X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=plc.d%2Fhttpd;h=6180e6eae012bb9be6007c0992359c899cb6c96d;hb=aab7636f16f072802f91f20b8f2307570d290e04;hp=67012236081bb97ec963e57696cb267adf202163;hpb=056625369a7163e8540b1e5cee4d756c07a64456;p=myplc.git diff --git a/plc.d/httpd b/plc.d/httpd index 6701223..6180e6e 100755 --- a/plc.d/httpd +++ b/plc.d/httpd @@ -1,6 +1,4 @@ #!/bin/bash -# $Id$ -# $URL$ # # priority: 600 # @@ -23,6 +21,8 @@ php_ini=/etc/php.ini httpd_conf=/etc/httpd/conf/httpd.conf ssl_conf=/etc/httpd/conf.d/ssl.conf plc_conf=/etc/httpd/conf.d/plc.conf +php_fpm_conf=/etc/php-fpm.d/plc.conf +php_fpm_dir=$(dirname $php_fpm_conf) function disable_file () { file=$1; shift @@ -58,6 +58,10 @@ case "$1" in include_path=".:$DocumentRoot/planetlab/includes:$DocumentRoot/plekit/php:$DocumentRoot/generated:/etc/planetlab/php:/usr/share/plc_api/php" sed -i -e "s@[;]*include_path = \"\.:.*\"@include_path = \"$include_path\"@" $php_ini + # Set open_basedir so as to avoid leaks + open_basedir="$DocumentRoot:/etc/planetlab/php:/usr/share/plc_api/php:/var/log/myslice:/var/tmp/bootmedium:/var/log/bm:/tmp" + sed -i -e "s@[;]*open_basedir =.*@open_basedir = \"$open_basedir\"@" $php_ini + # for php-5.3 under fedora12, otherwise issues tons of warning messages # Set timezone in php.ini if not already there if grep '^;date.timezone' $php_ini >& /dev/null; then @@ -65,9 +69,41 @@ case "$1" in sed -i -e 's,^;date.timezone.*,date.timezone = GMT,' $php_ini fi + if grep '^short_open_tag = Off' $php_ini >& /dev/null; then + sed -i -e 's,^short_open_tag = Off,short_open_tag = On,' $php_ini + fi + + ## patch php.ini + # memory limit + sed -i -e 's,^memory_limit = 32M *;,memory_limit = 80M ; patch myplc -- ,' $php_ini + # log_errors : is On by default + # error_log + if ! grep '^error_log *=' $php_ini > /dev/null ; then + echo 'error_log = /var/log/php.log' >> $php_ini + touch /var/log/php.log + chmod 666 /var/log/php.log + fi + + # configure php-fpm as well if present (starting with f27) + if [ -d $php_fpm_dir ] ; then + cat > $php_fpm_conf << EOF +[www] +php_value[include_path] = $include_path +php_value[open_basedir] = $open_basedir +php_value[date.timezone] = GMT +php_value[short_open_tag] = On +php_value[memory_limit] = 80M +EOF + # this is needed because otherwise, the first time + # we do this configuration, the service is already up + # and the config is usable only the second time + systemctl restart php-fpm + fi + # Disable default Listen directive sed -i -e '/^Listen/d' $httpd_conf + plc_api_path_noslash=$(echo $PLC_API_PATH | sed -e s,/,,g) # Set the port numbers for server in WWW API BOOT ; do enabled=PLC_${server}_ENABLED @@ -98,40 +134,40 @@ case "$1" in previous_http_port=PLC_${previous_server}_PORT previous_https_port=PLC_${previous_server}_SSL_PORT - if [ "${!http_port}" = "${!previous_http_port}" ] ; then + if [ -z "${http_port}" ]; then + skip_http=1; + elif [ -z "${!http_port}" ]; then + skip_http=1; + elif [ "${!http_port}" = "${!previous_http_port}" ] ; then skip_http=1 fi - if [ "${!https_port}" = "${!previous_https_port}" ] ; then + if [ -z "${https_port}" ]; then + skip_https=1 + elif [ -z "${!https_port}" ]; then + skip_https=1 + elif [ "${!https_port}" = "${!previous_https_port}" ] ; then skip_https=1 fi done - # Create a separate path for mod_wsgi until we are ready to replace - # mod_python - PLC_API_WSGI_PATH=/PLCAPIWSGI - # HTTP configuration - if [ $skip_http -eq 0 -a -n "${!http_port}" ] ; then + if [ $skip_http -eq 0 ] ; then cat < + # Make sure that the admin web pages are always accessed via SSL Redirect /db https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/db Redirect /planetlab https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/planetlab - Redirect /$PLC_API_PATH https://$PLC_API_HOST:$PLC_API_PORT/$PLC_API_PATH -### Redirect /$PLC_API_WSGI_PATH/ https://$PLC_API_HOST:$PLC_API_PORT/$PLC_API_WSGI_PATH/ -### WSGIScriptAlias $PLC_API_WSGI_PATH /usr/share/plc_api/ModWSGI.wsgi - # XX make processes and threads configurable -### WSGIDaemonProcess plcapi-wsgi user=apache group=apache processes=1 threads=25 -### WSGIProcessGroup plcapi-wsgi +# as a matter of fact most xmlrpc clients won't follow the redirection +# so this is mostly rethorical, but just in case... + Redirect /$plc_api_path_noslash https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/$plc_api_path_noslash + EOF fi # HTTPS configuration - if [ $skip_https -eq 0 -a -n "${!https_port}" ] ; then + if [ $skip_https -eq 0 ] ; then # XXX Cannot support NameVirtualHost over SSL. If # the API, boot, and web servers are all running # on the same machine, the web server certificate @@ -140,48 +176,89 @@ EOF -e "s/^Listen .*/Listen ${!https_port}/" \ -e "s///" \ $ssl_conf - fi - done >$plc_conf + # this is used to locate the right certificates + server_lower=$(echo $server | tr 'A-Z' 'a-z') + + # which one is used is currently configured in myplc.spec, + # with mod_python preferred + if rpm -q mod_python >& /dev/null ; then + configure_for_mod_python=true + elif rpm -q mod_wsgi >& /dev/null || rpm -q python2-mod_wsgi >& /dev/null ; then + configure_for_mod_wsgi=true + else + echo "Requires mod_python or mod_wsgi.... exiting" + exit 1 + fi - # Set custom Apache directives - ( - if [ "$PLC_API_ENABLED" = "1" ] ; then - cat < here + # but early tests showed this could be tricky/fragile + # So let's hard-wire it for one module + # A lot of trial-and -error was involved in getting this that way... + + if [ -n "$configure_for_mod_python" ] ; then +#################### for mod_python + cat < + SetHandler mod_python PythonPath "sys.path + ['/usr/share/plc_api']" - PythonHandler ModPython + PythonHandler apache.ModPython +EOF -# mod_wsgi location -### -### SetHandler mod_wsgi -### + elif [ -n "$configure_for_mod_wsgi" ] ; then +#################### for mod_wsgi + cat < + + # SSL + SSLEngine On + SSLCertificateFile /etc/planetlab/${server_lower}_ssl.crt + SSLCertificateKeyFile /etc/planetlab/${server_lower}_ssl.key + SSLCertificateChainFile /etc/planetlab/${server_lower}_ca_ssl.crt + + WSGIScriptAlias /$plc_api_path_noslash /usr/share/plc_api/apache/plc.wsgi +# xxx would be cool to be able to tweak this through config + WSGIDaemonProcess plcapi-wsgi-ssl user=apache group=apache processes=1 threads=25 + WSGIProcessGroup plcapi-wsgi-ssl + + + Options +ExecCGI + $(apache_allow) + + + EOF - else - cat < - Deny from all - + fi + fi + done >$plc_conf + # Set custom Apache directives + ( + # could be restricted to boot boxes but harmless.. + cat < -### Deny from all -### + + $(apache_forbid) + EOF fi + # redirect www requests if not on the right server if [ "$PLC_WWW_ENABLED" != "1" ] ; then cat <>$plc_conf # Make alpina-logs directory writable for bootmanager log upload @@ -233,16 +310,9 @@ define('PLANETLAB_SUPPORT_EMAIL_ONLY', PLC_MAIL_SUPPORT_ADDRESS); ?> EOF - ## patch php.ini - # memory limit - sed -i -e 's,^memory_limit = 32M *;,memory_limit = 80M ; patch myplc -- ,' $php_ini - # log_errors : is On by default - # error_log - if ! grep '^error_log *=' $php_ini > /dev/null ; then - echo 'error_log = /var/log/php.log' >> $php_ini - touch /var/log/php.log - chmod 666 /var/log/php.log - fi + ## make room for logs + touch /var/log/plcapi.log + chmod 666 /var/log/plcapi.log plc_daemon httpd check