Open Stack

On Sat, May 19, 2018 at 07:21:22PM +0200, Thomas Goirand wrote:
> On 05/08/2018 07:55 PM, Matthew Treinish wrote:
> > I wrote up a doc about running under
> > apache when I added the uwsgi chunked transfer encoding support to glance about
> > running glance under apache here:
> > 
> > https://docs.openstack.org/glance/latest/admin/apache-httpd.html
> > 
> > Which includes how you have to configure things to get it working and a section
> > on why mod_wsgi doesn't work.
> 
> Thanks for that. Could you also push a uWSGI .ini configuration example
> file, as well as the mod_proxy example? There's so many options in uwsgi
> that I don't want to risk doing something wrong. I've pasted my config
> at the end of this message. Do you think it's also OK to use SSL
> directly with uwsgi, using the --https option? What about the 104 error
> that I've been experiencing? Is it because I'm not using mod_proxy?

There already are example configs in the glance repo. I pushed them up
when I added the documentation:

https://github.com/openstack/glance/tree/master/httpd

Those configs are are more or less just a mirror of what I setup for the
gate (and my personal cloud):

http://logs.openstack.org/47/566747/1/gate/tempest-full-py3/c7f3b2e/controller/logs/etc/glance/glance-uwsgi.ini.gz
http://logs.openstack.org/47/566747/1/gate/tempest-full-py3/c7f3b2e/controller/logs/apache_config/glance-wsgi-api_conf.txt.gz

The way I normally configure things is to do the ssl termination with
apache and then just limit the uwsgi socket on localhost. I haven't
tried setting up the ssl in uwsgi directly, since the idea was to
share a single web server with different endpoints off of it for
each api service. 

As for the 104 error there are several probable causes, without seeing
the full configuration and looking at the traffic it's hard to say
where the connections are getting reset. I would try getting your
config to mirror what we know to be working and then go from there.

> 
> BTW, there's no need to manually do the symlink, you can use instead:
> a2ensite uwsgi-glance-api.conf

Feel free to push a patch to update the docs.

> 
> Cheers,
> 
> Thomas Goirand (zigo)
> 
> 
> [uwsgi]
> ############################
> ### Generic UWSGI config ###
> ############################
> 
> # Override the default size for headers from the 4k default.
> buffer-size = 65535
> 
> # This avoids error 104: "Connection reset by peer"
> rem-header = Content-Lenght
> 
> # This is running standalone
> master = true
> 
> # Threads and processes
> enable-threads = true
> 
> processes = 4
> 
> # uwsgi recommends this to prevent thundering herd on accept.
> thunder-lock = true
> 
> plugins = python3
> 
> # This ensures that file descriptors aren't shared between the WSGI
> application processes.
> lazy-apps = true
> 
> # Log from the wsgi application: needs python3-pastescript as runtime
> depends.
> paste-logger = true
> 
> # automatically kill workers if master dies
> no-orphans = true
> 
> # exit instead of brutal reload on SIGTERM
> die-on-term = true
> 
> ##################################
> ### OpenStack service specific ###
> ##################################
> 
> # This is the standard port for the WSGI application, listening on all
> available IPs
> http-socket = :9292
> logto = /var/log/glance/glance-api.log
> name = glance-api
> uid = glance
> gid = glance
> chdir = /var/lib/glance
> wsgi-file = /usr/bin/glance-wsgi-api
> 
> __________________________________________________________________________
> OpenStack Development Mailing List (not for usage questions)
> Unsubscribe: OpenStack-dev-request at lists.openstack.org?subject:unsubscribe
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20180519/20b7c26d/attachment.sig>