Merge lp:~pfalcon/linaro-license-protection/configs.capture-openid-groups into lp:~linaro-automation/linaro-license-protection/trunk

[Paul Sokolovsky]

BP Ref: https://blueprints.launchpad.net/linaro-infrastructure-misc/+spec/prepare-snapshots-migration-ec2

Reviewing setup Philip did on ec2-54-242-19-2.compute-1.amazonaws.com, I see that we miss in our docs step of setting up files in /etc/apache2/security/ , which are referenced by site config files. So, this patch capture those files from snapshots.linaro.org host. I also compared it with what we have on staging.snapshots.linaro.org, and there, it's fewer files, and there're some textual differences:

$ diff -ur security security2
diff -ur security/allowed-ops.txt security2/allowed-ops.txt
--- security/allowed-ops.txt 2013-03-18 17:53:53.737577210 +0200
+++ security2/allowed-ops.txt 2013-03-18 17:50:06.000000000 +0200
@@ -1 +1 @@
-Ubuntu=https://login.ubuntu.com
+Ubuntu=https://login.launchpad.net
diff -ur security/all-private-hwpack-teams.txt security2/all-private-hwpack-teams.txt
--- security/all-private-hwpack-teams.txt 2013-03-18 17:53:53.849577329 +0200
+++ security2/all-private-hwpack-teams.txt 2013-03-18 17:50:07.000000000 +0200
@@ -1,4 +1,4 @@
-linaro-landing-team-freescale
+naro-landing-team-freescale
 linaro-landing-team-samsung
 linaro-landing-team-ste
 linaro-landing-team-ti
Only in security: linaro-android-teams.txt
Only in security: mservices.linaro.org-teams.txt

Note that last hunk looks like typo.

[lp:~pfalcon/linaro-license-protection/configs.capture-openid-groups]

30. By Paul Sokolovsky on 2013-03-18

Update README with steps for /etc/apache2/security/ population.

Unmerged revisions

30. By Paul Sokolovsky on 2013-03-18

Update README with steps for /etc/apache2/security/ population.

29. By Paul Sokolovsky on 2013-03-18

Capture /etc/apache2/security dir from snapshots.linaro.org

This nostly contains OpenID group lists. These files are referenced
from *snapshots.linaro.org Apache site config files.

28. By Paul Sokolovsky on 2013-02-21

Update name of deployment script.

27. By Georgy Redkozubov on 2012-10-24

Removed fallback support

26. By Georgy Redkozubov on 2012-10-23

[merge] Update LINUX_FILES according to spec

25. By Georgy Redkozubov on 2012-10-23

Remove HOWTO_flashfirmware.txt from mandatory files

24. By Stevan Radaković on 2012-10-23

Move textile constants to settings so we can change them for releases.*.

23. By Данило Шеган on 2012-08-24

Update the snapshots.linaro.org to match the actual production config.

22. By Данило Шеган on 2012-08-23

Use python2.6 for production.

21. By Данило Шеган on 2012-08-23

Sync the configs with mombin IPs.

=== added file 'README'
--- README	1970-01-01 00:00:00 +0000
+++ README	2013-03-18 16:19:18 +0000
@@ -0,0 +1,216 @@
+Linaro License Protection configuration
+=======================================
+
+This branch contains current production configuration for
+
+ * releases.linaro.org (hosted on mombin.canonical.com)
+ * snapshots.linaro.org (mombin)
+ * staging.releases.linaro.org (kahaku.canonical.com)
+ * staging.snapshots.linaro.org (kahaku.canonical.com)
+
+
+Dependencies
+------------
+
+libapache2-mod-xsendfile >= 0.10
+libapache2-mod-python
+python-django >= 1.3.1
+python-django-openid-auth
+python-apache-openid
+
+python-apache-openid is needed until we migrate existing apache
+openid-protected directories to the new setup.
+
+
+Pushing framework on snapshots.linaro.org
+-----------------------------------------
+
+Pushing/uploading side is currently implemented as a multi-system setup:
+
+ * configuration on jenkins
+ * configuration of users on server
+
+Configuration of jenkins
+........................
+
+ * We are using Publish-over-SSH plugin for jenkins
+
+ * We perform two build (not publish, to allow for LAVA to have known URLs)
+   steps:
+
+   * publish artifacts over SSH (ends up on a private location on the server)
+
+   * call out a trigger script over SSH (to move files securely to a public
+     location)
+
+ * We use strictly "push from master" in advanced settings of publish-over-ssh
+   plugin, and keep private keys for both actions above on the master:
+
+    /home/ubuntu/snapshots-sync2/linaro-android-build-publish —
+      linaro-android-build-publish
+    /home/ubuntu/snapshots-sync2/linaro-android-build-publish-trigger —
+      linaro-android-build-publish-trigger
+
+Configuration of users on the receiving server (snapshots.l.o)
+..............................................................
+
+For the two actions above, we have two separate users for all hosts
+accessing the system (two for android-build.linaro.org and another two
+for ci.linaro.org at this time).
+
+One of the users is a sftp/push user, and another is the trigger user that
+shuffles the files around.
+
+Current users and their configurations:
+
+ * linaro-android-build-publish
+   /etc/ssh/user-authorized-keys/linaro-android-build-publish
+
+     command="/usr/lib/sftp-server",no-pty,no-port-forwarding,\
+     no-X11-forwarding,no-agent-forwarding,from="50.17.250.69" \
+     <PUBLIC-SSH-KEY-DATA>
+
+   (chrooted to /srv/snapshots.linaro.org/uploads/)
+
+ * linaro-android-build-publish-trigger:
+
+   /etc/ssh/user-authorized-keys/linaro-android-build-publish-trigger
+
+     command="/home/linaro-android-build-publish-trigger/scripts\
+              /trigger-linaro-android-build-publish.sh \
+              ${SSH_ORIGINAL_COMMAND#* }",\
+     no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding,
+     from="50.17.250.69" <PUBLIC-SSH-KEY-DATA>
+
+   The script being executed passes parameters to publish_to_snapshots
+   which moves files from /uploads/ into appropriate public directory:
+
+     #!/bin/sh
+     if [ "$(id -un)" != "linaro-android-build-publish-trigger" ]; then
+       echo "This script is designed to be run as linaro-android-build-publish-trigger user"
+       exit 1
+     fi
+     sudo -u linaro-android-build-publish /home/linaro-android-build-publish/linaro-license-protection/scripts/publish_to_snapshots.py "$@"
+
+ * linaro-ci-publish
+
+   Exactly the same as linaro-android-build-publish, except for the IP
+   (allowing ci.linaro.org from 50.17.200.206) and SSH key data.
+
+ * linaro-ci-publish-trigger
+
+   Like linaro-android-build-publish-trigger, with different IP
+   and SSH key data.  Script lives in
+
+     /home/linaro-ci-publish-trigger/scripts/trigger-linaro-ci-publish.sh
+
+   and is of similar structure to the one for the user
+   linaro-android-build-publish-trigger.
+
+android-build.linaro.org
+........................
+
+Runs Jenkins and uses SFTP plugin to access the above two users.  Private
+keys live in
+
+  /home/ubuntu/snapshots-sync2/linaro-android-build-publish —
+    linaro-android-build-publish
+  /home/ubuntu/snapshots-sync2/linaro-android-build-publish-trigger —
+    linaro-android-build-publish-trigger
+
+To ensure serialization of steps, and allow LAVA submission, these happen as
+build steps, and not as publishing steps.
+
+Deployment steps
+----------------
+
+This documents our current deployment while at the same time representing
+an example production deployment.
+
+1. Install the dependencies
+   (see the "Dependencies" section)
+
+2. Get the code
+
+     mkdir -p /srv/shared-branches
+     cd /srv/shared-branches
+     bzr branch lp:linaro-license-protection
+
+   (we are actually using http URLs since lp: defaults to bzr+ssh which
+   doesn't work on system accounts)
+
+3. Get the configuration
+
+   Configuration files for deploying to snapshots.linaro.org,
+   releases.linaro.org, staging.snapshots.linaro.org
+   and staging.releases.linaro.org all live in
+
+     lp:linaro-license-protection/configs
+
+   We need to branch that into /srv/shared-branches as well:
+
+     cd /srv/shared-branches
+     bzr branch lp:linaro-license-protection/configs linaro-license-protection-configs
+
+4. Checkout branches for the services you want to use:
+
+     (cd /srv/staging.snapshots.linaro.org &&
+      bzr checkout /srv/shared-branches/linaro-license-protection-configs configs &&
+      bzr checkout /srv/shared-branches/linaro-license-protection)
+
+   Replace "/srv/staging.snapshots.linaro.org" with one of
+     /srv/staging.releases.linaro.org
+     /srv/snapshots.linaro.org
+     /srv/releases.linaro.org
+
+   depending on the service you are deploying.
+
+   If you use these paths, none of the config files will need updating.
+
+5. Configure apache2
+
+   Make sure mod-xsendfile and mod-python are enabled.
+   Copy appropriate
+     /srv/staging.snapshots.linaro.org/configs/apache/staging.snapshots.linaro.org
+   files to /etc/apache2/sites-available
+
+   Copy apache/security/ directory to /etc/apache2/security (it contains OpenID group
+   mappings, etc).
+
+   Add appropriate NameVirtualHost directive to
+
+     /etc/apache2/sites-enabled/000-default
+
+   Run "a2ensite staging.snapshots.linaro.org".
+
+   You also need to set up SSL certificate for *snapshots.linaro.org.
+
+6. Create databases and set up static files
+
+   Make sure appropriate configs/django directory is in the PYTHONPATH
+   and set DJANGO_SETTINGS_MODULE and then run django-admin:
+
+     export PYTHONPATH=/srv/staging.snapshots.linaro.org:/srv/staging.snapshots.linaro.org/linaro-license-protection:/srv/staging.snapshots.linaro.org/configs/django
+     export DJANGO_SETTINGS_MODULE=settings_staging_snapshots
+     mkdir -p /srv/staging.snapshots.linaro.org/db
+     django-admin syncdb --noinput
+     django-admin collectstatic --noinput
+
+7. Set up a cron job to keep code updating automatically
+
+   You may want to automatically keep code up to date (mostly for staging)
+   instances.
+
+   There is
+
+     scripts/update-deployment.py
+
+   from lp:linaro-license-protection which can be run from a cronjob to keep
+   the above deployment always up to date.
+
+8. Ensure license_protected_downloads/config.py contains relevant white-listed
+   IP addresses:
+
+     For releases.linaro.org:
+      * android-build.linaro.org (50.17.250.69)
+      * validation.linaro.org (213.123.120.124)

=== renamed file 'README' => 'README.moved'
=== added directory 'apache'
=== added file 'apache/releases.linaro.org'
--- apache/releases.linaro.org	1970-01-01 00:00:00 +0000
+++ apache/releases.linaro.org	2013-03-18 16:19:18 +0000
@@ -0,0 +1,39 @@
+<VirtualHost 91.189.95.16:80>
+    Alias /static/ /srv/releases.linaro.org/linaro-license-protection/static/
+    DocumentRoot /srv/releases.linaro.org/www
+    ServerName releases.linaro.org
+    ServerAdmin [e-mail]
+    CustomLog /var/log/apache2/releases.linaro.org-access.log combined
+    ErrorLog  /var/log/apache2/releases.linaro.org-error.log
+
+    <Directory /srv/releases.linaro.org/linaro-license-protection/static>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    <Directory /srv/releases.linaro.org/www>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    XSendFile on
+    XSendFilePath /srv/releases.linaro.org/www
+
+    WSGIScriptAlias / /srv/releases.linaro.org/configs/wsgi/wsgi_releases.py
+    WSGIDaemonProcess linaro-license-protection-releases
+
+    <Directory /srv/releases.linaro.org/configs/wsgi>
+        <Files wsgi_releases.py>
+            Order deny,allow
+            Allow from all
+        </Files>
+    </Directory>
+
+    <Directory />
+        IndexOptions NameWidth=* +SuppressDescription
+        Options +Indexes +FollowSymLinks
+        IndexIgnore favicon.ico HEADER.html
+        AllowOverride FileInfo Indexes
+    </Directory>
+
+</VirtualHost>

=== added directory 'apache/security'
=== added file 'apache/security/all-private-hwpack-teams.txt'
--- apache/security/all-private-hwpack-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/all-private-hwpack-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,5 @@
+linaro-landing-team-freescale
+linaro-landing-team-samsung
+linaro-landing-team-ste
+linaro-landing-team-ti
+linaro-landing-team-arm

=== added file 'apache/security/allowed-ops.txt'
--- apache/security/allowed-ops.txt	1970-01-01 00:00:00 +0000
+++ apache/security/allowed-ops.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,1 @@
+Ubuntu=https://login.ubuntu.com

=== added file 'apache/security/arm-private-hwpack-teams.txt'
--- apache/security/arm-private-hwpack-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/arm-private-hwpack-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,1 @@
+linaro-landing-team-arm

=== added file 'apache/security/freescale-private-hwpack-teams.txt'
--- apache/security/freescale-private-hwpack-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/freescale-private-hwpack-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,1 @@
+linaro-landing-team-freescale

=== added file 'apache/security/linaro-android-teams.txt'
--- apache/security/linaro-android-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/linaro-android-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,2 @@
+linaro
+linaro-android-restricted

=== added file 'apache/security/linaro-teams.txt'
--- apache/security/linaro-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/linaro-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,1 @@
+linaro

=== added file 'apache/security/mservices.linaro.org-teams.txt'
--- apache/security/mservices.linaro.org-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/mservices.linaro.org-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,2 @@
+linaro-member-services-leadership
+canonical-sysadmins

=== added file 'apache/security/samsung-private-hwpack-teams.txt'
--- apache/security/samsung-private-hwpack-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/samsung-private-hwpack-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,1 @@
+linaro-landing-team-samsung

=== added file 'apache/security/ste-private-hwpack-teams.txt'
--- apache/security/ste-private-hwpack-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/ste-private-hwpack-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,1 @@
+linaro-landing-team-ste

=== added file 'apache/security/ti-private-hwpack-teams.txt'
--- apache/security/ti-private-hwpack-teams.txt	1970-01-01 00:00:00 +0000
+++ apache/security/ti-private-hwpack-teams.txt	2013-03-18 16:19:18 +0000
@@ -0,0 +1,1 @@
+linaro-landing-team-ti

=== added file 'apache/snapshots.linaro.org'
--- apache/snapshots.linaro.org	1970-01-01 00:00:00 +0000
+++ apache/snapshots.linaro.org	2013-03-18 16:19:18 +0000
@@ -0,0 +1,165 @@
+<VirtualHost 91.189.95.16:80 91.189.95.247:80>
+
+    Alias /static/ /srv/snapshots.linaro.org/linaro-license-protection/static/
+    DocumentRoot /srv/snapshots.linaro.org/www
+    ServerName snapshots.linaro.org
+    ServerAdmin [e-mail]
+    CustomLog /var/log/apache2/snapshots.linaro.org-access.log combined
+    ErrorLog  /var/log/apache2/snapshots.linaro.org-error.log
+
+    # SSL + OpenID for these:
+    Redirect /hwpacks https://snapshots.linaro.org/hwpacks
+    Redirect /android/~linaro-android-private https://snapshots.linaro.org/android/~linaro-android-private
+    Redirect /android/~linaro-android-restricted https://snapshots.linaro.org/android/~linaro-android-restricted
+    Redirect /precise/restricted https://snapshots.linaro.org/precise/restricted
+
+    <Directory /srv/snapshots.linaro.org/linaro-license-protection/static>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    <Directory /srv/snapshots.linaro.org/www>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    XSendFile on
+    XSendFilePath /srv/snapshots.linaro.org/www
+
+    WSGIScriptAlias / /srv/snapshots.linaro.org/configs/wsgi/wsgi_snapshots.py
+    WSGIDaemonProcess linaro-license-protection-snapshots
+
+    <Directory /srv/snapshots.linaro.org/configs/wsgi>
+        <Files wsgi_snapshots.py>
+            Order deny,allow
+            Allow from all
+        </Files>
+    </Directory>
+
+    <Directory />
+        IndexOptions NameWidth=* +SuppressDescription
+        Options +Indexes +FollowSymLinks
+        IndexIgnore favicon.ico HEADER.html
+        AllowOverride FileInfo Indexes
+    </Directory>
+
+</VirtualHost>
+
+<VirtualHost 91.189.95.247:443>
+
+    Alias /static/ /srv/snapshots.linaro.org/linaro-license-protection/static/
+    DocumentRoot /srv/snapshots.linaro.org/www
+    ServerName snapshots.linaro.org
+    ServerAdmin [e-mail]
+    CustomLog /var/log/apache2/snapshots.linaro.org-access.log combined
+    ErrorLog  /var/log/apache2/snapshots.linaro.org-error.log
+
+    SSLEngine On
+    SSLCertificateFile /etc/apache2/ssl/snapshots.linaro.org.crt
+    SSLCertificateKeyFile /etc/apache2/ssl/snapshots.linaro.org.key
+    SSLCertificateChainFile /etc/apache2/ssl/gd_bundle.crt
+
+    <Directory /srv/snapshots.linaro.org/linaro-license-protection/static>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    <Directory /srv/snapshots.linaro.org/www>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    XSendFile on
+    XSendFilePath /srv/snapshots.linaro.org/www
+
+    WSGIScriptAlias / /srv/snapshots.linaro.org/configs/wsgi/wsgi_snapshots.py
+    WSGIDaemonProcess linaro-license-protection-snapshots-ssl
+
+    <Directory /srv/snapshots.linaro.org/configs/wsgi>
+        <Files wsgi_snapshots.py>
+            Order deny,allow
+            Allow from all
+        </Files>
+    </Directory>
+
+    <Directory />
+        IndexOptions NameWidth=* +SuppressDescription
+        Options +Indexes +FollowSymLinks
+        IndexIgnore favicon.ico HEADER.html
+        AllowOverride FileInfo Indexes
+    </Directory>
+
+    <Location "/hwpacks">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/all-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    <Location "/openid/">
+        Allow from all
+        SetHandler mod_python
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption store-type file
+        PythonOption store-directory /var/cache/apache2/openid/
+        PythonOption allowed-op-list-url "file:///etc/apache2/security/allowed-ops.txt"
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/all-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    <Location "/android/~linaro-android-restricted">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/linaro-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    <Location "/precise/restricted">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/linaro-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/freescale /srv/landing-teams/hwpacks/freescale
+    <Location "/hwpacks/freescale">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/freescale-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/samsung /srv/landing-teams/hwpacks/samsung
+    <Location "/hwpacks/samsung">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/samsung-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/ste /srv/landing-teams/hwpacks/ste
+    <Location "/hwpacks/ste">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/ste-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/ti /srv/landing-teams/hwpacks/ti
+    <Location "/hwpacks/ti">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/ti-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/arm /srv/landing-teams/hwpacks/arm
+    <Location "/hwpacks/arm">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/arm-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+</VirtualHost>

=== added file 'apache/staging.releases.linaro.org'
--- apache/staging.releases.linaro.org	1970-01-01 00:00:00 +0000
+++ apache/staging.releases.linaro.org	2013-03-18 16:19:18 +0000
@@ -0,0 +1,39 @@
+<VirtualHost 91.189.95.80:80>
+    Alias /static/ /srv/staging.releases.linaro.org/linaro-license-protection/static/
+    DocumentRoot /srv/staging.releases.linaro.org/www
+    ServerName staging.releases.linaro.org
+    ServerAdmin [e-mail]
+    CustomLog /var/log/apache2/staging.releases.linaro.org-access.log combined
+    ErrorLog  /var/log/apache2/staging.releases.linaro.org-error.log
+
+    <Directory /srv/staging.releases.linaro.org/linaro-license-protection/static>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    <Directory /srv/staging.releases.linaro.org/www>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    XSendFile on
+    XSendFilePath /srv/staging.releases.linaro.org/www
+
+    WSGIScriptAlias / /srv/staging.releases.linaro.org/configs/wsgi/wsgi_staging_releases.py
+    WSGIDaemonProcess linaro-license-protection-staging-releases
+
+    <Directory /srv/staging.releases.linaro.org/configs/wsgi>
+        <Files wsgi_staging_releases.py>
+            Order deny,allow
+            Allow from all
+        </Files>
+    </Directory>
+
+    <Directory />
+        IndexOptions NameWidth=* +SuppressDescription
+        Options +Indexes +FollowSymLinks
+        IndexIgnore favicon.ico HEADER.html
+        AllowOverride FileInfo Indexes
+    </Directory>
+
+</VirtualHost>

=== added file 'apache/staging.snapshots.linaro.org'
--- apache/staging.snapshots.linaro.org	1970-01-01 00:00:00 +0000
+++ apache/staging.snapshots.linaro.org	2013-03-18 16:19:18 +0000
@@ -0,0 +1,154 @@
+<VirtualHost 91.189.95.80:80>
+
+    Alias /static/ /srv/staging.snapshots.linaro.org/linaro-license-protection/static/
+    DocumentRoot /srv/staging.snapshots.linaro.org/www
+    ServerName staging.snapshots.linaro.org
+    ServerAdmin [e-mail]
+    CustomLog /var/log/apache2/staging.snapshots.linaro.org-access.log combined
+    ErrorLog  /var/log/apache2/staging.snapshots.linaro.org-error.log
+
+    Redirect /hwpacks https://staging.snapshots.linaro.org/hwpacks
+    Redirect /precise/restricted https://staging.snapshots.linaro.org/precise/restricted
+
+    <Directory /srv/staging.snapshots.linaro.org/linaro-license-protection/static>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    <Directory /srv/staging.snapshots.linaro.org/www>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    XSendFile on
+    XSendFilePath /srv/staging.snapshots.linaro.org/www
+
+    WSGIScriptAlias / /srv/staging.snapshots.linaro.org/configs/wsgi/wsgi_staging_snapshots.py
+    WSGIDaemonProcess linaro-license-protection-staging-snapshots
+
+    <Directory /srv/staging.snapshots.linaro.org/configs/wsgi>
+        <Files wsgi_staging_snapshots.py>
+            Order deny,allow
+            Allow from all
+        </Files>
+    </Directory>
+
+    <Directory />
+        IndexOptions NameWidth=* +SuppressDescription
+        Options +Indexes +FollowSymLinks
+        IndexIgnore favicon.ico HEADER.html
+        AllowOverride FileInfo Indexes
+    </Directory>
+
+</VirtualHost>
+
+<VirtualHost 91.189.95.80:443>
+
+    Alias /static/ /srv/staging.snapshots.linaro.org/linaro-license-protection/static/
+    DocumentRoot /srv/staging.snapshots.linaro.org/www
+    ServerName staging.snapshots.linaro.org
+    ServerAdmin [e-mail]
+    CustomLog /var/log/apache2/staging.snapshots.linaro.org-access.log combined
+    ErrorLog  /var/log/apache2/staging.snapshots.linaro.org-error.log
+
+    SSLEngine On
+    SSLCertificateFile /etc/apache2/ssl/staging.snapshots.linaro.org.pem
+
+    <Directory /srv/staging.snapshots.linaro.org/linaro-license-protection/static>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    <Directory /srv/staging.snapshots.linaro.org/www>
+        Order deny,allow
+        Allow from all
+    </Directory>
+
+    XSendFile on
+    XSendFilePath /srv/staging.snapshots.linaro.org/www
+
+    WSGIScriptAlias / /srv/staging.snapshots.linaro.org/configs/wsgi/wsgi_staging_snapshots.py
+    WSGIDaemonProcess linaro-license-protection-staging-snapshots-ssl
+
+    <Directory /srv/staging.snapshots.linaro.org/configs/wsgi>
+        <Files wsgi_staging_snapshots.py>
+            Order deny,allow
+            Allow from all
+        </Files>
+    </Directory>
+
+    <Directory />
+        IndexOptions NameWidth=* +SuppressDescription
+        Options +Indexes +FollowSymLinks
+        IndexIgnore favicon.ico HEADER.html
+        AllowOverride FileInfo Indexes
+    </Directory>
+
+    <Location "/hwpacks">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/all-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    <Location "/openid/">
+        Allow from all
+        SetHandler mod_python
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption store-type file
+        PythonOption store-directory /var/cache/apache2/openid/
+        PythonOption allowed-op-list-url "file:///etc/apache2/security/allowed-ops.txt"
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/all-private-hwpack-teams.txt"
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/linaro-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    <Location "/precise/restricted">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/linaro-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/freescale /srv/landing-teams/hwpacks/freescale
+    <Location "/hwpacks/freescale">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/freescale-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/samsung /srv/landing-teams/hwpacks/samsung
+    <Location "/hwpacks/samsung">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/samsung-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/ste /srv/landing-teams/hwpacks/ste
+    <Location "/hwpacks/ste">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/ste-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/ti /srv/landing-teams/hwpacks/ti
+    <Location "/hwpacks/ti">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/ti-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+    Alias /hwpacks/arm /srv/landing-teams/hwpacks/arm
+    <Location "/hwpacks/arm">
+        PythonAccessHandler apache_openid::protect
+        PythonOption handler openidteams
+        PythonOption authorized-teams-list-url "file:///etc/apache2/security/arm-private-hwpack-teams.txt"
+        PythonOption action-path "/openid/"
+    </Location>
+
+</VirtualHost>

=== added directory 'django'
=== added file 'django/settings_releases.py'
--- django/settings_releases.py	1970-01-01 00:00:00 +0000
+++ django/settings_releases.py	2013-03-18 16:19:18 +0000
@@ -0,0 +1,54 @@
+# Settings for releases.linaro.org.
+
+from settings import *
+
+DEBUG = False
+
+ROOT_URLCONF = 'urls'
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': '/srv/releases.linaro.org/db/licenses.db',
+        'USER': '',
+        'PASSWORD': '',
+        'HOST': '',
+        'PORT': '',
+    }
+}
+
+TEMPLATE_DIRS = (
+    os.path.join(PROJECT_ROOT, "templates_releases" ),
+    os.path.join(PROJECT_ROOT, "templates" ),
+    )
+SERVED_PATHS = ['/srv/releases.linaro.org/www']
+
+# Render TEXTILE files settings.
+LINUX_FILES = ('README.textile',
+               'INSTALL.textile',
+               'HACKING.textile',
+               'FIRMWARE.textile',
+               'RTSM.textile')
+
+ANDROID_FILES = ('HOWTO_releasenotes.txt',
+                 'HOWTO_install.txt',
+                 'HOWTO_getsourceandbuild.txt',
+                 'HOWTO_flashfirmware.txt',
+                 'HOWTO_rtsm.txt')
+
+FILES_MAP = {'HOWTO_releasenotes.txt': 'Release Notes',
+             'HOWTO_install.txt': 'Binary Image Installation',
+             'HOWTO_getsourceandbuild.txt': 'Building From Source',
+             'HOWTO_flashfirmware.txt': 'Firmware Update',
+             'HOWTO_rtsm.txt': 'RTSM',
+             'README.textile': 'Release Notes',
+             'INSTALL.textile': 'Binary Image Installation',
+             'HACKING.textile': 'Building From Source',
+             'FIRMWARE.textile': 'Firmware Update',
+             'RTSM.textile': 'RTSM'}
+
+TAB_PRIORITY = ['Release Notes',
+                'Binary Image Installation',
+                'Building From Source',
+                'Firmware Update',
+                'RTSM']

=== added file 'django/settings_snapshots.py'
--- django/settings_snapshots.py	1970-01-01 00:00:00 +0000
+++ django/settings_snapshots.py	2013-03-18 16:19:18 +0000
@@ -0,0 +1,54 @@
+# Settings for snapshots.linaro.org.
+
+from settings import *
+
+DEBUG = False
+
+ROOT_URLCONF = 'urls'
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': '/srv/snapshots.linaro.org/db/licenses.db',
+        'USER': '',
+        'PASSWORD': '',
+        'HOST': '',
+        'PORT': '',
+    }
+}
+
+TEMPLATE_DIRS = (
+    os.path.join(PROJECT_ROOT, "templates_snapshots" ),
+    os.path.join(PROJECT_ROOT, "templates" ),
+    )
+SERVED_PATHS = ['/srv/snapshots.linaro.org/www']
+
+# Render TEXTILE files settings.
+LINUX_FILES = ('README',
+               'INSTALL',
+               'HACKING',
+               'FIRMWARE',
+               'RTSM')
+
+ANDROID_FILES = ('HOWTO_releasenotes.txt',
+                 'HOWTO_install.txt',
+                 'HOWTO_getsourceandbuild.txt',
+                 'HOWTO_flashfirmware.txt',
+                 'HOWTO_rtsm.txt')
+
+FILES_MAP = {'HOWTO_releasenotes.txt': 'Release Notes',
+             'HOWTO_install.txt': 'Binary Image Installation',
+             'HOWTO_getsourceandbuild.txt': 'Building From Source',
+             'HOWTO_flashfirmware.txt': 'Firmware Update',
+             'HOWTO_rtsm.txt': 'RTSM',
+             'README': 'Release Notes',
+             'INSTALL': 'Binary Image Installation',
+             'HACKING': 'Building From Source',
+             'FIRMWARE': 'Firmware Update',
+             'RTSM': 'RTSM'}
+
+TAB_PRIORITY = ['Release Notes',
+                'Binary Image Installation',
+                'Building From Source',
+                'Firmware Update',
+                'RTSM']

=== added file 'django/settings_staging_releases.py'
--- django/settings_staging_releases.py	1970-01-01 00:00:00 +0000
+++ django/settings_staging_releases.py	2013-03-18 16:19:18 +0000
@@ -0,0 +1,39 @@
+# Settings for staging.releases.linaro.org.
+
+from settings import *
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': '/srv/staging.releases.linaro.org/db/licenses.db',
+        'USER': '',
+        'PASSWORD': '',
+        'HOST': '',
+        'PORT': '',
+    }
+}
+
+TEMPLATE_DIRS = (
+    os.path.join(PROJECT_ROOT, "templates_releases" ),
+    os.path.join(PROJECT_ROOT, "templates" ),
+    )
+SERVED_PATHS = ['/srv/staging.releases.linaro.org/www']
+
+# Render TEXTILE files settings.
+LINUX_FILES = ('README.textile',
+               'INSTALL.textile',
+               'HACKING.textile',
+               'FIRMWARE.textile',
+               'RTSM.textile')
+
+FILES_MAP = {'HOWTO_releasenotes.txt': 'Release Notes',
+             'HOWTO_install.txt': 'Binary Image Installation',
+             'HOWTO_getsourceandbuild.txt': 'Building From Source',
+             'HOWTO_flashfirmware.txt': 'Firmware Update',
+             'HOWTO_rtsm.txt': 'RTSM',
+             'README.textile': 'Release Notes',
+             'INSTALL.textile': 'Binary Image Installation',
+             'HACKING.textile': 'Building From Source',
+             'FIRMWARE.textile': 'Firmware Update',
+             'RTSM.textile': 'RTSM'}
+

=== added file 'django/settings_staging_snapshots.py'
--- django/settings_staging_snapshots.py	1970-01-01 00:00:00 +0000
+++ django/settings_staging_snapshots.py	2013-03-18 16:19:18 +0000
@@ -0,0 +1,20 @@
+# Settings for staging.snapshots.linaro.org.
+
+from settings import *
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': '/srv/staging.snapshots.linaro.org/db/licenses.db',
+        'USER': '',
+        'PASSWORD': '',
+        'HOST': '',
+        'PORT': '',
+    }
+}
+
+TEMPLATE_DIRS = (
+    os.path.join(PROJECT_ROOT, "templates_snapshots" ),
+    os.path.join(PROJECT_ROOT, "templates" ),
+    )
+SERVED_PATHS = ['/srv/staging.snapshots.linaro.org/www']

=== added directory 'wsgi'
=== added file 'wsgi/wsgi_releases.py'
--- wsgi/wsgi_releases.py	1970-01-01 00:00:00 +0000
+++ wsgi/wsgi_releases.py	2013-03-18 16:19:18 +0000
@@ -0,0 +1,19 @@
+"""
+WSGI config for license_protected_downloads project.
+
+This file configures WSGI for releases.linaro.org.
+"""
+import os
+import sys
+sys.path.append("/usr/lib/python2.6/dist-packages")
+sys.path.append("/usr/lib/pymodules/python2.6")
+sys.path.append("/usr/lib/python2.6")
+
+sys.path.append("/srv/releases.linaro.org")
+sys.path.append("/srv/releases.linaro.org/linaro-license-protection")
+sys.path.append("/srv/releases.linaro.org/configs/django")
+
+os.environ["DJANGO_SETTINGS_MODULE"] = "settings_releases"
+
+import django.core.handlers.wsgi
+application = django.core.handlers.wsgi.WSGIHandler()

=== added file 'wsgi/wsgi_snapshots.py'
--- wsgi/wsgi_snapshots.py	1970-01-01 00:00:00 +0000
+++ wsgi/wsgi_snapshots.py	2013-03-18 16:19:18 +0000
@@ -0,0 +1,19 @@
+"""
+WSGI config for license_protected_downloads project.
+
+This file configures WSGI for snapshots.linaro.org.
+"""
+import os
+import sys
+sys.path.append("/usr/lib/python2.6/dist-packages")
+sys.path.append("/usr/lib/pymodules/python2.6")
+sys.path.append("/usr/lib/python2.6")
+
+sys.path.append("/srv/snapshots.linaro.org")
+sys.path.append("/srv/snapshots.linaro.org/linaro-license-protection")
+sys.path.append("/srv/snapshots.linaro.org/configs/django")
+
+os.environ["DJANGO_SETTINGS_MODULE"] = "settings_snapshots"
+
+import django.core.handlers.wsgi
+application = django.core.handlers.wsgi.WSGIHandler()

=== added file 'wsgi/wsgi_staging_releases.py'
--- wsgi/wsgi_staging_releases.py	1970-01-01 00:00:00 +0000
+++ wsgi/wsgi_staging_releases.py	2013-03-18 16:19:18 +0000
@@ -0,0 +1,19 @@
+"""
+WSGI config for license_protected_downloads project.
+
+This file configures WSGI for staging.releases.linaro.org.
+"""
+import os
+import sys
+sys.path.append("/usr/lib/python2.7/dist-packages")
+sys.path.append("/usr/lib/pymodules/python2.7")
+sys.path.append("/usr/lib/python2.7")
+
+sys.path.append("/srv/staging.releases.linaro.org")
+sys.path.append("/srv/staging.releases.linaro.org/linaro-license-protection")
+sys.path.append("/srv/staging.releases.linaro.org/configs/django")
+
+os.environ["DJANGO_SETTINGS_MODULE"] = "settings_staging_releases"
+
+import django.core.handlers.wsgi
+application = django.core.handlers.wsgi.WSGIHandler()

=== added file 'wsgi/wsgi_staging_snapshots.py'
--- wsgi/wsgi_staging_snapshots.py	1970-01-01 00:00:00 +0000
+++ wsgi/wsgi_staging_snapshots.py	2013-03-18 16:19:18 +0000
@@ -0,0 +1,19 @@
+"""
+WSGI config for license_protected_downloads project.
+
+This file configures WSGI for staging.snapshots.linaro.org.
+"""
+import os
+import sys
+sys.path.append("/usr/lib/python2.7/dist-packages")
+sys.path.append("/usr/lib/pymodules/python2.7")
+sys.path.append("/usr/lib/python2.7")
+
+sys.path.append("/srv/staging.snapshots.linaro.org")
+sys.path.append("/srv/staging.snapshots.linaro.org/linaro-license-protection")
+sys.path.append("/srv/staging.snapshots.linaro.org/configs/django")
+
+os.environ["DJANGO_SETTINGS_MODULE"] = "settings_staging_snapshots"
+
+import django.core.handlers.wsgi
+application = django.core.handlers.wsgi.WSGIHandler()