Changes between Version 58 and Version 59 of Download/SCDB


Ignore:
Timestamp:
Sep 15, 2008, 10:33:45 PM (16 years ago)
Author:
/O=GRID-FR/C=FR/O=CNRS/OU=LAL/CN=Michel Jouvin
Comment:

Rewrite Apache/SVN configuration parts

Legend:

Unmodified
Added
Removed
Modified

  • Download/SCDB

    v58 v59  
    2727Recommended setting for these 3 areas are :
    2828 * Restrict access to profile and Kickstart configuration to IP adresses (or subnets) matching Quattor clients, as these files may contain sensitive information like encrypted passwords or MySQL passwords (cleartext).
    29  * Configure all these areas to ignore any `index.html` file and auto-indexing. This is particularly important for RPM repositories URLs, as presence of an `index.html` will prevent SCDB tools to get the list of RPMs in the repository. Recommended settings for these areas are :
    30 {{{
     29 * Configure all these areas to ignore any `index.html` file and auto-indexing. This is particularly important for RPM repositories URLs, as presence of an `index.html` will prevent SCDB tools to get the list of RPMs in the repository.
     30
     31Configuration for these areas is normally done by creating a file `/etc/httpd/conf.d/quattor.conf` with directives like the following one for each area (replace `/path/to/area` by your actual directoy name) :
     32{{{
     33<Directory /path/to/area>
    3134    Options Indexes
    3235    DirectoryIndex VeryUnlikelyDirectoryIndex.none
    3336    AllowOverride None
    34 }}}
    35 
    36 == Subversion Server ==
    37 
    38 There is no need for a Subversion server dedicated to Quattor. SCDB is just one repository from the Subversion point of view. If you already run a Subversion server, you can skip the installation part and go directly to the configuration part.
    39 
    40 === Subversion installation ===
    41 
    42 There are many possible installation options for a Subversion server. The best is to install it as Apache module, anyway. There is no requirement for the Subversion server to run on a Linux machine, even if it is the installation option documented here. You can even choose to use a Subversion server outside of your site, if you think the network connection is good enough.
    43 
    44 If you need to install a Subversion server, the easiest is to install Apache and then retrieve the RPMs for Subversion from [http://subversion.tigris.org/project_packages.html Subversion site]. Don't forget to install the Apache module which is in a separate RPM.
    45 
    46 After installing, you have to configure the Subversion server. Look at Quattor installation guide on [http://quattor.org Quattor] web site.
    47 
    48 Quick setup:
    49 
    50 {{{
    51 # Create SVN repository
    52 mkdir -p /var/svn/quattor
    53 svnadmin create /var/svn/quattor
    54 # Fetch the quattor specific post-commit hook
    55 wget  --no-check-certificate "https://trac.lal.in2p3.fr/Quattor/browser/trunk/src/hooks/post-commit?format=raw" -O /var/svn/quattor/hooks/post-commit
    56 # Quattor deployment scripts (used by post-commit svn hook)
    57 mkdir -p /root/quattor/scripts
    58 wget  --no-check-certificate "https://trac.lal.in2p3.fr/Quattor/browser/trunk/src/hooks/build-tag.pl?format=raw" -O /root/quattor/scripts/build-tag.pl
    59 
    60 }}}
    61 
    62 These scripts require some configuration files that will be created during [wiki:Download/SCDB#QuattorServerFinalconfiguration final configuration].
    63 
    64 Quattor tools access SVN repository through {{{http(s):}}} method (not {{{file:}}}), thus it is necessary to install and configure Apache {{{mod_dav_svn}}} module.
    65 
    66 The SVN repository should belong to the identity that run the web server:
    67 
    68 {{{
    69 chown -R apache:apache /var/svn/quattor
    70 }}}
    71 
    72 === Apache for subversion and package service ===
    73 
    74 Files  {{{/etc/httpd/conf.d/subversion.conf}}} and  {{{/etc/httpd/conf.d/ssl.conf}}} (if using ssl) have to be edited and configured.
    75 
    76 In {{{/etc/http/conf/httpd.conf}}}, you may have to add the following lines to avoid a bug in the http interface of the rpm client.
    77 
     37</Directory>
     38}}}
     39
     40It is also better to add the following directive in our `/etc/httpd/conf.d/quattor.conf` to work around a problem in some RPM versions:
    7841{{{
    7942<IfModule mod_setenvif.c>
    8043  BrowserMatch "rpm/.*" nokeepalive force-response-1.0
    8144</IfModule>
     45}}}
     46
     47''Note: if you are installing a new Apache server, don't forget to edit `DocumentRoot` in `/etc/httpd/conf/httpd.conf` to reflect your local configuration.`
     48
     49== Subversion Server ==
     50
     51There is no need for a Subversion server dedicated to Quattor. SCDB is just one repository from the Subversion point of view. If you already run a Subversion server, you can skip the installation part and go directly to the configuration part.
     52
     53=== Subversion Installation and Configuration ===
     54
     55There are many possible installation options for a Subversion server. The best is to install it as Apache module, anyway. There is no requirement for the Subversion server to run on a Linux machine, even if it is the installation option documented here. You can even choose to use a Subversion server outside of your site, if you think the network connection is good enough.
     56
     57If you need to install a Subversion server, the easiest is to install Apache using YUM. Another option is to retrieve the RPMs for Subversion from [http://subversion.tigris.org/project_packages.html Subversion site]. Don't forget to install the Apache module which is in a separate RPM.
     58
     59A typical SVN installation with YUM is:
     60{{{
     61yum install subversion mod_dav_svn
     62}}}
     63
     64After installing, you have to configure the Subversion server. Refer to [http://subversion.tigris.org Subversion web site] for details. Configuration the SVN server typically involves:
     65 * Creation of directory which will contain the Quattor repository (this example uses `/var/svn`):
     66{{{
     67mkdir -p /var/svn
     68}}}
     69 * Create Subversion repository that will be used for Quattor SCDB (don't forget to '''backup this directory'''):
     70{{{
     71svnadmin create /var/svn/quattor
     72# Repository must be owned by Apache account
     73chown -R apache:apache /var/svn/quattor
     74}}}
     75
     76Apache SVN module configuration (`/etc/httpd/conf.d/subversion.conf`) must be edited to configure URL used by SVN. A typical example, based on previously created repository (adjust paths to reflect your configuration) is:
     77{{{
     78<Location /svn>
     79   DAV svn
     80   SVNParentPath /var/svn
     81
     82   AuthzSVNAccessFile security/svn-repositories-access
     83
     84   AuthType        Basic
     85   AuthUserFile    security/passwd
     86   AuthGroupFile   security/group
     87   AuthName        "Grid Tutorial SVN server"
     88
     89   # Limit write permission to list of valid users.
     90   <LimitExcept GET PROPFIND OPTIONS REPORT>
     91      # Require SSL connection for password protection.
     92      # SSLRequireSSL
     93
     94      Require valid-user
     95   </LimitExcept>
     96</Location>
     97}}}
     98
     99To configuration SVN authentication for SCDB repository, you need to create one or more accounts in `/etc/httpd/security/passwd`. You can use `htpasswd` or `openssl passwd -apr1` to generate an encrypted password.
     100
     101You also need to define SVN ACLs in `/etc/httpd/security/svn-repositories-access`. A typical file to start is (it assumes the account you created is called `quattormgr`, if this is a list it must be comma separated):
     102{{{
     103[groups]
     104quattor-mgrs = quattormgr
     105
     106[/]
     107* = r
     108@quattor-mgrs = rw
    82109}}}
    83110
    … …  
    101128}}}
    102129
    103 Then, initial checkout will be:
    104 
    105 {{{
    106 svn checkout https://svn.server.tld/svn/quattor/
     130Then, you can do the initial checkout with (this will create a `scdb` sub-directory of you current directory):
     131
     132{{{
     133svn checkout https://svn.server.tld/svn/quattor/trunk scdb
    107134}}}
    108135
    … …  
    217244
    218245=== Installation of hook script and server script ===
    219 
     246{{{
     247# Fetch the quattor specific post-commit hook
     248wget  --no-check-certificate "https://trac.lal.in2p3.fr/Quattor/browser/trunk/src/hooks/post-commit?format=raw" -O /var/svn/quattor/hooks/post-commit
     249# Quattor deployment scripts (used by post-commit svn hook)
     250mkdir -p /root/quattor/scripts
     251wget  --no-check-certificate "https://trac.lal.in2p3.fr/Quattor/browser/trunk/src/hooks/build-tag.pl?format=raw" -O /root/quattor/scripts/build-tag.pl
     252
     253}}}
    220254The hook script, [source:SCDB/tags/pro/src/hooks/post-commit post-commit], is provided as part of SCDB, in the `src/hooks` directory. It must be installed on your Subversion server, in the `hook` directory of the repository, and given executable permission for Apache user. This script requires a configuration file `/etc/quattor-deploy.conf`, see SCDB [wiki:Doc/SCDB/Server server-side customizations] for details.
    221255
    … …  
    226260For more details about these scripts and their customization, see the page on SCDB [wiki:Doc/SCDB/Server server-side customizations].
    227261
    228 === Creation of Ssh Keys ===
     262=== Creation of SSH Keys ===
    229263
    230264Currently, deployment of new version of the templates is done by the hook script triggered by `ant deploy` executing the server script `build-tag.pl` through ssh. There is no way to enter a password at this time, thus ssh must be configured in such a way that the Apache account on the Subversion server can do a ssh connection as root on the Quattor server, without password. The easiest is to use ssh keys to do that.