From 8a0e9c549595e114a0eadc9d6792a17fb59d0f3e Mon Sep 17 00:00:00 2001
From: Peter Amstutz <pamstutz@veritasgenetics.com>
Date: Mon, 25 Mar 2019 11:28:33 -0400
Subject: [PATCH] 13996: Migrate tests to new config

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>
---
 services/api/app/models/collection.rb         |  2 +-
 .../api/config/initializers/load_config.rb    | 45 ++++--------------
 services/api/lib/config_loader.rb             | 12 ++++-
 .../arvados/v1/collections_controller_test.rb | 30 ++++++------
 .../functional/arvados/v1/filters_test.rb     |  4 +-
 .../arvados/v1/groups_controller_test.rb      |  4 +-
 .../arvados/v1/jobs_controller_test.rb        | 10 ++--
 .../arvados/v1/nodes_controller_test.rb       |  2 +-
 .../v1/repositories_controller_test.rb        | 14 +++---
 .../arvados/v1/schema_controller_test.rb      |  2 +-
 .../arvados/v1/users_controller_test.rb       |  4 +-
 services/api/test/helpers/git_test_helper.rb  |  8 ++--
 .../test/integration/collections_api_test.rb  |  6 +--
 services/api/test/integration/groups_test.rb  |  2 +-
 .../api/test/integration/remote_user_test.rb  |  6 +--
 .../test/integration/user_sessions_test.rb    |  8 ++--
 .../tasks/delete_old_container_logs_test.rb   |  2 +-
 .../test/tasks/delete_old_job_logs_test.rb    |  2 +-
 services/api/test/test_helper.rb              |  7 +--
 services/api/test/unit/blob_test.rb           |  6 +--
 services/api/test/unit/collection_test.rb     | 46 +++++++++----------
 services/api/test/unit/commit_test.rb         |  8 ++--
 .../api/test/unit/container_request_test.rb   | 26 +++++------
 services/api/test/unit/container_test.rb      |  6 +--
 .../api/test/unit/crunch_dispatch_test.rb     |  6 +--
 services/api/test/unit/fail_jobs_test.rb      |  6 +--
 services/api/test/unit/job_test.rb            | 33 +++++++------
 services/api/test/unit/log_test.rb            | 12 ++---
 services/api/test/unit/node_test.rb           | 38 +++++++--------
 services/api/test/unit/repository_test.rb     |  6 +--
 services/api/test/unit/user_notifier_test.rb  |  4 +-
 services/api/test/unit/user_test.rb           | 44 +++++++++---------
 32 files changed, 196 insertions(+), 215 deletions(-)

diff --git a/services/api/app/models/collection.rb b/services/api/app/models/collection.rb
index aaae19f4bf..46da37afd4 100644
--- a/services/api/app/models/collection.rb
+++ b/services/api/app/models/collection.rb
@@ -125,7 +125,7 @@ class Collection < ArvadosModel
             # Signature provided, but verify_signature did not like it.
             logger.warn "Invalid signature on locator #{tok}"
             raise ArvadosModel::PermissionDeniedError
-          elsif Rails.configuration.Collections["BlobSigning"]
+          elsif !Rails.configuration.Collections["BlobSigning"]
             # No signature provided, but we are running in insecure mode.
             logger.debug "Missing signature on locator #{tok} ignored"
           elsif Blob.new(tok).empty?
diff --git a/services/api/config/initializers/load_config.rb b/services/api/config/initializers/load_config.rb
index 53439cec83..23a5eb5a95 100644
--- a/services/api/config/initializers/load_config.rb
+++ b/services/api/config/initializers/load_config.rb
@@ -111,11 +111,11 @@ declare_config "Containers.JobsAPI.ReuseJobIfOutputsDiffer", Boolean, :reuse_job
 declare_config "Containers.JobsAPI.DefaultDockerImage", String, :default_docker_image_for_jobs
 declare_config "Mail.MailchimpAPIKey", String, :mailchimp_api_key
 declare_config "Mail.MailchimpListID", String, :mailchimp_list_id
-declare_config "Services.Workbench1.ExternalURL", String, :workbench_address
-declare_config "Services.Websocket.ExternalURL", String, :websocket_address
-declare_config "Services.WebDAV.ExternalURL", String, :keep_web_service_url
-declare_config "Services.GitHTTP.ExternalURL", String, :git_repo_https_base
-declare_config "Services.GitSSH.ExternalURL", String, :git_repo_ssh_base
+declare_config "Services.Workbench1.ExternalURL", URI, :workbench_address
+declare_config "Services.Websocket.ExternalURL", URI, :websocket_address
+declare_config "Services.WebDAV.ExternalURL", URI, :keep_web_service_url
+declare_config "Services.GitHTTP.ExternalURL", URI, :git_repo_https_base
+declare_config "Services.GitSSH.ExternalURL", URI, :git_repo_ssh_base
 declare_config "RemoteClusters", Hash, :remote_hosts, ->(cfg, k, v) {
   h = {}
   v.each do |clusterid, host|
@@ -144,7 +144,7 @@ application_config = {}
   end
 end
 
-remainders = migrate_config application_config, $arvados_config
+$remaining_config = migrate_config application_config, $arvados_config
 
 if application_config[:auto_activate_users_from]
   application_config[:auto_activate_users_from].each do |cluster|
@@ -154,38 +154,13 @@ if application_config[:auto_activate_users_from]
   end
 end
 
+# Checks for wrongly typed configuration items, and essential items
+# that can't be empty
 coercion_and_check $arvados_config
 
 Server::Application.configure do
   nils = []
-  $arvados_config.each do |k, v|
-    cfg = config
-    if cfg.respond_to?(k.to_sym) and !cfg.send(k).nil?
-    # Config must have been set already in environments/*.rb.
-    #
-    # After config files have been migrated, this mechanism should
-    # be deprecated, then removed.
-    elsif v.nil?
-      # Config variables are not allowed to be nil. Make a "naughty"
-      # list, and present it below.
-      nils << k
-    else
-      cfg.send "#{k}=", v
-    end
-  end
-  remainders.each do |k, v|
-    config.send "#{k}=", v
-  end
-
-  if !nils.empty?
-    raise <<EOS
-Refusing to start in #{::Rails.env.to_s} mode with missing configuration.
-
-The following configuration settings must be specified in
-config/application.yml:
-* #{nils.join "\n* "}
-
-EOS
-  end
+  copy_into_config $arvados_config, config
+  copy_into_config $remaining_config, config
   config.secret_key_base = config.secret_token
 end
diff --git a/services/api/lib/config_loader.rb b/services/api/lib/config_loader.rb
index 6bfbdd7a83..1a4135e842 100644
--- a/services/api/lib/config_loader.rb
+++ b/services/api/lib/config_loader.rb
@@ -29,7 +29,7 @@ module Psych
 end
 
 def set_cfg cfg, k, v
-  # "foo.bar: baz" --> { config.foo.bar = baz }
+  # "foo.bar = baz" --> { cfg["foo"]["bar"] = baz }
   ks = k.split '.'
   k = ks.pop
   ks.each do |kk|
@@ -126,9 +126,19 @@ def coercion_and_check check_cfg
       end
     end
 
+    if cfgtype == URI
+      cfg[k] = URI(cfg[k])
+    end
+
     if !cfg[k].is_a? cfgtype
       raise "#{cfgkey} expected #{cfgtype} but was #{cfg[k].class}"
     end
   end
 
 end
+
+def copy_into_config src, dst
+  src.each do |k, v|
+    dst.send "#{k}=", Marshal.load(Marshal.dump v)
+  end
+end
diff --git a/services/api/test/functional/arvados/v1/collections_controller_test.rb b/services/api/test/functional/arvados/v1/collections_controller_test.rb
index ee2b016cd5..ef3198bc63 100644
--- a/services/api/test/functional/arvados/v1/collections_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/collections_controller_test.rb
@@ -11,7 +11,7 @@ class Arvados::V1::CollectionsControllerTest < ActionController::TestCase
 
   def permit_unsigned_manifests isok=true
     # Set security model for the life of a test.
-    Rails.configuration.permit_create_collection_with_unsigned_manifest = isok
+    Rails.configuration.Collections["BlobSigning"] = !isok
   end
 
   def assert_signed_manifest manifest_text, label='', token: false
@@ -24,7 +24,7 @@ class Arvados::V1::CollectionsControllerTest < ActionController::TestCase
         exp = tok[/\+A[[:xdigit:]]+@([[:xdigit:]]+)/, 1].to_i(16)
         sig = Blob.sign_locator(
           bare,
-          key: Rails.configuration.blob_signing_key,
+          key: Rails.configuration.Collections["BlobSigningKey"],
           expire: exp,
           api_token: token)[/\+A[^\+]*/, 0]
         assert_includes tok, sig
@@ -88,7 +88,7 @@ class Arvados::V1::CollectionsControllerTest < ActionController::TestCase
       token = api_client_authorizations(:active).send(token_method)
       signed = Blob.sign_locator(
         'acbd18db4cc2f85cedef654fccc4a4d8+3',
-        key: Rails.configuration.blob_signing_key,
+        key: Rails.configuration.Collections["BlobSigningKey"],
         api_token: token)
       authorize_with_token token
       put :update, params: {
@@ -221,7 +221,7 @@ class Arvados::V1::CollectionsControllerTest < ActionController::TestCase
   def request_capped_index(params={})
     authorize_with :user1_with_load
     coll1 = collections(:collection_1_of_201)
-    Rails.configuration.max_index_database_read =
+    Rails.configuration.API["MaxIndexDatabaseRead"] =
       yield(coll1.manifest_text.size)
     get :index, params: {
       select: %w(uuid manifest_text),
@@ -566,7 +566,7 @@ EOS
 
       # Build a manifest with both signed and unsigned locators.
       signing_opts = {
-        key: Rails.configuration.blob_signing_key,
+        key: Rails.configuration.Collections["BlobSigningKey"],
         api_token: api_token(:active),
       }
       signed_locators = locators.collect do |x|
@@ -622,7 +622,7 @@ EOS
     # TODO(twp): in phase 4, all locators will need to be signed, so
     # this test should break and will need to be rewritten. Issue #2755.
     signing_opts = {
-      key: Rails.configuration.blob_signing_key,
+      key: Rails.configuration.Collections["BlobSigningKey"],
       api_token: api_token(:active),
       ttl: 3600   # 1 hour
     }
@@ -653,7 +653,7 @@ EOS
   test "create fails with invalid signature" do
     authorize_with :active
     signing_opts = {
-      key: Rails.configuration.blob_signing_key,
+      key: Rails.configuration.Collections["BlobSigningKey"],
       api_token: api_token(:active),
     }
 
@@ -683,7 +683,7 @@ EOS
   test "create fails with uuid of signed manifest" do
     authorize_with :active
     signing_opts = {
-      key: Rails.configuration.blob_signing_key,
+      key: Rails.configuration.Collections["BlobSigningKey"],
       api_token: api_token(:active),
     }
 
@@ -755,7 +755,7 @@ EOS
       ea10d51bcf88862dbcc36eb292017dfd+45)
 
     signing_opts = {
-      key: Rails.configuration.blob_signing_key,
+      key: Rails.configuration.Collections["BlobSigningKey"],
       api_token: api_token(:active),
     }
 
@@ -903,7 +903,7 @@ EOS
 
   [1, 5, nil].each do |ask|
     test "Set replication_desired=#{ask.inspect}" do
-      Rails.configuration.default_collection_replication = 2
+      Rails.configuration.Collections["DefaultReplication"] = 2
       authorize_with :active
       put :update, params: {
         id: collections(:replication_undesired_unconfirmed).uuid,
@@ -1176,7 +1176,7 @@ EOS
     assert_response 200
     c = Collection.find_by_uuid(uuid)
     assert_operator c.trash_at, :<, db_current_time
-    assert_equal c.delete_at, c.trash_at + Rails.configuration.blob_signature_ttl
+    assert_equal c.delete_at, c.trash_at + Rails.configuration.Collection["BlobSigningTTL"]
   end
 
   test 'delete long-trashed collection immediately using http DELETE verb' do
@@ -1208,7 +1208,7 @@ EOS
       assert_response 200
       c = Collection.find_by_uuid(uuid)
       assert_operator c.trash_at, :<, db_current_time
-      assert_operator c.delete_at, :>=, time_before_trashing + Rails.configuration.default_trash_lifetime
+      assert_operator c.delete_at, :>=, time_before_trashing + Rails.configuration.Collections["DefaultTrashLifetime"]
     end
   end
 
@@ -1373,8 +1373,8 @@ EOS
   end
 
   test "update collection with versioning enabled" do
-    Rails.configuration.collection_versioning = true
-    Rails.configuration.preserve_version_if_idle = 1 # 1 second
+    Rails.configuration.Collections["CollectionVersioning"] = true
+    Rails.configuration.Collections["PreserveVersionIfIdle"] = 1 # 1 second
 
     col = collections(:collection_owned_by_active)
     assert_equal 2, col.version
@@ -1383,7 +1383,7 @@ EOS
     token = api_client_authorizations(:active).v2token
     signed = Blob.sign_locator(
       'acbd18db4cc2f85cedef654fccc4a4d8+3',
-      key: Rails.configuration.blob_signing_key,
+      key: Rails.configuration.Collections["BlobSigningKey"],
       api_token: token)
     authorize_with_token token
     put :update, params: {
diff --git a/services/api/test/functional/arvados/v1/filters_test.rb b/services/api/test/functional/arvados/v1/filters_test.rb
index b596baaae4..d49fe7a3e6 100644
--- a/services/api/test/functional/arvados/v1/filters_test.rb
+++ b/services/api/test/functional/arvados/v1/filters_test.rb
@@ -108,7 +108,7 @@ class Arvados::V1::FiltersTest < ActionController::TestCase
       format: :json,
       count: 'none',
       limit: 1000,
-      filters: [['any', '@@', Rails.configuration.uuid_prefix]],
+      filters: [['any', '@@', Rails.configuration.ClusterID]],
     }
 
     assert_response :success
@@ -137,7 +137,7 @@ class Arvados::V1::FiltersTest < ActionController::TestCase
       limit: 1000,
       offset: '5',
       last_object_class: 'PipelineInstance',
-      filters: [['any', '@@', Rails.configuration.uuid_prefix]],
+      filters: [['any', '@@', Rails.configuration.ClusterID]],
     }
 
     assert_response :success
diff --git a/services/api/test/functional/arvados/v1/groups_controller_test.rb b/services/api/test/functional/arvados/v1/groups_controller_test.rb
index 37b606409e..ff86f04933 100644
--- a/services/api/test/functional/arvados/v1/groups_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/groups_controller_test.rb
@@ -431,7 +431,7 @@ class Arvados::V1::GroupsControllerTest < ActionController::TestCase
   end
 
   test 'get contents with jobs and pipeline instances disabled' do
-    Rails.configuration.disable_api_methods = ['jobs.index', 'pipeline_instances.index']
+    Rails.configuration.API["DisabledAPIs"] = ['jobs.index', 'pipeline_instances.index']
 
     authorize_with :active
     get :contents, params: {
@@ -444,7 +444,7 @@ class Arvados::V1::GroupsControllerTest < ActionController::TestCase
   test 'get contents with low max_index_database_read' do
     # Some result will certainly have at least 12 bytes in a
     # restricted column
-    Rails.configuration.max_index_database_read = 12
+    Rails.configuration.API["MaxIndexDatabaseRead"] = 12
     authorize_with :active
     get :contents, params: {
           id: groups(:aproject).uuid,
diff --git a/services/api/test/functional/arvados/v1/jobs_controller_test.rb b/services/api/test/functional/arvados/v1/jobs_controller_test.rb
index fb81f23636..8bbe96687f 100644
--- a/services/api/test/functional/arvados/v1/jobs_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/jobs_controller_test.rb
@@ -83,7 +83,7 @@ class Arvados::V1::JobsControllerTest < ActionController::TestCase
     # We need to verify that "cancel" creates a trigger file, so first
     # let's make sure there is no stale trigger file.
     begin
-      File.unlink(Rails.configuration.crunch_refresh_trigger)
+      File.unlink(Rails.configuration.Containers["JobsAPI"]["CrunchRefreshTrigger"])
     rescue Errno::ENOENT
     end
 
@@ -105,7 +105,7 @@ class Arvados::V1::JobsControllerTest < ActionController::TestCase
                  'server should correct bogus cancelled_at ' +
                  job['cancelled_at'])
     assert_equal(true,
-                 File.exist?(Rails.configuration.crunch_refresh_trigger),
+                 File.exist?(Rails.configuration.Containers["JobsAPI"]["CrunchRefreshTrigger"]),
                  'trigger file should be created when job is cancelled')
   end
 
@@ -123,7 +123,7 @@ class Arvados::V1::JobsControllerTest < ActionController::TestCase
       # We need to verify that "cancel" creates a trigger file, so first
       # let's make sure there is no stale trigger file.
       begin
-        File.unlink(Rails.configuration.crunch_refresh_trigger)
+        File.unlink(Rails.configuration.Containers["JobsAPI"]["CrunchRefreshTrigger"])
       rescue Errno::ENOENT
       end
 
@@ -144,7 +144,7 @@ class Arvados::V1::JobsControllerTest < ActionController::TestCase
     # We need to verify that "cancel" creates a trigger file, so first
     # let's make sure there is no stale trigger file.
     begin
-      File.unlink(Rails.configuration.crunch_refresh_trigger)
+      File.unlink(Rails.configuration.Containers["JobsAPI"]["CrunchRefreshTrigger"])
     rescue Errno::ENOENT
     end
 
@@ -480,7 +480,7 @@ class Arvados::V1::JobsControllerTest < ActionController::TestCase
   end
 
   test 'jobs.create disabled in config' do
-    Rails.configuration.disable_api_methods = ["jobs.create",
+    Rails.configuration.API["DisabledAPIs"] = ["jobs.create",
                                                "pipeline_instances.create"]
     authorize_with :active
     post :create, params: {
diff --git a/services/api/test/functional/arvados/v1/nodes_controller_test.rb b/services/api/test/functional/arvados/v1/nodes_controller_test.rb
index 0beff6882a..435764baa4 100644
--- a/services/api/test/functional/arvados/v1/nodes_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/nodes_controller_test.rb
@@ -223,7 +223,7 @@ class Arvados::V1::NodesControllerTest < ActionController::TestCase
   end
 
   test "node should fail ping with invalid hostname config format" do
-    Rails.configuration.assign_node_hostname = 'compute%<slot_number>04'  # should end with "04d"
+    Rails.configuration.Containers["SLURM"]["Managed"]["AssignNodeHostname"] = 'compute%<slot_number>04'  # should end with "04d"
     post :ping, params: {
       id: nodes(:new_with_no_hostname).uuid,
       ping_secret: nodes(:new_with_no_hostname).info['ping_secret'],
diff --git a/services/api/test/functional/arvados/v1/repositories_controller_test.rb b/services/api/test/functional/arvados/v1/repositories_controller_test.rb
index b810d69939..d986ff937b 100644
--- a/services/api/test/functional/arvados/v1/repositories_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/repositories_controller_test.rb
@@ -200,15 +200,15 @@ class Arvados::V1::RepositoriesControllerTest < ActionController::TestCase
   end
 
   [
-    {cfg: :git_repo_ssh_base, cfgval: "git@example.com:", match: %r"^git@example.com:"},
-    {cfg: :git_repo_ssh_base, cfgval: true, match: %r"^git@git.zzzzz.arvadosapi.com:"},
-    {cfg: :git_repo_ssh_base, cfgval: false, refute: /^git@/ },
-    {cfg: :git_repo_https_base, cfgval: "https://example.com/", match: %r"^https://example.com/"},
-    {cfg: :git_repo_https_base, cfgval: true, match: %r"^https://git.zzzzz.arvadosapi.com/"},
-    {cfg: :git_repo_https_base, cfgval: false, refute: /^http/ },
+    {cfg: "Services.GitSSH.ExternalURL", cfgval: "git@example.com:", match: %r"^git@example.com:"},
+    {cfg: "Services.GitSSH.ExternalURL", cfgval: true, match: %r"^git@git.zzzzz.arvadosapi.com:"},
+    {cfg: "Services.GitSSH.ExternalURL", cfgval: false, refute: /^git@/ },
+    {cfg: "Services.GitHTTP.ExternalURL", cfgval: "https://example.com/", match: %r"^https://example.com/"},
+    {cfg: "Services.GitHTTP.ExternalURL", cfgval: true, match: %r"^https://git.zzzzz.arvadosapi.com/"},
+    {cfg: "Services.GitHTTP.ExternalURL", cfgval: false, refute: /^http/ },
   ].each do |expect|
     test "set #{expect[:cfg]} to #{expect[:cfgval]}" do
-      Rails.configuration.send expect[:cfg].to_s+"=", expect[:cfgval]
+      set_cfg Rails.configuration, expect[:cfg].to_s, expect[:cfgval]
       authorize_with :active
       get :index
       assert_response :success
diff --git a/services/api/test/functional/arvados/v1/schema_controller_test.rb b/services/api/test/functional/arvados/v1/schema_controller_test.rb
index 53c1ed72e7..9d49128052 100644
--- a/services/api/test/functional/arvados/v1/schema_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/schema_controller_test.rb
@@ -65,7 +65,7 @@ class Arvados::V1::SchemaControllerTest < ActionController::TestCase
   end
 
   test "non-empty disable_api_methods" do
-    Rails.configuration.disable_api_methods =
+    Rails.configuration.API["DisabledAPIs"] =
       ['jobs.create', 'pipeline_instances.create', 'pipeline_templates.create']
     get :index
     assert_response :success
diff --git a/services/api/test/functional/arvados/v1/users_controller_test.rb b/services/api/test/functional/arvados/v1/users_controller_test.rb
index 22a44a97ab..66e32713e1 100644
--- a/services/api/test/functional/arvados/v1/users_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/users_controller_test.rb
@@ -638,12 +638,12 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase
     setup_email = ActionMailer::Base.deliveries.last
     assert_not_nil setup_email, 'Expected email after setup'
 
-    assert_equal Rails.configuration.user_notifier_email_from, setup_email.from[0]
+    assert_equal Rails.configuration.Users["UserNotifierEmailFrom"], setup_email.from[0]
     assert_equal 'foo@example.com', setup_email.to[0]
     assert_equal 'Welcome to Arvados - shell account enabled', setup_email.subject
     assert (setup_email.body.to_s.include? 'Your Arvados shell account has been set up'),
         'Expected Your Arvados shell account has been set up in email body'
-    assert (setup_email.body.to_s.include? "#{Rails.configuration.workbench_address}users/#{created['uuid']}/virtual_machines"), 'Expected virtual machines url in email body'
+    assert (setup_email.body.to_s.include? "#{Rails.configuration.Services["Workbench1"]["ExternalURL"]}users/#{created['uuid']}/virtual_machines"), 'Expected virtual machines url in email body'
   end
 
   test "setup inactive user by changing is_active to true" do
diff --git a/services/api/test/helpers/git_test_helper.rb b/services/api/test/helpers/git_test_helper.rb
index 170b59ee1e..7ad9bcad13 100644
--- a/services/api/test/helpers/git_test_helper.rb
+++ b/services/api/test/helpers/git_test_helper.rb
@@ -19,14 +19,14 @@ module GitTestHelper
   def self.included base
     base.setup do
       # Extract the test repository data into the default test
-      # environment's Rails.configuration.git_repositories_dir. (We
+      # environment's Rails.configuration.Git["Repositories"]. (We
       # don't use that config setting here, though: it doesn't seem
       # worth the risk of stepping on a real git repo root.)
       @tmpdir = Rails.root.join 'tmp', 'git'
       FileUtils.mkdir_p @tmpdir
       system("tar", "-xC", @tmpdir.to_s, "-f", "test/test.git.tar")
-      Rails.configuration.git_repositories_dir = "#{@tmpdir}/test"
-      Rails.configuration.git_internal_dir = "#{@tmpdir}/internal.git"
+      Rails.configuration.Git["Repositories"] = "#{@tmpdir}/test"
+      Rails.configuration.Containers["JobsAPI"]["GitInternalDir"] = "#{@tmpdir}/internal.git"
     end
 
     base.teardown do
@@ -37,7 +37,7 @@ module GitTestHelper
   end
 
   def internal_tag tag
-    IO.read "|git --git-dir #{Rails.configuration.git_internal_dir.shellescape} log --format=format:%H -n1 #{tag.shellescape}"
+    IO.read "|git --git-dir #{Rails.configuration.Containers["JobsAPI"]["GitInternalDir"].shellescape} log --format=format:%H -n1 #{tag.shellescape}"
   end
 
   # Intercept fetch_remote_repository and fetch from a specified url
diff --git a/services/api/test/integration/collections_api_test.rb b/services/api/test/integration/collections_api_test.rb
index 7096575342..e82172b559 100644
--- a/services/api/test/integration/collections_api_test.rb
+++ b/services/api/test/integration/collections_api_test.rb
@@ -129,7 +129,7 @@ class CollectionsApiTest < ActionDispatch::IntegrationTest
 
   test "store collection as json" do
     signing_opts = {
-      key: Rails.configuration.blob_signing_key,
+      key: Rails.configuration.Collections["BlobSigningKey"],
       api_token: api_token(:active),
     }
     signed_locator = Blob.sign_locator('bad42fa702ae3ea7d888fef11b46f450+44',
@@ -146,7 +146,7 @@ class CollectionsApiTest < ActionDispatch::IntegrationTest
 
   test "store collection with manifest_text only" do
     signing_opts = {
-      key: Rails.configuration.blob_signing_key,
+      key: Rails.configuration.Collections["BlobSigningKey"],
       api_token: api_token(:active),
     }
     signed_locator = Blob.sign_locator('bad42fa702ae3ea7d888fef11b46f450+44',
@@ -163,7 +163,7 @@ class CollectionsApiTest < ActionDispatch::IntegrationTest
 
   test "store collection then update name" do
     signing_opts = {
-      key: Rails.configuration.blob_signing_key,
+      key: Rails.configuration.Collections["BlobSigningKey"],
       api_token: api_token(:active),
     }
     signed_locator = Blob.sign_locator('bad42fa702ae3ea7d888fef11b46f450+44',
diff --git a/services/api/test/integration/groups_test.rb b/services/api/test/integration/groups_test.rb
index e45dd4eb52..9c2d023c04 100644
--- a/services/api/test/integration/groups_test.rb
+++ b/services/api/test/integration/groups_test.rb
@@ -194,7 +194,7 @@ class NonTransactionalGroupsTest < ActionDispatch::IntegrationTest
   end
 
   test "create request with async=true defers permissions update" do
-    Rails.configuration.async_permissions_update_interval = 1 # second
+    Rails.configuration.API["AsyncPermissionsUpdateInterval"] = 1 # second
     name = "Random group #{rand(1000)}"
     assert_equal nil, Group.find_by_name(name)
 
diff --git a/services/api/test/integration/remote_user_test.rb b/services/api/test/integration/remote_user_test.rb
index 5c09cf1bcc..644c2b1be5 100644
--- a/services/api/test/integration/remote_user_test.rb
+++ b/services/api/test/integration/remote_user_test.rb
@@ -63,8 +63,8 @@ class RemoteUsersTest < ActionDispatch::IntegrationTest
     ready.pop
     @remote_server = srv
     @remote_host = "127.0.0.1:#{srv.config[:Port]}"
-    Rails.configuration.remote_hosts = Rails.configuration.remote_hosts.merge({'zbbbb' => @remote_host,
-                                                                               'zbork' => @remote_host})
+    Rails.configuration.RemoteClusters = Rails.configuration.RemoteClusters.merge({'zbbbb' => {"Host" => @remote_host},
+                                                                                   'zbork' => {"Host" => @remote_host}})
     Arvados::V1::SchemaController.any_instance.stubs(:root_url).returns "https://#{@remote_host}"
     @stub_status = 200
     @stub_content = {
@@ -243,7 +243,7 @@ class RemoteUsersTest < ActionDispatch::IntegrationTest
   end
 
   test 'auto-activate user from trusted cluster' do
-    Rails.configuration.auto_activate_users_from = ['zbbbb']
+    Rails.configuration.RemoteClusters['zbbbb']["ActivateUsers"] = true
     get '/arvados/v1/users/current',
       params: {format: 'json'},
       headers: auth(remote: 'zbbbb')
diff --git a/services/api/test/integration/user_sessions_test.rb b/services/api/test/integration/user_sessions_test.rb
index f2dbaa5069..e725626920 100644
--- a/services/api/test/integration/user_sessions_test.rb
+++ b/services/api/test/integration/user_sessions_test.rb
@@ -111,10 +111,10 @@ class UserSessionsApiTest < ActionDispatch::IntegrationTest
    ].each do |testcase|
     test "user auto-activate #{testcase.inspect}" do
       # Configure auto_setup behavior according to testcase[:cfg]
-      Rails.configuration.auto_setup_new_users = testcase[:cfg][:auto]
-      Rails.configuration.auto_setup_new_users_with_vm_uuid =
-        (testcase[:cfg][:vm] ? virtual_machines(:testvm).uuid : false)
-      Rails.configuration.auto_setup_new_users_with_repository =
+      Rails.configuration.Users["AutoSetupNewUsers"] = testcase[:cfg][:auto]
+      Rails.configuration.Users["AutoSetupNewUsersWithVmUUID"] =
+        (testcase[:cfg][:vm] ? virtual_machines(:testvm).uuid : "")
+      Rails.configuration.Users["AutoSetupNewUsersWithRepository"] =
         testcase[:cfg][:repo]
 
       mock_auth_with(email: testcase[:email])
diff --git a/services/api/test/tasks/delete_old_container_logs_test.rb b/services/api/test/tasks/delete_old_container_logs_test.rb
index 45278ac1aa..0403ceb2ec 100644
--- a/services/api/test/tasks/delete_old_container_logs_test.rb
+++ b/services/api/test/tasks/delete_old_container_logs_test.rb
@@ -16,7 +16,7 @@ class DeleteOldContainerLogsTaskTest < ActiveSupport::TestCase
   end
 
   def run_with_expiry(clean_after)
-    Rails.configuration.clean_container_log_rows_after = clean_after
+    Rails.configuration.Containers["Logging"]["MaxAge"] = clean_after
     Rake::Task[TASK_NAME].reenable
     Rake.application.invoke_task TASK_NAME
   end
diff --git a/services/api/test/tasks/delete_old_job_logs_test.rb b/services/api/test/tasks/delete_old_job_logs_test.rb
index 4d4cdbc9e5..6a793e1e0e 100644
--- a/services/api/test/tasks/delete_old_job_logs_test.rb
+++ b/services/api/test/tasks/delete_old_job_logs_test.rb
@@ -16,7 +16,7 @@ class DeleteOldJobLogsTaskTest < ActiveSupport::TestCase
   end
 
   def run_with_expiry(clean_after)
-    Rails.configuration.clean_job_log_rows_after = clean_after
+    Rails.configuration.Containers["Logging"]["MaxAge"] = clean_after
     Rake::Task[TASK_NAME].reenable
     Rake.application.invoke_task TASK_NAME
   end
diff --git a/services/api/test/test_helper.rb b/services/api/test/test_helper.rb
index 939242cf8e..e87a1c6d8a 100644
--- a/services/api/test/test_helper.rb
+++ b/services/api/test/test_helper.rb
@@ -99,11 +99,8 @@ class ActiveSupport::TestCase
 
   def restore_configuration
     # Restore configuration settings changed during tests
-    $application_config.each do |k,v|
-      if k.match(/^[^.]*$/)
-        Rails.configuration.send (k + '='), v
-      end
-    end
+    copy_into_config $arvados_config, Rails.configuration
+    copy_into_config $remaining_config, Rails.configuration
   end
 
   def set_user_from_auth(auth_name)
diff --git a/services/api/test/unit/blob_test.rb b/services/api/test/unit/blob_test.rb
index 429ebde976..ad083946d3 100644
--- a/services/api/test/unit/blob_test.rb
+++ b/services/api/test/unit/blob_test.rb
@@ -130,14 +130,14 @@ class BlobTest < ActiveSupport::TestCase
       expire: 0x7fffffff,
     }
 
-    original_ttl = Rails.configuration.blob_signature_ttl
-    Rails.configuration.blob_signature_ttl = original_ttl*2
+    original_ttl = Rails.configuration.Collections["BlobSigningTTL"]
+    Rails.configuration.Collections["BlobSigningTTL"] = original_ttl*2
     signed2 = Blob.sign_locator @@known_locator, {
       api_token: @@known_token,
       key: @@known_key,
       expire: 0x7fffffff,
     }
-    Rails.configuration.blob_signature_ttl = original_ttl
+    Rails.configuration.Collections["BlobSigningTTL"] = original_ttl
 
     assert_not_equal signed, signed2
   end
diff --git a/services/api/test/unit/collection_test.rb b/services/api/test/unit/collection_test.rb
index 8deedee018..0ae9a02186 100644
--- a/services/api/test/unit/collection_test.rb
+++ b/services/api/test/unit/collection_test.rb
@@ -157,8 +157,8 @@ class CollectionTest < ActiveSupport::TestCase
   end
 
   test "auto-create version after idle setting" do
-    Rails.configuration.collection_versioning = true
-    Rails.configuration.preserve_version_if_idle = 600 # 10 minutes
+    Rails.configuration.Collections["CollectionVersioning"] = true
+    Rails.configuration.Collections["PreserveVersionIfIdle"] = 600 # 10 minutes
     act_as_user users(:active) do
       # Set up initial collection
       c = create_collection 'foo', Encoding::US_ASCII
@@ -188,8 +188,8 @@ class CollectionTest < ActiveSupport::TestCase
   end
 
   test "preserve_version=false assignment is ignored while being true and not producing a new version" do
-    Rails.configuration.collection_versioning = true
-    Rails.configuration.preserve_version_if_idle = 3600
+    Rails.configuration.Collections["CollectionVersioning"] = true
+    Rails.configuration.Collections["PreserveVersionIfIdle"] = 3600
     act_as_user users(:active) do
       # Set up initial collection
       c = create_collection 'foo', Encoding::US_ASCII
@@ -244,8 +244,8 @@ class CollectionTest < ActiveSupport::TestCase
   end
 
   test "uuid updates on current version make older versions update their pointers" do
-    Rails.configuration.collection_versioning = true
-    Rails.configuration.preserve_version_if_idle = 0
+    Rails.configuration.Collections["CollectionVersioning"] = true
+    Rails.configuration.Collections["PreserveVersionIfIdle"] = 0
     act_as_system_user do
       # Set up initial collection
       c = create_collection 'foo', Encoding::US_ASCII
@@ -267,8 +267,8 @@ class CollectionTest < ActiveSupport::TestCase
   end
 
   test "older versions' modified_at indicate when they're created" do
-    Rails.configuration.collection_versioning = true
-    Rails.configuration.preserve_version_if_idle = 0
+    Rails.configuration.Collections["CollectionVersioning"] = true
+    Rails.configuration.Collections["PreserveVersionIfIdle"] = 0
     act_as_user users(:active) do
       # Set up initial collection
       c = create_collection 'foo', Encoding::US_ASCII
@@ -301,8 +301,8 @@ class CollectionTest < ActiveSupport::TestCase
   end
 
   test "past versions should not be directly updatable" do
-    Rails.configuration.collection_versioning = true
-    Rails.configuration.preserve_version_if_idle = 0
+    Rails.configuration.Collections["CollectionVersioning"] = true
+    Rails.configuration.Collections["PreserveVersionIfIdle"] = 0
     act_as_system_user do
       # Set up initial collection
       c = create_collection 'foo', Encoding::US_ASCII
@@ -324,7 +324,7 @@ class CollectionTest < ActiveSupport::TestCase
       assert c_old.invalid?
       c_old.reload
       # Now disable collection versioning, it should behave the same way
-      Rails.configuration.collection_versioning = false
+      Rails.configuration.Collections["CollectionVersioning"] = false
       c_old.name = 'this was foo'
       assert c_old.invalid?
     end
@@ -337,8 +337,8 @@ class CollectionTest < ActiveSupport::TestCase
     ['is_trashed', true, false],
   ].each do |attr, first_val, second_val|
     test "sync #{attr} with older versions" do
-      Rails.configuration.collection_versioning = true
-      Rails.configuration.preserve_version_if_idle = 0
+      Rails.configuration.Collections["CollectionVersioning"] = true
+      Rails.configuration.Collections["PreserveVersionIfIdle"] = 0
       act_as_system_user do
         # Set up initial collection
         c = create_collection 'foo', Encoding::US_ASCII
@@ -379,8 +379,8 @@ class CollectionTest < ActiveSupport::TestCase
     [false, 'replication_desired', 5, false],
   ].each do |versioning, attr, val, new_version_expected|
     test "update #{attr} with versioning #{versioning ? '' : 'not '}enabled should #{new_version_expected ? '' : 'not '}create a new version" do
-      Rails.configuration.collection_versioning = versioning
-      Rails.configuration.preserve_version_if_idle = 0
+      Rails.configuration.Collections["CollectionVersioning"] = versioning
+      Rails.configuration.Collections["PreserveVersionIfIdle"] = 0
       act_as_user users(:active) do
         # Create initial collection
         c = create_collection 'foo', Encoding::US_ASCII
@@ -414,8 +414,8 @@ class CollectionTest < ActiveSupport::TestCase
   end
 
   test 'current_version_uuid is ignored during update' do
-    Rails.configuration.collection_versioning = true
-    Rails.configuration.preserve_version_if_idle = 0
+    Rails.configuration.Collections["CollectionVersioning"] = true
+    Rails.configuration.Collections["PreserveVersionIfIdle"] = 0
     act_as_user users(:active) do
       # Create 1st collection
       col1 = create_collection 'foo', Encoding::US_ASCII
@@ -439,8 +439,8 @@ class CollectionTest < ActiveSupport::TestCase
   end
 
   test 'with versioning enabled, simultaneous updates increment version correctly' do
-    Rails.configuration.collection_versioning = true
-    Rails.configuration.preserve_version_if_idle = 0
+    Rails.configuration.Collections["CollectionVersioning"] = true
+    Rails.configuration.Collections["PreserveVersionIfIdle"] = 0
     act_as_user users(:active) do
       # Create initial collection
       col = create_collection 'foo', Encoding::US_ASCII
@@ -654,7 +654,7 @@ class CollectionTest < ActiveSupport::TestCase
 
   [0, 2, 4, nil].each do |ask|
     test "set replication_desired to #{ask.inspect}" do
-      Rails.configuration.default_collection_replication = 2
+      Rails.configuration.Collections["DefaultReplication"] = 2
       act_as_user users(:active) do
         c = collections(:replication_undesired_unconfirmed)
         c.update_attributes replication_desired: ask
@@ -760,7 +760,7 @@ class CollectionTest < ActiveSupport::TestCase
                              name: 'foo',
                              trash_at: db_current_time + 1.years)
       sig_exp = /\+A[0-9a-f]{40}\@([0-9]+)/.match(c.signed_manifest_text)[1].to_i
-      expect_max_sig_exp = db_current_time.to_i + Rails.configuration.blob_signature_ttl
+      expect_max_sig_exp = db_current_time.to_i + Rails.configuration.Collections["BlobSigningTTL"]
       assert_operator c.trash_at.to_i, :>, expect_max_sig_exp
       assert_operator sig_exp.to_i, :<=, expect_max_sig_exp
     end
@@ -849,7 +849,7 @@ class CollectionTest < ActiveSupport::TestCase
     test test_name do
       act_as_user users(:active) do
         min_exp = (db_current_time +
-                   Rails.configuration.blob_signature_ttl.seconds)
+                   Rails.configuration.Collections["BlobSigningTTL"].seconds)
         if fixture_name == :expired_collection
           # Fixture-finder shorthand doesn't find trashed collections
           # because they're not in the default scope.
@@ -890,7 +890,7 @@ class CollectionTest < ActiveSupport::TestCase
   end
 
   test 'default trash interval > blob signature ttl' do
-    Rails.configuration.default_trash_lifetime = 86400 * 21 # 3 weeks
+    Rails.configuration.Collections["DefaultTrashLifetime"] = 86400 * 21 # 3 weeks
     start = db_current_time
     act_as_user users(:active) do
       c = Collection.create!(manifest_text: '', name: 'foo')
diff --git a/services/api/test/unit/commit_test.rb b/services/api/test/unit/commit_test.rb
index af365b19e2..5ae8080e93 100644
--- a/services/api/test/unit/commit_test.rb
+++ b/services/api/test/unit/commit_test.rb
@@ -78,7 +78,7 @@ class CommitTest < ActiveSupport::TestCase
 
   test 'tag_in_internal_repository creates and updates tags in internal.git' do
     authorize_with :active
-    gitint = "git --git-dir #{Rails.configuration.git_internal_dir}"
+    gitint = "git --git-dir #{Rails.configuration.Containers["JobsAPI"]["GitInternalDir"]}"
     IO.read("|#{gitint} tag -d testtag 2>/dev/null") # "no such tag", fine
     assert_match(/^fatal: /, IO.read("|#{gitint} show testtag 2>&1"))
     refute $?.success?
@@ -88,7 +88,7 @@ class CommitTest < ActiveSupport::TestCase
   end
 
   def with_foo_repository
-    Dir.chdir("#{Rails.configuration.git_repositories_dir}/#{repositories(:foo).uuid}") do
+    Dir.chdir("#{Rails.configuration.Git["Repositories"]}/#{repositories(:foo).uuid}") do
       must_pipe("git checkout master 2>&1")
       yield
     end
@@ -107,7 +107,7 @@ class CommitTest < ActiveSupport::TestCase
       must_pipe("git -c user.email=x@x -c user.name=X commit -m -")
     end
     Commit.tag_in_internal_repository 'active/foo', sha1, tag
-    gitint = "git --git-dir #{Rails.configuration.git_internal_dir.shellescape}"
+    gitint = "git --git-dir #{Rails.configuration.Containers["JobsAPI"]["GitInternalDir"].shellescape}"
     assert_match(/^commit /, IO.read("|#{gitint} show #{tag.shellescape}"))
     assert $?.success?
   end
@@ -123,7 +123,7 @@ class CommitTest < ActiveSupport::TestCase
       must_pipe("git reset --hard HEAD^")
     end
     Commit.tag_in_internal_repository 'active/foo', sha1, tag
-    gitint = "git --git-dir #{Rails.configuration.git_internal_dir.shellescape}"
+    gitint = "git --git-dir #{Rails.configuration.Containers["JobsAPI"]["GitInternalDir"].shellescape}"
     assert_match(/^commit /, IO.read("|#{gitint} show #{tag.shellescape}"))
     assert $?.success?
   end
diff --git a/services/api/test/unit/container_request_test.rb b/services/api/test/unit/container_request_test.rb
index 5c4a56c2c5..5d998a2442 100644
--- a/services/api/test/unit/container_request_test.rb
+++ b/services/api/test/unit/container_request_test.rb
@@ -514,7 +514,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
   test "Container.resolve_container_image(pdh)" do
     set_user_from_auth :active
     [[:docker_image, 'v1'], [:docker_image_1_12, 'v2']].each do |coll, ver|
-      Rails.configuration.docker_image_formats = [ver]
+      Rails.configuration.Containers["SupportedDockerImageFormats"] = [ver]
       pdh = collections(coll).portable_data_hash
       resolved = Container.resolve_container_image(pdh)
       assert_equal resolved, pdh
@@ -535,12 +535,12 @@ class ContainerRequestTest < ActiveSupport::TestCase
 
   test "allow unrecognized container when there are remote_hosts" do
     set_user_from_auth :active
-    Rails.configuration.remote_hosts = {"foooo" => "bar.com"}
+    Rails.configuration.RemoteClusters = {"foooo" => {"Host" => "bar.com"} }
     Container.resolve_container_image('acbd18db4cc2f85cedef654fccc4a4d8+3')
   end
 
   test "migrated docker image" do
-    Rails.configuration.docker_image_formats = ['v2']
+    Rails.configuration.Containers["SupportedDockerImageFormats"] = ['v2']
     add_docker19_migration_link
 
     # Test that it returns only v2 images even though request is for v1 image.
@@ -558,7 +558,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
   end
 
   test "use unmigrated docker image" do
-    Rails.configuration.docker_image_formats = ['v1']
+    Rails.configuration.Containers["SupportedDockerImageFormats"] = ['v1']
     add_docker19_migration_link
 
     # Test that it returns only supported v1 images even though there is a
@@ -577,7 +577,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
   end
 
   test "incompatible docker image v1" do
-    Rails.configuration.docker_image_formats = ['v1']
+    Rails.configuration.Containers["SupportedDockerImageFormats"] = ['v1']
     add_docker19_migration_link
 
     # Don't return unsupported v2 image even if we ask for it directly.
@@ -590,7 +590,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
   end
 
   test "incompatible docker image v2" do
-    Rails.configuration.docker_image_formats = ['v2']
+    Rails.configuration.Containers["SupportedDockerImageFormats"] = ['v2']
     # No migration link, don't return unsupported v1 image,
 
     set_user_from_auth :active
@@ -836,7 +836,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
     assert_not_nil(trash)
     assert_not_nil(delete)
     assert_in_delta(trash, now + 1.second, 10)
-    assert_in_delta(delete, now + Rails.configuration.blob_signature_ttl.second, 10)
+    assert_in_delta(delete, now + Rails.configuration.Collections["BlobSigningTTL"].second, 10)
   end
 
   def check_output_ttl_1y(now, trash, delete)
@@ -884,7 +884,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
     [false, ActiveRecord::RecordInvalid],
     [true, nil],
   ].each do |preemptible_conf, expected|
-    test "having Rails.configuration.preemptible_instances=#{preemptible_conf}, create preemptible container request and verify #{expected}" do
+    test "having Rails.configuration.Containers["UsePreemptibleInstances"]=#{preemptible_conf}, create preemptible container request and verify #{expected}" do
       sp = {"preemptible" => true}
       common_attrs = {cwd: "test",
                       priority: 1,
@@ -892,7 +892,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
                       output_path: "test",
                       scheduling_parameters: sp,
                       mounts: {"test" => {"kind" => "json"}}}
-      Rails.configuration.preemptible_instances = preemptible_conf
+      Rails.configuration.Containers["UsePreemptibleInstances"] = preemptible_conf
       set_user_from_auth :active
 
       cr = create_minimal_req!(common_attrs)
@@ -921,7 +921,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
                       scheduling_parameters: {"preemptible" => false},
                       mounts: {"test" => {"kind" => "json"}}}
 
-      Rails.configuration.preemptible_instances = true
+      Rails.configuration.Containers["UsePreemptibleInstances"] = true
       set_user_from_auth :active
 
       if requesting_c
@@ -946,14 +946,14 @@ class ContainerRequestTest < ActiveSupport::TestCase
     [false, 'zzzzz-dz642-runningcontainr', nil],
     [false, nil, nil],
   ].each do |preemptible_conf, requesting_c, schedule_preemptible|
-    test "having Rails.configuration.preemptible_instances=#{preemptible_conf}, #{requesting_c.nil? ? 'non-':''}child CR should #{schedule_preemptible ? '':'not'} ask for preemptible instance by default" do
+    test "having Rails.configuration.Containers["UsePreemptibleInstances"]=#{preemptible_conf}, #{requesting_c.nil? ? 'non-':''}child CR should #{schedule_preemptible ? '':'not'} ask for preemptible instance by default" do
       common_attrs = {cwd: "test",
                       priority: 1,
                       command: ["echo", "hello"],
                       output_path: "test",
                       mounts: {"test" => {"kind" => "json"}}}
 
-      Rails.configuration.preemptible_instances = preemptible_conf
+      Rails.configuration.Containers["UsePreemptibleInstances"] = preemptible_conf
       set_user_from_auth :active
 
       if requesting_c
@@ -1017,7 +1017,7 @@ class ContainerRequestTest < ActiveSupport::TestCase
                     state: ContainerRequest::Committed,
                     mounts: {"test" => {"kind" => "json"}}}
     set_user_from_auth :active
-    Rails.configuration.preemptible_instances = true
+    Rails.configuration.Containers["UsePreemptibleInstances"] = true
 
     cr = with_container_auth(Container.find_by_uuid 'zzzzz-dz642-runningcontainr') do
       create_minimal_req!(common_attrs)
diff --git a/services/api/test/unit/container_test.rb b/services/api/test/unit/container_test.rb
index 5ce3739a36..1711841b48 100644
--- a/services/api/test/unit/container_test.rb
+++ b/services/api/test/unit/container_test.rb
@@ -241,7 +241,7 @@ class ContainerTest < ActiveSupport::TestCase
   end
 
   test "find_reusable method should select higher priority queued container" do
-        Rails.configuration.log_reuse_decisions = true
+        Rails.configuration.Containers["LogReuseDecisions"] = true
     set_user_from_auth :active
     common_attrs = REUSABLE_COMMON_ATTRS.merge({environment:{"var" => "queued"}})
     c_low_priority, _ = minimal_new(common_attrs.merge({use_existing:false, priority:1}))
@@ -511,7 +511,7 @@ class ContainerTest < ActiveSupport::TestCase
 
   test "find_reusable with logging enabled" do
     set_user_from_auth :active
-    Rails.configuration.log_reuse_decisions = true
+    Rails.configuration.Containers["LogReuseDecisions"] = true
     Rails.logger.expects(:info).at_least(3)
     Container.find_reusable(REUSABLE_COMMON_ATTRS)
   end
@@ -666,7 +666,7 @@ class ContainerTest < ActiveSupport::TestCase
   end
 
   test "Exceed maximum lock-unlock cycles" do
-    Rails.configuration.max_container_dispatch_attempts = 3
+    Rails.configuration.Containers["MaxDispatchAttempts"] = 3
 
     set_user_from_auth :active
     c, cr = minimal_new
diff --git a/services/api/test/unit/crunch_dispatch_test.rb b/services/api/test/unit/crunch_dispatch_test.rb
index 42ef0d160c..d2c0b124ed 100644
--- a/services/api/test/unit/crunch_dispatch_test.rb
+++ b/services/api/test/unit/crunch_dispatch_test.rb
@@ -99,7 +99,7 @@ class CrunchDispatchTest < ActiveSupport::TestCase
 
   test 'override --cgroup-root with CRUNCH_CGROUP_ROOT' do
     ENV['CRUNCH_CGROUP_ROOT'] = '/path/to/cgroup'
-    Rails.configuration.crunch_job_wrapper = :none
+    Rails.configuration.Containers["JobsAPI"]["CrunchJobWrapper"] = "none"
     act_as_system_user do
       j = Job.create(repository: 'active/foo',
                      script: 'hash',
@@ -140,7 +140,7 @@ class CrunchDispatchTest < ActiveSupport::TestCase
 
   test 'rate limit of partial line segments' do
     act_as_system_user do
-      Rails.configuration.crunch_log_partial_line_throttle_period = 1
+      Rails.configuration.Containers["Logging"]["LogPartialLineThrottlePeriod"] = 1
 
       job = {}
       job[:bytes_logged] = 0
@@ -197,7 +197,7 @@ class CrunchDispatchTest < ActiveSupport::TestCase
   end
 
   test 'scancel orphaned job nodes' do
-    Rails.configuration.crunch_job_wrapper = :slurm_immediate
+    Rails.configuration.Containers["JobsAPI"]["CrunchJobWrapper"] = "slurm_immediate"
     act_as_system_user do
       dispatch = CrunchDispatch.new
 
diff --git a/services/api/test/unit/fail_jobs_test.rb b/services/api/test/unit/fail_jobs_test.rb
index 3c7f9a9096..01ed220601 100644
--- a/services/api/test/unit/fail_jobs_test.rb
+++ b/services/api/test/unit/fail_jobs_test.rb
@@ -40,8 +40,8 @@ class FailJobsTest < ActiveSupport::TestCase
   end
 
   test 'cancel slurm jobs' do
-    Rails.configuration.crunch_job_wrapper = :slurm_immediate
-    Rails.configuration.crunch_job_user = 'foobar'
+    Rails.configuration.Containers["JobsAPI"]["CrunchJobWrapper"] = "slurm_immediate"
+    Rails.configuration.Containers["JobsAPI"]["CrunchJobUser"] = 'foobar'
     fake_squeue = IO.popen("echo #{@job[:before_reboot].uuid}")
     fake_scancel = IO.popen("true")
     IO.expects(:popen).
@@ -55,7 +55,7 @@ class FailJobsTest < ActiveSupport::TestCase
   end
 
   test 'use reboot time' do
-    Rails.configuration.crunch_job_wrapper = nil
+    Rails.configuration.Containers["JobsAPI"]["CrunchJobWrapper"] = nil
     @dispatch.expects(:open).once.with('/proc/stat').
       returns open(Rails.root.join('test/fixtures/files/proc_stat'))
     @dispatch.fail_jobs(before: 'reboot')
diff --git a/services/api/test/unit/job_test.rb b/services/api/test/unit/job_test.rb
index fcbd1722f3..65725f3301 100644
--- a/services/api/test/unit/job_test.rb
+++ b/services/api/test/unit/job_test.rb
@@ -90,7 +90,7 @@ class JobTest < ActiveSupport::TestCase
   ].each do |use_config|
     test "Job with no Docker image uses default docker image when configuration is set #{use_config}" do
       default_docker_image = collections(:docker_image)[:portable_data_hash]
-      Rails.configuration.default_docker_image_for_jobs = default_docker_image if use_config
+      Rails.configuration.Containers["JobsAPI"]["DefaultDockerImage"] = default_docker_image if use_config
 
       job = Job.new job_attrs
       assert job.valid?, job.errors.full_messages.to_s
@@ -127,7 +127,7 @@ class JobTest < ActiveSupport::TestCase
     'locator' => BAD_COLLECTION,
   }.each_pair do |spec_type, image_spec|
     test "Job validation fails with nonexistent Docker image #{spec_type}" do
-      Rails.configuration.remote_hosts = {}
+      Rails.configuration.RemoteClusters = {}
       job = Job.new job_attrs(runtime_constraints:
                               {'docker_image' => image_spec})
       assert(job.invalid?, "nonexistent Docker image #{spec_type} was valid")
@@ -426,7 +426,7 @@ class JobTest < ActiveSupport::TestCase
   end
 
   test "use migrated docker image if requesting old-format image by tag" do
-    Rails.configuration.docker_image_formats = ['v2']
+    Rails.configuration.Containers["SupportedDockerImageFormats"] = ['v2']
     add_docker19_migration_link
     job = Job.create!(
       job_attrs(
@@ -438,7 +438,7 @@ class JobTest < ActiveSupport::TestCase
   end
 
   test "use migrated docker image if requesting old-format image by pdh" do
-    Rails.configuration.docker_image_formats = ['v2']
+    Rails.configuration.Containers["SupportedDockerImageFormats"] = ['v2']
     add_docker19_migration_link
     job = Job.create!(
       job_attrs(
@@ -455,7 +455,7 @@ class JobTest < ActiveSupport::TestCase
    [:docker_image_1_12, :docker_image_1_12, :docker_image_1_12],
   ].each do |existing_image, request_image, expect_image|
     test "if a #{existing_image} job exists, #{request_image} yields #{expect_image} after migration" do
-      Rails.configuration.docker_image_formats = ['v1']
+      Rails.configuration.Containers["SupportedDockerImageFormats"] = ['v1']
 
       if existing_image == :docker_image
         oldjob = Job.create!(
@@ -477,7 +477,7 @@ class JobTest < ActiveSupport::TestCase
         end
       end
 
-      Rails.configuration.docker_image_formats = ['v2']
+      Rails.configuration.Containers["SupportedDockerImageFormats"] = ['v2']
       add_docker19_migration_link
 
       # Check that both v1 and v2 images get resolved to v2.
@@ -568,7 +568,7 @@ class JobTest < ActiveSupport::TestCase
   end
 
   test 'find_reusable with logging' do
-    Rails.configuration.log_reuse_decisions = true
+    Rails.configuration.Containers["LogReuseDecisions"] = true
     Rails.logger.expects(:info).at_least(3)
     try_find_reusable
   end
@@ -595,7 +595,7 @@ class JobTest < ActiveSupport::TestCase
     assert_nil Job.find_reusable(example_attrs, {}, [], [users(:active)])
 
     # ...unless config says to reuse the earlier job in such cases.
-    Rails.configuration.reuse_job_if_outputs_differ = true
+    Rails.configuration.Containers["JobsAPI"]["ReuseJobIfOutputsDiffer"] = true
     j = Job.find_reusable(example_attrs, {}, [], [users(:active)])
     assert_equal foobar.uuid, j.uuid
   end
@@ -648,33 +648,32 @@ class JobTest < ActiveSupport::TestCase
   end
 
   test 'enable legacy api configuration option = true' do
-    Rails.configuration.enable_legacy_jobs_api = true
+    Rails.configuration.Containers["JobsAPI"]["Enable"] = "true"
     check_enable_legacy_jobs_api
-    assert_equal [], Rails.configuration.disable_api_methods
+    assert_equal [], Rails.configuration.API["DisabledAPIs"]
   end
 
   test 'enable legacy api configuration option = false' do
-    Rails.configuration.enable_legacy_jobs_api = false
+    Rails.configuration.Containers["JobsAPI"]["Enable"] = "false"
     check_enable_legacy_jobs_api
-    assert_equal Disable_jobs_api_method_list, Rails.configuration.disable_api_methods
+    assert_equal Disable_jobs_api_method_list, Rails.configuration.API["DisabledAPIs"]
   end
 
   test 'enable legacy api configuration option = auto, has jobs' do
-    Rails.configuration.enable_legacy_jobs_api = "auto"
+    Rails.configuration.Containers["JobsAPI"]["Enable"] = "auto"
     assert Job.count > 0
-    assert_equal [], Rails.configuration.disable_api_methods
     check_enable_legacy_jobs_api
-    assert_equal [], Rails.configuration.disable_api_methods
+    assert_equal [], Rails.configuration.API["DisabledAPIs"]
   end
 
   test 'enable legacy api configuration option = auto, no jobs' do
-    Rails.configuration.enable_legacy_jobs_api = "auto"
+    Rails.configuration.Containers["JobsAPI"]["Enable"] = "auto"
     act_as_system_user do
       Job.destroy_all
     end
     assert_equal 0, Job.count
     assert_equal [], Rails.configuration.disable_api_methods
     check_enable_legacy_jobs_api
-    assert_equal Disable_jobs_api_method_list, Rails.configuration.disable_api_methods
+    assert_equal Disable_jobs_api_method_list, Rails.configuration.API["DisabledAPIs"]
   end
 end
diff --git a/services/api/test/unit/log_test.rb b/services/api/test/unit/log_test.rb
index 5a78f25235..3f6e278cf8 100644
--- a/services/api/test/unit/log_test.rb
+++ b/services/api/test/unit/log_test.rb
@@ -282,7 +282,7 @@ class LogTest < ActiveSupport::TestCase
   end
 
   test "non-empty configuration.unlogged_attributes" do
-    Rails.configuration.unlogged_attributes = ["manifest_text"]
+    Rails.configuration.AuditLogs["UnloggedAttributes"] = ["manifest_text"]
     txt = ". acbd18db4cc2f85cedef654fccc4a4d8+3 0:3:foo\n"
 
     act_as_system_user do
@@ -297,7 +297,7 @@ class LogTest < ActiveSupport::TestCase
   end
 
   test "empty configuration.unlogged_attributes" do
-    Rails.configuration.unlogged_attributes = []
+    Rails.configuration.AuditLogs["UnloggedAttributes"] = []
     txt = ". acbd18db4cc2f85cedef654fccc4a4d8+3 0:3:foo\n"
 
     act_as_system_user do
@@ -332,8 +332,8 @@ class LogTest < ActiveSupport::TestCase
   test 'retain old audit logs with default settings' do
     assert_no_logs_deleted do
       AuditLogs.delete_old(
-        max_age: Rails.configuration.max_audit_log_age,
-        max_batch: Rails.configuration.max_audit_log_delete_batch)
+        max_age: Rails.configuration.AuditLogs["MaxAge"],
+        max_batch: Rails.configuration.AuditLogs["MaxDeleteBatch"])
     end
   end
 
@@ -362,8 +362,8 @@ class LogTest < ActiveSupport::TestCase
 
   test 'delete old audit logs in thread' do
     begin
-      Rails.configuration.max_audit_log_age = 20
-      Rails.configuration.max_audit_log_delete_batch = 100000
+      Rails.configuration.AuditLogs["MaxAge"] = 20
+      Rails.configuration.AuditLogs["MaxDeleteBatch"] = 100000
       Rails.cache.delete 'AuditLogs'
       initial_log_count = Log.unscoped.all.count + 1
       act_as_system_user do
diff --git a/services/api/test/unit/node_test.rb b/services/api/test/unit/node_test.rb
index 4cb7a0a1b1..7e6a01db66 100644
--- a/services/api/test/unit/node_test.rb
+++ b/services/api/test/unit/node_test.rb
@@ -34,8 +34,8 @@ class NodeTest < ActiveSupport::TestCase
   end
 
   test "dns_server_conf_template" do
-    Rails.configuration.dns_server_conf_dir = Rails.root.join 'tmp'
-    Rails.configuration.dns_server_conf_template = Rails.root.join 'config', 'unbound.template'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerConfDir"] = Rails.root.join 'tmp'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerConfTemplate"] = Rails.root.join 'config', 'unbound.template'
     conffile = Rails.root.join 'tmp', 'compute65535.conf'
     File.unlink conffile rescue nil
     assert Node.dns_server_update 'compute65535', '127.0.0.1'
@@ -44,8 +44,8 @@ class NodeTest < ActiveSupport::TestCase
   end
 
   test "dns_server_restart_command" do
-    Rails.configuration.dns_server_conf_dir = Rails.root.join 'tmp'
-    Rails.configuration.dns_server_reload_command = 'foobar'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerConfDir"] = Rails.root.join 'tmp'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerReloadCommand"] = 'foobar'
     restartfile = Rails.root.join 'tmp', 'restart.txt'
     File.unlink restartfile rescue nil
     assert Node.dns_server_update 'compute65535', '127.0.0.127'
@@ -54,14 +54,14 @@ class NodeTest < ActiveSupport::TestCase
   end
 
   test "dns_server_restart_command fail" do
-    Rails.configuration.dns_server_conf_dir = Rails.root.join 'tmp', 'bogusdir'
-    Rails.configuration.dns_server_reload_command = 'foobar'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerConfDir"] = Rails.root.join 'tmp', 'bogusdir'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerReloadCommand"] = 'foobar'
     refute Node.dns_server_update 'compute65535', '127.0.0.127'
   end
 
   test "dns_server_update_command with valid command" do
     testfile = Rails.root.join('tmp', 'node_test_dns_server_update_command.txt')
-    Rails.configuration.dns_server_update_command =
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerUpdateCommand"] =
       ('echo -n "%{hostname} == %{ip_address}" >' +
        testfile.to_s.shellescape)
     assert Node.dns_server_update 'compute65535', '127.0.0.1'
@@ -70,23 +70,23 @@ class NodeTest < ActiveSupport::TestCase
   end
 
   test "dns_server_update_command with failing command" do
-    Rails.configuration.dns_server_update_command = 'false %{hostname}'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerUpdateCommand"] = 'false %{hostname}'
     refute Node.dns_server_update 'compute65535', '127.0.0.1'
   end
 
   test "dns update with no commands/dirs configured" do
-    Rails.configuration.dns_server_update_command = false
-    Rails.configuration.dns_server_conf_dir = false
-    Rails.configuration.dns_server_conf_template = 'ignored!'
-    Rails.configuration.dns_server_reload_command = 'ignored!'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerUpdateCommand"] = false
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerConfDir"] = false
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerConfTemplate"] = 'ignored!'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerReloadCommand"] = 'ignored!'
     assert Node.dns_server_update 'compute65535', '127.0.0.127'
   end
 
   test "don't leave temp files behind if there's an error writing them" do
-    Rails.configuration.dns_server_conf_template = Rails.root.join 'config', 'unbound.template'
+    Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerConfTemplate"] = Rails.root.join 'config', 'unbound.template'
     Tempfile.any_instance.stubs(:puts).raises(IOError)
     Dir.mktmpdir do |tmpdir|
-      Rails.configuration.dns_server_conf_dir = tmpdir
+      Rails.configuration.Containers["SLURM"]["Managed"]["DNSServerConfDir"] = tmpdir
       refute Node.dns_server_update 'compute65535', '127.0.0.127'
       assert_empty Dir.entries(tmpdir).select{|f| File.file? f}
     end
@@ -100,14 +100,14 @@ class NodeTest < ActiveSupport::TestCase
   end
 
   test "ping new node with no hostname and no config" do
-    Rails.configuration.assign_node_hostname = false
+    Rails.configuration.Containers["SLURM"]["Managed"]["AssignNodeHostname"] = false
     node = ping_node(:new_with_no_hostname, {})
     refute_nil node.slot_number
     assert_nil node.hostname
   end
 
   test "ping new node with zero padding config" do
-    Rails.configuration.assign_node_hostname = 'compute%<slot_number>04d'
+    Rails.configuration.Containers["SLURM"]["Managed"]["AssignNodeHostname"] = 'compute%<slot_number>04d'
     node = ping_node(:new_with_no_hostname, {})
     slot_number = node.slot_number
     refute_nil slot_number
@@ -121,7 +121,7 @@ class NodeTest < ActiveSupport::TestCase
   end
 
   test "ping node with hostname and no config and expect hostname unchanged" do
-    Rails.configuration.assign_node_hostname = false
+    Rails.configuration.Containers["SLURM"]["Managed"]["AssignNodeHostname"] = false
     node = ping_node(:new_with_custom_hostname, {})
     assert_equal(23, node.slot_number)
     assert_equal("custom1", node.hostname)
@@ -196,13 +196,13 @@ class NodeTest < ActiveSupport::TestCase
   end
 
   test 'run out of slots' do
-    Rails.configuration.max_compute_nodes = 3
+    Rails.configuration.Containers["MaxComputeVMs"] = 3
     act_as_system_user do
       Node.destroy_all
       (1..4).each do |i|
         n = Node.create!
         args = { ip: "10.0.0.#{i}", ping_secret: n.info['ping_secret'] }
-        if i <= Rails.configuration.max_compute_nodes
+        if i <= Rails.configuration.Containers["MaxComputeVMs"]
           n.ping(args)
         else
           assert_raises do
diff --git a/services/api/test/unit/repository_test.rb b/services/api/test/unit/repository_test.rb
index fa4c37f74f..2f62350291 100644
--- a/services/api/test/unit/repository_test.rb
+++ b/services/api/test/unit/repository_test.rb
@@ -23,15 +23,15 @@ class RepositoryTest < ActiveSupport::TestCase
   def default_git_url(repo_name, user_name=nil)
     if user_name
       "git@git.%s.arvadosapi.com:%s/%s.git" %
-        [Rails.configuration.uuid_prefix, user_name, repo_name]
+        [Rails.configuration.ClusterID, user_name, repo_name]
     else
       "git@git.%s.arvadosapi.com:%s.git" %
-        [Rails.configuration.uuid_prefix, repo_name]
+        [Rails.configuration.ClusterID, repo_name]
     end
   end
 
   def assert_server_path(path_tail, repo_sym)
-    assert_equal(File.join(Rails.configuration.git_repositories_dir, path_tail),
+    assert_equal(File.join(Rails.configuration.Git["Repositories"], path_tail),
                  repositories(repo_sym).server_path)
   end
 
diff --git a/services/api/test/unit/user_notifier_test.rb b/services/api/test/unit/user_notifier_test.rb
index 008259c0b6..b5688fcc69 100644
--- a/services/api/test/unit/user_notifier_test.rb
+++ b/services/api/test/unit/user_notifier_test.rb
@@ -14,12 +14,12 @@ class UserNotifierTest < ActionMailer::TestCase
     assert_not_nil email
 
     # Test the body of the sent email contains what we expect it to
-    assert_equal Rails.configuration.user_notifier_email_from, email.from.first
+    assert_equal Rails.configuration.Users["UserNotifierEmailFrom"], email.from.first
     assert_equal user.email, email.to.first
     assert_equal 'Welcome to Arvados - shell account enabled', email.subject
     assert (email.body.to_s.include? 'Your Arvados shell account has been set up'),
         'Expected Your Arvados shell account has been set up in email body'
-    assert (email.body.to_s.include? Rails.configuration.workbench_address),
+    assert (email.body.to_s.include? Rails.configuration.Services["Workbench1"]["ExternalURL"]),
         'Expected workbench url in email body'
   end
 
diff --git a/services/api/test/unit/user_test.rb b/services/api/test/unit/user_test.rb
index 67c410047c..52333db8e8 100644
--- a/services/api/test/unit/user_test.rb
+++ b/services/api/test/unit/user_test.rb
@@ -110,7 +110,7 @@ class UserTest < ActiveSupport::TestCase
   end
 
   test "new username set avoiding blacklist" do
-    Rails.configuration.auto_setup_name_blacklist = ["root"]
+    Rails.configuration.Users["AutoSetupUsernameBlacklist"] = ["root"]
     check_new_username_setting("root", "root2")
   end
 
@@ -170,8 +170,8 @@ class UserTest < ActiveSupport::TestCase
         assert_equal 0, @all_users.count, "No admin users should exist (except for the system user)"
       end
 
-      Rails.configuration.auto_admin_first_user = auto_admin_first_user_config
-      Rails.configuration.auto_admin_user = auto_admin_user_config
+      Rails.configuration.Users["AutoAdminFirstUser"] = auto_admin_first_user_config
+      Rails.configuration.Users["AutoAdminUserWithEmail"] = auto_admin_user_config
 
       # See if the foo user has is_admin
       foo = User.new
@@ -384,15 +384,15 @@ class UserTest < ActiveSupport::TestCase
     test "create new user with auto setup #{active} #{email} #{auto_setup_vm} #{auto_setup_repo}" do
       set_user_from_auth :admin
 
-      Rails.configuration.auto_setup_new_users = true
+      Rails.configuration.Users["AutoSetupNewUsers"] = true
 
       if auto_setup_vm
-        Rails.configuration.auto_setup_new_users_with_vm_uuid = virtual_machines(:testvm)['uuid']
+        Rails.configuration.Users["AutoSetupNewUsersWithVmUUID"] = virtual_machines(:testvm)['uuid']
       else
-        Rails.configuration.auto_setup_new_users_with_vm_uuid = false
+        Rails.configuration.Users["AutoSetupNewUsersWithVmUUID"] = ""
       end
 
-      Rails.configuration.auto_setup_new_users_with_repository = auto_setup_repo
+      Rails.configuration.Users["AutoSetupNewUsersWithRepository"] = auto_setup_repo
 
       create_user_and_verify_setup_and_notifications active, new_user_recipients, inactive_recipients, email, expect_username
     end
@@ -625,12 +625,12 @@ class UserTest < ActiveSupport::TestCase
   end
 
   def create_user_and_verify_setup_and_notifications (active, new_user_recipients, inactive_recipients, email, expect_username)
-    Rails.configuration.new_user_notification_recipients = new_user_recipients
-    Rails.configuration.new_inactive_user_notification_recipients = inactive_recipients
+    Rails.configuration.Users["NewUserNotificationRecipients"] = new_user_recipients
+    Rails.configuration.Users["NewInactiveUserNotificationRecipients"] = inactive_recipients
 
     ActionMailer::Base.deliveries = []
 
-    can_setup = (Rails.configuration.auto_setup_new_users and
+    can_setup = (Rails.configuration.Users["AutoSetupNewUsers"] and
                  (not expect_username.nil?))
     expect_repo_name = "#{expect_username}/#{expect_username}"
     prior_repo = Repository.where(name: expect_repo_name).first
@@ -643,21 +643,21 @@ class UserTest < ActiveSupport::TestCase
     assert_equal(expect_username, user.username)
 
     # check user setup
-    verify_link_exists(Rails.configuration.auto_setup_new_users || active,
+    verify_link_exists(Rails.configuration.Users["AutoSetupNewUsers"] || active,
                        groups(:all_users).uuid, user.uuid,
                        "permission", "can_read")
     # Check for OID login link.
-    verify_link_exists(Rails.configuration.auto_setup_new_users || active,
+    verify_link_exists(Rails.configuration.Users["AutoSetupNewUsers"] || active,
                        user.uuid, user.email, "permission", "can_login")
     # Check for repository.
     if named_repo = (prior_repo or
                      Repository.where(name: expect_repo_name).first)
       verify_link_exists((can_setup and prior_repo.nil? and
-                          Rails.configuration.auto_setup_new_users_with_repository),
+                          Rails.configuration.Users["AutoSetupNewUsersWithRepository"]),
                          named_repo.uuid, user.uuid, "permission", "can_manage")
     end
     # Check for VM login.
-    if auto_vm_uuid = Rails.configuration.auto_setup_new_users_with_vm_uuid
+    if auto_vm_uuid = Rails.configuration.Users["AutoSetupNewUsersWithVmUUID"]
       verify_link_exists(can_setup, auto_vm_uuid, user.uuid,
                          "permission", "can_login", "username", expect_username)
     end
@@ -666,17 +666,17 @@ class UserTest < ActiveSupport::TestCase
     new_user_email = nil
     new_inactive_user_email = nil
 
-    new_user_email_subject = "#{Rails.configuration.email_subject_prefix}New user created notification"
-    if Rails.configuration.auto_setup_new_users
+    new_user_email_subject = "#{Rails.configuration.Users["EmailSubjectPrefix"]}New user created notification"
+    if Rails.configuration.Users["AutoSetupNewUsers"]
       new_user_email_subject = (expect_username or active) ?
-                                 "#{Rails.configuration.email_subject_prefix}New user created and setup notification" :
-                                 "#{Rails.configuration.email_subject_prefix}New user created, but not setup notification"
+                                 "#{Rails.configuration.Users["EmailSubjectPrefix"]}New user created and setup notification" :
+                                 "#{Rails.configuration.Users["EmailSubjectPrefix"]}New user created, but not setup notification"
     end
 
     ActionMailer::Base.deliveries.each do |d|
       if d.subject == new_user_email_subject then
         new_user_email = d
-      elsif d.subject == "#{Rails.configuration.email_subject_prefix}New inactive user notification" then
+      elsif d.subject == "#{Rails.configuration.Users["EmailSubjectPrefix"]}New inactive user notification" then
         new_inactive_user_email = d
       end
     end
@@ -685,7 +685,7 @@ class UserTest < ActiveSupport::TestCase
     # if the new user email recipients config parameter is set
     if not new_user_recipients.empty? then
       assert_not_nil new_user_email, 'Expected new user email after setup'
-      assert_equal Rails.configuration.user_notifier_email_from, new_user_email.from[0]
+      assert_equal Rails.configuration.Users["UserNotifierEmailFrom"], new_user_email.from[0]
       assert_equal new_user_recipients, new_user_email.to[0]
       assert_equal new_user_email_subject, new_user_email.subject
     else
@@ -695,9 +695,9 @@ class UserTest < ActiveSupport::TestCase
     if not active
       if not inactive_recipients.empty? then
         assert_not_nil new_inactive_user_email, 'Expected new inactive user email after setup'
-        assert_equal Rails.configuration.user_notifier_email_from, new_inactive_user_email.from[0]
+        assert_equal Rails.configuration.Users["UserNotifierEmailFrom"], new_inactive_user_email.from[0]
         assert_equal inactive_recipients, new_inactive_user_email.to[0]
-        assert_equal "#{Rails.configuration.email_subject_prefix}New inactive user notification", new_inactive_user_email.subject
+        assert_equal "#{Rails.configuration.Users["EmailSubjectPrefix"]}New inactive user notification", new_inactive_user_email.subject
       else
         assert_nil new_inactive_user_email, 'Did not expect new inactive user email after setup'
       end
-- 
2.30.2