X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=plc.d%2Fhttpd;h=526e37cfda4842dc2b82d6375e6d95a2878a4dbc;hb=53c1e4601ebbbf8baaa60b61bb65fc763247235e;hp=25abcc3374c2f23bbd8e586342069e49a71bc194;hpb=45447eb73cbdaa3b3b6fb8c7022b2e60f70db5e1;p=myplc.git diff --git a/plc.d/httpd b/plc.d/httpd index 25abcc3..526e37c 100755 --- a/plc.d/httpd +++ b/plc.d/httpd @@ -21,6 +21,8 @@ php_ini=/etc/php.ini httpd_conf=/etc/httpd/conf/httpd.conf ssl_conf=/etc/httpd/conf.d/ssl.conf plc_conf=/etc/httpd/conf.d/plc.conf +php_fpm_conf=/etc/php-fpm.d/plc.conf +php_fpm_dir=$(dirname $php_fpm_conf) function disable_file () { file=$1; shift @@ -44,7 +46,7 @@ case "$1" in # set document root - not really useful on fedora but just in case sed -i -e "s@^DocumentRoot.*@DocumentRoot \"$DocumentRoot\"@" $httpd_conf - # whether WWW is enabled or not : + # whether WWW is enabled or not : if [ "$PLC_WWW_ENABLED" != "1" ] ; then # avoid hitting drupal, that would try to connect to the db and create noise disable_file $DocumentRoot/index.php @@ -57,9 +59,9 @@ case "$1" in sed -i -e "s@[;]*include_path = \"\.:.*\"@include_path = \"$include_path\"@" $php_ini # Set open_basedir so as to avoid leaks - open_basedir="$DocumentRoot:/etc/planetlab/php:/usr/share/plc_api/php:/var/log/myslice:/var/tmp/bootmedium:/tmp" + open_basedir="$DocumentRoot:/etc/planetlab/php:/usr/share/plc_api/php:/var/log/myslice:/var/tmp/bootmedium:/var/log/bm:/tmp" sed -i -e "s@[;]*open_basedir =.*@open_basedir = \"$open_basedir\"@" $php_ini - + # for php-5.3 under fedora12, otherwise issues tons of warning messages # Set timezone in php.ini if not already there if grep '^;date.timezone' $php_ini >& /dev/null; then @@ -71,9 +73,37 @@ case "$1" in sed -i -e 's,^short_open_tag = Off,short_open_tag = On,' $php_ini fi + ## patch php.ini + # memory limit + sed -i -e 's,^memory_limit = 32M *;,memory_limit = 80M ; patch myplc -- ,' $php_ini + # log_errors : is On by default + # error_log + if ! grep '^error_log *=' $php_ini > /dev/null ; then + echo 'error_log = /var/log/php.log' >> $php_ini + touch /var/log/php.log + chmod 666 /var/log/php.log + fi + + # configure php-fpm as well if present (starting with f27) + if [ -d $php_fpm_dir ] ; then + cat > $php_fpm_conf << EOF +[www] +php_value[include_path] = $include_path +php_value[open_basedir] = $open_basedir +php_value[date.timezone] = GMT +php_value[short_open_tag] = On +php_value[memory_limit] = 80M +EOF + # this is needed because otherwise, the first time + # we do this configuration, the service is already up + # and the config is usable only the second time + systemctl restart php-fpm + fi + # Disable default Listen directive sed -i -e '/^Listen/d' $httpd_conf + plc_api_path_noslash=$(echo $PLC_API_PATH | sed -e s,/,,g) # Set the port numbers for server in WWW API BOOT ; do enabled=PLC_${server}_ENABLED @@ -104,38 +134,40 @@ case "$1" in previous_http_port=PLC_${previous_server}_PORT previous_https_port=PLC_${previous_server}_SSL_PORT - if [ "${!http_port}" = "${!previous_http_port}" ] ; then + if [ -z "${http_port}" ]; then + skip_http=1; + elif [ -z "${!http_port}" ]; then + skip_http=1; + elif [ "${!http_port}" = "${!previous_http_port}" ] ; then skip_http=1 fi - if [ "${!https_port}" = "${!previous_https_port}" ] ; then + if [ -z "${https_port}" ]; then + skip_https=1 + elif [ -z "${!https_port}" ]; then + skip_https=1 + elif [ "${!https_port}" = "${!previous_https_port}" ] ; then skip_https=1 fi done - # mod_python being retired as of fedora18 we go for mod_wsgi instead - PLC_API_PATH_WSGI=$PLC_API_PATH - # HTTP configuration - if [ $skip_http -eq 0 -a -n "${!http_port}" ] ; then + if [ $skip_http -eq 0 ] ; then cat < + # Make sure that the admin web pages are always accessed via SSL Redirect /db https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/db Redirect /planetlab https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/planetlab - Redirect /$PLC_API_PATH https://$PLC_API_HOST:$PLC_API_PORT/$PLC_API_PATH - WSGIScriptAlias $PLC_API_PATH_WSGI /usr/share/plc_api/ModWSGI.wsgi - # xxx make processes and threads configurable - WSGIDaemonProcess plcapi-wsgi user=apache group=apache processes=1 threads=25 - WSGIProcessGroup plcapi-wsgi +# as a matter of fact most xmlrpc clients won't follow the redirection +# so this is mostly rethorical, but just in case... + Redirect /$plc_api_path_noslash https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/$plc_api_path_noslash + EOF fi # HTTPS configuration - if [ $skip_https -eq 0 -a -n "${!https_port}" ] ; then + if [ $skip_https -eq 0 ] ; then # XXX Cannot support NameVirtualHost over SSL. If # the API, boot, and web servers are all running # on the same machine, the web server certificate @@ -144,48 +176,91 @@ EOF -e "s/^Listen .*/Listen ${!https_port}/" \ -e "s///" \ $ssl_conf + # this is used to locate the right certificates + server_lower=$(echo $server | tr 'A-Z' 'a-z') + + # which one is used is currently configured in myplc.spec, + # with mod_python preferred + if rpm -q mod_python >& /dev/null ; then + configure_for_mod_python=true + elif rpm -q mod_wsgi >& /dev/null \ + || rpm -q python2-mod_wsgi >& /dev/null \ + || rpm -q python3-mod_wsgi >& /dev/null ; then + configure_for_mod_wsgi=true + else + echo "Requires mod_python or mod_wsgi.... exiting" + exit 1 + fi + + # It would be tempting to use here + # but early tests showed this could be tricky/fragile + # So let's hard-wire it for one module + # A lot of trial-and -error was involved in getting this that way... + + if [ -n "$configure_for_mod_python" ] ; then +#################### for mod_python + cat < + SetHandler mod_python + PythonPath "sys.path + ['/usr/share/plc_api']" + PythonHandler apache.ModPython + +EOF + + elif [ -n "$configure_for_mod_wsgi" ] ; then +#################### for mod_wsgi + cat < + + # SSL + SSLEngine On + SSLCertificateFile /etc/planetlab/${server_lower}_ssl.crt + SSLCertificateKeyFile /etc/planetlab/${server_lower}_ssl.key + SSLCertificateChainFile /etc/planetlab/${server_lower}_ca_ssl.crt + + WSGIScriptAlias /$plc_api_path_noslash /usr/share/plc_api/apache/plc.wsgi +# xxx would be cool to be able to tweak this through config + WSGIDaemonProcess plcapi-wsgi-ssl user=apache group=apache processes=1 threads=25 + WSGIProcessGroup plcapi-wsgi-ssl + + + Options +ExecCGI + $(apache_allow) + + + +EOF + fi fi done >$plc_conf # Set custom Apache directives ( - if [ "$PLC_API_ENABLED" = "1" ] ; then - cat < -### SetHandler mod_python -### PythonPath "sys.path + ['/usr/share/plc_api']" -### PythonHandler ModPython -### - -# mod_wsgi location - enabled - - SetHandler mod_wsgi - + # could be restricted to boot boxes but harmless.. + cat < -### Deny from all -### - # mod_wsgi location - - Deny from all - + + $(apache_forbid) + EOF fi + # redirect www requests if not on the right server if [ "$PLC_WWW_ENABLED" != "1" ] ; then cat <>$plc_conf # Make alpina-logs directory writable for bootmanager log upload @@ -237,16 +312,9 @@ define('PLANETLAB_SUPPORT_EMAIL_ONLY', PLC_MAIL_SUPPORT_ADDRESS); ?> EOF - ## patch php.ini - # memory limit - sed -i -e 's,^memory_limit = 32M *;,memory_limit = 80M ; patch myplc -- ,' $php_ini - # log_errors : is On by default - # error_log - if ! grep '^error_log *=' $php_ini > /dev/null ; then - echo 'error_log = /var/log/php.log' >> $php_ini - touch /var/log/php.log - chmod 666 /var/log/php.log - fi + ## make room for logs + touch /var/log/plcapi.log + chmod 666 /var/log/plcapi.log plc_daemon httpd check