Firewall on Demand

----------------------

.. note::

        ./manage.py migrate longerusername

        ./manage.py migrate flowspec

        ./manage.py migrate accounts

If upgrading from flowspy version <1.1.x pay attention to settings.py changes. Also, do not forget to run if PEER\_\*\_TABLE tables are set to TRUE in settings.py::

Upgrading from v<1.0.x

----------------------

If upgrading from flowspy version <1.0.x pay attention to settings.py changes. Also, do not forget to run::

    ./manage.py migrate

to catch-up with latest database changes.

Required system packages

    apt-get upgrade

    apt-get install mysql-server apache2 memcached libapache2-mod-proxy-html gunicorn beanstalkd python-django python-django-south python-django-tinymce tinymce python-mysqldb python-yaml python-memcache python-django-registration python-ipaddr python-lxml mysql-client git python-django-celery python-paramiko python-gevent vim

.. note::

    Set username and password for mysql if used

Application configuration

=========================

Copy settings.py.dist to settings.py::

    cd flowspy

    cp settings.py.dist settings.py

    PEER_MANAGED_TABLE = True

    PEER_RANGE_MANAGED_TABLE = True

.. note::

    Soon we will release a version with django-registration as a means to add users and Shibboleth will become an alternative

    # :Configuration file: /etc/default/celeryd

    #

    # See http://docs.celeryq.org/en/latest/cookbook/daemonizing.html#init-script-celeryd

    ### BEGIN INIT INFO

    # Provides:              celeryd

    # Required-Start:     $network $local_fs $remote_fs

    # Short-Description: celery task worker daemon

    # Description:          Starts the Celery worker daemon for a single project.

    ### END INIT INFO

    #set -e

    DEFAULT_PID_FILE="/var/run/celery/%n.pid"

    DEFAULT_LOG_FILE="/var/log/celery/%n.log"

    DEFAULT_LOG_LEVEL="INFO"

    DEFAULT_NODES="celery"

    DEFAULT_CELERYD="-m celery.bin.celeryd_detach"

    ENABLED="false"

    [ -r "$CELERY_DEFAULTS" ] && . "$CELERY_DEFAULTS"

    [ -r /etc/default/celeryd ] && . /etc/default/celeryd

    if [ "$ENABLED" != "true" ]; then

          echo "celery daemon disabled - see /etc/default/celeryd."

          exit 0

    fi

    CELERYD_PID_FILE=${CELERYD_PID_FILE:-${CELERYD_PIDFILE:-$DEFAULT_PID_FILE}}

    CELERYD_LOG_FILE=${CELERYD_LOG_FILE:-${CELERYD_LOGFILE:-$DEFAULT_LOG_FILE}}

    CELERYD_LOG_LEVEL=${CELERYD_LOG_LEVEL:-${CELERYD_LOGLEVEL:-$DEFAULT_LOG_LEVEL}}

    CELERYD=${CELERYD:-$DEFAULT_CELERYD}

    CELERYCTL=${CELERYCTL:="celeryctl"}

    CELERYD_NODES=${CELERYD_NODES:-$DEFAULT_NODES}

    export CELERY_LOADER

    if [ -n "$2" ]; then

          CELERYD_OPTS="$CELERYD_OPTS $2"

    fi

    CELERYD_LOG_DIR=`dirname $CELERYD_LOG_FILE`

    CELERYD_PID_DIR=`dirname $CELERYD_PID_FILE`

    if [ ! -d "$CELERYD_LOG_DIR" ]; then

    if [ ! -d "$CELERYD_PID_DIR" ]; then

          mkdir -p $CELERYD_PID_DIR

    fi

    # Extra start-stop-daemon options, like user/group.

    if [ -n "$CELERYD_USER" ]; then

          DAEMON_OPTS="$DAEMON_OPTS --uid=$CELERYD_USER"

          DAEMON_OPTS="$DAEMON_OPTS --gid=$CELERYD_GROUP"

          chgrp "$CELERYD_GROUP" $CELERYD_LOG_DIR $CELERYD_PID_DIR

    fi

    if [ -n "$CELERYD_CHDIR" ]; then

          DAEMON_OPTS="$DAEMON_OPTS --workdir=\"$CELERYD_CHDIR\""

    fi

    check_dev_null() {

          if [ ! -c /dev/null ]; then

               echo "/dev/null is not a character device!"

               exit 1

          fi

    }

    export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

    stop_workers () {

          $CELERYD_MULTI stop $CELERYD_NODES --pidfile="$CELERYD_PID_FILE"

    }

    start_workers () {

          $CELERYD_MULTI start $CELERYD_NODES $DAEMON_OPTS           \

                                        --pidfile="$CELERYD_PID_FILE"        \

                                        --cmd="$CELERYD"                           \

                                        $CELERYD_OPTS

    }

    restart_workers () {

          $CELERYD_MULTI restart $CELERYD_NODES $DAEMON_OPTS        \

                                           --pidfile="$CELERYD_PID_FILE"     \

                                           --cmd="$CELERYD"                        \

                                           $CELERYD_OPTS

    }

    case "$1" in

          start)

               check_dev_null

               start_workers

          ;;

          stop)

               check_dev_null

               stop_workers

          ;;

          reload|force-reload)

               echo "Use restart"

          ;;

          status)

               $CELERYCTL status $CELERYCTL_OPTS

          ;;

          restart)

               check_dev_null

               restart_workers

          ;;

          try-restart)

               check_dev_null

               restart_workers

          ;;

          *)

               echo "Usage: /etc/init.d/celeryd {start|stop|restart|try-restart|kill}"

               exit 1

          ;;

    esac

    exit 0

celeryd configuration

    # Default: false

    ENABLED="true"

    # Name of nodes to start, here we have a single node

    CELERYD_NODES="w1"

    # or we could have three nodes:

    #CELERYD_NODES="w1 w2 w3"

    # Where to chdir at start.

    CELERYD_CHDIR="/srv/flowspy"

    # How to call "manage.py celeryd_multi"

    CELERYD_MULTI="python $CELERYD_CHDIR/manage.py celeryd_multi"

    # How to call "manage.py celeryctl"

    CELERYCTL="python $CELERYD_CHDIR/manage.py celeryctl"

    # Extra arguments to celeryd

    #CELERYD_OPTS="--time-limit=300 --concurrency=8"

    CELERYD_OPTS="-E -B --schedule=/var/run/celery/celerybeat-schedule --concurrency=1 --soft-time-limit=180 --time-limit=1800"

    # Name of the celery config module.

    CELERY_CONFIG_MODULE="celeryconfig"

    # %n will be replaced with the nodename.

    CELERYD_LOG_FILE="/var/log/celery/fod_%n.log"

    CELERYD_PID_FILE="/var/run/celery/%n.pid"

    CELERYD_USER="root"

    CELERYD_GROUP="root"

    # Name of the projects settings module.

    export DJANGO_SETTINGS_MODULE="flowspy.settings"

        ServerAdmin webmaster@localhost

        ServerName  fod.example.com

        DocumentRoot /var/www

        ErrorLog ${APACHE_LOG_DIR}/fod_error.log

        # Possible values include: debug, info, notice, warn, error, crit,

        # alert, emerg.

        LogLevel debug

        CustomLog ${APACHE_LOG_DIR}/fod_access.log combined

        Alias /static       /srv/flowspy/static

          RewriteEngine On

          RewriteCond %{HTTPS} off

          RewriteRule ^/(.*) https://fod.example.com/$1 [L,R]

    </VirtualHost>

    <VirtualHost *:443>

        ServerName    fod.example.com

        ServerAdmin     webmaster@localhost

        ServerSignature        On

        SSLEngine on

        SSLCertificateFile    /etc/ssl/certs/fod.example.com.crt

        SSLCertificateChainFile /etc/ssl/certs/example-chain.pem

        SSLCertificateKeyFile    /etc/ssl/private/fod.example.com.key

        AddDefaultCharset UTF-8

        IndexOptions        +Charset=UTF-8

        ShibConfig       /etc/shibboleth/shibboleth2.xml

        Alias          /shibboleth-sp /usr/share/shibboleth

        <Location /login>

             AuthType shibboleth

             ShibRequireSession On

             ShibRequestSetting entityID https://idp.example.com/idp/shibboleth

             require valid-user

        </Location>

        # Shibboleth debugging CGI script

        ScriptAlias /shibboleth/test /usr/lib/cgi-bin/shibtest.cgi

        <Location /shibboleth/test>

             ShibUseHeaders On

             require valid-user

        </Location>

        <Location /Shibboleth.sso>

             SetHandler shib

        </Location>

        # Shibboleth SP configuration

        #SetEnv                       proxy-sendchunked

              <Proxy *>

               Order allow,deny

               Allow from all

               </Proxy>

               SSLProxyEngine           off

               ProxyErrorOverride     off

          ProxyTimeout     28800

             ProxyPass        /static !

             ProxyPass          /shibboleth !

             ProxyPass        /Shibboleth.sso !

               ProxyPass           / http://localhost:8081/ retry=0

               ProxyPassReverse / http://localhost:8081/

          Alias /static          /srv/flowspy/static

        LogLevel warn

        ErrorLog ${APACHE_LOG_DIR}/fod_error.log

          CustomLog ${APACHE_LOG_DIR}/fod_access.log combined

    </VirtualHost>

Now, enable your site. You might want to disable the default site if fod is the only site you host on your server::

    python manage.py migrate flowspec

    python manage.py migrate djcelery

    python manage.py migrate accounts

If you have not changed the values of the PEER\_\*\_TABLE variables to False and thus you are going for a default installation (that is PEER\_\*\_TABLE variables are set to True) , then run::

    python manage.py migrate peers

If however you have set the PEER\_\*\_TABLE variables to False and by accident you have ran the command above, then you have to cleanup you database manually by dropping the peer\* tables plus the techc_email table. For MySQL the command is::

Restart, gunicorn and apache::

Propagate the flatpages

=======================

To import the flatpages, run from root folder::

    python manage.py loaddata initial_data/fixtures_manual.xml