Mercurial > kallithea
annotate init.d/supervisord.conf @ 8886:3d7ba590f6f5
auth: only use X- headers instead of REMOTE_ADDR if explicitly told so in remote_addr_header
Before, X-Forwarded-For (and others) headers would *always* be trusted blindly,
also in setups without a proxy server. It would thus in some cases be
possible for users to fake their IP, and thus potentially be possible to bypass
IP restrictions configured in Kallithea.
Fixed by making it configurable which WSGI environment variable to use for the
remote address. Users can configure remote_addr_header to for example
HTTP_X_FORWARDED_FOR instead of using the default REMOTE_ADDR.
This change is a bit similar to what is going on in the https_fixup middleware,
but is doing a bit more of what for example is happening in similar code in
werkzeug/middleware/proxy_fix.py .
| author | Mads Kiilerich <mads@kiilerich.com> |
|---|---|
| date | Sun, 09 May 2021 22:34:02 +0200 |
| parents | 2c3d30095d5e |
| children |
| rev | line source |
|---|---|
|
4212
24c0d584ba86
General renaming to Kallithea
Bradley M. Kuhn <bkuhn@sfconservancy.org>
parents:
4190
diff
changeset
|
1 ; Kallithea Supervisord |
|
2483
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
2 ; ########################## |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
3 ; for help see http://supervisord.org/configuration.html |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
4 ; ########################## |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
5 |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
6 [inet_http_server] ; inet (TCP) server disabled by default |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
7 port=127.0.0.1:9001 ; (ip_address:port specifier, *:port for all iface) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
8 ;username=user ; (default is no username (open server)) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
9 ;password=123 ; (default is no password (open server)) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
10 |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
11 [supervisord] |
|
4190
99ad9d0af1a3
Rename init scripts and fix references inside them
Bradley M. Kuhn <bkuhn@sfconservancy.org>
parents:
2483
diff
changeset
|
12 logfile=/%(here)s/supervisord_kallithea.log ; (main log file;default $CWD/supervisord.log) |
|
2483
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
13 logfile_maxbytes=50MB ; (max main logfile bytes b4 rotation;default 50MB) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
14 logfile_backups=10 ; (num of main logfile rotation backups;default 10) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
15 loglevel=info ; (log level;default info; others: debug,warn,trace) |
|
4190
99ad9d0af1a3
Rename init scripts and fix references inside them
Bradley M. Kuhn <bkuhn@sfconservancy.org>
parents:
2483
diff
changeset
|
16 pidfile=/%(here)s/supervisord_kallithea.pid ; (supervisord pidfile;default supervisord.pid) |
|
2483
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
17 nodaemon=true ; (start in foreground if true;default false) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
18 minfds=1024 ; (min. avail startup file descriptors;default 1024) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
19 minprocs=200 ; (min. avail process descriptors;default 200) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
20 umask=022 ; (process file creation umask;default 022) |
|
4190
99ad9d0af1a3
Rename init scripts and fix references inside them
Bradley M. Kuhn <bkuhn@sfconservancy.org>
parents:
2483
diff
changeset
|
21 user=username ; (default is current user, required if root) |
|
2483
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
22 ;identifier=supervisor ; (supervisord identifier, default is 'supervisor') |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
23 ;directory=/tmp ; (default is not to cd during start) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
24 ;nocleanup=true ; (don't clean up tempfiles at start;default false) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
25 ;childlogdir=/tmp ; ('AUTO' child log dir, default $TEMP) |
| 4902 | 26 environment=HOME=/srv/kallithea ; (key value pairs to add to environment) |
|
2483
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
27 ;strip_ansi=false ; (strip ansi escape codes in logs; def. false) |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
28 |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
29 ; the below section must remain in the config file for RPC |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
30 ; (supervisorctl/web interface) to work, additional interfaces may be |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
31 ; added by defining them in separate rpcinterface: sections |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
32 [rpcinterface:supervisor] |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
33 supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
34 |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
35 [supervisorctl] |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
36 serverurl=http://127.0.0.1:9001 ; use an http:// url to specify an inet socket |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
37 ;username=user ; should be same as http_username if set |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
38 ;password=123 ; should be same as http_password if set |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
39 ;prompt=mysupervisor ; cmd line prompt (default "supervisor") |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
40 ;history_file=~/.sc_history ; use readline history if available |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
41 |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
42 |
|
4190
99ad9d0af1a3
Rename init scripts and fix references inside them
Bradley M. Kuhn <bkuhn@sfconservancy.org>
parents:
2483
diff
changeset
|
43 ; restart with supervisorctl restart kallithea:* |
|
99ad9d0af1a3
Rename init scripts and fix references inside them
Bradley M. Kuhn <bkuhn@sfconservancy.org>
parents:
2483
diff
changeset
|
44 [program:kallithea] |
|
2483
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
45 numprocs = 1 |
|
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
46 numprocs_start = 5000 # possible should match ports |
| 4902 | 47 directory=/srv/kallithea |
|
6554
2c3d30095d5e
gearbox: replace paster with something TurboGears2-ish that still works with the Pylons stack
Mads Kiilerich <madski@unity3d.com>
parents:
6370
diff
changeset
|
48 command = /srv/kallithea/venv/bin/gearbox serve -c my.ini |
|
2483
e4eabd2558b6
added example supervisord config to init scripts
Marcin Kuzminski <marcin@python-works.com>
parents:
diff
changeset
|
49 process_name = %(program_name)s_%(process_num)04d |
|
6370
e285bb7abb28
scripts: apply whitespace cleanup to more files - opt out instead of opt in
Mads Kiilerich <mads@kiilerich.com>
parents:
4902
diff
changeset
|
50 redirect_stderr=true |
|
e285bb7abb28
scripts: apply whitespace cleanup to more files - opt out instead of opt in
Mads Kiilerich <mads@kiilerich.com>
parents:
4902
diff
changeset
|
51 stdout_logfile=/%(here)s/kallithea.log |