root / doc / source / install.rst @ ca345a18
History | View | Annotate | Download (19 kB)
1 | 51ce199a | Leonidas Poulopoulos | ************ |
---|---|---|---|
2 | 51ce199a | Leonidas Poulopoulos | Installation |
3 | 51ce199a | Leonidas Poulopoulos | ************ |
4 | 51ce199a | Leonidas Poulopoulos | |
5 | 51ce199a | Leonidas Poulopoulos | .. toctree:: |
6 | f8938aca | Leonidas Poulopoulos | :maxdepth: 2 |
7 | 51ce199a | Leonidas Poulopoulos | |
8 | b7566dcc | Leonidas Poulopoulos | Debian Wheezy (x64) - Django 1.4.x |
9 | 51ce199a | Leonidas Poulopoulos | ================================== |
10 | 51ce199a | Leonidas Poulopoulos | This guide assumes that installation is carried out in /srv/flowspy directory. If other directory is to be used, please change the corresponding configuration files. It is also assumed that the root user will perform every action. |
11 | 51ce199a | Leonidas Poulopoulos | |
12 | 0bf16f7f | Leonidas Poulopoulos | Upgrading from v<1.0.x |
13 | 0bf16f7f | Leonidas Poulopoulos | ---------------------- |
14 | 0bf16f7f | Leonidas Poulopoulos | If upgrading from flowspy version <1.0.x pay attention to settings.py changes. Also, do not forget to run:: |
15 | f8938aca | Leonidas Poulopoulos | |
16 | f8938aca | Leonidas Poulopoulos | ./manage.py migrate |
17 | f8938aca | Leonidas Poulopoulos | |
18 | 0bf16f7f | Leonidas Poulopoulos | to catch-up with latest database changes. |
19 | 0bf16f7f | Leonidas Poulopoulos | |
20 | 51ce199a | Leonidas Poulopoulos | Required system packages |
21 | 51ce199a | Leonidas Poulopoulos | ------------------------ |
22 | 51ce199a | Leonidas Poulopoulos | Update and install the required packages:: |
23 | 51ce199a | Leonidas Poulopoulos | |
24 | f8938aca | Leonidas Poulopoulos | apt-get update |
25 | f8938aca | Leonidas Poulopoulos | apt-get upgrade |
26 | f8938aca | Leonidas Poulopoulos | apt-get install mysql-server apache2 memcached libapache2-mod-proxy-html gunicorn beanstalkd python-django python-django-south python-django-tinymce tinymce python-mysqldb python-yaml python-memcache python-django-registration python-ipaddr python-lxml mysql-client git python-django-celery python-paramiko python-gevent vim |
27 | 51ce199a | Leonidas Poulopoulos | |
28 | 51ce199a | Leonidas Poulopoulos | .. note:: |
29 | f8938aca | Leonidas Poulopoulos | Set username and password for mysql if used |
30 | 51ce199a | Leonidas Poulopoulos | |
31 | 51ce199a | Leonidas Poulopoulos | .. note:: |
32 | f8938aca | Leonidas Poulopoulos | If you wish to deploy an outgoing mail server, now it is time to do it. Otherwise you could set FoD to send out mails via a third party account |
33 | 51ce199a | Leonidas Poulopoulos | |
34 | 93f99c86 | Leonidas Poulopoulos | Create a database |
35 | 93f99c86 | Leonidas Poulopoulos | ----------------- |
36 | 93f99c86 | Leonidas Poulopoulos | If you are using mysql, you should create a database:: |
37 | 93f99c86 | Leonidas Poulopoulos | |
38 | f8938aca | Leonidas Poulopoulos | mysql -u root -p -e 'create database fod' |
39 | 93f99c86 | Leonidas Poulopoulos | |
40 | 51ce199a | Leonidas Poulopoulos | Required application packages |
41 | 51ce199a | Leonidas Poulopoulos | ----------------------------- |
42 | f8938aca | Leonidas Poulopoulos | Get the required packages and their dependencies and install them:: |
43 | f8938aca | Leonidas Poulopoulos | |
44 | f8938aca | Leonidas Poulopoulos | apt-get install libxml2-dev libxslt-dev gcc python-dev |
45 | 51ce199a | Leonidas Poulopoulos | |
46 | 51ce199a | Leonidas Poulopoulos | - ncclient: NETCONF python client:: |
47 | 51ce199a | Leonidas Poulopoulos | |
48 | f8938aca | Leonidas Poulopoulos | cd ~ |
49 | f8938aca | Leonidas Poulopoulos | git clone https://github.com/leopoul/ncclient.git |
50 | f8938aca | Leonidas Poulopoulos | cd ncclient |
51 | f8938aca | Leonidas Poulopoulos | python setup.py install |
52 | 51ce199a | Leonidas Poulopoulos | |
53 | 51ce199a | Leonidas Poulopoulos | - nxpy: Python Objects from/to XML proxy:: |
54 | 51ce199a | Leonidas Poulopoulos | |
55 | f8938aca | Leonidas Poulopoulos | cd ~ |
56 | f8938aca | Leonidas Poulopoulos | git clone https://code.grnet.gr/git/nxpy |
57 | f8938aca | Leonidas Poulopoulos | cd nxpy |
58 | f8938aca | Leonidas Poulopoulos | python setup.py install |
59 | 51ce199a | Leonidas Poulopoulos | |
60 | 51ce199a | Leonidas Poulopoulos | - flowspy: core application. Installation is done at /srv/flowspy:: |
61 | 51ce199a | Leonidas Poulopoulos | |
62 | f8938aca | Leonidas Poulopoulos | cd /srv |
63 | f8938aca | Leonidas Poulopoulos | git clone https://code.grnet.gr/git/flowspy |
64 | f8938aca | Leonidas Poulopoulos | cd flowspy |
65 | 51ce199a | Leonidas Poulopoulos | |
66 | 51ce199a | Leonidas Poulopoulos | Application configuration |
67 | 51ce199a | Leonidas Poulopoulos | ========================= |
68 | 51ce199a | Leonidas Poulopoulos | Copy settings.py.dist to settings.py:: |
69 | f8938aca | Leonidas Poulopoulos | |
70 | f8938aca | Leonidas Poulopoulos | cd flowspy |
71 | f8938aca | Leonidas Poulopoulos | cp settings.py.dist settings.py |
72 | 51ce199a | Leonidas Poulopoulos | |
73 | 51ce199a | Leonidas Poulopoulos | Edit settings.py file and set the following according to your configuration:: |
74 | 51ce199a | Leonidas Poulopoulos | |
75 | f8938aca | Leonidas Poulopoulos | ADMINS: set your admin name and email (assuming that your server can send notifications) |
76 | f8938aca | Leonidas Poulopoulos | DATABASES (to point to your local database). You could use views instead of tables for models: peer, peercontacts, peernetworks. For this to work we suggest MySQL with MyISAM db engine |
77 | f8938aca | Leonidas Poulopoulos | SECRET_KEY : Make this unique, and don't share it with anybody |
78 | f8938aca | Leonidas Poulopoulos | STATIC_ROOT: /srv/flowspy/static (or your installation directory) |
79 | f8938aca | Leonidas Poulopoulos | STATIC_URL (static media directory) . If you have followed the above this should be: /srv/flowspy/static |
80 | f8938aca | Leonidas Poulopoulos | TEMPLATE_DIRS : If you have followed the above this should be: /srv/flowspy/templates |
81 | f8938aca | Leonidas Poulopoulos | CACHE_BACKEND: Enable Memcached for production or leave to DummyCache for development environments |
82 | f8938aca | Leonidas Poulopoulos | Alternatively you could go for redis with the corresponding Django client lib. |
83 | f8938aca | Leonidas Poulopoulos | NETCONF_DEVICE (tested with Juniper EX4200 but any BGP enabled Juniper should work). This is the flowspec capable device |
84 | f8938aca | Leonidas Poulopoulos | NETCONF_USER (enable ssh and netconf on device) |
85 | f8938aca | Leonidas Poulopoulos | NETCONF_PASS |
86 | f8938aca | Leonidas Poulopoulos | If beanstalk is selected the following should be left intact. |
87 | f8938aca | Leonidas Poulopoulos | BROKER_HOST (beanstalk host) |
88 | f8938aca | Leonidas Poulopoulos | BROKER_PORT (beanstalk port) |
89 | f8938aca | Leonidas Poulopoulos | SERVER_EMAIL |
90 | f8938aca | Leonidas Poulopoulos | EMAIL_SUBJECT_PREFIX |
91 | f8938aca | Leonidas Poulopoulos | If beanstalk is selected the following should be left intact. |
92 | f8938aca | Leonidas Poulopoulos | BROKER_URL (beanstalk url) |
93 | f8938aca | Leonidas Poulopoulos | SHIB_AUTH_ENTITLEMENT (if you go for Shibboleth authentication) |
94 | f8938aca | Leonidas Poulopoulos | NOTIFY_ADMIN_MAILS (bcc mail addresses) |
95 | f8938aca | Leonidas Poulopoulos | PROTECTED_SUBNETS (subnets for which source or destination address will prevent rule creation and notify the NOTIFY_ADMIN_MAILS) |
96 | f8938aca | Leonidas Poulopoulos | The whois client is meant to be used in case you have inserted peers with their ASes in the peers table and wish to get network info for each one in an automated manner. |
97 | f8938aca | Leonidas Poulopoulos | PRIMARY_WHOIS |
98 | f8938aca | Leonidas Poulopoulos | ALTERNATE_WHOIS |
99 | f8938aca | Leonidas Poulopoulos | If you wish to deploy FoD with Shibboleth change the following attributes according to your setup: |
100 | f8938aca | Leonidas Poulopoulos | SHIB_AUTH_ENTITLEMENT = 'urn:mace' |
101 | f8938aca | Leonidas Poulopoulos | SHIB_ADMIN_DOMAIN = 'example.com' |
102 | f8938aca | Leonidas Poulopoulos | SHIB_LOGOUT_URL = 'https://example.com/Shibboleth.sso/Logout' |
103 | f8938aca | Leonidas Poulopoulos | SHIB_USERNAME = ['HTTP_EPPN'] |
104 | f8938aca | Leonidas Poulopoulos | SHIB_MAIL = ['mail', 'HTTP_MAIL', 'HTTP_SHIB_INETORGPERSON_MAIL'] |
105 | f8938aca | Leonidas Poulopoulos | SHIB_FIRSTNAME = ['HTTP_SHIB_INETORGPERSON_GIVENNAME'] |
106 | f8938aca | Leonidas Poulopoulos | SHIB_LASTNAME = ['HTTP_SHIB_PERSON_SURNAME'] |
107 | f8938aca | Leonidas Poulopoulos | SHIB_ENTITLEMENT = ['HTTP_SHIB_EP_ENTITLEMENT'] |
108 | 51ce199a | Leonidas Poulopoulos | |
109 | 51ce199a | Leonidas Poulopoulos | If you have not installed an outgoing mail server you can always use your own account (either corporate or gmail, hotmail ,etc) by adding the following lines in settings.py:: |
110 | 51ce199a | Leonidas Poulopoulos | |
111 | f8938aca | Leonidas Poulopoulos | EMAIL_USE_TLS = True #(or False) |
112 | f8938aca | Leonidas Poulopoulos | EMAIL_HOST = 'smtp.example.com' |
113 | f8938aca | Leonidas Poulopoulos | EMAIL_HOST_USER = 'username' |
114 | f8938aca | Leonidas Poulopoulos | EMAIL_HOST_PASSWORD = 'yourpassword' |
115 | f8938aca | Leonidas Poulopoulos | EMAIL_PORT = 587 #(outgoing) |
116 | f8938aca | Leonidas Poulopoulos | |
117 | f8938aca | Leonidas Poulopoulos | It is strongly advised that you do not change the following to False values unless, you want to integrate FoD with you CRM or members database. This implies that you are able/have the rights to create database views between the two databases:: |
118 | 51ce199a | Leonidas Poulopoulos | |
119 | f8938aca | Leonidas Poulopoulos | PEER_MANAGED_TABLE = True |
120 | f8938aca | Leonidas Poulopoulos | PEER_RANGE_MANAGED_TABLE = True |
121 | f8938aca | Leonidas Poulopoulos | PEER_TECHC_MANAGED_TABLE = True |
122 | f8938aca | Leonidas Poulopoulos | |
123 | f8938aca | Leonidas Poulopoulos | By doing that the corresponding tables as defined in peers/models will not be created. As noted above, you have to create the views that the tables will rely on. |
124 | 51ce199a | Leonidas Poulopoulos | |
125 | 51ce199a | Leonidas Poulopoulos | .. note:: |
126 | f8938aca | Leonidas Poulopoulos | Soon we will release a version with django-registration as a means to add users and Shibboleth will become an alternative |
127 | 51ce199a | Leonidas Poulopoulos | |
128 | 51ce199a | Leonidas Poulopoulos | Let's move on with some copies and dir creations:: |
129 | 51ce199a | Leonidas Poulopoulos | |
130 | f8938aca | Leonidas Poulopoulos | mkdir /var/log/fod |
131 | f8938aca | Leonidas Poulopoulos | chown www-data.www-data /var/log/fod |
132 | f8938aca | Leonidas Poulopoulos | cp urls.py.dist urls.py |
133 | f8938aca | Leonidas Poulopoulos | cd .. |
134 | 51ce199a | Leonidas Poulopoulos | |
135 | 51ce199a | Leonidas Poulopoulos | System configuration |
136 | 51ce199a | Leonidas Poulopoulos | ==================== |
137 | 51ce199a | Leonidas Poulopoulos | Apache operates as a gunicorn Proxy with WSGI and Shibboleth modules enabled. |
138 | 51ce199a | Leonidas Poulopoulos | Depending on the setup the apache configuration may vary:: |
139 | 51ce199a | Leonidas Poulopoulos | |
140 | f8938aca | Leonidas Poulopoulos | a2enmod rewrite |
141 | f8938aca | Leonidas Poulopoulos | a2enmod proxy |
142 | f8938aca | Leonidas Poulopoulos | a2enmod ssl |
143 | f8938aca | Leonidas Poulopoulos | a2enmod proxy_http |
144 | 51ce199a | Leonidas Poulopoulos | |
145 | 51ce199a | Leonidas Poulopoulos | If shibboleth is to be used:: |
146 | 51ce199a | Leonidas Poulopoulos | |
147 | f8938aca | Leonidas Poulopoulos | apt-get install libapache2-mod-shib2 |
148 | f8938aca | Leonidas Poulopoulos | a2enmod shib2 |
149 | 51ce199a | Leonidas Poulopoulos | |
150 | 51ce199a | Leonidas Poulopoulos | Now it is time to configure beanstalk, gunicorn, celery and apache. |
151 | 51ce199a | Leonidas Poulopoulos | |
152 | 51ce199a | Leonidas Poulopoulos | beanstalkd |
153 | 51ce199a | Leonidas Poulopoulos | ---------- |
154 | 51ce199a | Leonidas Poulopoulos | Enable beanstalk by editting /etc/default/beanstalkd:: |
155 | 51ce199a | Leonidas Poulopoulos | |
156 | f8938aca | Leonidas Poulopoulos | vim /etc/default/beanstalkd |
157 | 51ce199a | Leonidas Poulopoulos | |
158 | 51ce199a | Leonidas Poulopoulos | Uncomment the line **START=yes** to enable beanstalk |
159 | 51ce199a | Leonidas Poulopoulos | |
160 | 51ce199a | Leonidas Poulopoulos | Start beanstalkd:: |
161 | 51ce199a | Leonidas Poulopoulos | |
162 | f8938aca | Leonidas Poulopoulos | service beanstalkd start |
163 | 51ce199a | Leonidas Poulopoulos | |
164 | 51ce199a | Leonidas Poulopoulos | gunicorn.d |
165 | 51ce199a | Leonidas Poulopoulos | ---------- |
166 | 0bf16f7f | Leonidas Poulopoulos | Create and edit /etc/gunicorn.d/fod:: |
167 | 51ce199a | Leonidas Poulopoulos | |
168 | f8938aca | Leonidas Poulopoulos | vim /etc/gunicorn.d/fod |
169 | 51ce199a | Leonidas Poulopoulos | |
170 | 51ce199a | Leonidas Poulopoulos | FoD is served via gunicorn and is then proxied by Apache. If the above directory conventions have been followed so far, then your configuration should be:: |
171 | 51ce199a | Leonidas Poulopoulos | |
172 | f8938aca | Leonidas Poulopoulos | CONFIG = { |
173 | f8938aca | Leonidas Poulopoulos | 'mode': 'django', |
174 | f8938aca | Leonidas Poulopoulos | 'working_dir': '/srv/flowspy', |
175 | f8938aca | Leonidas Poulopoulos | 'args': ( |
176 | f8938aca | Leonidas Poulopoulos | '--bind=127.0.0.1:8081', |
177 | f8938aca | Leonidas Poulopoulos | '--workers=1', |
178 | f8938aca | Leonidas Poulopoulos | '--worker-class=egg:gunicorn#gevent', |
179 | f8938aca | Leonidas Poulopoulos | '--timeout=30', |
180 | ca345a18 | Leonidas Poulopoulos | '--debug', |
181 | f8938aca | Leonidas Poulopoulos | '--log-level=debug', |
182 | f8938aca | Leonidas Poulopoulos | '--log-file=/var/log/gunicorn/fod.log', |
183 | f8938aca | Leonidas Poulopoulos | ), |
184 | f8938aca | Leonidas Poulopoulos | } |
185 | b7566dcc | Leonidas Poulopoulos | |
186 | 51ce199a | Leonidas Poulopoulos | |
187 | 0bf16f7f | Leonidas Poulopoulos | celeryd |
188 | 0bf16f7f | Leonidas Poulopoulos | ------- |
189 | 51ce199a | Leonidas Poulopoulos | Celery is used over beanstalkd to apply firewall rules in a serial manner so that locks are avoided on the flowspec capable device. In our setup celery runs via django. That is why the python-django-celery package was installed. |
190 | 51ce199a | Leonidas Poulopoulos | |
191 | 0bf16f7f | Leonidas Poulopoulos | Create the celeryd daemon at /etc/init.d/celeryd **if it does not already exist**:: |
192 | 0bf16f7f | Leonidas Poulopoulos | |
193 | f8938aca | Leonidas Poulopoulos | vim /etc/init.d/celeryd |
194 | 0bf16f7f | Leonidas Poulopoulos | |
195 | 0bf16f7f | Leonidas Poulopoulos | The configuration should be:: |
196 | 0bf16f7f | Leonidas Poulopoulos | |
197 | f8938aca | Leonidas Poulopoulos | #!/bin/sh -e |
198 | f8938aca | Leonidas Poulopoulos | # ============================================ |
199 | f8938aca | Leonidas Poulopoulos | # celeryd - Starts the Celery worker daemon. |
200 | f8938aca | Leonidas Poulopoulos | # ============================================ |
201 | f8938aca | Leonidas Poulopoulos | # |
202 | f8938aca | Leonidas Poulopoulos | # :Usage: /etc/init.d/celeryd {start|stop|force-reload|restart|try-restart|status} |
203 | f8938aca | Leonidas Poulopoulos | # :Configuration file: /etc/default/celeryd |
204 | f8938aca | Leonidas Poulopoulos | # |
205 | f8938aca | Leonidas Poulopoulos | # See http://docs.celeryq.org/en/latest/cookbook/daemonizing.html#init-script-celeryd |
206 | f8938aca | Leonidas Poulopoulos | |
207 | f8938aca | Leonidas Poulopoulos | |
208 | f8938aca | Leonidas Poulopoulos | ### BEGIN INIT INFO |
209 | f8938aca | Leonidas Poulopoulos | # Provides: celeryd |
210 | f8938aca | Leonidas Poulopoulos | # Required-Start: $network $local_fs $remote_fs |
211 | f8938aca | Leonidas Poulopoulos | # Required-Stop: $network $local_fs $remote_fs |
212 | f8938aca | Leonidas Poulopoulos | # Default-Start: 2 3 4 5 |
213 | f8938aca | Leonidas Poulopoulos | # Default-Stop: 0 1 6 |
214 | f8938aca | Leonidas Poulopoulos | # Short-Description: celery task worker daemon |
215 | f8938aca | Leonidas Poulopoulos | # Description: Starts the Celery worker daemon for a single project. |
216 | f8938aca | Leonidas Poulopoulos | ### END INIT INFO |
217 | f8938aca | Leonidas Poulopoulos | |
218 | f8938aca | Leonidas Poulopoulos | #set -e |
219 | f8938aca | Leonidas Poulopoulos | |
220 | f8938aca | Leonidas Poulopoulos | DEFAULT_PID_FILE="/var/run/celery/%n.pid" |
221 | f8938aca | Leonidas Poulopoulos | DEFAULT_LOG_FILE="/var/log/celery/%n.log" |
222 | f8938aca | Leonidas Poulopoulos | DEFAULT_LOG_LEVEL="INFO" |
223 | f8938aca | Leonidas Poulopoulos | DEFAULT_NODES="celery" |
224 | f8938aca | Leonidas Poulopoulos | DEFAULT_CELERYD="-m celery.bin.celeryd_detach" |
225 | f8938aca | Leonidas Poulopoulos | ENABLED="false" |
226 | f8938aca | Leonidas Poulopoulos | |
227 | f8938aca | Leonidas Poulopoulos | [ -r "$CELERY_DEFAULTS" ] && . "$CELERY_DEFAULTS" |
228 | f8938aca | Leonidas Poulopoulos | |
229 | f8938aca | Leonidas Poulopoulos | [ -r /etc/default/celeryd ] && . /etc/default/celeryd |
230 | f8938aca | Leonidas Poulopoulos | |
231 | f8938aca | Leonidas Poulopoulos | if [ "$ENABLED" != "true" ]; then |
232 | f8938aca | Leonidas Poulopoulos | echo "celery daemon disabled - see /etc/default/celeryd." |
233 | f8938aca | Leonidas Poulopoulos | exit 0 |
234 | f8938aca | Leonidas Poulopoulos | fi |
235 | f8938aca | Leonidas Poulopoulos | |
236 | f8938aca | Leonidas Poulopoulos | |
237 | f8938aca | Leonidas Poulopoulos | CELERYD_PID_FILE=${CELERYD_PID_FILE:-${CELERYD_PIDFILE:-$DEFAULT_PID_FILE}} |
238 | f8938aca | Leonidas Poulopoulos | CELERYD_LOG_FILE=${CELERYD_LOG_FILE:-${CELERYD_LOGFILE:-$DEFAULT_LOG_FILE}} |
239 | f8938aca | Leonidas Poulopoulos | CELERYD_LOG_LEVEL=${CELERYD_LOG_LEVEL:-${CELERYD_LOGLEVEL:-$DEFAULT_LOG_LEVEL}} |
240 | f8938aca | Leonidas Poulopoulos | CELERYD_MULTI=${CELERYD_MULTI:-"celeryd-multi"} |
241 | f8938aca | Leonidas Poulopoulos | CELERYD=${CELERYD:-$DEFAULT_CELERYD} |
242 | f8938aca | Leonidas Poulopoulos | CELERYCTL=${CELERYCTL:="celeryctl"} |
243 | f8938aca | Leonidas Poulopoulos | CELERYD_NODES=${CELERYD_NODES:-$DEFAULT_NODES} |
244 | f8938aca | Leonidas Poulopoulos | |
245 | f8938aca | Leonidas Poulopoulos | export CELERY_LOADER |
246 | f8938aca | Leonidas Poulopoulos | |
247 | f8938aca | Leonidas Poulopoulos | if [ -n "$2" ]; then |
248 | f8938aca | Leonidas Poulopoulos | CELERYD_OPTS="$CELERYD_OPTS $2" |
249 | f8938aca | Leonidas Poulopoulos | fi |
250 | f8938aca | Leonidas Poulopoulos | |
251 | f8938aca | Leonidas Poulopoulos | CELERYD_LOG_DIR=`dirname $CELERYD_LOG_FILE` |
252 | f8938aca | Leonidas Poulopoulos | CELERYD_PID_DIR=`dirname $CELERYD_PID_FILE` |
253 | f8938aca | Leonidas Poulopoulos | if [ ! -d "$CELERYD_LOG_DIR" ]; then |
254 | f8938aca | Leonidas Poulopoulos | mkdir -p $CELERYD_LOG_DIR |
255 | f8938aca | Leonidas Poulopoulos | fi |
256 | f8938aca | Leonidas Poulopoulos | if [ ! -d "$CELERYD_PID_DIR" ]; then |
257 | f8938aca | Leonidas Poulopoulos | mkdir -p $CELERYD_PID_DIR |
258 | f8938aca | Leonidas Poulopoulos | fi |
259 | f8938aca | Leonidas Poulopoulos | |
260 | f8938aca | Leonidas Poulopoulos | # Extra start-stop-daemon options, like user/group. |
261 | f8938aca | Leonidas Poulopoulos | if [ -n "$CELERYD_USER" ]; then |
262 | f8938aca | Leonidas Poulopoulos | DAEMON_OPTS="$DAEMON_OPTS --uid=$CELERYD_USER" |
263 | f8938aca | Leonidas Poulopoulos | chown "$CELERYD_USER" $CELERYD_LOG_DIR $CELERYD_PID_DIR |
264 | f8938aca | Leonidas Poulopoulos | fi |
265 | f8938aca | Leonidas Poulopoulos | if [ -n "$CELERYD_GROUP" ]; then |
266 | f8938aca | Leonidas Poulopoulos | DAEMON_OPTS="$DAEMON_OPTS --gid=$CELERYD_GROUP" |
267 | f8938aca | Leonidas Poulopoulos | chgrp "$CELERYD_GROUP" $CELERYD_LOG_DIR $CELERYD_PID_DIR |
268 | f8938aca | Leonidas Poulopoulos | fi |
269 | f8938aca | Leonidas Poulopoulos | |
270 | f8938aca | Leonidas Poulopoulos | if [ -n "$CELERYD_CHDIR" ]; then |
271 | f8938aca | Leonidas Poulopoulos | DAEMON_OPTS="$DAEMON_OPTS --workdir=\"$CELERYD_CHDIR\"" |
272 | f8938aca | Leonidas Poulopoulos | fi |
273 | f8938aca | Leonidas Poulopoulos | |
274 | f8938aca | Leonidas Poulopoulos | |
275 | f8938aca | Leonidas Poulopoulos | check_dev_null() { |
276 | f8938aca | Leonidas Poulopoulos | if [ ! -c /dev/null ]; then |
277 | f8938aca | Leonidas Poulopoulos | echo "/dev/null is not a character device!" |
278 | f8938aca | Leonidas Poulopoulos | exit 1 |
279 | f8938aca | Leonidas Poulopoulos | fi |
280 | f8938aca | Leonidas Poulopoulos | } |
281 | f8938aca | Leonidas Poulopoulos | |
282 | f8938aca | Leonidas Poulopoulos | |
283 | f8938aca | Leonidas Poulopoulos | export PATH="${PATH:+$PATH:}/usr/sbin:/sbin" |
284 | f8938aca | Leonidas Poulopoulos | |
285 | f8938aca | Leonidas Poulopoulos | |
286 | f8938aca | Leonidas Poulopoulos | stop_workers () { |
287 | f8938aca | Leonidas Poulopoulos | $CELERYD_MULTI stop $CELERYD_NODES --pidfile="$CELERYD_PID_FILE" |
288 | f8938aca | Leonidas Poulopoulos | } |
289 | f8938aca | Leonidas Poulopoulos | |
290 | f8938aca | Leonidas Poulopoulos | |
291 | f8938aca | Leonidas Poulopoulos | start_workers () { |
292 | f8938aca | Leonidas Poulopoulos | $CELERYD_MULTI start $CELERYD_NODES $DAEMON_OPTS \ |
293 | f8938aca | Leonidas Poulopoulos | --pidfile="$CELERYD_PID_FILE" \ |
294 | f8938aca | Leonidas Poulopoulos | --logfile="$CELERYD_LOG_FILE" \ |
295 | f8938aca | Leonidas Poulopoulos | --loglevel="$CELERYD_LOG_LEVEL" \ |
296 | f8938aca | Leonidas Poulopoulos | --cmd="$CELERYD" \ |
297 | f8938aca | Leonidas Poulopoulos | $CELERYD_OPTS |
298 | f8938aca | Leonidas Poulopoulos | } |
299 | f8938aca | Leonidas Poulopoulos | |
300 | f8938aca | Leonidas Poulopoulos | |
301 | f8938aca | Leonidas Poulopoulos | restart_workers () { |
302 | f8938aca | Leonidas Poulopoulos | $CELERYD_MULTI restart $CELERYD_NODES $DAEMON_OPTS \ |
303 | f8938aca | Leonidas Poulopoulos | --pidfile="$CELERYD_PID_FILE" \ |
304 | f8938aca | Leonidas Poulopoulos | --logfile="$CELERYD_LOG_FILE" \ |
305 | f8938aca | Leonidas Poulopoulos | --loglevel="$CELERYD_LOG_LEVEL" \ |
306 | f8938aca | Leonidas Poulopoulos | --cmd="$CELERYD" \ |
307 | f8938aca | Leonidas Poulopoulos | $CELERYD_OPTS |
308 | f8938aca | Leonidas Poulopoulos | } |
309 | f8938aca | Leonidas Poulopoulos | |
310 | f8938aca | Leonidas Poulopoulos | |
311 | f8938aca | Leonidas Poulopoulos | |
312 | f8938aca | Leonidas Poulopoulos | case "$1" in |
313 | f8938aca | Leonidas Poulopoulos | start) |
314 | f8938aca | Leonidas Poulopoulos | check_dev_null |
315 | f8938aca | Leonidas Poulopoulos | start_workers |
316 | f8938aca | Leonidas Poulopoulos | ;; |
317 | f8938aca | Leonidas Poulopoulos | |
318 | f8938aca | Leonidas Poulopoulos | stop) |
319 | f8938aca | Leonidas Poulopoulos | check_dev_null |
320 | f8938aca | Leonidas Poulopoulos | stop_workers |
321 | f8938aca | Leonidas Poulopoulos | ;; |
322 | f8938aca | Leonidas Poulopoulos | |
323 | f8938aca | Leonidas Poulopoulos | reload|force-reload) |
324 | f8938aca | Leonidas Poulopoulos | echo "Use restart" |
325 | f8938aca | Leonidas Poulopoulos | ;; |
326 | f8938aca | Leonidas Poulopoulos | |
327 | f8938aca | Leonidas Poulopoulos | status) |
328 | f8938aca | Leonidas Poulopoulos | $CELERYCTL status $CELERYCTL_OPTS |
329 | f8938aca | Leonidas Poulopoulos | ;; |
330 | f8938aca | Leonidas Poulopoulos | |
331 | f8938aca | Leonidas Poulopoulos | restart) |
332 | f8938aca | Leonidas Poulopoulos | check_dev_null |
333 | f8938aca | Leonidas Poulopoulos | restart_workers |
334 | f8938aca | Leonidas Poulopoulos | ;; |
335 | f8938aca | Leonidas Poulopoulos | |
336 | f8938aca | Leonidas Poulopoulos | try-restart) |
337 | f8938aca | Leonidas Poulopoulos | check_dev_null |
338 | f8938aca | Leonidas Poulopoulos | restart_workers |
339 | f8938aca | Leonidas Poulopoulos | ;; |
340 | f8938aca | Leonidas Poulopoulos | |
341 | f8938aca | Leonidas Poulopoulos | *) |
342 | f8938aca | Leonidas Poulopoulos | echo "Usage: /etc/init.d/celeryd {start|stop|restart|try-restart|kill}" |
343 | f8938aca | Leonidas Poulopoulos | exit 1 |
344 | f8938aca | Leonidas Poulopoulos | ;; |
345 | f8938aca | Leonidas Poulopoulos | esac |
346 | f8938aca | Leonidas Poulopoulos | |
347 | f8938aca | Leonidas Poulopoulos | exit 0 |
348 | 0bf16f7f | Leonidas Poulopoulos | |
349 | 0bf16f7f | Leonidas Poulopoulos | celeryd configuration |
350 | 0bf16f7f | Leonidas Poulopoulos | --------------------- |
351 | 51ce199a | Leonidas Poulopoulos | celeryd requires a /etc/default/celeryd file to be in place. |
352 | 51ce199a | Leonidas Poulopoulos | Thus we are going to create this file (/etc/default/celeryd):: |
353 | 51ce199a | Leonidas Poulopoulos | |
354 | f8938aca | Leonidas Poulopoulos | vim /etc/default/celeryd |
355 | 51ce199a | Leonidas Poulopoulos | |
356 | e7fc07ea | Leonidas Poulopoulos | Again if the directory conventions have been followed the file is (pay attention to the CELERYD_USER, CELERYD_GROUP and change accordingly) :: |
357 | 51ce199a | Leonidas Poulopoulos | |
358 | f8938aca | Leonidas Poulopoulos | # Default: false |
359 | f8938aca | Leonidas Poulopoulos | ENABLED="true" |
360 | f8938aca | Leonidas Poulopoulos | |
361 | f8938aca | Leonidas Poulopoulos | # Name of nodes to start, here we have a single node |
362 | f8938aca | Leonidas Poulopoulos | CELERYD_NODES="w1" |
363 | f8938aca | Leonidas Poulopoulos | # or we could have three nodes: |
364 | f8938aca | Leonidas Poulopoulos | #CELERYD_NODES="w1 w2 w3" |
365 | f8938aca | Leonidas Poulopoulos | |
366 | f8938aca | Leonidas Poulopoulos | # Where to chdir at start. |
367 | f8938aca | Leonidas Poulopoulos | CELERYD_CHDIR="/srv/flowspy" |
368 | f8938aca | Leonidas Poulopoulos | # How to call "manage.py celeryd_multi" |
369 | f8938aca | Leonidas Poulopoulos | CELERYD_MULTI="python $CELERYD_CHDIR/manage.py celeryd_multi" |
370 | f8938aca | Leonidas Poulopoulos | |
371 | f8938aca | Leonidas Poulopoulos | # How to call "manage.py celeryctl" |
372 | f8938aca | Leonidas Poulopoulos | CELERYCTL="python $CELERYD_CHDIR/manage.py celeryctl" |
373 | f8938aca | Leonidas Poulopoulos | |
374 | f8938aca | Leonidas Poulopoulos | # Extra arguments to celeryd |
375 | f8938aca | Leonidas Poulopoulos | #CELERYD_OPTS="--time-limit=300 --concurrency=8" |
376 | ca345a18 | Leonidas Poulopoulos | CELERYD_OPTS="-E -B --schedule=/var/run/celery/celerybeat-schedule --concurrency=1 --soft-time-limit=180 --time-limit=1800" |
377 | f8938aca | Leonidas Poulopoulos | # Name of the celery config module. |
378 | f8938aca | Leonidas Poulopoulos | CELERY_CONFIG_MODULE="celeryconfig" |
379 | f8938aca | Leonidas Poulopoulos | |
380 | f8938aca | Leonidas Poulopoulos | # %n will be replaced with the nodename. |
381 | f8938aca | Leonidas Poulopoulos | CELERYD_LOG_FILE="/var/log/celery/fod_%n.log" |
382 | f8938aca | Leonidas Poulopoulos | CELERYD_PID_FILE="/var/run/celery/%n.pid" |
383 | f8938aca | Leonidas Poulopoulos | |
384 | f8938aca | Leonidas Poulopoulos | # Workers should run as an unprivileged user. |
385 | f8938aca | Leonidas Poulopoulos | CELERYD_USER="celery" |
386 | f8938aca | Leonidas Poulopoulos | CELERYD_GROUP="celery" |
387 | f8938aca | Leonidas Poulopoulos | |
388 | f8938aca | Leonidas Poulopoulos | # Name of the projects settings module. |
389 | f8938aca | Leonidas Poulopoulos | export DJANGO_SETTINGS_MODULE="flowspy.settings" |
390 | 51ce199a | Leonidas Poulopoulos | |
391 | 51ce199a | Leonidas Poulopoulos | Apache |
392 | 51ce199a | Leonidas Poulopoulos | ------ |
393 | 51ce199a | Leonidas Poulopoulos | Apache proxies gunicorn. Things are more flexible here as you may follow your own configuration and conventions. Create and edit /etc/apache2/sites-available/fod. You should set <server_name> and <admin_mail> along with your certificates. If under testing environment, you can use the provided snakeoil certs. If you do not intent to use Shibboleth delete or comment the corresponding configuration parts inside **Shibboleth configuration** :: |
394 | 51ce199a | Leonidas Poulopoulos | |
395 | f8938aca | Leonidas Poulopoulos | vim /etc/apache2/sites-available/fod |
396 | 51ce199a | Leonidas Poulopoulos | |
397 | 51ce199a | Leonidas Poulopoulos | Again if the directory conventions have been followed the file should be:: |
398 | 51ce199a | Leonidas Poulopoulos | |
399 | f8938aca | Leonidas Poulopoulos | <VirtualHost *:80> |
400 | f8938aca | Leonidas Poulopoulos | ServerAdmin webmaster@localhost |
401 | f8938aca | Leonidas Poulopoulos | ServerName fod.example.com |
402 | f8938aca | Leonidas Poulopoulos | DocumentRoot /var/www |
403 | f8938aca | Leonidas Poulopoulos | |
404 | f8938aca | Leonidas Poulopoulos | ErrorLog ${APACHE_LOG_DIR}/fod_error.log |
405 | f8938aca | Leonidas Poulopoulos | |
406 | f8938aca | Leonidas Poulopoulos | # Possible values include: debug, info, notice, warn, error, crit, |
407 | f8938aca | Leonidas Poulopoulos | # alert, emerg. |
408 | f8938aca | Leonidas Poulopoulos | LogLevel debug |
409 | f8938aca | Leonidas Poulopoulos | |
410 | f8938aca | Leonidas Poulopoulos | CustomLog ${APACHE_LOG_DIR}/fod_access.log combined |
411 | f8938aca | Leonidas Poulopoulos | |
412 | f8938aca | Leonidas Poulopoulos | Alias /static /srv/flowspy/static |
413 | f8938aca | Leonidas Poulopoulos | RewriteEngine On |
414 | f8938aca | Leonidas Poulopoulos | RewriteCond %{HTTPS} off |
415 | f8938aca | Leonidas Poulopoulos | RewriteRule ^/(.*) https://fod.example.com/$1 [L,R] |
416 | f8938aca | Leonidas Poulopoulos | </VirtualHost> |
417 | f8938aca | Leonidas Poulopoulos | |
418 | f8938aca | Leonidas Poulopoulos | <VirtualHost *:443> |
419 | f8938aca | Leonidas Poulopoulos | ServerName fod.example.com |
420 | f8938aca | Leonidas Poulopoulos | ServerAdmin webmaster@localhost |
421 | f8938aca | Leonidas Poulopoulos | ServerSignature On |
422 | f8938aca | Leonidas Poulopoulos | |
423 | f8938aca | Leonidas Poulopoulos | SSLEngine on |
424 | f8938aca | Leonidas Poulopoulos | SSLCertificateFile /etc/ssl/certs/fod.example.com.crt |
425 | f8938aca | Leonidas Poulopoulos | SSLCertificateChainFile /etc/ssl/certs/example-chain.pem |
426 | f8938aca | Leonidas Poulopoulos | SSLCertificateKeyFile /etc/ssl/private/fod.example.com.key |
427 | f8938aca | Leonidas Poulopoulos | |
428 | f8938aca | Leonidas Poulopoulos | AddDefaultCharset UTF-8 |
429 | f8938aca | Leonidas Poulopoulos | IndexOptions +Charset=UTF-8 |
430 | f8938aca | Leonidas Poulopoulos | |
431 | f8938aca | Leonidas Poulopoulos | ShibConfig /etc/shibboleth/shibboleth2.xml |
432 | f8938aca | Leonidas Poulopoulos | Alias /shibboleth-sp /usr/share/shibboleth |
433 | f8938aca | Leonidas Poulopoulos | |
434 | f8938aca | Leonidas Poulopoulos | |
435 | f8938aca | Leonidas Poulopoulos | <Location /login> |
436 | f8938aca | Leonidas Poulopoulos | AuthType shibboleth |
437 | f8938aca | Leonidas Poulopoulos | ShibRequireSession On |
438 | f8938aca | Leonidas Poulopoulos | ShibUseHeaders On |
439 | f8938aca | Leonidas Poulopoulos | ShibRequestSetting entityID https://idp.example.com/idp/shibboleth |
440 | f8938aca | Leonidas Poulopoulos | require valid-user |
441 | f8938aca | Leonidas Poulopoulos | </Location> |
442 | f8938aca | Leonidas Poulopoulos | |
443 | f8938aca | Leonidas Poulopoulos | # Shibboleth debugging CGI script |
444 | f8938aca | Leonidas Poulopoulos | ScriptAlias /shibboleth/test /usr/lib/cgi-bin/shibtest.cgi |
445 | f8938aca | Leonidas Poulopoulos | <Location /shibboleth/test> |
446 | f8938aca | Leonidas Poulopoulos | AuthType shibboleth |
447 | f8938aca | Leonidas Poulopoulos | ShibRequireSession On |
448 | f8938aca | Leonidas Poulopoulos | ShibUseHeaders On |
449 | f8938aca | Leonidas Poulopoulos | require valid-user |
450 | f8938aca | Leonidas Poulopoulos | </Location> |
451 | f8938aca | Leonidas Poulopoulos | |
452 | f8938aca | Leonidas Poulopoulos | <Location /Shibboleth.sso> |
453 | f8938aca | Leonidas Poulopoulos | SetHandler shib |
454 | f8938aca | Leonidas Poulopoulos | </Location> |
455 | f8938aca | Leonidas Poulopoulos | |
456 | f8938aca | Leonidas Poulopoulos | # Shibboleth SP configuration |
457 | f8938aca | Leonidas Poulopoulos | |
458 | f8938aca | Leonidas Poulopoulos | #SetEnv proxy-sendchunked |
459 | f8938aca | Leonidas Poulopoulos | |
460 | f8938aca | Leonidas Poulopoulos | <Proxy *> |
461 | f8938aca | Leonidas Poulopoulos | Order allow,deny |
462 | f8938aca | Leonidas Poulopoulos | Allow from all |
463 | f8938aca | Leonidas Poulopoulos | </Proxy> |
464 | f8938aca | Leonidas Poulopoulos | |
465 | f8938aca | Leonidas Poulopoulos | SSLProxyEngine off |
466 | f8938aca | Leonidas Poulopoulos | ProxyErrorOverride off |
467 | f8938aca | Leonidas Poulopoulos | ProxyTimeout 28800 |
468 | f8938aca | Leonidas Poulopoulos | ProxyPass /static ! |
469 | f8938aca | Leonidas Poulopoulos | ProxyPass /shibboleth ! |
470 | f8938aca | Leonidas Poulopoulos | ProxyPass /Shibboleth.sso ! |
471 | f8938aca | Leonidas Poulopoulos | |
472 | f8938aca | Leonidas Poulopoulos | ProxyPass / http://localhost:8081/ retry=0 |
473 | f8938aca | Leonidas Poulopoulos | ProxyPassReverse / http://localhost:8081/ |
474 | f8938aca | Leonidas Poulopoulos | |
475 | f8938aca | Leonidas Poulopoulos | Alias /static /srv/flowspy/static |
476 | f8938aca | Leonidas Poulopoulos | |
477 | f8938aca | Leonidas Poulopoulos | LogLevel warn |
478 | f8938aca | Leonidas Poulopoulos | |
479 | f8938aca | Leonidas Poulopoulos | ErrorLog ${APACHE_LOG_DIR}/fod_error.log |
480 | f8938aca | Leonidas Poulopoulos | CustomLog ${APACHE_LOG_DIR}/fod_access.log combined |
481 | f8938aca | Leonidas Poulopoulos | |
482 | f8938aca | Leonidas Poulopoulos | </VirtualHost> |
483 | 51ce199a | Leonidas Poulopoulos | |
484 | 1e40c2f5 | Leonidas Poulopoulos | Now, enable your site. You might want to disable the default site if fod is the only site you host on your server:: |
485 | 1e40c2f5 | Leonidas Poulopoulos | |
486 | f8938aca | Leonidas Poulopoulos | a2dissite default |
487 | f8938aca | Leonidas Poulopoulos | a2ensite fod |
488 | 1e40c2f5 | Leonidas Poulopoulos | |
489 | 51ce199a | Leonidas Poulopoulos | You are not far away from deploying FoD. When asked for a super user, create one:: |
490 | 51ce199a | Leonidas Poulopoulos | |
491 | f8938aca | Leonidas Poulopoulos | cd /srv/flowspy |
492 | f8938aca | Leonidas Poulopoulos | python manage.py syncdb |
493 | f8938aca | Leonidas Poulopoulos | python manage.py migrate flowspec |
494 | f8938aca | Leonidas Poulopoulos | python manage.py migrate djcelery |
495 | f8938aca | Leonidas Poulopoulos | python manage.py migrate accounts |
496 | f8938aca | Leonidas Poulopoulos | |
497 | f8938aca | Leonidas Poulopoulos | If you have not changed the values of the PEER\_\*\_TABLE variables to False and thus you are going for a default installation (that is PEER\_\*\_TABLE variables are set to True) , then run:: |
498 | f8938aca | Leonidas Poulopoulos | |
499 | f8938aca | Leonidas Poulopoulos | python manage.py migrate peers |
500 | f8938aca | Leonidas Poulopoulos | |
501 | f8938aca | Leonidas Poulopoulos | If however you have set the PEER\_\*\_TABLE variables to False and by accident you have ran the command above, then you have to cleanup you database manually by dropping the peer\* tables plus the techc_email table. For MySQL the command is:: |
502 | f8938aca | Leonidas Poulopoulos | |
503 | f8938aca | Leonidas Poulopoulos | DROP TABLE `peer`, `peer_networks`, `peer_range`, `peer_techc_emails`, techc_email; |
504 | 51ce199a | Leonidas Poulopoulos | |
505 | 51ce199a | Leonidas Poulopoulos | Restart, gunicorn and apache:: |
506 | 51ce199a | Leonidas Poulopoulos | |
507 | f8938aca | Leonidas Poulopoulos | service gunicorn restart && service apache2 restart |
508 | 51ce199a | Leonidas Poulopoulos | |
509 | 0bf16f7f | Leonidas Poulopoulos | |
510 | 0bf16f7f | Leonidas Poulopoulos | Propagate the flatpages |
511 | 0bf16f7f | Leonidas Poulopoulos | ======================= |
512 | 0bf16f7f | Leonidas Poulopoulos | Inside the initial_data/fixtures_manual.xml file we have placed 4 flatpages (2 for Greek, 2 for English) with Information and Terms of Service about the service. |
513 | 0bf16f7f | Leonidas Poulopoulos | To import the flatpages, run from root folder:: |
514 | 0bf16f7f | Leonidas Poulopoulos | |
515 | f8938aca | Leonidas Poulopoulos | python manage.py loaddata initial_data/fixtures_manual.xml |
516 | 0bf16f7f | Leonidas Poulopoulos | |
517 | 0bf16f7f | Leonidas Poulopoulos | |
518 | 0bf16f7f | Leonidas Poulopoulos | |
519 | 51ce199a | Leonidas Poulopoulos | Testing the platform |
520 | 51ce199a | Leonidas Poulopoulos | ==================== |
521 | f8938aca | Leonidas Poulopoulos | Log in to the admin interface via https:\/\/<hostname>\/admin. Go to Peer ranges and add a new range (part of/or a complete subnet), eg. 10.20.0.0/19 |
522 | f8938aca | Leonidas Poulopoulos | Go to Peers and add a new peer, eg. id: 1, name: Test, AS: 16503, tag: TEST and move the network you have created from Avalable to Chosen. From the admin front, go to User, and edit your user. From the bottom of the page, select the TEST peer and save. |
523 | f8938aca | Leonidas Poulopoulos | Last but not least, modify as required the existing (example.com) Site instance (admin home->Sites). You are done. As you are logged-in via the admin, there is no need to go through Shibboleth at this time. Go to https:\/\/<hostname>\/ and create a new rule. Your rule should be applied on the flowspec capable device after aprox. 10 seconds. If no Shibboleth authentication is available, a https:\/\/<hostname>\/altlogin is provided. |
524 | 51ce199a | Leonidas Poulopoulos | |
525 | 51ce199a | Leonidas Poulopoulos | Branding |
526 | 51ce199a | Leonidas Poulopoulos | ======== |
527 | 51ce199a | Leonidas Poulopoulos | Via the admin interface you can modify flatpages to suit your needs |
528 | 51ce199a | Leonidas Poulopoulos | |
529 | 51ce199a | Leonidas Poulopoulos | Footer |
530 | 51ce199a | Leonidas Poulopoulos | ------ |
531 | 51ce199a | Leonidas Poulopoulos | Under the templates folder (templates), you can alter the footer.html file to include your own footer messages, badges, etc. |
532 | 51ce199a | Leonidas Poulopoulos | |
533 | 51ce199a | Leonidas Poulopoulos | Welcome Page |
534 | 51ce199a | Leonidas Poulopoulos | ------------ |
535 | 51ce199a | Leonidas Poulopoulos | Under the templates folder (templates), you can alter the welcome page - welcome.html with your own images, carousel, videos, etc. |