accounting/bench
2
0
Fork 0
mirror of https://github.com/frappe/bench.git synced 2024-11-12 00:06:36 +00:00
Code Issues Releases Activity

fix: remove bench and supervisor from sudoers

Browse Source 
chore: move production prerequisites into setup_production
This commit is contained in:
Gavin D'souza 2020-03-13 16:41:00 +05:30
parent 1f5c7ec201
commit 51b81c3997
5 changed files with 23 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
bench/commands/setup.py
View File

@ -60,16 +60,6 @@ def setup_fonts():
@click.option("--yes", help="Yes to regeneration config", is_flag=True, default=False)
def setup_production(user, yes=False):
from bench.config.production_setup import setup_production
# Install prereqs for production
from distutils.spawn import find_executable
if not find_executable("ansible"):
exec_cmd("sudo -H {0} -m pip install ansible".format(sys.executable))
if not find_executable("fail2ban-client"):
exec_cmd("bench setup role fail2ban")
if not find_executable("nginx"):
exec_cmd("bench setup role nginx")
if not find_executable("supervisord"):
exec_cmd("bench setup role supervisor")
setup_production(user=user, yes=yes)

21
bench/config/production_setup.py
View File

@ -4,8 +4,23 @@ from bench.config.systemd import generate_systemd_config
from bench.config.nginx import make_nginx_conf
from bench.config.common_site_config import get_config
import os, subprocess
import sys
from distutils.spawn import find_executable
def setup_production_prerequisites():
if not find_executable("ansible"):
exec_cmd("sudo {0} -m pip install ansible".format(sys.executable))
if not find_executable("fail2ban-client"):
exec_cmd("bench setup role fail2ban")
if not find_executable("nginx"):
exec_cmd("bench setup role nginx")
if not find_executable("supervisord"):
exec_cmd("bench setup role supervisor")
def setup_production(user, bench_path='.', yes=False):
setup_production_prerequisites()
if get_config(bench_path).get('restart_supervisor_on_update') and get_config(bench_path).get('restart_systemd_on_update'):
raise Exception("You cannot use supervisor and systemd at the same time. Modify your common_site_config accordingly." )
@ -109,15 +124,15 @@ def reload_supervisor():
try:
# first try reread/update
exec_cmd('sudo {0} reread'.format(supervisorctl))
exec_cmd('sudo {0} update'.format(supervisorctl))
exec_cmd('{0} reread'.format(supervisorctl))
exec_cmd('{0} update'.format(supervisorctl))
return
except CommandFailedError:
pass
try:
# something is wrong, so try reloading
exec_cmd('sudo {0} reload'.format(supervisorctl))
exec_cmd('{0} reload'.format(supervisorctl))
return
except CommandFailedError:
pass

5
bench/config/templates/frappe_sudoers
View File

@ -8,13 +8,8 @@
{{ user }} ALL = (root) NOPASSWD: {{ systemctl }} * nginx
{{ user }} ALL = (root) NOPASSWD: {{ systemctl }} * supervisord
{% endif %}
{% if supervisorctl %}
{{ user }} ALL = (root) NOPASSWD: {{ supervisorctl }}
{% endif %}
{% if nginx %}
{{ user }} ALL = (root) NOPASSWD: {{ nginx }}
{% endif %}
{{ user }} ALL = (root) NOPASSWD: /opt/certbot-auto
{{ user }} ALL = (root) NOPASSWD: {{ bench }}
Defaults:{{ user }} !requiretty

4
bench/tests/test_setup_production.py
View File

@ -126,12 +126,12 @@ class TestSetupProduction(TestBenchBase):
def assert_supervisor_process(self, bench_name, use_rq=True, disable_production=False):
out = bench.utils.get_cmd_output("sudo supervisorctl status")
out = bench.utils.get_cmd_output("supervisorctl status")
while "STARTING" in out:
print ("Waiting for all processes to start...")
time.sleep(10)
out = bench.utils.get_cmd_output("sudo supervisorctl status")
out = bench.utils.get_cmd_output("supervisorctl status")
tests = [
"{bench_name}-web:{bench_name}-frappe-web[\s]+RUNNING",

9
bench/utils.py
View File

@ -37,6 +37,7 @@ class CommandFailedError(Exception):
logger = logging.getLogger(__name__)
folders_in_bench = ('apps', 'sites', 'config', 'logs', 'config/pids')
sudoers_file = '/etc/sudoers.d/frappe'
class color:
@ -423,16 +424,12 @@ def setup_sudoers(user):
if set_permissions:
os.chmod('/etc/sudoers', 0o440)
sudoers_file = '/etc/sudoers.d/frappe'
template = env.get_template('frappe_sudoers')
frappe_sudoers = template.render(**{
'user': user,
'service': find_executable('service'),
'systemctl': find_executable('systemctl'),
'supervisorctl': find_executable('supervisorctl'),
'nginx': find_executable('nginx'),
'bench': find_executable('bench')
})
frappe_sudoers = safe_decode(frappe_sudoers)
@ -548,7 +545,7 @@ def restart_supervisor_processes(bench_path='.', web_workers=False):
exec_cmd(cmd, cwd=bench_path)
else:
supervisor_status = subprocess.check_output(['sudo', 'supervisorctl', 'status'], cwd=bench_path)
supervisor_status = subprocess.check_output(['supervisorctl', 'status'], cwd=bench_path)
supervisor_status = safe_decode(supervisor_status)
if web_workers and '{bench_name}-web:'.format(bench_name=bench_name) in supervisor_status:
@ -565,7 +562,7 @@ def restart_supervisor_processes(bench_path='.', web_workers=False):
else:
group = 'frappe:'
exec_cmd('sudo supervisorctl restart {group}'.format(group=group), cwd=bench_path)
exec_cmd('supervisorctl restart {group}'.format(group=group), cwd=bench_path)
def restart_systemd_processes(bench_path='.', web_workers=False):