Sfoglia il codice sorgente

[backend] Enable Gunicorn server in Hue

"This commit does not contain secrets"

Change-Id: I41fae724c947b016c4d9522ee1422e3cbf0387d9
(cherry picked from commit a3345286532dc73e3cc68c84d51ca9778045be74)
(cherry picked from commit d8edd18b011622250e49f65bcd41928d3d773261)
Prakash Ranade 3 anni fa
parent
commit
ec1e70439f

+ 30 - 10
desktop/core/src/desktop/management/commands/rungunicornserver.py

@@ -17,14 +17,18 @@
 
 from __future__ import unicode_literals
 
+from OpenSSL import crypto
+
 import os
 import sys
 import ssl
 import multiprocessing
+import tempfile
 
 import gunicorn.app.base
 
 from desktop import conf
+from desktop import supervisor
 from django.core.management.base import BaseCommand
 from django.core.wsgi import get_wsgi_application
 from gunicorn import util
@@ -91,9 +95,25 @@ class StandaloneApplication(gunicorn.app.base.BaseApplication):
 def rungunicornserver():
   bind_addr = conf.HTTP_HOST.get() + ":" + str(conf.HTTP_PORT.get())
 
+  # Currently gunicorn does not support passphrase suppored SSL Keyfile
+  # https://github.com/benoitc/gunicorn/issues/2410
+  ssl_keyfile = None
+  if conf.SSL_CERTIFICATE.get() and conf.SSL_PRIVATE_KEY.get():
+    ssl_password = str.encode(conf.get_ssl_password())
+    if ssl_password:
+      with open(conf.SSL_PRIVATE_KEY.get(), 'r') as f:
+        with tempfile.NamedTemporaryFile(dir=os.path.dirname(
+                                          conf.SSL_CERTIFICATE.get()), delete=False) as tf:
+          tf.write(crypto.dump_privatekey(crypto.FILETYPE_PEM,
+                                          crypto.load_privatekey(crypto.FILETYPE_PEM,
+                                                                 f.read(), ssl_password)))
+          ssl_keyfile = tf.name
+    else:
+      ssl_keyfile = conf.SSL_PRIVATE_KEY.get()
+
   options = {
       'accesslog': "-",
-      'backlog': None,
+      'backlog': 2048,
       'bind': [bind_addr],
       'ca_certs': conf.SSL_CACERTS.get(),     # CA certificates file
       'capture_output': True,
@@ -104,25 +124,25 @@ def rungunicornserver():
       'ciphers': conf.SSL_CIPHER_LIST.get(),  # Ciphers to use (see stdlib ssl module)
       'config': None,
       'daemon': None,
-      'do_handshake_on_connect': None,        # Whether to perform SSL handshake on socket connect (see stdlib ssl module)
+      'do_handshake_on_connect': False,       # Whether to perform SSL handshake on socket connect.
       'enable_stdio_inheritance': None,
       'errorlog': "-",
       'forwarded_allow_ips': None,
       'graceful_timeout': 900,                # Timeout for graceful workers restart.
-      'group': None,
+      'group': conf.SERVER_GROUP.get(),
       'initgroups': None,
-      'keepalive': 120,                       # Set this to a higher value because this Gunicorn is behind a load balancer
-      'keyfile': conf.SSL_PRIVATE_KEY.get(),  # SSL key file
+      'keepalive': 120,                       # seconds to wait for requests on a keep-alive connection.
+      'keyfile': ssl_keyfile,                 # SSL key file
       'limit_request_field_size': None,
       'limit_request_fields': None,
       'limit_request_line': None,
       'logconfig': None,
       'loglevel': 'info',
-      'max_requests': 0,                      # 0 means disable worker restart.
+      'max_requests': 1200,                   # The maximum number of requests a worker will process before restarting.
       'max_requests_jitter': 0,
       'paste': None,
       'pidfile': None,
-      'preload_app': None,
+      'preload_app': False,
       'proc_name': "hue",
       'proxy_allow_ips': None,
       'proxy_protocol': None,
@@ -133,7 +153,7 @@ def rungunicornserver():
       'reload_engine': None,
       'sendfile': None,
       'spew': None,
-      'ssl_version': ssl.PROTOCOL_TLSv1_2,    # SSL version to use (see stdlib ssl module) [ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1]
+      'ssl_version': ssl.PROTOCOL_TLSv1_2,    # SSL version to use
       'statsd_host': None,
       'statsd_prefix': None,
       'suppress_ragged_eofs': None,           # Suppress ragged EOFs (see stdlib ssl module)
@@ -144,9 +164,9 @@ def rungunicornserver():
       'threads': conf.CHERRYPY_SERVER_THREADS.get(),
       'timeout': 900,                         # Workers silent for more than this many seconds are killed and restarted.
       'umask': None,
-      'user': None,
+      'user': conf.SERVER_USER.get(),
       'worker_class': conf.GUNICORN_WORKER_CLASS.get(),
-      'worker_connections': None,
+      'worker_connections': 1000,
       'worker_tmp_dir': None,
       'workers': conf.GUNICORN_NUMBER_OF_WORKERS.get() if conf.GUNICORN_NUMBER_OF_WORKERS.get() is not None else number_of_workers()
   }