Statistics
| Branch: | Tag: | Revision:

root / doc / source / install.rst @ ca345a18

History | View | Annotate | Download (19 kB)

1 51ce199a Leonidas Poulopoulos
************
2 51ce199a Leonidas Poulopoulos
Installation
3 51ce199a Leonidas Poulopoulos
************
4 51ce199a Leonidas Poulopoulos
5 51ce199a Leonidas Poulopoulos
.. toctree::
6 f8938aca Leonidas Poulopoulos
    :maxdepth: 2
7 51ce199a Leonidas Poulopoulos
8 b7566dcc Leonidas Poulopoulos
Debian Wheezy (x64) - Django 1.4.x
9 51ce199a Leonidas Poulopoulos
==================================
10 51ce199a Leonidas Poulopoulos
This guide assumes that installation is carried out in /srv/flowspy directory. If other directory is to be used, please change the corresponding configuration files. It is also assumed that the root user will perform every action.
11 51ce199a Leonidas Poulopoulos
12 0bf16f7f Leonidas Poulopoulos
Upgrading from v<1.0.x
13 0bf16f7f Leonidas Poulopoulos
----------------------
14 0bf16f7f Leonidas Poulopoulos
If upgrading from flowspy version <1.0.x pay attention to settings.py changes. Also, do not forget to run::
15 f8938aca Leonidas Poulopoulos
    
16 f8938aca Leonidas Poulopoulos
    ./manage.py migrate
17 f8938aca Leonidas Poulopoulos
    
18 0bf16f7f Leonidas Poulopoulos
to catch-up with latest database changes.
19 0bf16f7f Leonidas Poulopoulos
20 51ce199a Leonidas Poulopoulos
Required system packages
21 51ce199a Leonidas Poulopoulos
------------------------
22 51ce199a Leonidas Poulopoulos
Update and install the required packages::
23 51ce199a Leonidas Poulopoulos
24 f8938aca Leonidas Poulopoulos
    apt-get update
25 f8938aca Leonidas Poulopoulos
    apt-get upgrade
26 f8938aca Leonidas Poulopoulos
    apt-get install mysql-server apache2 memcached libapache2-mod-proxy-html gunicorn beanstalkd python-django python-django-south python-django-tinymce tinymce python-mysqldb python-yaml python-memcache python-django-registration python-ipaddr python-lxml mysql-client git python-django-celery python-paramiko python-gevent vim
27 51ce199a Leonidas Poulopoulos
28 51ce199a Leonidas Poulopoulos
.. note::
29 f8938aca Leonidas Poulopoulos
    Set username and password for mysql if used
30 51ce199a Leonidas Poulopoulos
31 51ce199a Leonidas Poulopoulos
.. note::
32 f8938aca Leonidas Poulopoulos
    If you wish to deploy an outgoing mail server, now it is time to do it. Otherwise you could set FoD to send out mails via a third party account
33 51ce199a Leonidas Poulopoulos
34 93f99c86 Leonidas Poulopoulos
Create a database
35 93f99c86 Leonidas Poulopoulos
-----------------
36 93f99c86 Leonidas Poulopoulos
If you are using mysql, you should create a database::
37 93f99c86 Leonidas Poulopoulos
38 f8938aca Leonidas Poulopoulos
    mysql -u root -p -e 'create database fod'
39 93f99c86 Leonidas Poulopoulos
40 51ce199a Leonidas Poulopoulos
Required application packages
41 51ce199a Leonidas Poulopoulos
-----------------------------
42 f8938aca Leonidas Poulopoulos
Get the required packages and their dependencies and install them::
43 f8938aca Leonidas Poulopoulos
44 f8938aca Leonidas Poulopoulos
    apt-get install libxml2-dev libxslt-dev gcc python-dev
45 51ce199a Leonidas Poulopoulos
46 51ce199a Leonidas Poulopoulos
- ncclient: NETCONF python client::
47 51ce199a Leonidas Poulopoulos
48 f8938aca Leonidas Poulopoulos
    cd ~
49 f8938aca Leonidas Poulopoulos
    git clone https://github.com/leopoul/ncclient.git
50 f8938aca Leonidas Poulopoulos
    cd ncclient
51 f8938aca Leonidas Poulopoulos
    python setup.py install
52 51ce199a Leonidas Poulopoulos
53 51ce199a Leonidas Poulopoulos
- nxpy: Python Objects from/to XML proxy::
54 51ce199a Leonidas Poulopoulos
55 f8938aca Leonidas Poulopoulos
    cd ~
56 f8938aca Leonidas Poulopoulos
    git clone https://code.grnet.gr/git/nxpy
57 f8938aca Leonidas Poulopoulos
    cd nxpy
58 f8938aca Leonidas Poulopoulos
    python setup.py install
59 51ce199a Leonidas Poulopoulos
60 51ce199a Leonidas Poulopoulos
- flowspy: core application. Installation is done at /srv/flowspy::
61 51ce199a Leonidas Poulopoulos
62 f8938aca Leonidas Poulopoulos
    cd /srv
63 f8938aca Leonidas Poulopoulos
    git clone https://code.grnet.gr/git/flowspy
64 f8938aca Leonidas Poulopoulos
    cd flowspy
65 51ce199a Leonidas Poulopoulos
66 51ce199a Leonidas Poulopoulos
Application configuration
67 51ce199a Leonidas Poulopoulos
=========================
68 51ce199a Leonidas Poulopoulos
Copy settings.py.dist to settings.py::
69 f8938aca Leonidas Poulopoulos
    
70 f8938aca Leonidas Poulopoulos
    cd flowspy
71 f8938aca Leonidas Poulopoulos
    cp settings.py.dist settings.py
72 51ce199a Leonidas Poulopoulos
73 51ce199a Leonidas Poulopoulos
Edit settings.py file and set the following according to your configuration::
74 51ce199a Leonidas Poulopoulos
75 f8938aca Leonidas Poulopoulos
    ADMINS: set your admin name and email (assuming that your server can send notifications)
76 f8938aca Leonidas Poulopoulos
    DATABASES (to point to your local database). You could use views instead of tables for models: peer, peercontacts, peernetworks. For this to work we suggest MySQL with MyISAM db engine
77 f8938aca Leonidas Poulopoulos
    SECRET_KEY : Make this unique, and don't share it with anybody
78 f8938aca Leonidas Poulopoulos
    STATIC_ROOT: /srv/flowspy/static (or your installation directory)
79 f8938aca Leonidas Poulopoulos
    STATIC_URL (static media directory) . If you have followed the above this should be: /srv/flowspy/static
80 f8938aca Leonidas Poulopoulos
    TEMPLATE_DIRS : If you have followed the above this should be: /srv/flowspy/templates
81 f8938aca Leonidas Poulopoulos
    CACHE_BACKEND:  Enable Memcached for production or leave to DummyCache for development environments
82 f8938aca Leonidas Poulopoulos
    Alternatively you could go for redis with the corresponding Django client lib.
83 f8938aca Leonidas Poulopoulos
    NETCONF_DEVICE (tested with Juniper EX4200 but any BGP enabled Juniper should work). This is the flowspec capable device
84 f8938aca Leonidas Poulopoulos
    NETCONF_USER (enable ssh and netconf on device)
85 f8938aca Leonidas Poulopoulos
    NETCONF_PASS
86 f8938aca Leonidas Poulopoulos
    If beanstalk is selected the following should be left intact.
87 f8938aca Leonidas Poulopoulos
    BROKER_HOST (beanstalk host)
88 f8938aca Leonidas Poulopoulos
    BROKER_PORT (beanstalk port)
89 f8938aca Leonidas Poulopoulos
    SERVER_EMAIL
90 f8938aca Leonidas Poulopoulos
    EMAIL_SUBJECT_PREFIX
91 f8938aca Leonidas Poulopoulos
    If beanstalk is selected the following should be left intact.
92 f8938aca Leonidas Poulopoulos
    BROKER_URL (beanstalk url)
93 f8938aca Leonidas Poulopoulos
    SHIB_AUTH_ENTITLEMENT (if you go for Shibboleth authentication)
94 f8938aca Leonidas Poulopoulos
    NOTIFY_ADMIN_MAILS (bcc mail addresses)
95 f8938aca Leonidas Poulopoulos
    PROTECTED_SUBNETS (subnets for which source or destination address will prevent rule creation and notify the NOTIFY_ADMIN_MAILS)
96 f8938aca Leonidas Poulopoulos
    The whois client is meant to be used in case you have inserted peers with their ASes in the peers table and wish to get network info for each one in an automated manner.
97 f8938aca Leonidas Poulopoulos
    PRIMARY_WHOIS
98 f8938aca Leonidas Poulopoulos
    ALTERNATE_WHOIS
99 f8938aca Leonidas Poulopoulos
    If you wish to deploy FoD with Shibboleth change the following attributes according to your setup:
100 f8938aca Leonidas Poulopoulos
    SHIB_AUTH_ENTITLEMENT = 'urn:mace'
101 f8938aca Leonidas Poulopoulos
    SHIB_ADMIN_DOMAIN = 'example.com'
102 f8938aca Leonidas Poulopoulos
    SHIB_LOGOUT_URL = 'https://example.com/Shibboleth.sso/Logout'
103 f8938aca Leonidas Poulopoulos
    SHIB_USERNAME = ['HTTP_EPPN']
104 f8938aca Leonidas Poulopoulos
    SHIB_MAIL = ['mail', 'HTTP_MAIL', 'HTTP_SHIB_INETORGPERSON_MAIL']
105 f8938aca Leonidas Poulopoulos
    SHIB_FIRSTNAME = ['HTTP_SHIB_INETORGPERSON_GIVENNAME']
106 f8938aca Leonidas Poulopoulos
    SHIB_LASTNAME = ['HTTP_SHIB_PERSON_SURNAME']
107 f8938aca Leonidas Poulopoulos
    SHIB_ENTITLEMENT = ['HTTP_SHIB_EP_ENTITLEMENT']
108 51ce199a Leonidas Poulopoulos
109 51ce199a Leonidas Poulopoulos
If you have not installed an outgoing mail server you can always use your own account (either corporate or gmail, hotmail ,etc) by adding the following lines in settings.py::
110 51ce199a Leonidas Poulopoulos
111 f8938aca Leonidas Poulopoulos
    EMAIL_USE_TLS = True #(or False)
112 f8938aca Leonidas Poulopoulos
    EMAIL_HOST = 'smtp.example.com'
113 f8938aca Leonidas Poulopoulos
    EMAIL_HOST_USER = 'username'
114 f8938aca Leonidas Poulopoulos
    EMAIL_HOST_PASSWORD = 'yourpassword'
115 f8938aca Leonidas Poulopoulos
    EMAIL_PORT = 587 #(outgoing)
116 f8938aca Leonidas Poulopoulos
117 f8938aca Leonidas Poulopoulos
It is strongly advised that you do not change the following to False values unless, you want to integrate FoD with you CRM or members database. This implies that you are able/have the rights to create database views between the two databases::
118 51ce199a Leonidas Poulopoulos
119 f8938aca Leonidas Poulopoulos
    PEER_MANAGED_TABLE = True
120 f8938aca Leonidas Poulopoulos
    PEER_RANGE_MANAGED_TABLE = True
121 f8938aca Leonidas Poulopoulos
    PEER_TECHC_MANAGED_TABLE = True   
122 f8938aca Leonidas Poulopoulos
123 f8938aca Leonidas Poulopoulos
By doing that the corresponding tables as defined in peers/models will not be created. As noted above, you have to create the views that the tables will rely on. 
124 51ce199a Leonidas Poulopoulos
125 51ce199a Leonidas Poulopoulos
.. note::
126 f8938aca Leonidas Poulopoulos
    Soon we will release a version with django-registration as a means to add users and Shibboleth will become an alternative
127 51ce199a Leonidas Poulopoulos
128 51ce199a Leonidas Poulopoulos
Let's move on with some copies and dir creations::
129 51ce199a Leonidas Poulopoulos
130 f8938aca Leonidas Poulopoulos
    mkdir /var/log/fod
131 f8938aca Leonidas Poulopoulos
    chown www-data.www-data /var/log/fod
132 f8938aca Leonidas Poulopoulos
    cp urls.py.dist urls.py
133 f8938aca Leonidas Poulopoulos
    cd ..
134 51ce199a Leonidas Poulopoulos
135 51ce199a Leonidas Poulopoulos
System configuration
136 51ce199a Leonidas Poulopoulos
====================
137 51ce199a Leonidas Poulopoulos
Apache operates as a gunicorn Proxy with WSGI and Shibboleth modules enabled.
138 51ce199a Leonidas Poulopoulos
Depending on the setup the apache configuration may vary::
139 51ce199a Leonidas Poulopoulos
140 f8938aca Leonidas Poulopoulos
    a2enmod rewrite
141 f8938aca Leonidas Poulopoulos
    a2enmod proxy
142 f8938aca Leonidas Poulopoulos
    a2enmod ssl
143 f8938aca Leonidas Poulopoulos
    a2enmod proxy_http
144 51ce199a Leonidas Poulopoulos
145 51ce199a Leonidas Poulopoulos
If shibboleth is to be used::
146 51ce199a Leonidas Poulopoulos
147 f8938aca Leonidas Poulopoulos
    apt-get install libapache2-mod-shib2
148 f8938aca Leonidas Poulopoulos
    a2enmod shib2
149 51ce199a Leonidas Poulopoulos
150 51ce199a Leonidas Poulopoulos
Now it is time to configure beanstalk, gunicorn, celery and apache.
151 51ce199a Leonidas Poulopoulos
152 51ce199a Leonidas Poulopoulos
beanstalkd
153 51ce199a Leonidas Poulopoulos
----------
154 51ce199a Leonidas Poulopoulos
Enable beanstalk by editting /etc/default/beanstalkd::
155 51ce199a Leonidas Poulopoulos
156 f8938aca Leonidas Poulopoulos
    vim /etc/default/beanstalkd
157 51ce199a Leonidas Poulopoulos
158 51ce199a Leonidas Poulopoulos
Uncomment the line **START=yes** to enable beanstalk
159 51ce199a Leonidas Poulopoulos
160 51ce199a Leonidas Poulopoulos
Start beanstalkd::
161 51ce199a Leonidas Poulopoulos
162 f8938aca Leonidas Poulopoulos
    service beanstalkd start
163 51ce199a Leonidas Poulopoulos
164 51ce199a Leonidas Poulopoulos
gunicorn.d
165 51ce199a Leonidas Poulopoulos
----------
166 0bf16f7f Leonidas Poulopoulos
Create and edit /etc/gunicorn.d/fod::
167 51ce199a Leonidas Poulopoulos
168 f8938aca Leonidas Poulopoulos
    vim /etc/gunicorn.d/fod
169 51ce199a Leonidas Poulopoulos
170 51ce199a Leonidas Poulopoulos
FoD is served via gunicorn and is then proxied by Apache. If the above directory conventions have been followed so far, then your configuration should be::
171 51ce199a Leonidas Poulopoulos
172 f8938aca Leonidas Poulopoulos
    CONFIG = {
173 f8938aca Leonidas Poulopoulos
          'mode': 'django',
174 f8938aca Leonidas Poulopoulos
          'working_dir': '/srv/flowspy',
175 f8938aca Leonidas Poulopoulos
          'args': (
176 f8938aca Leonidas Poulopoulos
               '--bind=127.0.0.1:8081',
177 f8938aca Leonidas Poulopoulos
               '--workers=1',
178 f8938aca Leonidas Poulopoulos
               '--worker-class=egg:gunicorn#gevent',
179 f8938aca Leonidas Poulopoulos
               '--timeout=30',
180 ca345a18 Leonidas Poulopoulos
               '--debug',
181 f8938aca Leonidas Poulopoulos
               '--log-level=debug',
182 f8938aca Leonidas Poulopoulos
               '--log-file=/var/log/gunicorn/fod.log',
183 f8938aca Leonidas Poulopoulos
          ),
184 f8938aca Leonidas Poulopoulos
    }
185 b7566dcc Leonidas Poulopoulos
186 51ce199a Leonidas Poulopoulos
187 0bf16f7f Leonidas Poulopoulos
celeryd
188 0bf16f7f Leonidas Poulopoulos
-------
189 51ce199a Leonidas Poulopoulos
Celery is used over beanstalkd to apply firewall rules in a serial manner so that locks are avoided on the flowspec capable device. In our setup celery runs via django. That is why the python-django-celery package was installed.
190 51ce199a Leonidas Poulopoulos
191 0bf16f7f Leonidas Poulopoulos
Create the celeryd daemon at /etc/init.d/celeryd **if it does not already exist**::
192 0bf16f7f Leonidas Poulopoulos
193 f8938aca Leonidas Poulopoulos
    vim /etc/init.d/celeryd
194 0bf16f7f Leonidas Poulopoulos
195 0bf16f7f Leonidas Poulopoulos
The configuration should be::
196 0bf16f7f Leonidas Poulopoulos
197 f8938aca Leonidas Poulopoulos
    #!/bin/sh -e
198 f8938aca Leonidas Poulopoulos
    # ============================================
199 f8938aca Leonidas Poulopoulos
    #  celeryd - Starts the Celery worker daemon.
200 f8938aca Leonidas Poulopoulos
    # ============================================
201 f8938aca Leonidas Poulopoulos
    #
202 f8938aca Leonidas Poulopoulos
    # :Usage: /etc/init.d/celeryd {start|stop|force-reload|restart|try-restart|status}
203 f8938aca Leonidas Poulopoulos
    # :Configuration file: /etc/default/celeryd
204 f8938aca Leonidas Poulopoulos
    #
205 f8938aca Leonidas Poulopoulos
    # See http://docs.celeryq.org/en/latest/cookbook/daemonizing.html#init-script-celeryd
206 f8938aca Leonidas Poulopoulos
    
207 f8938aca Leonidas Poulopoulos
    
208 f8938aca Leonidas Poulopoulos
    ### BEGIN INIT INFO
209 f8938aca Leonidas Poulopoulos
    # Provides:              celeryd
210 f8938aca Leonidas Poulopoulos
    # Required-Start:     $network $local_fs $remote_fs
211 f8938aca Leonidas Poulopoulos
    # Required-Stop:       $network $local_fs $remote_fs
212 f8938aca Leonidas Poulopoulos
    # Default-Start:       2 3 4 5
213 f8938aca Leonidas Poulopoulos
    # Default-Stop:        0 1 6
214 f8938aca Leonidas Poulopoulos
    # Short-Description: celery task worker daemon
215 f8938aca Leonidas Poulopoulos
    # Description:          Starts the Celery worker daemon for a single project.
216 f8938aca Leonidas Poulopoulos
    ### END INIT INFO
217 f8938aca Leonidas Poulopoulos
    
218 f8938aca Leonidas Poulopoulos
    #set -e
219 f8938aca Leonidas Poulopoulos
    
220 f8938aca Leonidas Poulopoulos
    DEFAULT_PID_FILE="/var/run/celery/%n.pid"
221 f8938aca Leonidas Poulopoulos
    DEFAULT_LOG_FILE="/var/log/celery/%n.log"
222 f8938aca Leonidas Poulopoulos
    DEFAULT_LOG_LEVEL="INFO"
223 f8938aca Leonidas Poulopoulos
    DEFAULT_NODES="celery"
224 f8938aca Leonidas Poulopoulos
    DEFAULT_CELERYD="-m celery.bin.celeryd_detach"
225 f8938aca Leonidas Poulopoulos
    ENABLED="false"
226 f8938aca Leonidas Poulopoulos
    
227 f8938aca Leonidas Poulopoulos
    [ -r "$CELERY_DEFAULTS" ] && . "$CELERY_DEFAULTS"
228 f8938aca Leonidas Poulopoulos
    
229 f8938aca Leonidas Poulopoulos
    [ -r /etc/default/celeryd ] && . /etc/default/celeryd
230 f8938aca Leonidas Poulopoulos
    
231 f8938aca Leonidas Poulopoulos
    if [ "$ENABLED" != "true" ]; then
232 f8938aca Leonidas Poulopoulos
          echo "celery daemon disabled - see /etc/default/celeryd."
233 f8938aca Leonidas Poulopoulos
          exit 0
234 f8938aca Leonidas Poulopoulos
    fi
235 f8938aca Leonidas Poulopoulos
    
236 f8938aca Leonidas Poulopoulos
    
237 f8938aca Leonidas Poulopoulos
    CELERYD_PID_FILE=${CELERYD_PID_FILE:-${CELERYD_PIDFILE:-$DEFAULT_PID_FILE}}
238 f8938aca Leonidas Poulopoulos
    CELERYD_LOG_FILE=${CELERYD_LOG_FILE:-${CELERYD_LOGFILE:-$DEFAULT_LOG_FILE}}
239 f8938aca Leonidas Poulopoulos
    CELERYD_LOG_LEVEL=${CELERYD_LOG_LEVEL:-${CELERYD_LOGLEVEL:-$DEFAULT_LOG_LEVEL}}
240 f8938aca Leonidas Poulopoulos
    CELERYD_MULTI=${CELERYD_MULTI:-"celeryd-multi"}
241 f8938aca Leonidas Poulopoulos
    CELERYD=${CELERYD:-$DEFAULT_CELERYD}
242 f8938aca Leonidas Poulopoulos
    CELERYCTL=${CELERYCTL:="celeryctl"}
243 f8938aca Leonidas Poulopoulos
    CELERYD_NODES=${CELERYD_NODES:-$DEFAULT_NODES}
244 f8938aca Leonidas Poulopoulos
    
245 f8938aca Leonidas Poulopoulos
    export CELERY_LOADER
246 f8938aca Leonidas Poulopoulos
    
247 f8938aca Leonidas Poulopoulos
    if [ -n "$2" ]; then
248 f8938aca Leonidas Poulopoulos
          CELERYD_OPTS="$CELERYD_OPTS $2"
249 f8938aca Leonidas Poulopoulos
    fi
250 f8938aca Leonidas Poulopoulos
    
251 f8938aca Leonidas Poulopoulos
    CELERYD_LOG_DIR=`dirname $CELERYD_LOG_FILE`
252 f8938aca Leonidas Poulopoulos
    CELERYD_PID_DIR=`dirname $CELERYD_PID_FILE`
253 f8938aca Leonidas Poulopoulos
    if [ ! -d "$CELERYD_LOG_DIR" ]; then
254 f8938aca Leonidas Poulopoulos
          mkdir -p $CELERYD_LOG_DIR
255 f8938aca Leonidas Poulopoulos
    fi
256 f8938aca Leonidas Poulopoulos
    if [ ! -d "$CELERYD_PID_DIR" ]; then
257 f8938aca Leonidas Poulopoulos
          mkdir -p $CELERYD_PID_DIR
258 f8938aca Leonidas Poulopoulos
    fi
259 f8938aca Leonidas Poulopoulos
    
260 f8938aca Leonidas Poulopoulos
    # Extra start-stop-daemon options, like user/group.
261 f8938aca Leonidas Poulopoulos
    if [ -n "$CELERYD_USER" ]; then
262 f8938aca Leonidas Poulopoulos
          DAEMON_OPTS="$DAEMON_OPTS --uid=$CELERYD_USER"
263 f8938aca Leonidas Poulopoulos
          chown "$CELERYD_USER" $CELERYD_LOG_DIR $CELERYD_PID_DIR
264 f8938aca Leonidas Poulopoulos
    fi
265 f8938aca Leonidas Poulopoulos
    if [ -n "$CELERYD_GROUP" ]; then
266 f8938aca Leonidas Poulopoulos
          DAEMON_OPTS="$DAEMON_OPTS --gid=$CELERYD_GROUP"
267 f8938aca Leonidas Poulopoulos
          chgrp "$CELERYD_GROUP" $CELERYD_LOG_DIR $CELERYD_PID_DIR
268 f8938aca Leonidas Poulopoulos
    fi
269 f8938aca Leonidas Poulopoulos
    
270 f8938aca Leonidas Poulopoulos
    if [ -n "$CELERYD_CHDIR" ]; then
271 f8938aca Leonidas Poulopoulos
          DAEMON_OPTS="$DAEMON_OPTS --workdir=\"$CELERYD_CHDIR\""
272 f8938aca Leonidas Poulopoulos
    fi
273 f8938aca Leonidas Poulopoulos
    
274 f8938aca Leonidas Poulopoulos
    
275 f8938aca Leonidas Poulopoulos
    check_dev_null() {
276 f8938aca Leonidas Poulopoulos
          if [ ! -c /dev/null ]; then
277 f8938aca Leonidas Poulopoulos
               echo "/dev/null is not a character device!"
278 f8938aca Leonidas Poulopoulos
               exit 1
279 f8938aca Leonidas Poulopoulos
          fi
280 f8938aca Leonidas Poulopoulos
    }
281 f8938aca Leonidas Poulopoulos
    
282 f8938aca Leonidas Poulopoulos
    
283 f8938aca Leonidas Poulopoulos
    export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"
284 f8938aca Leonidas Poulopoulos
    
285 f8938aca Leonidas Poulopoulos
    
286 f8938aca Leonidas Poulopoulos
    stop_workers () {
287 f8938aca Leonidas Poulopoulos
          $CELERYD_MULTI stop $CELERYD_NODES --pidfile="$CELERYD_PID_FILE"
288 f8938aca Leonidas Poulopoulos
    }
289 f8938aca Leonidas Poulopoulos
    
290 f8938aca Leonidas Poulopoulos
    
291 f8938aca Leonidas Poulopoulos
    start_workers () {
292 f8938aca Leonidas Poulopoulos
          $CELERYD_MULTI start $CELERYD_NODES $DAEMON_OPTS           \
293 f8938aca Leonidas Poulopoulos
                                        --pidfile="$CELERYD_PID_FILE"        \
294 f8938aca Leonidas Poulopoulos
                                        --logfile="$CELERYD_LOG_FILE"        \
295 f8938aca Leonidas Poulopoulos
                                        --loglevel="$CELERYD_LOG_LEVEL"     \
296 f8938aca Leonidas Poulopoulos
                                        --cmd="$CELERYD"                           \
297 f8938aca Leonidas Poulopoulos
                                        $CELERYD_OPTS
298 f8938aca Leonidas Poulopoulos
    }
299 f8938aca Leonidas Poulopoulos
    
300 f8938aca Leonidas Poulopoulos
    
301 f8938aca Leonidas Poulopoulos
    restart_workers () {
302 f8938aca Leonidas Poulopoulos
          $CELERYD_MULTI restart $CELERYD_NODES $DAEMON_OPTS        \
303 f8938aca Leonidas Poulopoulos
                                           --pidfile="$CELERYD_PID_FILE"     \
304 f8938aca Leonidas Poulopoulos
                                           --logfile="$CELERYD_LOG_FILE"     \
305 f8938aca Leonidas Poulopoulos
                                           --loglevel="$CELERYD_LOG_LEVEL"  \
306 f8938aca Leonidas Poulopoulos
                                           --cmd="$CELERYD"                        \
307 f8938aca Leonidas Poulopoulos
                                           $CELERYD_OPTS
308 f8938aca Leonidas Poulopoulos
    }
309 f8938aca Leonidas Poulopoulos
    
310 f8938aca Leonidas Poulopoulos
    
311 f8938aca Leonidas Poulopoulos
    
312 f8938aca Leonidas Poulopoulos
    case "$1" in
313 f8938aca Leonidas Poulopoulos
          start)
314 f8938aca Leonidas Poulopoulos
               check_dev_null
315 f8938aca Leonidas Poulopoulos
               start_workers
316 f8938aca Leonidas Poulopoulos
          ;;
317 f8938aca Leonidas Poulopoulos
    
318 f8938aca Leonidas Poulopoulos
          stop)
319 f8938aca Leonidas Poulopoulos
               check_dev_null
320 f8938aca Leonidas Poulopoulos
               stop_workers
321 f8938aca Leonidas Poulopoulos
          ;;
322 f8938aca Leonidas Poulopoulos
    
323 f8938aca Leonidas Poulopoulos
          reload|force-reload)
324 f8938aca Leonidas Poulopoulos
               echo "Use restart"
325 f8938aca Leonidas Poulopoulos
          ;;
326 f8938aca Leonidas Poulopoulos
    
327 f8938aca Leonidas Poulopoulos
          status)
328 f8938aca Leonidas Poulopoulos
               $CELERYCTL status $CELERYCTL_OPTS
329 f8938aca Leonidas Poulopoulos
          ;;
330 f8938aca Leonidas Poulopoulos
    
331 f8938aca Leonidas Poulopoulos
          restart)
332 f8938aca Leonidas Poulopoulos
               check_dev_null
333 f8938aca Leonidas Poulopoulos
               restart_workers
334 f8938aca Leonidas Poulopoulos
          ;;
335 f8938aca Leonidas Poulopoulos
    
336 f8938aca Leonidas Poulopoulos
          try-restart)
337 f8938aca Leonidas Poulopoulos
               check_dev_null
338 f8938aca Leonidas Poulopoulos
               restart_workers
339 f8938aca Leonidas Poulopoulos
          ;;
340 f8938aca Leonidas Poulopoulos
    
341 f8938aca Leonidas Poulopoulos
          *)
342 f8938aca Leonidas Poulopoulos
               echo "Usage: /etc/init.d/celeryd {start|stop|restart|try-restart|kill}"
343 f8938aca Leonidas Poulopoulos
               exit 1
344 f8938aca Leonidas Poulopoulos
          ;;
345 f8938aca Leonidas Poulopoulos
    esac
346 f8938aca Leonidas Poulopoulos
    
347 f8938aca Leonidas Poulopoulos
    exit 0
348 0bf16f7f Leonidas Poulopoulos
349 0bf16f7f Leonidas Poulopoulos
celeryd configuration
350 0bf16f7f Leonidas Poulopoulos
---------------------
351 51ce199a Leonidas Poulopoulos
celeryd requires a /etc/default/celeryd file to be in place.
352 51ce199a Leonidas Poulopoulos
Thus we are going to create this file (/etc/default/celeryd)::
353 51ce199a Leonidas Poulopoulos
354 f8938aca Leonidas Poulopoulos
    vim /etc/default/celeryd
355 51ce199a Leonidas Poulopoulos
356 e7fc07ea Leonidas Poulopoulos
Again if the directory conventions have been followed the file is (pay attention to the CELERYD_USER, CELERYD_GROUP and change accordingly)  ::
357 51ce199a Leonidas Poulopoulos
358 f8938aca Leonidas Poulopoulos
    # Default: false
359 f8938aca Leonidas Poulopoulos
    ENABLED="true"
360 f8938aca Leonidas Poulopoulos
    
361 f8938aca Leonidas Poulopoulos
    # Name of nodes to start, here we have a single node
362 f8938aca Leonidas Poulopoulos
    CELERYD_NODES="w1"
363 f8938aca Leonidas Poulopoulos
    # or we could have three nodes:
364 f8938aca Leonidas Poulopoulos
    #CELERYD_NODES="w1 w2 w3"
365 f8938aca Leonidas Poulopoulos
    
366 f8938aca Leonidas Poulopoulos
    # Where to chdir at start.
367 f8938aca Leonidas Poulopoulos
    CELERYD_CHDIR="/srv/flowspy"
368 f8938aca Leonidas Poulopoulos
    # How to call "manage.py celeryd_multi"
369 f8938aca Leonidas Poulopoulos
    CELERYD_MULTI="python $CELERYD_CHDIR/manage.py celeryd_multi"
370 f8938aca Leonidas Poulopoulos
    
371 f8938aca Leonidas Poulopoulos
    # How to call "manage.py celeryctl"
372 f8938aca Leonidas Poulopoulos
    CELERYCTL="python $CELERYD_CHDIR/manage.py celeryctl"
373 f8938aca Leonidas Poulopoulos
    
374 f8938aca Leonidas Poulopoulos
    # Extra arguments to celeryd
375 f8938aca Leonidas Poulopoulos
    #CELERYD_OPTS="--time-limit=300 --concurrency=8"
376 ca345a18 Leonidas Poulopoulos
    CELERYD_OPTS="-E -B --schedule=/var/run/celery/celerybeat-schedule --concurrency=1 --soft-time-limit=180 --time-limit=1800"
377 f8938aca Leonidas Poulopoulos
    # Name of the celery config module.
378 f8938aca Leonidas Poulopoulos
    CELERY_CONFIG_MODULE="celeryconfig"
379 f8938aca Leonidas Poulopoulos
    
380 f8938aca Leonidas Poulopoulos
    # %n will be replaced with the nodename.
381 f8938aca Leonidas Poulopoulos
    CELERYD_LOG_FILE="/var/log/celery/fod_%n.log"
382 f8938aca Leonidas Poulopoulos
    CELERYD_PID_FILE="/var/run/celery/%n.pid"
383 f8938aca Leonidas Poulopoulos
    
384 f8938aca Leonidas Poulopoulos
    # Workers should run as an unprivileged user.
385 f8938aca Leonidas Poulopoulos
    CELERYD_USER="celery"
386 f8938aca Leonidas Poulopoulos
    CELERYD_GROUP="celery"
387 f8938aca Leonidas Poulopoulos
    
388 f8938aca Leonidas Poulopoulos
    # Name of the projects settings module.
389 f8938aca Leonidas Poulopoulos
    export DJANGO_SETTINGS_MODULE="flowspy.settings"
390 51ce199a Leonidas Poulopoulos
391 51ce199a Leonidas Poulopoulos
Apache
392 51ce199a Leonidas Poulopoulos
------
393 51ce199a Leonidas Poulopoulos
Apache proxies gunicorn. Things are more flexible here as you may follow your own configuration and conventions. Create and edit /etc/apache2/sites-available/fod. You should set <server_name> and <admin_mail> along with your certificates. If under testing environment, you can use the provided snakeoil certs. If you do not intent to use Shibboleth delete or comment the corresponding configuration parts inside **Shibboleth configuration** ::
394 51ce199a Leonidas Poulopoulos
395 f8938aca Leonidas Poulopoulos
    vim /etc/apache2/sites-available/fod
396 51ce199a Leonidas Poulopoulos
397 51ce199a Leonidas Poulopoulos
Again if the directory conventions have been followed the file should be::
398 51ce199a Leonidas Poulopoulos
399 f8938aca Leonidas Poulopoulos
    <VirtualHost *:80>
400 f8938aca Leonidas Poulopoulos
        ServerAdmin webmaster@localhost
401 f8938aca Leonidas Poulopoulos
        ServerName  fod.example.com
402 f8938aca Leonidas Poulopoulos
        DocumentRoot /var/www
403 f8938aca Leonidas Poulopoulos
    
404 f8938aca Leonidas Poulopoulos
        ErrorLog ${APACHE_LOG_DIR}/fod_error.log
405 f8938aca Leonidas Poulopoulos
    
406 f8938aca Leonidas Poulopoulos
        # Possible values include: debug, info, notice, warn, error, crit,
407 f8938aca Leonidas Poulopoulos
        # alert, emerg.
408 f8938aca Leonidas Poulopoulos
        LogLevel debug
409 f8938aca Leonidas Poulopoulos
        
410 f8938aca Leonidas Poulopoulos
        CustomLog ${APACHE_LOG_DIR}/fod_access.log combined
411 f8938aca Leonidas Poulopoulos
    
412 f8938aca Leonidas Poulopoulos
        Alias /static       /srv/flowspy/static
413 f8938aca Leonidas Poulopoulos
          RewriteEngine On
414 f8938aca Leonidas Poulopoulos
          RewriteCond %{HTTPS} off
415 f8938aca Leonidas Poulopoulos
          RewriteRule ^/(.*) https://fod.example.com/$1 [L,R]
416 f8938aca Leonidas Poulopoulos
    </VirtualHost>
417 f8938aca Leonidas Poulopoulos
    
418 f8938aca Leonidas Poulopoulos
    <VirtualHost *:443>
419 f8938aca Leonidas Poulopoulos
        ServerName    fod.example.com
420 f8938aca Leonidas Poulopoulos
        ServerAdmin     webmaster@localhost
421 f8938aca Leonidas Poulopoulos
        ServerSignature        On
422 f8938aca Leonidas Poulopoulos
        
423 f8938aca Leonidas Poulopoulos
        SSLEngine on
424 f8938aca Leonidas Poulopoulos
        SSLCertificateFile    /etc/ssl/certs/fod.example.com.crt
425 f8938aca Leonidas Poulopoulos
        SSLCertificateChainFile /etc/ssl/certs/example-chain.pem
426 f8938aca Leonidas Poulopoulos
        SSLCertificateKeyFile    /etc/ssl/private/fod.example.com.key
427 f8938aca Leonidas Poulopoulos
    
428 f8938aca Leonidas Poulopoulos
        AddDefaultCharset UTF-8
429 f8938aca Leonidas Poulopoulos
        IndexOptions        +Charset=UTF-8
430 f8938aca Leonidas Poulopoulos
    
431 f8938aca Leonidas Poulopoulos
        ShibConfig       /etc/shibboleth/shibboleth2.xml
432 f8938aca Leonidas Poulopoulos
        Alias          /shibboleth-sp /usr/share/shibboleth
433 f8938aca Leonidas Poulopoulos
    
434 f8938aca Leonidas Poulopoulos
    
435 f8938aca Leonidas Poulopoulos
        <Location /login>
436 f8938aca Leonidas Poulopoulos
             AuthType shibboleth
437 f8938aca Leonidas Poulopoulos
             ShibRequireSession On
438 f8938aca Leonidas Poulopoulos
             ShibUseHeaders On
439 f8938aca Leonidas Poulopoulos
             ShibRequestSetting entityID https://idp.example.com/idp/shibboleth
440 f8938aca Leonidas Poulopoulos
             require valid-user
441 f8938aca Leonidas Poulopoulos
        </Location>
442 f8938aca Leonidas Poulopoulos
        
443 f8938aca Leonidas Poulopoulos
        # Shibboleth debugging CGI script
444 f8938aca Leonidas Poulopoulos
        ScriptAlias /shibboleth/test /usr/lib/cgi-bin/shibtest.cgi
445 f8938aca Leonidas Poulopoulos
        <Location /shibboleth/test>
446 f8938aca Leonidas Poulopoulos
             AuthType shibboleth
447 f8938aca Leonidas Poulopoulos
             ShibRequireSession On
448 f8938aca Leonidas Poulopoulos
             ShibUseHeaders On
449 f8938aca Leonidas Poulopoulos
             require valid-user
450 f8938aca Leonidas Poulopoulos
        </Location>
451 f8938aca Leonidas Poulopoulos
    
452 f8938aca Leonidas Poulopoulos
        <Location /Shibboleth.sso>
453 f8938aca Leonidas Poulopoulos
             SetHandler shib
454 f8938aca Leonidas Poulopoulos
        </Location>
455 f8938aca Leonidas Poulopoulos
    
456 f8938aca Leonidas Poulopoulos
        # Shibboleth SP configuration
457 f8938aca Leonidas Poulopoulos
    
458 f8938aca Leonidas Poulopoulos
        #SetEnv                       proxy-sendchunked
459 f8938aca Leonidas Poulopoulos
        
460 f8938aca Leonidas Poulopoulos
              <Proxy *>
461 f8938aca Leonidas Poulopoulos
               Order allow,deny
462 f8938aca Leonidas Poulopoulos
               Allow from all
463 f8938aca Leonidas Poulopoulos
               </Proxy>
464 f8938aca Leonidas Poulopoulos
    
465 f8938aca Leonidas Poulopoulos
               SSLProxyEngine           off
466 f8938aca Leonidas Poulopoulos
               ProxyErrorOverride     off
467 f8938aca Leonidas Poulopoulos
          ProxyTimeout     28800
468 f8938aca Leonidas Poulopoulos
             ProxyPass        /static !
469 f8938aca Leonidas Poulopoulos
             ProxyPass          /shibboleth !
470 f8938aca Leonidas Poulopoulos
             ProxyPass        /Shibboleth.sso !
471 f8938aca Leonidas Poulopoulos
             
472 f8938aca Leonidas Poulopoulos
               ProxyPass           / http://localhost:8081/ retry=0
473 f8938aca Leonidas Poulopoulos
               ProxyPassReverse / http://localhost:8081/
474 f8938aca Leonidas Poulopoulos
    
475 f8938aca Leonidas Poulopoulos
          Alias /static          /srv/flowspy/static
476 f8938aca Leonidas Poulopoulos
    
477 f8938aca Leonidas Poulopoulos
        LogLevel warn
478 f8938aca Leonidas Poulopoulos
        
479 f8938aca Leonidas Poulopoulos
        ErrorLog ${APACHE_LOG_DIR}/fod_error.log
480 f8938aca Leonidas Poulopoulos
          CustomLog ${APACHE_LOG_DIR}/fod_access.log combined
481 f8938aca Leonidas Poulopoulos
    
482 f8938aca Leonidas Poulopoulos
    </VirtualHost>
483 51ce199a Leonidas Poulopoulos
484 1e40c2f5 Leonidas Poulopoulos
Now, enable your site. You might want to disable the default site if fod is the only site you host on your server::
485 1e40c2f5 Leonidas Poulopoulos
486 f8938aca Leonidas Poulopoulos
    a2dissite default
487 f8938aca Leonidas Poulopoulos
    a2ensite fod
488 1e40c2f5 Leonidas Poulopoulos
489 51ce199a Leonidas Poulopoulos
You are not far away from deploying FoD. When asked for a super user, create one::
490 51ce199a Leonidas Poulopoulos
491 f8938aca Leonidas Poulopoulos
    cd /srv/flowspy
492 f8938aca Leonidas Poulopoulos
    python manage.py syncdb
493 f8938aca Leonidas Poulopoulos
    python manage.py migrate flowspec
494 f8938aca Leonidas Poulopoulos
    python manage.py migrate djcelery
495 f8938aca Leonidas Poulopoulos
    python manage.py migrate accounts
496 f8938aca Leonidas Poulopoulos
497 f8938aca Leonidas Poulopoulos
If you have not changed the values of the PEER\_\*\_TABLE variables to False and thus you are going for a default installation (that is PEER\_\*\_TABLE variables are set to True) , then run::
498 f8938aca Leonidas Poulopoulos
    
499 f8938aca Leonidas Poulopoulos
    python manage.py migrate peers
500 f8938aca Leonidas Poulopoulos
501 f8938aca Leonidas Poulopoulos
If however you have set the PEER\_\*\_TABLE variables to False and by accident you have ran the command above, then you have to cleanup you database manually by dropping the peer\* tables plus the techc_email table. For MySQL the command is::
502 f8938aca Leonidas Poulopoulos
    
503 f8938aca Leonidas Poulopoulos
    DROP TABLE `peer`, `peer_networks`, `peer_range`, `peer_techc_emails`, techc_email;  
504 51ce199a Leonidas Poulopoulos
505 51ce199a Leonidas Poulopoulos
Restart, gunicorn and apache::
506 51ce199a Leonidas Poulopoulos
507 f8938aca Leonidas Poulopoulos
    service gunicorn restart && service apache2 restart
508 51ce199a Leonidas Poulopoulos
509 0bf16f7f Leonidas Poulopoulos
510 0bf16f7f Leonidas Poulopoulos
Propagate the flatpages
511 0bf16f7f Leonidas Poulopoulos
=======================
512 0bf16f7f Leonidas Poulopoulos
Inside the initial_data/fixtures_manual.xml file we have placed 4 flatpages (2 for Greek, 2 for English) with Information and Terms of Service about the service. 
513 0bf16f7f Leonidas Poulopoulos
To import the flatpages, run from root folder::
514 0bf16f7f Leonidas Poulopoulos
515 f8938aca Leonidas Poulopoulos
    python manage.py loaddata initial_data/fixtures_manual.xml
516 0bf16f7f Leonidas Poulopoulos
517 0bf16f7f Leonidas Poulopoulos
518 0bf16f7f Leonidas Poulopoulos
519 51ce199a Leonidas Poulopoulos
Testing the platform
520 51ce199a Leonidas Poulopoulos
====================
521 f8938aca Leonidas Poulopoulos
Log in to the admin interface via https:\/\/<hostname>\/admin. Go to Peer ranges and add a new range (part of/or a complete subnet), eg. 10.20.0.0/19
522 f8938aca Leonidas Poulopoulos
Go to Peers and add a new peer, eg. id: 1, name: Test, AS: 16503, tag: TEST and move the network you have created from Avalable to Chosen. From the admin front, go to User, and edit your user. From the bottom of the page, select the TEST peer and save.
523 f8938aca Leonidas Poulopoulos
Last but not least, modify as required the existing (example.com) Site instance (admin home->Sites). You are done. As you are logged-in via the admin, there is no need to go through Shibboleth at this time. Go to https:\/\/<hostname>\/ and create a new rule. Your rule should be applied on the flowspec capable device after aprox. 10 seconds. If no Shibboleth authentication is available, a https:\/\/<hostname>\/altlogin is provided.
524 51ce199a Leonidas Poulopoulos
525 51ce199a Leonidas Poulopoulos
Branding
526 51ce199a Leonidas Poulopoulos
========
527 51ce199a Leonidas Poulopoulos
Via the admin interface you can modify flatpages to suit your needs
528 51ce199a Leonidas Poulopoulos
529 51ce199a Leonidas Poulopoulos
Footer
530 51ce199a Leonidas Poulopoulos
------
531 51ce199a Leonidas Poulopoulos
Under the templates folder (templates), you can alter the footer.html file to include your own footer messages, badges, etc.
532 51ce199a Leonidas Poulopoulos
533 51ce199a Leonidas Poulopoulos
Welcome Page
534 51ce199a Leonidas Poulopoulos
------------
535 51ce199a Leonidas Poulopoulos
Under the templates folder (templates), you can alter the welcome page - welcome.html with your own images, carousel, videos, etc.