Use a unix socket between httpd and Foreman's Puma - #593
Closed
ekohl wants to merge 2 commits into
Closed
Conversation
Member
Author
|
Looking at the logs I see in the DB migration: And then later on service startup: So I wonder what's going on here and if it's related to my change. |
| foreman_database_ssl_ca_path: /etc/foreman/db-ca.crt | ||
|
|
||
| foreman_name: "{{ ansible_facts['fqdn'] }}" | ||
| foreman_listen_stream: localhost:3000 |
Contributor
There was a problem hiding this comment.
Should we keep this consistent with PROD deployment?
Suggested change
| foreman_listen_stream: localhost:3000 | |
| foreman_listen_stream: /run/httpd.foreman.sock |
Member
Author
There was a problem hiding this comment.
The design here is that the role defaults remain standalone while a level higher they're connected to Apache.
Comment on lines
+16
to
+21
| # TODO: probably not the right boolean | ||
| - name: Set daemons_enable_cluster_mode so Apache can connect to unix sockets | ||
| ansible.posix.seboolean: | ||
| name: daemons_enable_cluster_mode | ||
| state: true | ||
| persistent: true |
Contributor
There was a problem hiding this comment.
I think it would make sense to run this only when SELinux is enabled?
Also, since it worked for you, can we remove the TODO comment as part of this change?
Suggested change
| # TODO: probably not the right boolean | |
| - name: Set daemons_enable_cluster_mode so Apache can connect to unix sockets | |
| ansible.posix.seboolean: | |
| name: daemons_enable_cluster_mode | |
| state: true | |
| persistent: true | |
| - name: Set daemons_enable_cluster_mode so Apache can connect to unix sockets | |
| ansible.posix.seboolean: | |
| name: daemons_enable_cluster_mode | |
| state: true | |
| persistent: true | |
| when: ansible_facts['selinux']['status'] == "enabled" |
Member
Author
There was a problem hiding this comment.
I don't think this really is the correct boolean so IMHO the TODO still stands.
| - mod_ssl | ||
| state: present | ||
|
|
||
| - name: Set httpd_can_network_connect so Apache can connect to Puma and Gunicorn |
Contributor
There was a problem hiding this comment.
We can now say we use httpd_can_network_connect just for Gunicorn? or we can remove this entirely when we update pulp unix sockets too?
2 tasks
Member
Author
|
Closing in favor of #608 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why are you introducing these changes? (Problem description, related links)
#118 included this previously, but splitting the focus.
In foreman-installer we saw using a unix socket had reliability benefits.
What are the changes introduced in this pull request?
How to test this pull request
Steps to reproduce:
Checklist