Re: [Kimchi-devel] [PATCH v6 0/4] Github #329: Kimchi must not run as root

From: Daniel Henrique Barboza <danielhb(a)linux.vnet.ibm.com&gt; New in v6: - Moved the SSL logic from server.py to proxy.py - server.py is now responsible to launch the proxy - removed references of 'ssl_port' New in v5: - fixes to VNC connection - fixes to unit tests - obscuring kimchid port by making it localhost only - launhing nginx proxy in unit tests New in v4: - added a new module with all nginx-related methods - added DEBIAN entries - other fixes proposed by Aline After reading the comments from Zhou Zheng Sheng, I simplified the work I did in version 2 to run only one cherrypy process instead of two processes, one for frontend and another for the backend. Nginx is still being used as a reverse proxy to allow kimchid to run as root, but not being exposed to the outside. As Zhou mentioned, it is to little avail to run frontend and backend separately if the exposed port is running by the reverse proxy anyway. He mentioned the RPC approach as a best long-term approach, which I agree. We can solve this issue right now and the work in a more suitable solution, such as RPC, and then ditch nginx. Daniel Henrique Barboza (4): Github #329: Proxy module and template file Github #329: Kimchid, config.py.in and server.py changes Github #329: changes in mockmodel, model/config and tests Github #329: .gitignore, spec, control.in and readme .gitignore | 1 + Makefile.am | 2 + contrib/DEBIAN/control.in | 3 +- contrib/kimchi.spec.fedora.in | 2 + contrib/kimchi.spec.suse.in | 2 + docs/README.md | 4 +- src/Makefile.am | 3 +- src/kimchi/config.py.in | 5 +- src/kimchi/mockmodel.py | 2 +- src/kimchi/model/config.py | 2 +- src/kimchi/proxy.py | 107 ++++++++++++++++++++++++++++++++++++++++++ src/kimchi/server.py | 44 +++++------------ src/kimchid.in | 44 ++++++++++++----- src/nginx.conf.in | 55 ++++++++++++++++++++++ tests/test_rest.py | 8 ++-- tests/utils.py | 10 +++- 16 files changed, 238 insertions(+), 56 deletions(-) create mode 100644 src/kimchi/proxy.py create mode 100644 src/nginx.conf.in