InflaterInputStream
+
+class InMemoryCache(
+    val maxAge: Duration,
+    val digestAlgorithm: String?,
+    val compressionEnabled: Boolean,
+    val compressionLevel: Int
+) : Cache {
+
+    private val map = ConcurrentHashMap<String, MapValue>()
+
+    private class MapValue(val rc: AtomicInteger, val payload : AtomicReference<ByteArray>)
+
+    private class RemovalQueueElement(val key: String, val expiry : Instant) : Comparable<RemovalQueueElement> {
+        override fun compareTo(other: RemovalQueueElement)= expiry.compareTo(other.expiry)
+    }
+
+    private val removalQueue = PriorityBlockingQueue<RemovalQueueElement>()
+
+    private var running = true
+    private val garbageCollector = Thread({
+        while(true) {
+            val el = removalQueue.take()
+            val now = Instant.now()
+            if(now > el.expiry) {
+                val value = map[el.key] ?: continue
+                val rc = value.rc.decrementAndGet()
+                if(rc == 0) {
+                    map.remove(el.key)
+                }
+            } else {
+                removalQueue.put(el)
+                Thread.sleep(minOf(Duration.between(now, el.expiry), Duration.ofSeconds(1)))
+            }
+        }
+    }).apply {
+        start()
+    }
+
+    override fun close() {
+        running = false
+        garbageCollector.join()
+    }
+
+    override fun get(key: String) =
+        (digestAlgorithm
+            ?.let(MessageDigest::getInstance)
+            ?.let { md ->
+                digestString(key.toByteArray(), md)
+            } ?: key
+                ).let { digest ->
+                map[digest]
+                    ?.let(MapValue::payload)
+                    ?.let(AtomicReference<ByteArray>::get)
+                    ?.let { value ->
+                    if (compressionEnabled) {
+                        val inflater = Inflater()
+                        Channels.newChannel(InflaterInputStream(ByteArrayInputStream(value), inflater))
+                    } else {
+                        Channels.newChannel(ByteArrayInputStream(value))
+                    }
+                }
+            }
+
+    override fun put(key: String, content: ByteArray) {
+        (digestAlgorithm
+            ?.let(MessageDigest::getInstance)
+            ?.let { md ->
+                digestString(key.toByteArray(), md)
+            } ?: key).let { digest ->
+            val value = if (compressionEnabled) {
+                val deflater = Deflater(compressionLevel)
+                val baos = ByteArrayOutputStream()
+                DeflaterOutputStream(baos, deflater).use { stream ->
+                    stream.write(content)
+                }
+                baos.toByteArray()
+            } else {
+                content
+            }
+            val mapValue = map.computeIfAbsent(digest) {
+                MapValue(AtomicInteger(0), AtomicReference())
+            }
+            mapValue.payload.set(value)
+            removalQueue.put(RemovalQueueElement(digest, Instant.now().plus(maxAge)))
+        }
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/InMemoryCacheConfiguration.kt

@@ -0,0 +1,23 @@
+package net.woggioni.gbcs.server.cache
+
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.common.GBCS
+import java.time.Duration
+
+data class InMemoryCacheConfiguration(
+    val maxAge: Duration,
+    val digestAlgorithm : String?,
+    val compressionEnabled: Boolean,
+    val compressionLevel: Int,
+) : Configuration.Cache {
+    override fun materialize() = InMemoryCache(
+        maxAge,
+        digestAlgorithm,
+        compressionEnabled,
+        compressionLevel
+    )
+
+    override fun getNamespaceURI() = GBCS.GBCS_NAMESPACE_URI
+
+    override fun getTypeName() = "inMemoryCacheType"
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/InMemoryCacheProvider.kt

@@ -0,0 +1,59 @@
+package net.woggioni.gbcs.server.cache
+
+import net.woggioni.gbcs.api.CacheProvider
+import net.woggioni.gbcs.common.GBCS
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.common.Xml.Companion.renderAttribute
+import org.w3c.dom.Document
+import org.w3c.dom.Element
+import java.nio.file.Path
+import java.time.Duration
+import java.util.zip.Deflater
+
+class InMemoryCacheProvider : CacheProvider<InMemoryCacheConfiguration> {
+
+    override fun getXmlSchemaLocation() = "classpath:net/woggioni/gbcs/server/schema/gbcs.xsd"
+
+    override fun getXmlType() = "inMemoryCacheType"
+
+    override fun getXmlNamespace() = "urn:net.woggioni.gbcs.server"
+
+    override fun deserialize(el: Element): InMemoryCacheConfiguration {
+        val maxAge = el.renderAttribute("max-age")
+            ?.let(Duration::parse)
+            ?: Duration.ofDays(1)
+        val enableCompression = el.renderAttribute("enable-compression")
+            ?.let(String::toBoolean)
+            ?: true
+        val compressionLevel = el.renderAttribute("compression-level")
+            ?.let(String::toInt)
+            ?: Deflater.DEFAULT_COMPRESSION
+        val digestAlgorithm = el.renderAttribute("digest") ?: "MD5"
+
+        return InMemoryCacheConfiguration(
+            maxAge,
+            digestAlgorithm,
+            enableCompression,
+            compressionLevel
+        )
+    }
+
+    override fun serialize(doc: Document, cache : InMemoryCacheConfiguration) = cache.run {
+        val result = doc.createElement("cache")
+        Xml.of(doc, result) {
+            val prefix = doc.lookupPrefix(GBCS.GBCS_NAMESPACE_URI)
+            attr("xs:type", "${prefix}:inMemoryCacheType", GBCS.XML_SCHEMA_NAMESPACE_URI)
+            attr("max-age", maxAge.toString())
+            digestAlgorithm?.let { digestAlgorithm ->
+                attr("digest", digestAlgorithm)
+            }
+            attr("enable-compression", compressionEnabled.toString())
+            compressionLevel.takeIf {
+                it != Deflater.DEFAULT_COMPRESSION
+            }?.let {
+                attr("compression-level", it.toString())
+            }
+        }
+        result
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/configuration/CacheSerializers.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.configuration
+package net.woggioni.gbcs.server.configuration
 
 import net.woggioni.gbcs.api.CacheProvider
 import net.woggioni.gbcs.api.Configuration

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/configuration/Parser.kt

@@ -0,0 +1,294 @@
+package net.woggioni.gbcs.server.configuration
+
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.api.Configuration.Authentication
+import net.woggioni.gbcs.api.Configuration.BasicAuthentication
+import net.woggioni.gbcs.api.Configuration.Cache
+import net.woggioni.gbcs.api.Configuration.ClientCertificateAuthentication
+import net.woggioni.gbcs.api.Configuration.Group
+import net.woggioni.gbcs.api.Configuration.KeyStore
+import net.woggioni.gbcs.api.Configuration.Tls
+import net.woggioni.gbcs.api.Configuration.TlsCertificateExtractor
+import net.woggioni.gbcs.api.Configuration.TrustStore
+import net.woggioni.gbcs.api.Configuration.User
+import net.woggioni.gbcs.api.Role
+import net.woggioni.gbcs.api.exception.ConfigurationException
+import net.woggioni.gbcs.common.Xml.Companion.asIterable
+import net.woggioni.gbcs.common.Xml.Companion.renderAttribute
+import org.w3c.dom.Document
+import org.w3c.dom.Element
+import org.w3c.dom.TypeInfo
+import java.nio.file.Paths
+import java.time.Duration
+import java.time.temporal.ChronoUnit
+
+object Parser {
+    fun parse(document: Document): Configuration {
+        val root = document.documentElement
+        val anonymousUser = User("", null, emptySet(), null)
+        var connection: Configuration.Connection = Configuration.Connection(
+            Duration.of(10, ChronoUnit.SECONDS),
+            Duration.of(10, ChronoUnit.SECONDS),
+            Duration.of(60, ChronoUnit.SECONDS),
+            Duration.of(30, ChronoUnit.SECONDS),
+            Duration.of(30, ChronoUnit.SECONDS),
+            67108864
+        )
+        var eventExecutor: Configuration.EventExecutor = Configuration.EventExecutor(true)
+        var cache: Cache? = null
+        var host = "127.0.0.1"
+        var port = 11080
+        var users: Map<String, User> = mapOf(anonymousUser.name to anonymousUser)
+        var groups = emptyMap<String, Group>()
+        var tls: Tls? = null
+        val serverPath = root.renderAttribute("path")
+        var incomingConnectionsBacklogSize = 1024
+        var authentication: Authentication? = null
+        for (child in root.asIterable()) {
+            val tagName = child.localName
+            when (tagName) {
+                "authentication" -> {
+                    for (gchild in child.asIterable()) {
+                        when (gchild.localName) {
+                            "basic" -> {
+                                authentication = BasicAuthentication()
+                            }
+
+                            "client-certificate" -> {
+                                var tlsExtractorUser: TlsCertificateExtractor? = null
+                                var tlsExtractorGroup: TlsCertificateExtractor? = null
+                                for (ggchild in gchild.asIterable()) {
+                                    when (ggchild.localName) {
+                                        "group-extractor" -> {
+                                            val attrName = ggchild.renderAttribute("attribute-name")
+                                            val pattern = ggchild.renderAttribute("pattern")
+                                            tlsExtractorGroup = TlsCertificateExtractor(attrName, pattern)
+                                        }
+
+                                        "user-extractor" -> {
+                                            val attrName = ggchild.renderAttribute("attribute-name")
+                                            val pattern = ggchild.renderAttribute("pattern")
+                                            tlsExtractorUser = TlsCertificateExtractor(attrName, pattern)
+                                        }
+                                    }
+                                }
+                                authentication = ClientCertificateAuthentication(tlsExtractorUser, tlsExtractorGroup)
+                            }
+                        }
+                    }
+                }
+
+                "authorization" -> {
+                    var knownUsers = sequenceOf(anonymousUser)
+                    for (gchild in child.asIterable()) {
+                        when (gchild.localName) {
+                            "users" -> {
+                                knownUsers += parseUsers(gchild)
+                            }
+
+                            "groups" -> {
+                                val pair = parseGroups(gchild, knownUsers)
+                                users = pair.first
+                                groups = pair.second
+                            }
+                        }
+                    }
+                }
+
+                "bind" -> {
+                    host = child.renderAttribute("host") ?: throw ConfigurationException("host attribute is required")
+                    port = Integer.parseInt(child.renderAttribute("port"))
+                    incomingConnectionsBacklogSize = child.renderAttribute("incoming-connections-backlog-size")
+                        ?.let(Integer::parseInt)
+                        ?: 1024
+                }
+
+                "cache" -> {
+                    cache = (child as TypeInfo).let { tf ->
+                        val typeNamespace = tf.typeNamespace
+                        val typeName = tf.typeName
+                        CacheSerializers.index[typeNamespace to typeName]
+                            ?: throw IllegalArgumentException("Cache provider for namespace '$typeNamespace' with name '$typeName' not found")
+                    }.deserialize(child)
+                }
+
+                "connection" -> {
+                    val writeTimeout = child.renderAttribute("write-timeout")
+                        ?.let(Duration::parse) ?: Duration.of(0, ChronoUnit.SECONDS)
+                    val readTimeout = child.renderAttribute("read-timeout")
+                        ?.let(Duration::parse) ?: Duration.of(0, ChronoUnit.SECONDS)
+                    val idleTimeout = child.renderAttribute("idle-timeout")
+                        ?.let(Duration::parse) ?: Duration.of(30, ChronoUnit.SECONDS)
+                    val readIdleTimeout = child.renderAttribute("read-idle-timeout")
+                        ?.let(Duration::parse) ?: Duration.of(60, ChronoUnit.SECONDS)
+                    val writeIdleTimeout = child.renderAttribute("write-idle-timeout")
+                        ?.let(Duration::parse) ?: Duration.of(60, ChronoUnit.SECONDS)
+                    val maxRequestSize = child.renderAttribute("max-request-size")
+                        ?.let(String::toInt) ?: 67108864
+                    connection = Configuration.Connection(
+                        readTimeout,
+                        writeTimeout,
+                        idleTimeout,
+                        readIdleTimeout,
+                        writeIdleTimeout,
+                        maxRequestSize
+                    )
+                }
+
+                "event-executor" -> {
+                    val useVirtualThread = root.renderAttribute("use-virtual-threads")
+                        ?.let(String::toBoolean) ?: true
+                    eventExecutor = Configuration.EventExecutor(useVirtualThread)
+                }
+
+                "tls" -> {
+                    var keyStore: KeyStore? = null
+                    var trustStore: TrustStore? = null
+
+                    for (granChild in child.asIterable()) {
+                        when (granChild.localName) {
+                            "keystore" -> {
+                                val keyStoreFile = Paths.get(granChild.renderAttribute("file"))
+                                val keyStorePassword = granChild.renderAttribute("password")
+                                val keyAlias = granChild.renderAttribute("key-alias")
+                                val keyPassword = granChild.renderAttribute("key-password")
+                                keyStore = KeyStore(
+                                    keyStoreFile,
+                                    keyStorePassword,
+                                    keyAlias,
+                                    keyPassword
+                                )
+                            }
+
+                            "truststore" -> {
+                                val trustStoreFile = Paths.get(granChild.renderAttribute("file"))
+                                val trustStorePassword = granChild.renderAttribute("password")
+                                val checkCertificateStatus = granChild.renderAttribute("check-certificate-status")
+                                    ?.let(String::toBoolean)
+                                    ?: false
+                                val requireClientCertificate = child.renderAttribute("require-client-certificate")
+                                    ?.let(String::toBoolean) ?: false
+
+                                trustStore = TrustStore(
+                                    trustStoreFile,
+                                    trustStorePassword,
+                                    checkCertificateStatus,
+                                    requireClientCertificate
+                                )
+                            }
+                        }
+                    }
+                    tls = Tls(keyStore, trustStore)
+                }
+            }
+        }
+        return Configuration.of(
+            host,
+            port,
+            incomingConnectionsBacklogSize,
+            serverPath,
+            eventExecutor,
+            connection,
+            users,
+            groups,
+            cache!!,
+            authentication,
+            tls,
+        )
+    }
+
+    private fun parseRoles(root: Element) = root.asIterable().asSequence().map {
+        when (it.localName) {
+            "reader" -> Role.Reader
+            "writer" -> Role.Writer
+            else -> throw UnsupportedOperationException("Illegal node '${it.localName}'")
+        }
+    }.toSet()
+
+    private fun parseUserRefs(root: Element) = root.asIterable().asSequence().map {
+        when (it.localName) {
+            "user" -> it.renderAttribute("ref")
+            "anonymous" -> ""
+            else -> ConfigurationException("Unrecognized tag '${it.localName}'")
+        }
+    }
+
+    private fun parseQuota(el: Element): Configuration.Quota {
+        val calls = el.renderAttribute("calls")
+            ?.let(String::toLong)
+            ?: throw ConfigurationException("Missing attribute 'calls'")
+        val maxAvailableCalls = el.renderAttribute("max-available-calls")
+            ?.let(String::toLong)
+            ?: calls
+        val initialAvailableCalls = el.renderAttribute("initial-available-calls")
+            ?.let(String::toLong)
+            ?: maxAvailableCalls
+        val period = el.renderAttribute("period")
+            ?.let(Duration::parse)
+            ?: throw ConfigurationException("Missing attribute 'period'")
+        return Configuration.Quota(calls, period, initialAvailableCalls, maxAvailableCalls)
+    }
+
+    private fun parseUsers(root: Element): Sequence<User> {
+        return root.asIterable().asSequence().mapNotNull { child ->
+            when (child.localName) {
+                "user" -> {
+                    val username = child.renderAttribute("name")
+                    val password = child.renderAttribute("password")
+                    var quota: Configuration.Quota? = null
+                    for (gchild in child.asIterable()) {
+                        if (gchild.localName == "quota") {
+                            quota = parseQuota(gchild)
+                        }
+                    }
+                    User(username, password, emptySet(), quota)
+                }
+                "anonymous" -> {
+                    var quota: Configuration.Quota? = null
+                    for (gchild in child.asIterable()) {
+                        if (gchild.localName == "quota") {
+                            quota= parseQuota(gchild)
+                        }
+                    }
+                    User("", null, emptySet(), quota)
+                }
+                else -> null
+            }
+        }
+    }
+
+    private fun parseGroups(root: Element, knownUsers: Sequence<User>): Pair<Map<String, User>, Map<String, Group>> {
+        val knownUsersMap = knownUsers.associateBy(User::getName)
+        val userGroups = mutableMapOf<String, MutableSet<String>>()
+        val groups = root.asIterable().asSequence().filter {
+            it.localName == "group"
+        }.map { el ->
+            val groupName = el.renderAttribute("name") ?: throw ConfigurationException("Group name is required")
+            var roles = emptySet<Role>()
+            var quota: Configuration.Quota? = null
+            for (child in el.asIterable()) {
+                when (child.localName) {
+                    "users" -> {
+                        parseUserRefs(child).mapNotNull(knownUsersMap::get).forEach { user ->
+                            userGroups.computeIfAbsent(user.name) {
+                                mutableSetOf()
+                            }.add(groupName)
+                        }
+                    }
+
+                    "roles" -> {
+                        roles = parseRoles(child)
+                    }
+                    "quota" -> {
+                        quota = parseQuota(child)
+                    }
+                }
+            }
+            groupName to Group(groupName, roles, quota)
+        }.toMap()
+        val users = knownUsersMap.map { (name, user) ->
+            name to User(name, user.password, userGroups[name]?.mapNotNull { groups[it] }?.toSet() ?: emptySet(), user.quota)
+        }.toMap()
+        return users to groups
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/configuration/Serializer.kt

@@ -1,9 +1,9 @@
-package net.woggioni.gbcs.configuration
+package net.woggioni.gbcs.server.configuration
 
 import net.woggioni.gbcs.api.CacheProvider
 import net.woggioni.gbcs.api.Configuration
-import net.woggioni.gbcs.base.GBCS
-import net.woggioni.gbcs.base.Xml
+import net.woggioni.gbcs.common.GBCS
+import net.woggioni.gbcs.common.Xml
 import org.w3c.dom.Document
 
 object Serializer {
@@ -14,10 +14,9 @@ object Serializer {
             it.xmlNamespace to it.xmlSchemaLocation
         }.toMap()
         return Xml.of(GBCS.GBCS_NAMESPACE_URI, GBCS.GBCS_PREFIX + ":server") {
-            attr("useVirtualThreads", conf.isUseVirtualThread.toString())
 //            attr("xmlns:xs", GradleBuildCacheServer.XML_SCHEMA_NAMESPACE_URI)
             val value = schemaLocations.asSequence().map { (k, v) -> "$k $v" }.joinToString(" ")
-            attr("xs:schemaLocation",value , namespaceURI = GBCS.XML_SCHEMA_NAMESPACE_URI)
+            attr("xs:schemaLocation", value , namespaceURI = GBCS.XML_SCHEMA_NAMESPACE_URI)
 
             conf.serverPath
                 ?.takeIf(String::isNotEmpty)
@@ -27,6 +26,20 @@ object Serializer {
             node("bind") {
                 attr("host", conf.host)
                 attr("port", conf.port.toString())
+                attr("incoming-connections-backlog-size", conf.incomingConnectionsBacklogSize.toString())
+            }
+            node("connection") {
+                conf.connection.let { connection ->
+                    attr("read-timeout", connection.readTimeout.toString())
+                    attr("write-timeout", connection.writeTimeout.toString())
+                    attr("idle-timeout", connection.idleTimeout.toString())
+                    attr("read-idle-timeout", connection.readIdleTimeout.toString())
+                    attr("write-idle-timeout", connection.writeIdleTimeout.toString())
+                    attr("max-request-size", connection.maxRequestSize.toString())
+                }
+            }
+            node("event-executor") {
+                attr("use-virtual-threads", conf.eventExecutor.isUseVirtualThreads.toString())
             }
             val cache = conf.cache
             val serializer : CacheProvider<Configuration.Cache> =
@@ -35,13 +48,36 @@ object Serializer {
             node("authorization") {
                 node("users") {
                     for(user in conf.users.values) {
-                        node("user") {
-                            attr("name", user.name)
-                            user.password?.let { password ->
-                                attr("password", password)
+                        if(user.name.isNotEmpty()) {
+                            node("user") {
+                                attr("name", user.name)
+                                user.password?.let { password ->
+                                    attr("password", password)
+                                }
+                                user.quota?.let { quota ->
+                                    node("quota") {
+                                        attr("calls", quota.calls.toString())
+                                        attr("period", quota.period.toString())
+                                        attr("max-available-calls", quota.maxAvailableCalls.toString())
+                                        attr("initial-available-calls", quota.initialAvailableCalls.toString())
+                                    }
+                                }
                             }
                         }
                     }
+                    conf.users[""]
+                        ?.let { anonymousUser ->
+                            anonymousUser.quota?.let { quota ->
+                                node("anonymous") {
+                                    node("quota") {
+                                        attr("calls", quota.calls.toString())
+                                        attr("period", quota.period.toString())
+                                        attr("max-available-calls", quota.maxAvailableCalls.toString())
+                                        attr("initial-available-calls", quota.initialAvailableCalls.toString())
+                                    }
+                                }
+                            }
+                        }
                 }
                 node("groups") {
                     val groups = conf.users.values.asSequence()
@@ -55,11 +91,19 @@ object Serializer {
                             attr("name", group.name)
                             if(users.isNotEmpty()) {
                                 node("users") {
+                                    var anonymousUser : Configuration.User? = null
                                     for(user in users) {
-                                        node("user") {
-                                            attr("ref", user.name)
+                                        if(user.name.isNotEmpty()) {
+                                            node("user") {
+                                                attr("ref", user.name)
+                                            }
+                                        } else {
+                                            anonymousUser = user
                                         }
                                     }
+                                    if(anonymousUser != null) {
+                                        node("anonymous")
+                                    }
                                 }
                             }
                             if(group.roles.isNotEmpty()) {
@@ -69,6 +113,14 @@ object Serializer {
                                     }
                                 }
                             }
+                            group.quota?.let { quota ->
+                                node("quota") {
+                                    attr("calls", quota.calls.toString())
+                                    attr("period", quota.period.toString())
+                                    attr("max-available-calls", quota.maxAvailableCalls.toString())
+                                    attr("initial-available-calls", quota.initialAvailableCalls.toString())
+                                }
+                            }
                         }
                     }
                 }
@@ -82,6 +134,12 @@ object Serializer {
                         }
                         is Configuration.ClientCertificateAuthentication -> {
                             node("client-certificate") {
+                                authentication.groupExtractor?.let { extractor ->
+                                    node("group-extractor") {
+                                        attr("attribute-name", extractor.rdnType)
+                                        attr("pattern", extractor.pattern)
+                                    }
+                                }
                                 authentication.userExtractor?.let { extractor ->
                                     node("user-extractor") {
                                         attr("attribute-name", extractor.rdnType)
@@ -116,6 +174,7 @@ object Serializer {
                                 attr("password", password)
                             }
                             attr("check-certificate-status", trustStore.isCheckCertificateStatus.toString())
+                            attr("require-client-certificate", trustStore.isRequireClientCertificate.toString())
                         }
                     }
                 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/exception/ExceptionHandler.kt

@@ -0,0 +1,92 @@
+package net.woggioni.gbcs.server.exception
+
+import io.netty.buffer.Unpooled
+import io.netty.channel.ChannelDuplexHandler
+import io.netty.channel.ChannelFutureListener
+import io.netty.channel.ChannelHandler
+import io.netty.channel.ChannelHandlerContext
+import io.netty.handler.codec.DecoderException
+import io.netty.handler.codec.http.DefaultFullHttpResponse
+import io.netty.handler.codec.http.FullHttpResponse
+import io.netty.handler.codec.http.HttpHeaderNames
+import io.netty.handler.codec.http.HttpResponseStatus
+import io.netty.handler.codec.http.HttpVersion
+import io.netty.handler.timeout.ReadTimeoutException
+import io.netty.handler.timeout.WriteTimeoutException
+import net.woggioni.gbcs.api.exception.CacheException
+import net.woggioni.gbcs.api.exception.ContentTooLargeException
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.common.debug
+import javax.net.ssl.SSLPeerUnverifiedException
+
+@ChannelHandler.Sharable
+class ExceptionHandler : ChannelDuplexHandler() {
+    private val log = contextLogger()
+
+    private val NOT_AUTHORIZED: FullHttpResponse = DefaultFullHttpResponse(
+        HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER
+    ).apply {
+        headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+    }
+
+    private val TOO_BIG: FullHttpResponse = DefaultFullHttpResponse(
+        HttpVersion.HTTP_1_1, HttpResponseStatus.REQUEST_ENTITY_TOO_LARGE, Unpooled.EMPTY_BUFFER
+    ).apply {
+        headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+    }
+
+    private val NOT_AVAILABLE: FullHttpResponse = DefaultFullHttpResponse(
+        HttpVersion.HTTP_1_1, HttpResponseStatus.SERVICE_UNAVAILABLE, Unpooled.EMPTY_BUFFER
+    ).apply {
+        headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+    }
+
+    private val SERVER_ERROR: FullHttpResponse = DefaultFullHttpResponse(
+        HttpVersion.HTTP_1_1, HttpResponseStatus.INTERNAL_SERVER_ERROR, Unpooled.EMPTY_BUFFER
+    ).apply {
+        headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+    }
+
+    override fun exceptionCaught(ctx: ChannelHandlerContext, cause: Throwable) {
+        when (cause) {
+            is DecoderException -> {
+                log.error(cause.message, cause)
+                ctx.close()
+            }
+
+            is SSLPeerUnverifiedException -> {
+                ctx.writeAndFlush(NOT_AUTHORIZED.retainedDuplicate())
+                    .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+            }
+
+            is ContentTooLargeException -> {
+                ctx.writeAndFlush(TOO_BIG.retainedDuplicate())
+                    .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+            }
+            is ReadTimeoutException -> {
+                log.debug {
+                    val channelId = ctx.channel().id().asShortText()
+                    "Read timeout on channel $channelId, closing the connection"
+                }
+                ctx.close()
+            }
+            is WriteTimeoutException -> {
+                log.debug {
+                    val channelId = ctx.channel().id().asShortText()
+                    "Write timeout on channel $channelId, closing the connection"
+                }
+                ctx.close()
+            }
+            is CacheException -> {
+                log.error(cause.message, cause)
+                ctx.writeAndFlush(NOT_AVAILABLE.retainedDuplicate())
+                    .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+            }
+            else -> {
+                log.error(cause.message, cause)
+                ctx.writeAndFlush(SERVER_ERROR.retainedDuplicate())
+                    .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+            }
+        }
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/handler/ServerHandler.kt

@@ -0,0 +1,167 @@
+package net.woggioni.gbcs.server.handler
+
+import io.netty.buffer.Unpooled
+import io.netty.channel.ChannelFutureListener
+import io.netty.channel.ChannelHandler
+import io.netty.channel.ChannelHandlerContext
+import io.netty.channel.DefaultFileRegion
+import io.netty.channel.SimpleChannelInboundHandler
+import io.netty.handler.codec.http.DefaultFullHttpResponse
+import io.netty.handler.codec.http.DefaultHttpResponse
+import io.netty.handler.codec.http.FullHttpRequest
+import io.netty.handler.codec.http.HttpHeaderNames
+import io.netty.handler.codec.http.HttpHeaderValues
+import io.netty.handler.codec.http.HttpMethod
+import io.netty.handler.codec.http.HttpResponseStatus
+import io.netty.handler.codec.http.HttpUtil
+import io.netty.handler.codec.http.LastHttpContent
+import io.netty.handler.stream.ChunkedNioStream
+import net.woggioni.gbcs.api.Cache
+import net.woggioni.gbcs.api.exception.CacheException
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.server.debug
+import net.woggioni.gbcs.server.warn
+import java.nio.channels.FileChannel
+import java.nio.file.Path
+
+@ChannelHandler.Sharable
+class ServerHandler(private val cache: Cache, private val serverPrefix: Path) :
+    SimpleChannelInboundHandler<FullHttpRequest>() {
+
+    private val log = contextLogger()
+
+    override fun channelRead0(ctx: ChannelHandlerContext, msg: FullHttpRequest) {
+        val keepAlive: Boolean = HttpUtil.isKeepAlive(msg)
+        val method = msg.method()
+        if (method === HttpMethod.GET) {
+            val path = Path.of(msg.uri())
+            val prefix = path.parent
+            val key = path.fileName?.toString() ?: let {
+                val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.NOT_FOUND)
+                response.headers()[HttpHeaderNames.CONTENT_LENGTH] = 0
+                ctx.writeAndFlush(response)
+                return
+            }
+            if (serverPrefix == prefix) {
+                try {
+                    cache.get(key)
+                } catch(ex : Throwable) {
+                    throw CacheException("Error accessing the cache backend", ex)
+                }?.let { channel ->
+                    log.debug(ctx) {
+                        "Cache hit for key '$key'"
+                    }
+                    val response = DefaultHttpResponse(msg.protocolVersion(), HttpResponseStatus.OK)
+                    response.headers()[HttpHeaderNames.CONTENT_TYPE] = HttpHeaderValues.APPLICATION_OCTET_STREAM
+                    if (!keepAlive) {
+                        response.headers().set(HttpHeaderNames.CONNECTION, HttpHeaderValues.CLOSE)
+                        response.headers().set(HttpHeaderNames.TRANSFER_ENCODING, HttpHeaderValues.IDENTITY)
+                    } else {
+                        response.headers().set(HttpHeaderNames.CONNECTION, HttpHeaderValues.KEEP_ALIVE)
+                        response.headers().set(HttpHeaderNames.TRANSFER_ENCODING, HttpHeaderValues.CHUNKED)
+                    }
+                    ctx.write(response)
+                    when (channel) {
+                        is FileChannel -> {
+                            if (keepAlive) {
+                                ctx.write(DefaultFileRegion(channel, 0, channel.size()))
+                                ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT.retainedDuplicate())
+                            } else {
+                                ctx.writeAndFlush(DefaultFileRegion(channel, 0, channel.size()))
+                                    .addListener(ChannelFutureListener.CLOSE)
+                            }
+                        }
+                        else -> {
+                            ctx.write(ChunkedNioStream(channel)).addListener { evt ->
+                                channel.close()
+                            }
+                            ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT.retainedDuplicate())
+                        }
+                    }
+                } ?: let {
+                    log.debug(ctx) {
+                        "Cache miss for key '$key'"
+                    }
+                    val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.NOT_FOUND)
+                    response.headers()[HttpHeaderNames.CONTENT_LENGTH] = 0
+                    ctx.writeAndFlush(response)
+                }
+            } else {
+                log.warn(ctx) {
+                    "Got request for unhandled path '${msg.uri()}'"
+                }
+                val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.BAD_REQUEST)
+                response.headers()[HttpHeaderNames.CONTENT_LENGTH] = 0
+                ctx.writeAndFlush(response)
+            }
+        } else if (method === HttpMethod.PUT) {
+            val path = Path.of(msg.uri())
+            val prefix = path.parent
+            val key = path.fileName.toString()
+
+            if (serverPrefix == prefix) {
+                log.debug(ctx) {
+                    "Added value for key '$key' to build cache"
+                }
+                val bodyBytes = msg.content().run {
+                    if (isDirect) {
+                        ByteArray(readableBytes()).also {
+                            readBytes(it)
+                        }
+                    } else {
+                        array()
+                    }
+                }
+                try {
+                    cache.put(key, bodyBytes)
+                } catch(ex : Throwable) {
+                    throw CacheException("Error accessing the cache backend", ex)
+                }
+                val response = DefaultFullHttpResponse(
+                    msg.protocolVersion(), HttpResponseStatus.CREATED,
+                    Unpooled.copiedBuffer(key.toByteArray())
+                )
+                response.headers()[HttpHeaderNames.CONTENT_LENGTH] = response.content().readableBytes()
+                ctx.writeAndFlush(response)
+            } else {
+                log.warn(ctx) {
+                    "Got request for unhandled path '${msg.uri()}'"
+                }
+                val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.BAD_REQUEST)
+                response.headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+                ctx.writeAndFlush(response)
+            }
+        } else if(method == HttpMethod.TRACE) {
+            val replayedRequestHead = ctx.alloc().buffer()
+            replayedRequestHead.writeCharSequence("TRACE ${Path.of(msg.uri())} ${msg.protocolVersion().text()}\r\n", Charsets.US_ASCII)
+            msg.headers().forEach { (key, value) ->
+                replayedRequestHead.apply {
+                    writeCharSequence(key, Charsets.US_ASCII)
+                    writeCharSequence(": ", Charsets.US_ASCII)
+                    writeCharSequence(value, Charsets.UTF_8)
+                    writeCharSequence("\r\n", Charsets.US_ASCII)
+                }
+            }
+            replayedRequestHead.writeCharSequence("\r\n", Charsets.US_ASCII)
+            val requestBody = msg.content()
+            requestBody.retain()
+            val responseBody = ctx.alloc().compositeBuffer(2).apply {
+                addComponents(true, replayedRequestHead)
+                addComponents(true, requestBody)
+            }
+            val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.OK, responseBody)
+            response.headers().apply {
+                set(HttpHeaderNames.CONTENT_TYPE, "message/http")
+                set(HttpHeaderNames.CONTENT_LENGTH, responseBody.readableBytes())
+            }
+            ctx.writeAndFlush(response)
+        } else {
+            log.warn(ctx) {
+                "Got request with unhandled method '${msg.method().name()}'"
+            }
+            val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.METHOD_NOT_ALLOWED)
+            response.headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+            ctx.writeAndFlush(response)
+        }
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/throttling/BucketManager.kt

@@ -0,0 +1,86 @@
+package net.woggioni.gbcs.server.throttling
+
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.jwo.Bucket
+import java.net.InetSocketAddress
+import java.util.Arrays
+import java.util.concurrent.ConcurrentHashMap
+import java.util.function.Function
+
+class BucketManager private constructor(
+    private val bucketsByUser: Map<Configuration.User, Bucket> = HashMap(),
+    private val bucketsByGroup: Map<Configuration.Group, Bucket> = HashMap(),
+    loader: Function<InetSocketAddress, Bucket>?
+) {
+
+    private class BucketsByAddress(
+        private val map: MutableMap<ByteArrayKey, Bucket>,
+        private val loader: Function<InetSocketAddress, Bucket>
+    ) {
+        fun getBucket(socketAddress : InetSocketAddress) = map.computeIfAbsent(ByteArrayKey(socketAddress.address.address))  {
+            loader.apply(socketAddress)
+        }
+    }
+
+    private val bucketsByAddress: BucketsByAddress? = loader?.let {
+        BucketsByAddress(ConcurrentHashMap(), it)
+    }
+
+    private class ByteArrayKey(val array: ByteArray) {
+        override fun equals(other: Any?) = (other as? ByteArrayKey)?.let { bak ->
+            array contentEquals bak.array
+        } ?: false
+
+        override fun hashCode() = Arrays.hashCode(array)
+    }
+
+    fun getBucketByAddress(address : InetSocketAddress) : Bucket? {
+        return bucketsByAddress?.getBucket(address)
+    }
+
+    fun getBucketByUser(user : Configuration.User) = bucketsByUser[user]
+    fun getBucketByGroup(group : Configuration.Group) = bucketsByGroup[group]
+
+    companion object {
+        fun from(cfg : Configuration) : BucketManager {
+            val bucketsByUser = cfg.users.values.asSequence().filter {
+                it.quota != null
+            }.map { user ->
+                val quota = user.quota
+                val bucket = Bucket.local(
+                    quota.maxAvailableCalls,
+                    quota.calls,
+                    quota.period,
+                    quota.initialAvailableCalls
+                )
+                user to bucket
+            }.toMap()
+            val bucketsByGroup = cfg.groups.values.asSequence().filter {
+                it.quota != null
+            }.map { group ->
+                val quota = group.quota
+                val bucket = Bucket.local(
+                    quota.maxAvailableCalls,
+                    quota.calls,
+                    quota.period,
+                    quota.initialAvailableCalls
+                )
+                group to bucket
+            }.toMap()
+            return BucketManager(
+                bucketsByUser,
+                bucketsByGroup,
+                cfg.users[""]?.quota?.let { anonymousUserQuota ->
+                    Function {
+                        Bucket.local(
+                            anonymousUserQuota.maxAvailableCalls,
+                            anonymousUserQuota.calls,
+                            anonymousUserQuota.period,
+                            anonymousUserQuota.initialAvailableCalls
+                        )
+                    }
+                }
+            )
+        }
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/throttling/ThrottlingHandler.kt

@@ -0,0 +1,99 @@
+package net.woggioni.gbcs.server.throttling
+
+import io.netty.channel.ChannelHandler.Sharable
+import io.netty.channel.ChannelHandlerContext
+import io.netty.channel.ChannelInboundHandlerAdapter
+import io.netty.handler.codec.http.DefaultFullHttpResponse
+import io.netty.handler.codec.http.HttpHeaderNames
+import io.netty.handler.codec.http.HttpResponseStatus
+import io.netty.handler.codec.http.HttpVersion
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.server.GradleBuildCacheServer
+import net.woggioni.jwo.Bucket
+import net.woggioni.jwo.LongMath
+import java.net.InetSocketAddress
+import java.time.Duration
+import java.time.temporal.ChronoUnit
+import java.util.concurrent.TimeUnit
+
+
+@Sharable
+class ThrottlingHandler(cfg: Configuration) :
+    ChannelInboundHandlerAdapter() {
+
+    private val log = contextLogger()
+    private val bucketManager = BucketManager.from(cfg)
+
+    private val connectionConfiguration = cfg.connection
+
+    /**
+     * If the suggested waiting time from the bucket is lower than this
+     * amount, then the server will simply wait by itself before sending a response
+     * instead of replying with 429
+     */
+    private val waitThreshold = minOf(
+        connectionConfiguration.idleTimeout,
+        connectionConfiguration.readIdleTimeout,
+        connectionConfiguration.writeIdleTimeout
+    ).dividedBy(2)
+
+    override fun channelRead(ctx: ChannelHandlerContext, msg: Any) {
+        val buckets = mutableListOf<Bucket>()
+        val user = ctx.channel().attr(GradleBuildCacheServer.userAttribute).get()
+        if (user != null) {
+            bucketManager.getBucketByUser(user)?.let(buckets::add)
+        }
+        val groups = ctx.channel().attr(GradleBuildCacheServer.groupAttribute).get() ?: emptySet()
+        if (groups.isNotEmpty()) {
+            groups.forEach { group ->
+                bucketManager.getBucketByGroup(group)?.let(buckets::add)
+            }
+        }
+        if (user == null && groups.isEmpty()) {
+            bucketManager.getBucketByAddress(ctx.channel().remoteAddress() as InetSocketAddress)?.let(buckets::add)
+        }
+        if (buckets.isEmpty()) {
+            return super.channelRead(ctx, msg)
+        } else {
+            handleBuckets(buckets, ctx, msg, true)
+        }
+    }
+
+    private fun handleBuckets(buckets : List<Bucket>, ctx : ChannelHandlerContext, msg : Any, delayResponse : Boolean) {
+        var nextAttempt = -1L
+        for (bucket in buckets) {
+            val bucketNextAttempt = bucket.removeTokensWithEstimate(1)
+            if (bucketNextAttempt > nextAttempt) {
+                nextAttempt = bucketNextAttempt
+            }
+        }
+        if(nextAttempt < 0) {
+            super.channelRead(ctx, msg)
+            return
+        }
+        val waitDuration = Duration.of(LongMath.ceilDiv(nextAttempt, 100_000_000L) * 100L, ChronoUnit.MILLIS)
+        if (delayResponse && waitDuration < waitThreshold) {
+            ctx.executor().schedule({
+                handleBuckets(buckets, ctx, msg, false)
+            }, waitDuration.toMillis(), TimeUnit.MILLISECONDS)
+        } else {
+            sendThrottledResponse(ctx, waitDuration)
+        }
+    }
+
+    private fun sendThrottledResponse(ctx: ChannelHandlerContext, retryAfter: Duration) {
+        val response = DefaultFullHttpResponse(
+            HttpVersion.HTTP_1_1,
+            HttpResponseStatus.TOO_MANY_REQUESTS
+        )
+        response.headers()[HttpHeaderNames.CONTENT_LENGTH] = 0
+        retryAfter.seconds.takeIf {
+            it > 0
+        }?.let {
+            response.headers()[HttpHeaderNames.RETRY_AFTER] = retryAfter.seconds
+        }
+
+        ctx.writeAndFlush(response)
+    }
+}

gbcs-server/src/main/resources/META-INF/services/net.woggioni.gbcs.api.CacheProvider

@@ -0,0 +1,2 @@
+net.woggioni.gbcs.server.cache.FileSystemCacheProvider
+net.woggioni.gbcs.server.cache.InMemoryCacheProvider

gbcs-server/src/main/resources/net/woggioni/gbcs/server/gbcs-default.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs:server
+             xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+             xmlns:gbcs="urn:net.woggioni.gbcs.server"
+             xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
+    <bind host="127.0.0.1" port="8080" incoming-connections-backlog-size="1024"/>
+    <connection
+            max-request-size="67108864"
+            idle-timeout="PT30S"
+            read-timeout="PT10S"
+            write-timeout="PT10S"
+            read-idle-timeout="PT60S"
+            write-idle-timeout="PT60S"/>
+    <event-executor use-virtual-threads="true"/>
+    <cache xs:type="gbcs:fileSystemCacheType" path="/tmp/gbcs" max-age="P7D"/>
+    <authentication>
+        <none/>
+    </authentication>
+</gbcs:server>

gbcs-server/src/main/resources/net/woggioni/gbcs/server/schema/gbcs.xsd

@@ -1,14 +1,15 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<xs:schema targetNamespace="urn:net.woggioni.gbcs"
+<xs:schema targetNamespace="urn:net.woggioni.gbcs.server"
            xmlns:xs="http://www.w3.org/2001/XMLSchema"
-           xmlns:gbcs="urn:net.woggioni.gbcs"
-           elementFormDefault="unqualified"
->
+           xmlns:gbcs="urn:net.woggioni.gbcs.server"
+           elementFormDefault="unqualified">
     <xs:element name="server" type="gbcs:serverType"/>
 
     <xs:complexType name="serverType">
         <xs:sequence minOccurs="0">
             <xs:element name="bind" type="gbcs:bindType" maxOccurs="1"/>
+            <xs:element name="connection" type="gbcs:connectionType" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="event-executor" type="gbcs:eventExecutorType" minOccurs="0" maxOccurs="1"/>
             <xs:element name="cache" type="gbcs:cacheType" maxOccurs="1"/>
             <xs:element name="authorization" type="gbcs:authorizationType" minOccurs="0">
                 <xs:key name="userId">
@@ -21,20 +22,43 @@
                 </xs:keyref>
             </xs:element>
             <xs:element name="authentication" type="gbcs:authenticationType" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="tls-certificate-authorization" type="gbcs:tlsCertificateAuthorizationType" minOccurs="0" maxOccurs="1"/>
             <xs:element name="tls" type="gbcs:tlsType" minOccurs="0" maxOccurs="1"/>
         </xs:sequence>
         <xs:attribute name="path" type="xs:string" use="optional"/>
-        <xs:attribute name="useVirtualThreads" type="xs:boolean" use="optional" default="true"/>
     </xs:complexType>
 
     <xs:complexType name="bindType">
-        <xs:attribute name="host" type="xs:string" use="required"/>
+        <xs:attribute name="host" type="xs:token" use="required"/>
         <xs:attribute name="port" type="xs:unsignedShort" use="required"/>
+        <xs:attribute name="incoming-connections-backlog-size" type="xs:unsignedInt" use="optional" default="1024"/>
+    </xs:complexType>
+
+    <xs:complexType name="connectionType">
+        <xs:attribute name="read-timeout" type="xs:duration" use="optional" default="PT0S"/>
+        <xs:attribute name="write-timeout" type="xs:duration" use="optional" default="PT0S"/>
+        <xs:attribute name="idle-timeout" type="xs:duration" use="optional" default="PT30S"/>
+        <xs:attribute name="read-idle-timeout" type="xs:duration" use="optional" default="PT60S"/>
+        <xs:attribute name="write-idle-timeout" type="xs:duration" use="optional" default="PT60S"/>
+        <xs:attribute name="max-request-size" type="xs:unsignedInt" use="optional" default="67108864"/>
+    </xs:complexType>
+
+    <xs:complexType name="eventExecutorType">
+        <xs:attribute name="use-virtual-threads" type="xs:boolean" use="optional" default="true"/>
     </xs:complexType>
 
     <xs:complexType name="cacheType" abstract="true"/>
 
+    <xs:complexType name="inMemoryCacheType">
+        <xs:complexContent>
+            <xs:extension base="gbcs:cacheType">
+                <xs:attribute name="max-age" type="xs:duration" default="P1D"/>
+                <xs:attribute name="digest" type="xs:token" default="MD5"/>
+                <xs:attribute name="enable-compression" type="xs:boolean" default="true"/>
+                <xs:attribute name="compression-level" type="xs:byte" default="-1"/>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+
     <xs:complexType name="fileSystemCacheType">
         <xs:complexContent>
             <xs:extension base="gbcs:cacheType">
@@ -49,14 +73,14 @@
 
     <xs:complexType name="tlsCertificateAuthorizationType">
         <xs:sequence>
-            <xs:element name="group-extractor" type="gbcs:X500NameExtractorType"/>
-            <xs:element name="user-extractor" type="gbcs:X500NameExtractorType"/>
+            <xs:element name="group-extractor" type="gbcs:X500NameExtractorType" minOccurs="0"/>
+            <xs:element name="user-extractor" type="gbcs:X500NameExtractorType" minOccurs="0"/>
         </xs:sequence>
     </xs:complexType>
 
     <xs:complexType name="X500NameExtractorType">
-        <xs:attribute name="attribute-name" type="xs:string"/>
-        <xs:attribute name="pattern" type="xs:string"/>
+        <xs:attribute name="attribute-name" type="xs:token"/>
+        <xs:attribute name="pattern" type="xs:token"/>
     </xs:complexType>
 
     <xs:complexType name="authorizationType">
@@ -79,17 +103,34 @@
         </xs:choice>
     </xs:complexType>
 
-    <xs:complexType name="usersType">
+    <xs:complexType name="quotaType">
+        <xs:attribute name="calls" type="xs:positiveInteger" use="required"/>
+        <xs:attribute name="period" type="xs:duration" use="required"/>
+        <xs:attribute name="max-available-calls" type="xs:positiveInteger" use="optional"/>
+        <xs:attribute name="initial-available-calls" type="xs:unsignedInt" use="optional"/>
+    </xs:complexType>
+
+    <xs:complexType name="anonymousUserType">
         <xs:sequence>
-            <xs:element name="user" type="gbcs:userType" minOccurs="0" maxOccurs="unbounded"/>
+            <xs:element name="quota" type="gbcs:quotaType" minOccurs="0" maxOccurs="1"/>
         </xs:sequence>
     </xs:complexType>
 
     <xs:complexType name="userType">
-        <xs:attribute name="name" type="xs:string" use="required"/>
+        <xs:sequence>
+            <xs:element name="quota" type="gbcs:quotaType" minOccurs="0" maxOccurs="1"/>
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:token" use="required"/>
         <xs:attribute name="password" type="xs:string" use="optional"/>
     </xs:complexType>
 
+    <xs:complexType name="usersType">
+        <xs:sequence>
+            <xs:element name="user" type="gbcs:userType" minOccurs="0" maxOccurs="unbounded"/>
+            <xs:element name="anonymous" type="gbcs:anonymousUserType" minOccurs="0" maxOccurs="1"/>
+        </xs:sequence>
+    </xs:complexType>
+
     <xs:complexType name="groupsType">
         <xs:sequence>
             <xs:element name="group" type="gbcs:groupType" maxOccurs="unbounded" minOccurs="0"/>
@@ -105,12 +146,13 @@
                 </xs:unique>
             </xs:element>
             <xs:element name="roles" type="gbcs:rolesType" maxOccurs="1" minOccurs="0"/>
+            <xs:element name="quota" type="gbcs:quotaType" minOccurs="0" maxOccurs="1"/>
         </xs:sequence>
-        <xs:attribute name="name" type="xs:string"/>
+        <xs:attribute name="name" type="xs:token"/>
     </xs:complexType>
 
     <xs:simpleType name="role" final="restriction" >
-        <xs:restriction base="xs:string">
+        <xs:restriction base="xs:token">
             <xs:enumeration value="READER" />
             <xs:enumeration value="WRITER" />
         </xs:restriction>
@@ -127,7 +169,8 @@
 
     <xs:complexType name="userRefsType">
         <xs:sequence>
-            <xs:element name="user" type="gbcs:userRefType" maxOccurs="unbounded" minOccurs="0"/>
+                <xs:element name="user" type="gbcs:userRefType" maxOccurs="unbounded" minOccurs="0"/>
+                <xs:element name="anonymous" minOccurs="0" maxOccurs="1"/>
         </xs:sequence>
     </xs:complexType>
 
@@ -140,7 +183,6 @@
             <xs:element name="keystore" type="gbcs:keyStoreType" />
             <xs:element name="truststore" type="gbcs:trustStoreType" minOccurs="0"/>
         </xs:all>
-        <xs:attribute name="verify-clients" type="xs:boolean" use="optional"/>
     </xs:complexType>
 
     <xs:complexType name="keyStoreType">
@@ -154,6 +196,7 @@
         <xs:attribute name="file" type="xs:string" use="required"/>
         <xs:attribute name="password" type="xs:string"/>
         <xs:attribute name="check-certificate-status" type="xs:boolean"/>
+        <xs:attribute name="require-client-certificate" type="xs:boolean" use="optional" default="false"/>
     </xs:complexType>
 
     <xs:complexType name="propertiesType">

gbcs-server/src/test/java/net/woggioni/gbcs/server/test/utils/CertificateUtils.java

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.utils;
+package net.woggioni.gbcs.server.test.utils;
 
 import org.bouncycastle.asn1.DERSequence;
 import org.bouncycastle.asn1.x500.X500Name;

gbcs-server/src/test/java/net/woggioni/gbcs/server/test/utils/NetworkUtils.java

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.utils;
+package net.woggioni.gbcs.server.test.utils;
 
 import net.woggioni.jwo.JWO;
 

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/AbstractBasicAuthServerTest.kt

@@ -0,0 +1,86 @@
+package net.woggioni.gbcs.server.test
+
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.api.Role
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.server.cache.FileSystemCacheConfiguration
+import net.woggioni.gbcs.server.configuration.Serializer
+import net.woggioni.gbcs.server.test.utils.NetworkUtils
+import java.net.URI
+import java.net.http.HttpRequest
+import java.nio.charset.StandardCharsets
+import java.nio.file.Path
+import java.time.Duration
+import java.time.temporal.ChronoUnit
+import java.util.Base64
+import java.util.zip.Deflater
+import kotlin.random.Random
+
+
+abstract class AbstractBasicAuthServerTest : AbstractServerTest() {
+
+    private lateinit var cacheDir : Path
+
+    protected val random = Random(101325)
+    protected val keyValuePair = newEntry(random)
+    protected val serverPath = "gbcs"
+    protected val readersGroup = Configuration.Group("readers", setOf(Role.Reader), null)
+    protected val writersGroup = Configuration.Group("writers", setOf(Role.Writer), null)
+
+    abstract protected val users : List<Configuration.User>
+
+    override fun setUp() {
+        this.cacheDir = testDir.resolve("cache")
+        cfg = Configuration.of(
+            "127.0.0.1",
+            NetworkUtils.getFreePort(),
+            50,
+            serverPath,
+            Configuration.EventExecutor(false),
+            Configuration.Connection(
+                Duration.of(10, ChronoUnit.SECONDS),
+                Duration.of(10, ChronoUnit.SECONDS),
+                Duration.of(60, ChronoUnit.SECONDS),
+                Duration.of(30, ChronoUnit.SECONDS),
+                Duration.of(30, ChronoUnit.SECONDS),
+                0x1000
+            ),
+            users.asSequence().map { it.name to it}.toMap(),
+            sequenceOf(writersGroup, readersGroup).map { it.name to it}.toMap(),
+            FileSystemCacheConfiguration(this.cacheDir,
+                maxAge = Duration.ofSeconds(3600 * 24),
+                digestAlgorithm = "MD5",
+                compressionLevel = Deflater.DEFAULT_COMPRESSION,
+                compressionEnabled = false
+            ),
+            Configuration.BasicAuthentication(),
+            null,
+        )
+        Xml.write(Serializer.serialize(cfg), System.out)
+    }
+
+    override fun tearDown() {
+    }
+
+    protected fun buildAuthorizationHeader(user : Configuration.User, password : String) : String {
+        val b64 = Base64.getEncoder().encode("${user.name}:${password}".toByteArray(Charsets.UTF_8)).let{
+            String(it, StandardCharsets.UTF_8)
+        }
+        return "Basic $b64"
+    }
+
+    protected fun newRequestBuilder(key : String) = HttpRequest.newBuilder()
+        .uri(URI.create("http://${cfg.host}:${cfg.port}/$serverPath/$key"))
+
+
+    protected fun newEntry(random : Random) : Pair<String, ByteArray> {
+        val key = ByteArray(0x10).let {
+            random.nextBytes(it)
+            Base64.getUrlEncoder().encodeToString(it)
+        }
+        val value = ByteArray(0x1000).also {
+            random.nextBytes(it)
+        }
+        return key to value
+    }
+}

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/AbstractServerTest.kt

@@ -1,6 +1,6 @@
-package net.woggioni.gbcs.test
+package net.woggioni.gbcs.server.test
 
-import net.woggioni.gbcs.GradleBuildCacheServer
+import net.woggioni.gbcs.server.GradleBuildCacheServer
 import net.woggioni.gbcs.api.Configuration
 import org.junit.jupiter.api.AfterAll
 import org.junit.jupiter.api.BeforeAll

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/AbstractTlsServerTest.kt

@@ -1,29 +1,25 @@
-package net.woggioni.gbcs.test
+package net.woggioni.gbcs.server.test
 
-import io.netty.handler.codec.http.HttpResponseStatus
 import net.woggioni.gbcs.api.Configuration
 import net.woggioni.gbcs.api.Role
-import net.woggioni.gbcs.base.Xml
-import net.woggioni.gbcs.cache.FileSystemCacheConfiguration
-import net.woggioni.gbcs.configuration.Serializer
-import net.woggioni.gbcs.utils.CertificateUtils
-import net.woggioni.gbcs.utils.CertificateUtils.X509Credentials
-import net.woggioni.gbcs.utils.NetworkUtils
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.server.cache.FileSystemCacheConfiguration
+import net.woggioni.gbcs.server.cache.InMemoryCacheConfiguration
+import net.woggioni.gbcs.server.configuration.Serializer
+import net.woggioni.gbcs.server.test.utils.CertificateUtils
+import net.woggioni.gbcs.server.test.utils.CertificateUtils.X509Credentials
+import net.woggioni.gbcs.server.test.utils.NetworkUtils
 import org.bouncycastle.asn1.x500.X500Name
-import org.junit.jupiter.api.Assertions
-import org.junit.jupiter.api.Order
-import org.junit.jupiter.api.Test
-import java.net.ServerSocket
 import java.net.URI
 import java.net.http.HttpClient
 import java.net.http.HttpRequest
-import java.net.http.HttpResponse
 import java.nio.charset.StandardCharsets
 import java.nio.file.Files
 import java.nio.file.Path
 import java.security.KeyStore
 import java.security.KeyStore.PasswordProtection
 import java.time.Duration
+import java.time.temporal.ChronoUnit
 import java.util.Base64
 import java.util.zip.Deflater
 import javax.net.ssl.KeyManagerFactory
@@ -32,7 +28,7 @@ import javax.net.ssl.TrustManagerFactory
 import kotlin.random.Random
 
 
-class TlsServerTest : AbstractServerTest() {
+abstract class AbstractTlsServerTest : AbstractServerTest() {
 
     companion object {
         private const val CA_CERTIFICATE_ENTRY = "gbcs-ca"
@@ -48,21 +44,17 @@ class TlsServerTest : AbstractServerTest() {
     private lateinit var serverKeyStore: KeyStore
     private lateinit var clientKeyStore: KeyStore
     private lateinit var trustStore: KeyStore
-    private lateinit var ca: X509Credentials
+    protected lateinit var ca: X509Credentials
 
-    private val readersGroup = Configuration.Group("readers", setOf(Role.Reader))
-    private val writersGroup = Configuration.Group("writers", setOf(Role.Writer))
-    private val random = Random(101325)
-    private val keyValuePair = newEntry(random)
+    protected val readersGroup = Configuration.Group("readers", setOf(Role.Reader), null)
+    protected val writersGroup = Configuration.Group("writers", setOf(Role.Writer), null)
+    protected val random = Random(101325)
+    protected val keyValuePair = newEntry(random)
     private val serverPath : String? = null
 
-    private val users = listOf(
-        Configuration.User("user1", null, setOf(readersGroup)),
-        Configuration.User("user2", null, setOf(writersGroup)),
-        Configuration.User("user3", null, setOf(readersGroup, writersGroup))
-    )
+    protected abstract val users : List<Configuration.User>
 
-    fun createKeyStoreAndTrustStore() {
+    protected fun createKeyStoreAndTrustStore() {
         ca = CertificateUtils.createCertificateAuthority(CA_CERTIFICATE_ENTRY, 30)
         val serverCert = CertificateUtils.createServerCertificate(ca, X500Name("CN=$SERVER_CERTIFICATE_ENTRY"), 30)
         val clientCert = CertificateUtils.createClientCertificate(ca, X500Name("CN=$CLIENT_CERTIFICATE_ENTRY"), 30)
@@ -108,7 +100,7 @@ class TlsServerTest : AbstractServerTest() {
         }
     }
 
-    fun getClientKeyStore(ca: X509Credentials, subject: X500Name) = KeyStore.getInstance("PKCS12").apply {
+    protected fun getClientKeyStore(ca: X509Credentials, subject: X500Name) = KeyStore.getInstance("PKCS12").apply {
         val clientCert = CertificateUtils.createClientCertificate(ca, subject, 30)
 
         load(null, null)
@@ -120,7 +112,7 @@ class TlsServerTest : AbstractServerTest() {
         )
     }
 
-    fun getHttpClient(clientKeyStore: KeyStore?): HttpClient {
+    protected fun getHttpClient(clientKeyStore: KeyStore?): HttpClient {
         val kmf = clientKeyStore?.let {
             KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()).apply {
                 init(it, PASSWORD.toCharArray())
@@ -148,7 +140,17 @@ class TlsServerTest : AbstractServerTest() {
         cfg = Configuration(
             "127.0.0.1",
             NetworkUtils.getFreePort(),
+            100,
             serverPath,
+            Configuration.EventExecutor(false),
+            Configuration.Connection(
+                Duration.of(10, ChronoUnit.SECONDS),
+                Duration.of(10, ChronoUnit.SECONDS),
+                Duration.of(60, ChronoUnit.SECONDS),
+                Duration.of(30, ChronoUnit.SECONDS),
+                Duration.of(30, ChronoUnit.SECONDS),
+                0x1000
+            ),
             users.asSequence().map { it.name to it }.toMap(),
             sequenceOf(writersGroup, readersGroup).map { it.name to it }.toMap(),
             FileSystemCacheConfiguration(this.cacheDir,
@@ -157,16 +159,20 @@ class TlsServerTest : AbstractServerTest() {
                 compressionLevel = Deflater.DEFAULT_COMPRESSION,
                 digestAlgorithm = "MD5"
             ),
+//            InMemoryCacheConfiguration(
+//                maxAge = Duration.ofSeconds(3600 * 24),
+//                compressionEnabled = true,
+//                compressionLevel = Deflater.DEFAULT_COMPRESSION,
+//                digestAlgorithm = "MD5"
+//            ),
             Configuration.ClientCertificateAuthentication(
                 Configuration.TlsCertificateExtractor("CN", "(.*)"),
                 null
             ),
             Configuration.Tls(
                 Configuration.KeyStore(this.serverKeyStoreFile, null, SERVER_CERTIFICATE_ENTRY, PASSWORD),
-                Configuration.TrustStore(this.trustStoreFile, null, false),
-                true
-            ),
-            false,
+                Configuration.TrustStore(this.trustStoreFile, null, false, false),
+            )
         )
         Xml.write(Serializer.serialize(cfg), System.out)
     }
@@ -174,17 +180,17 @@ class TlsServerTest : AbstractServerTest() {
     override fun tearDown() {
     }
 
-    fun newRequestBuilder(key: String) = HttpRequest.newBuilder()
+    protected fun newRequestBuilder(key: String) = HttpRequest.newBuilder()
         .uri(URI.create("https://${cfg.host}:${cfg.port}/${serverPath ?: ""}/$key"))
 
-    fun buildAuthorizationHeader(user: Configuration.User, password: String): String {
+    private fun buildAuthorizationHeader(user: Configuration.User, password: String): String {
         val b64 = Base64.getEncoder().encode("${user.name}:${password}".toByteArray(Charsets.UTF_8)).let {
             String(it, StandardCharsets.UTF_8)
         }
         return "Basic $b64"
     }
 
-    fun newEntry(random: Random): Pair<String, ByteArray> {
+    protected fun newEntry(random: Random): Pair<String, ByteArray> {
         val key = ByteArray(0x10).let {
             random.nextBytes(it)
             Base64.getUrlEncoder().encodeToString(it)
@@ -194,106 +200,4 @@ class TlsServerTest : AbstractServerTest() {
         }
         return key to value
     }
-
-    @Test
-    @Order(1)
-    fun putWithNoClientCertificate() {
-        val client: HttpClient = getHttpClient(null)
-        val (key, value) = keyValuePair
-
-        val requestBuilder = newRequestBuilder(key)
-            .header("Content-Type", "application/octet-stream")
-            .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
-
-        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
-        Assertions.assertEquals(HttpResponseStatus.UNAUTHORIZED.code(), response.statusCode())
-    }
-
-    @Test
-    @Order(2)
-    fun putAsAReaderUser() {
-        val (key, value) = keyValuePair
-        val user = cfg.users.values.find {
-            Role.Reader in it.roles && Role.Writer !in it.roles
-        } ?: throw RuntimeException("Reader user not found")
-        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
-        val requestBuilder = newRequestBuilder(key)
-            .header("Content-Type", "application/octet-stream")
-            .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
-
-        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
-        Assertions.assertEquals(HttpResponseStatus.FORBIDDEN.code(), response.statusCode())
-    }
-
-    @Test
-    @Order(3)
-    fun getAsAWriterUser() {
-        val (key, _) = keyValuePair
-        val user = cfg.users.values.find {
-            Role.Writer in it.roles
-        } ?: throw RuntimeException("Reader user not found")
-        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
-
-        val requestBuilder = newRequestBuilder(key)
-            .header("Authorization", buildAuthorizationHeader(user, PASSWORD))
-            .GET()
-
-        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
-        Assertions.assertEquals(HttpResponseStatus.FORBIDDEN.code(), response.statusCode())
-    }
-
-    @Test
-    @Order(4)
-    fun putAsAWriterUser() {
-        val (key, value) = keyValuePair
-        val user = cfg.users.values.find {
-            Role.Writer in it.roles
-        } ?: throw RuntimeException("Reader user not found")
-        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
-
-        val requestBuilder = newRequestBuilder(key)
-            .header("Content-Type", "application/octet-stream")
-            .header("Authorization", buildAuthorizationHeader(user, PASSWORD))
-            .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
-
-        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
-        Assertions.assertEquals(HttpResponseStatus.CREATED.code(), response.statusCode())
-    }
-
-    @Test
-    @Order(5)
-    fun getAsAReaderUser() {
-        val (key, value) = keyValuePair
-        val user = cfg.users.values.find {
-            Role.Reader in it.roles
-        } ?: throw RuntimeException("Reader user not found")
-        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
-
-        val requestBuilder = newRequestBuilder(key)
-            .header("Authorization", buildAuthorizationHeader(user, PASSWORD))
-            .GET()
-
-        val response: HttpResponse<ByteArray> =
-            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
-        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
-        Assertions.assertArrayEquals(value, response.body())
-    }
-
-    @Test
-    @Order(6)
-    fun getMissingKeyAsAReaderUser() {
-        val (key, _) = newEntry(random)
-        val user = cfg.users.values.find {
-            Role.Reader in it.roles
-        } ?: throw RuntimeException("Reader user not found")
-        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
-
-        val requestBuilder = newRequestBuilder(key)
-            .header("Authorization", buildAuthorizationHeader(user, PASSWORD))
-            .GET()
-
-        val response: HttpResponse<ByteArray> =
-            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
-        Assertions.assertEquals(HttpResponseStatus.NOT_FOUND.code(), response.statusCode())
-    }
 }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/BasicAuthServerTest.kt

@@ -1,93 +1,37 @@
-package net.woggioni.gbcs.test
+package net.woggioni.gbcs.server.test
 
 import io.netty.handler.codec.http.HttpResponseStatus
 import net.woggioni.gbcs.api.Configuration
 import net.woggioni.gbcs.api.Role
-import net.woggioni.gbcs.base.PasswordSecurity.hashPassword
-import net.woggioni.gbcs.base.Xml
-import net.woggioni.gbcs.cache.FileSystemCacheConfiguration
-import net.woggioni.gbcs.configuration.Serializer
-import net.woggioni.gbcs.utils.NetworkUtils
+import net.woggioni.gbcs.common.PasswordSecurity.hashPassword
 import org.junit.jupiter.api.Assertions
 import org.junit.jupiter.api.Order
 import org.junit.jupiter.api.Test
-import java.io.IOException
-import java.net.ServerSocket
-import java.net.URI
 import java.net.http.HttpClient
 import java.net.http.HttpRequest
 import java.net.http.HttpResponse
-import java.nio.charset.StandardCharsets
-import java.nio.file.Path
 import java.time.Duration
-import java.util.Base64
-import java.util.zip.Deflater
-import kotlin.random.Random
+import java.time.temporal.ChronoUnit
 
 
-class BasicAuthServerTest : AbstractServerTest() {
+class BasicAuthServerTest : AbstractBasicAuthServerTest() {
 
     companion object {
         private const val PASSWORD = "password"
     }
 
-    private lateinit var cacheDir : Path
-
-    private val random = Random(101325)
-    private val keyValuePair = newEntry(random)
-    private val serverPath = "gbcs"
-
-    override fun setUp() {
-        this.cacheDir = testDir.resolve("cache")
-        val readersGroup = Configuration.Group("readers", setOf(Role.Reader))
-        val writersGroup = Configuration.Group("writers", setOf(Role.Writer))
-        cfg = Configuration(
-            "127.0.0.1",
-            NetworkUtils.getFreePort(),
-            serverPath,
-            listOf(
-                Configuration.User("user1", hashPassword(PASSWORD), setOf(readersGroup)),
-                Configuration.User("user2", hashPassword(PASSWORD), setOf(writersGroup)),
-                Configuration.User("user3", hashPassword(PASSWORD), setOf(readersGroup, writersGroup))
-            ).asSequence().map { it.name to it}.toMap(),
-            sequenceOf(writersGroup, readersGroup).map { it.name to it}.toMap(),
-            FileSystemCacheConfiguration(this.cacheDir,
-                maxAge = Duration.ofSeconds(3600 * 24),
-                digestAlgorithm = "MD5",
-                compressionLevel = Deflater.DEFAULT_COMPRESSION,
-                compressionEnabled = false
-            ),
-            Configuration.BasicAuthentication(),
-            null,
-            true,
+    override val users = listOf(
+        Configuration.User("user1", hashPassword(PASSWORD), setOf(readersGroup), null),
+        Configuration.User("user2", hashPassword(PASSWORD), setOf(writersGroup), null),
+        Configuration.User("user3", hashPassword(PASSWORD), setOf(readersGroup, writersGroup), null),
+        Configuration.User("", null, setOf(readersGroup), null),
+        Configuration.User("user4", hashPassword(PASSWORD), setOf(readersGroup),
+            Configuration.Quota(1, Duration.of(1, ChronoUnit.DAYS), 0, 1)
+        ),
+        Configuration.User("user5", hashPassword(PASSWORD), setOf(readersGroup),
+            Configuration.Quota(1, Duration.of(5, ChronoUnit.SECONDS), 0, 1)
         )
-        Xml.write(Serializer.serialize(cfg), System.out)
-    }
-
-    override fun tearDown() {
-    }
-
-    fun buildAuthorizationHeader(user : Configuration.User, password : String) : String {
-        val b64 = Base64.getEncoder().encode("${user.name}:${password}".toByteArray(Charsets.UTF_8)).let{
-            String(it, StandardCharsets.UTF_8)
-        }
-        return "Basic $b64"
-    }
-
-    fun newRequestBuilder(key : String) = HttpRequest.newBuilder()
-        .uri(URI.create("http://${cfg.host}:${cfg.port}/$serverPath/$key"))
-
-
-    fun newEntry(random : Random) : Pair<String, ByteArray> {
-        val key = ByteArray(0x10).let {
-            random.nextBytes(it)
-            Base64.getUrlEncoder().encodeToString(it)
-        }
-        val value = ByteArray(0x1000).also {
-            random.nextBytes(it)
-        }
-        return key to value
-    }
+    )
 
     @Test
     @Order(1)
@@ -100,7 +44,7 @@ class BasicAuthServerTest : AbstractServerTest() {
             .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
 
         val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
-        Assertions.assertEquals(HttpResponseStatus.UNAUTHORIZED.code(), response.statusCode())
+        Assertions.assertEquals(HttpResponseStatus.FORBIDDEN.code(), response.statusCode())
     }
 
     @Test
@@ -179,6 +123,20 @@ class BasicAuthServerTest : AbstractServerTest() {
 
     @Test
     @Order(6)
+    fun getAsAnonymousUser() {
+        val client: HttpClient = HttpClient.newHttpClient()
+        val (key, value) = keyValuePair
+
+        val requestBuilder = newRequestBuilder(key)
+            .GET()
+
+        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
+        Assertions.assertArrayEquals(value, response.body())
+    }
+
+    @Test
+    @Order(7)
     fun getMissingKeyAsAReaderUser() {
         val client: HttpClient = HttpClient.newHttpClient()
 
@@ -194,4 +152,41 @@ class BasicAuthServerTest : AbstractServerTest() {
         val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
         Assertions.assertEquals(HttpResponseStatus.NOT_FOUND.code(), response.statusCode())
     }
+
+    @Test
+    @Order(6)
+    fun getAsAThrottledUser() {
+        val client: HttpClient = HttpClient.newHttpClient()
+
+        val (key, value) = keyValuePair
+        val user = cfg.users.values.find {
+            it.name == "user4"
+        } ?: throw RuntimeException("user4 not found")
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Authorization", buildAuthorizationHeader(user, PASSWORD))
+            .GET()
+
+        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.TOO_MANY_REQUESTS.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(7)
+    fun getAsAThrottledUser2() {
+        val client: HttpClient = HttpClient.newHttpClient()
+
+        val (key, value) = keyValuePair
+        val user = cfg.users.values.find {
+            it.name == "user5"
+        } ?: throw RuntimeException("user5 not found")
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Authorization", buildAuthorizationHeader(user, PASSWORD))
+            .GET()
+
+        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
+        Assertions.assertArrayEquals(value, response.body())
+    }
 }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/ConfigurationTest.kt

@@ -0,0 +1,56 @@
+package net.woggioni.gbcs.server.test
+
+import net.woggioni.gbcs.common.GBCS.toUrl
+import net.woggioni.gbcs.common.GbcsUrlStreamHandlerFactory
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.server.configuration.Parser
+import net.woggioni.gbcs.server.configuration.Serializer
+import org.junit.jupiter.api.Assertions
+import org.junit.jupiter.api.io.TempDir
+import org.junit.jupiter.params.ParameterizedTest
+import org.junit.jupiter.params.provider.ValueSource
+import org.xml.sax.SAXParseException
+import java.nio.file.Files
+import java.nio.file.Path
+
+class ConfigurationTest {
+
+    @ValueSource(
+        strings = [
+            "classpath:net/woggioni/gbcs/server/test/valid/gbcs-default.xml",
+            "classpath:net/woggioni/gbcs/server/test/valid/gbcs-memcached.xml",
+            "classpath:net/woggioni/gbcs/server/test/valid/gbcs-tls.xml",
+            "classpath:net/woggioni/gbcs/server/test/valid/gbcs-memcached-tls.xml",
+        ]
+    )
+    @ParameterizedTest
+    fun test(configurationUrl: String, @TempDir testDir: Path) {
+        GbcsUrlStreamHandlerFactory.install()
+        val doc = Xml.parseXml(configurationUrl.toUrl())
+        val cfg = Parser.parse(doc)
+        val configFile = testDir.resolve("gbcs.xml")
+        Files.newOutputStream(configFile).use {
+            Xml.write(Serializer.serialize(cfg), it)
+        }
+        Xml.write(Serializer.serialize(cfg), System.out)
+
+        val parsed = Parser.parse(Xml.parseXml(configFile.toUri().toURL()))
+        Assertions.assertEquals(cfg, parsed)
+    }
+
+    @ValueSource(
+        strings = [
+            "classpath:net/woggioni/gbcs/server/test/invalid/invalid-user-ref.xml",
+            "classpath:net/woggioni/gbcs/server/test/invalid/duplicate-anonymous-user.xml",
+            "classpath:net/woggioni/gbcs/server/test/invalid/duplicate-anonymous-user2.xml",
+            "classpath:net/woggioni/gbcs/server/test/invalid/multiple-user-quota.xml",
+        ]
+    )
+    @ParameterizedTest
+    fun invalidConfigurationTest(configurationUrl: String) {
+        GbcsUrlStreamHandlerFactory.install()
+        Assertions.assertThrows(SAXParseException::class.java) {
+            Xml.parseXml(configurationUrl.toUrl())
+        }
+    }
+}

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/NoAnonymousUserBasicAuthServerTest.kt

@@ -0,0 +1,52 @@
+package net.woggioni.gbcs.server.test
+
+import io.netty.handler.codec.http.HttpResponseStatus
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.common.PasswordSecurity.hashPassword
+import org.junit.jupiter.api.Assertions
+import org.junit.jupiter.api.Order
+import org.junit.jupiter.api.Test
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+
+
+class NoAnonymousUserBasicAuthServerTest : AbstractBasicAuthServerTest() {
+
+    companion object {
+        private const val PASSWORD = "anotherPassword"
+    }
+
+    override val users = listOf(
+        Configuration.User("user1", hashPassword(PASSWORD), setOf(readersGroup), null),
+        Configuration.User("user2", hashPassword(PASSWORD), setOf(writersGroup), null),
+        Configuration.User("user3", hashPassword(PASSWORD), setOf(readersGroup, writersGroup), null),
+    )
+
+    @Test
+    @Order(1)
+    fun putWithNoAuthorizationHeader() {
+        val client: HttpClient = HttpClient.newHttpClient()
+        val (key, value) = keyValuePair
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Content-Type", "application/octet-stream")
+            .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
+
+        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
+        Assertions.assertEquals(HttpResponseStatus.UNAUTHORIZED.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(2)
+    fun getWithNoAuthorizationHeader() {
+        val client: HttpClient = HttpClient.newHttpClient()
+        val (key, value) = keyValuePair
+
+        val requestBuilder = newRequestBuilder(key)
+            .GET()
+
+        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.UNAUTHORIZED.code(), response.statusCode())
+    }
+}

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/NoAnonymousUserTlsServerTest.kt

@@ -0,0 +1,47 @@
+package net.woggioni.gbcs.server.test
+
+import io.netty.handler.codec.http.HttpResponseStatus
+import net.woggioni.gbcs.api.Configuration
+import org.junit.jupiter.api.Assertions
+import org.junit.jupiter.api.Order
+import org.junit.jupiter.api.Test
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+
+class NoAnonymousUserTlsServerTest : AbstractTlsServerTest() {
+
+    override val users = listOf(
+        Configuration.User("user1", null, setOf(readersGroup), null),
+        Configuration.User("user2", null, setOf(writersGroup), null),
+        Configuration.User("user3", null, setOf(readersGroup, writersGroup), null),
+    )
+
+    @Test
+    @Order(1)
+    fun getAsAnonymousUser() {
+        val (key, _) = keyValuePair
+        val client: HttpClient = getHttpClient(null)
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Content-Type", "application/octet-stream")
+            .GET()
+
+        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.UNAUTHORIZED.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(2)
+    fun putAsAnonymousUser() {
+        val (key, value) = keyValuePair
+        val client: HttpClient = getHttpClient(null)
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Content-Type", "application/octet-stream")
+            .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
+
+        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
+        Assertions.assertEquals(HttpResponseStatus.UNAUTHORIZED.code(), response.statusCode())
+    }
+}

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/NoAuthServerTest.kt

@@ -1,21 +1,22 @@
-package net.woggioni.gbcs.test
+package net.woggioni.gbcs.server.test
 
 import io.netty.handler.codec.http.HttpResponseStatus
-import net.woggioni.gbcs.base.Xml
 import net.woggioni.gbcs.api.Configuration
-import net.woggioni.gbcs.cache.FileSystemCacheConfiguration
-import net.woggioni.gbcs.configuration.Serializer
-import net.woggioni.gbcs.utils.NetworkUtils
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.server.cache.FileSystemCacheConfiguration
+import net.woggioni.gbcs.server.cache.InMemoryCacheConfiguration
+import net.woggioni.gbcs.server.configuration.Serializer
+import net.woggioni.gbcs.server.test.utils.NetworkUtils
 import org.junit.jupiter.api.Assertions
 import org.junit.jupiter.api.Order
 import org.junit.jupiter.api.Test
-import java.net.ServerSocket
 import java.net.URI
 import java.net.http.HttpClient
 import java.net.http.HttpRequest
 import java.net.http.HttpResponse
 import java.nio.file.Path
 import java.time.Duration
+import java.time.temporal.ChronoUnit
 import java.util.Base64
 import java.util.zip.Deflater
 import kotlin.random.Random
@@ -23,7 +24,7 @@ import kotlin.random.Random
 
 class NoAuthServerTest : AbstractServerTest() {
 
-    private lateinit var cacheDir : Path
+    private lateinit var cacheDir: Path
 
     private val random = Random(101325)
     private val keyValuePair = newEntry(random)
@@ -34,11 +35,20 @@ class NoAuthServerTest : AbstractServerTest() {
         cfg = Configuration(
             "127.0.0.1",
             NetworkUtils.getFreePort(),
+            100,
             serverPath,
+            Configuration.EventExecutor(false),
+            Configuration.Connection(
+                Duration.of(10, ChronoUnit.SECONDS),
+                Duration.of(10, ChronoUnit.SECONDS),
+                Duration.of(60, ChronoUnit.SECONDS),
+                Duration.of(30, ChronoUnit.SECONDS),
+                Duration.of(30, ChronoUnit.SECONDS),
+                0x1000
+            ),
             emptyMap(),
             emptyMap(),
-            FileSystemCacheConfiguration(
-                this.cacheDir,
+            InMemoryCacheConfiguration(
                 maxAge = Duration.ofSeconds(3600 * 24),
                 compressionEnabled = true,
                 digestAlgorithm = "MD5",
@@ -46,7 +56,6 @@ class NoAuthServerTest : AbstractServerTest() {
             ),
             null,
             null,
-            true,
         )
         Xml.write(Serializer.serialize(cfg), System.out)
     }
@@ -54,10 +63,10 @@ class NoAuthServerTest : AbstractServerTest() {
     override fun tearDown() {
     }
 
-    fun newRequestBuilder(key : String) = HttpRequest.newBuilder()
+    fun newRequestBuilder(key: String) = HttpRequest.newBuilder()
         .uri(URI.create("http://${cfg.host}:${cfg.port}/$serverPath/$key"))
 
-    fun newEntry(random : Random) : Pair<String, ByteArray> {
+    fun newEntry(random: Random): Pair<String, ByteArray> {
         val key = ByteArray(0x10).let {
             random.nextBytes(it)
             Base64.getUrlEncoder().encodeToString(it)
@@ -86,10 +95,11 @@ class NoAuthServerTest : AbstractServerTest() {
     @Order(2)
     fun getWithNoAuthorizationHeader() {
         val client: HttpClient = HttpClient.newHttpClient()
-        val (key, value ) = keyValuePair
+        val (key, value) = keyValuePair
         val requestBuilder = newRequestBuilder(key)
             .GET()
-        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
         Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
         Assertions.assertArrayEquals(value, response.body())
     }
@@ -102,31 +112,23 @@ class NoAuthServerTest : AbstractServerTest() {
         val (key, _) = newEntry(random)
         val requestBuilder = newRequestBuilder(key).GET()
 
-        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
         Assertions.assertEquals(HttpResponseStatus.NOT_FOUND.code(), response.statusCode())
     }
 
-//    @Test
-//    @Order(4)
-//    fun manyRequestsTest() {
-//        val client: HttpClient = HttpClient.newHttpClient()
-//
-//        for(i in 0 until 100000) {
-//
-//            val newEntry = random.nextBoolean()
-//            val (key, _) = if(newEntry) {
-//                newEntry(random)
-//            } else {
-//                keyValuePair
-//            }
-//            val requestBuilder = newRequestBuilder(key).GET()
-//
-//            val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
-//            if(newEntry) {
-//                Assertions.assertEquals(HttpResponseStatus.NOT_FOUND.code(), response.statusCode())
-//            } else {
-//                Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
-//            }
-//        }
-//    }
+    @Test
+    @Order(4)
+    fun traceTest() {
+        val client: HttpClient = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).build()
+        val requestBuilder = newRequestBuilder("").method(
+            "TRACE",
+            HttpRequest.BodyPublishers.ofByteArray("sfgsdgfaiousfiuhsd".toByteArray())
+        )
+
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
+        println(String(response.body()))
+    }
 }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/TlsServerTest.kt

@@ -0,0 +1,152 @@
+package net.woggioni.gbcs.server.test
+
+import io.netty.handler.codec.http.HttpResponseStatus
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.api.Role
+import org.bouncycastle.asn1.x500.X500Name
+import org.junit.jupiter.api.Assertions
+import org.junit.jupiter.api.Order
+import org.junit.jupiter.api.Test
+import org.junit.jupiter.params.provider.ArgumentsSource
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+
+
+class TlsServerTest : AbstractTlsServerTest() {
+
+    override val users = listOf(
+        Configuration.User("user1", null, setOf(readersGroup), null),
+        Configuration.User("user2", null, setOf(writersGroup), null),
+        Configuration.User("user3", null, setOf(readersGroup, writersGroup), null),
+        Configuration.User("", null, setOf(readersGroup), null)
+    )
+
+    @Test
+    @Order(1)
+    fun putAsAReaderUser() {
+        val (key, value) = keyValuePair
+        val user = cfg.users.values.find {
+            Role.Reader in it.roles && Role.Writer !in it.roles
+        } ?: throw RuntimeException("Reader user not found")
+        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
+        val requestBuilder = newRequestBuilder(key)
+            .header("Content-Type", "application/octet-stream")
+            .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
+
+        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
+        Assertions.assertEquals(HttpResponseStatus.FORBIDDEN.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(2)
+    fun getAsAWriterUser() {
+        val (key, _) = keyValuePair
+        val user = cfg.users.values.find {
+            Role.Writer in it.roles
+        } ?: throw RuntimeException("Reader user not found")
+        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
+
+        val requestBuilder = newRequestBuilder(key)
+            .GET()
+
+        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
+        Assertions.assertEquals(HttpResponseStatus.FORBIDDEN.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(3)
+    fun putAsAWriterUser() {
+        val (key, value) = keyValuePair
+        val user = cfg.users.values.find {
+            Role.Writer in it.roles
+        } ?: throw RuntimeException("Reader user not found")
+        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Content-Type", "application/octet-stream")
+            .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
+
+        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
+        Assertions.assertEquals(HttpResponseStatus.CREATED.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(4)
+    fun getAsAReaderUser() {
+        val (key, value) = keyValuePair
+        val user = cfg.users.values.find {
+            Role.Reader in it.roles
+        } ?: throw RuntimeException("Reader user not found")
+        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
+
+        val requestBuilder = newRequestBuilder(key)
+            .GET()
+
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
+        Assertions.assertArrayEquals(value, response.body())
+    }
+
+    @Test
+    @Order(5)
+    fun getMissingKeyAsAReaderUser() {
+        val (key, _) = newEntry(random)
+        val user = cfg.users.values.find {
+            Role.Reader in it.roles
+        } ?: throw RuntimeException("Reader user not found")
+        val client: HttpClient = getHttpClient(getClientKeyStore(ca, X500Name("CN=${user.name}")))
+
+        val requestBuilder = newRequestBuilder(key)
+            .GET()
+
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.NOT_FOUND.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(6)
+    fun getAsAnonymousUser() {
+        val (key, value) = keyValuePair
+        val client: HttpClient = getHttpClient(null)
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Content-Type", "application/octet-stream")
+            .GET()
+
+        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
+        Assertions.assertArrayEquals(value, response.body())
+    }
+
+    @Test
+    @Order(7)
+    fun putAsAnonymousUser() {
+        val (key, value) = keyValuePair
+        val client: HttpClient = getHttpClient(null)
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Content-Type", "application/octet-stream")
+            .PUT(HttpRequest.BodyPublishers.ofByteArray(value))
+
+        val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
+        Assertions.assertEquals(HttpResponseStatus.FORBIDDEN.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(8)
+    fun traceAsAnonymousUser() {
+        val client: HttpClient = getHttpClient(null)
+        val requestBuilder = newRequestBuilder("").method(
+            "TRACE",
+            HttpRequest.BodyPublishers.ofByteArray("sfgsdgfaiousfiuhsd".toByteArray())
+        )
+
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
+        println(String(response.body()))
+    }
+}

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/X500NameTest.kt

@@ -1,4 +1,4 @@
-package net.woggioni.gbcs.test
+package net.woggioni.gbcs.server.test
 
 import org.junit.jupiter.api.Assertions
 import org.junit.jupiter.api.Test

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/invalid/duplicate-anonymous-user.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+             xmlns:gbcs="urn:net.woggioni.gbcs.server"
+             xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
+    <bind host="127.0.0.1" port="11443"/>
+    <cache xs:type="gbcs:fileSystemCacheType" path="/tmp/gbcs" max-age="P7D"/>
+    <authorization>
+        <users>
+            <user name="user1" password="password1"/>
+            <user name="user2" password="password2"/>
+            <anonymous>
+                <quota calls="10" period="P3D"/>
+            </anonymous>
+            <anonymous>
+                <quota calls="15" period="P3D"/>
+            </anonymous>
+        </users>
+    </authorization>
+</gbcs:server>

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/invalid/duplicate-anonymous-user2.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+             xmlns:gbcs="urn:net.woggioni.gbcs.server"
+             xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
+    <bind host="127.0.0.1" port="11443"/>
+    <cache xs:type="gbcs:fileSystemCacheType" path="/tmp/gbcs" max-age="P7D"/>
+    <authorization>
+        <users>
+            <user name="user1" password="password1"/>
+            <user name="user2" password="password2"/>
+        </users>
+        <groups>
+            <group name="group1">
+                <users>
+                    <anonymous/>
+                    <user ref="user1"/>
+                    <anonymous/>
+                </users>
+                <roles>
+                    <reader/>
+                </roles>
+            </group>
+        </groups>
+    </authorization>
+</gbcs:server>