c10ad0d9eb
Drop privileges to a regular user when running commands defined by this snap. In most cases this is done prior to executing the command. NGINX is an exception in that the command will be run as root, allowing the the master process to bind to ports. The nginx.conf template is configured to then drop privileges for worker processes, which do all work, such as handling network connections, r/w to disk, and communication with servers. Change-Id: If9bf24fc65412b90b8b1890944a469de23888c32
102 lines
3.1 KiB
YAML
102 lines
3.1 KiB
YAML
name: keystone
|
|
version: ocata
|
|
summary: OpenStack Identity Service (keystone)
|
|
description: |
|
|
Keystone provides authentication, authorization and service discovery
|
|
mechanisms via HTTP primarily for use by projects in the OpenStack
|
|
family. It is most commonly deployed as an HTTP interface to existing
|
|
identity systems, such as LDAP.
|
|
confinement: classic
|
|
grade: devel
|
|
|
|
apps:
|
|
uwsgi:
|
|
command: >
|
|
env PYTHONPATH=$PYTHONPATH:$SNAP/lib/python2.7/site-packages
|
|
$SNAP/usr/bin/python2 $SNAP/bin/snap-openstack keystone-uwsgi
|
|
daemon: simple
|
|
nginx:
|
|
command: >
|
|
env PYTHONPATH=$PYTHONPATH:$SNAP/lib/python2.7/site-packages
|
|
LD_LIBRARY_PATH=$SNAP/usr/lib/x86_64-linux-gnu:$LD_LIBRARY_PATH
|
|
$SNAP/usr/bin/python2 $SNAP/bin/snap-openstack keystone-nginx
|
|
daemon: forking
|
|
manage:
|
|
command: >
|
|
env PYTHONPATH=$PYTHONPATH:$SNAP/lib/python2.7/site-packages
|
|
$SNAP/usr/bin/python2 $SNAP/bin/snap-openstack keystone-manage
|
|
|
|
parts:
|
|
keystone:
|
|
after: [python]
|
|
plugin: python
|
|
python-version: python2
|
|
source: http://tarballs.openstack.org/keystone/keystone-stable-ocata.tar.gz
|
|
python-packages:
|
|
- mysql-python
|
|
- pymysql
|
|
- pysqlite
|
|
- uwsgi
|
|
- git+https://github.com/openstack/snap.openstack#egg=snap.openstack
|
|
constraints: https://raw.githubusercontent.com/openstack/requirements/stable/ocata/upper-constraints.txt
|
|
build-packages:
|
|
- gcc
|
|
- libffi-dev
|
|
- libmysqlclient-dev
|
|
- libssl-dev
|
|
- libsqlite3-dev
|
|
stage:
|
|
- -usr/bin/2to3
|
|
- -usr/bin/pydoc
|
|
- -usr/bin/python2.7
|
|
- -usr/lib/python2.7
|
|
install:
|
|
touch $SNAPCRAFT_PART_INSTALL/lib/python2.7/site-packages/paste/__init__.py
|
|
touch $SNAPCRAFT_PART_INSTALL/lib/python2.7/site-packages/repoze/__init__.py
|
|
templates:
|
|
after: [keystone]
|
|
plugin: dump
|
|
source: snap
|
|
config:
|
|
after: [keystone]
|
|
plugin: dump
|
|
source: http://tarballs.openstack.org/keystone/keystone-stable-ocata.tar.gz
|
|
organize:
|
|
etc/*.conf: etc/keystone/
|
|
etc/*.ini: etc/keystone/
|
|
etc/*.json: etc/keystone/
|
|
etc/*.templates: etc/keystone/
|
|
filesets:
|
|
etc:
|
|
- etc/keystone/*.conf
|
|
- etc/keystone/*.ini
|
|
- etc/keystone/*.json
|
|
- etc/keystone/*.templates
|
|
stage: [$etc]
|
|
prime: [$etc]
|
|
nginx:
|
|
source: http://www.nginx.org/download/nginx-1.13.0.tar.gz
|
|
plugin: autotools
|
|
configflags:
|
|
- --prefix=/usr
|
|
- --http-log-path=/var/snap/keystone/common/log/nginx-access.log
|
|
- --error-log-path=/var/snap/keystone/common/log/nginx-error.log
|
|
- --lock-path=/var/snap/keystone/common/lock/nginx.lock
|
|
- --pid-path=/var/snap/keystone/common/run/nginx.pid
|
|
build-packages:
|
|
- libpcre3-dev
|
|
- libssl-dev
|
|
python:
|
|
source: https://www.python.org/ftp/python/2.7.13/Python-2.7.13.tar.xz
|
|
plugin: autotools
|
|
configflags:
|
|
- --prefix=/usr
|
|
- --enable-shared
|
|
- --enable-unicode=ucs4
|
|
build-packages:
|
|
- libssl-dev
|
|
prime:
|
|
- -usr/include
|
|
install:
|
|
$SNAPCRAFT_PART_INSTALL/usr/bin/python2 -m ensurepip
|