mirror of
https://github.com/ansible/awx.git
synced 2026-01-13 02:50:02 -03:30
7d12427497
implement a whitelist setting that - if populated - will only allow specific IPs/hostnames to provide custom REMOTE_HOST_HEADERS header values (i.e., `HTTP_X_FORWARDED_FOR`) see: #6538
288 lines
9.8 KiB
Plaintext
288 lines
9.8 KiB
Plaintext
# Copyright (c) 2015 Ansible, Inc. (formerly AnsibleWorks, Inc.)
|
|
# All Rights Reserved.
|
|
|
|
# Local Django settings for AWX project. Rename to "local_settings.py" and
|
|
# edit as needed for your development environment.
|
|
|
|
# All variables defined in awx/settings/development.py will already be loaded
|
|
# into the global namespace before this file is loaded, to allow for reading
|
|
# and updating the default settings as needed.
|
|
|
|
###############################################################################
|
|
# MISC PROJECT SETTINGS
|
|
###############################################################################
|
|
import os
|
|
|
|
def patch_broken_pipe_error():
|
|
"""Monkey Patch BaseServer.handle_error to not write
|
|
a stacktrace to stderr on broken pipe.
|
|
http://stackoverflow.com/a/22618740/362702"""
|
|
import sys
|
|
from SocketServer import BaseServer
|
|
from wsgiref import handlers
|
|
|
|
handle_error = BaseServer.handle_error
|
|
log_exception = handlers.BaseHandler.log_exception
|
|
|
|
def is_broken_pipe_error():
|
|
type, err, tb = sys.exc_info()
|
|
return "Connection reset by peer" in repr(err)
|
|
|
|
def my_handle_error(self, request, client_address):
|
|
if not is_broken_pipe_error():
|
|
handle_error(self, request, client_address)
|
|
|
|
def my_log_exception(self, exc_info):
|
|
if not is_broken_pipe_error():
|
|
log_exception(self, exc_info)
|
|
|
|
BaseServer.handle_error = my_handle_error
|
|
handlers.BaseHandler.log_exception = my_log_exception
|
|
|
|
patch_broken_pipe_error()
|
|
|
|
|
|
ADMINS = (
|
|
# ('Your Name', 'your_email@domain.com'),
|
|
)
|
|
|
|
MANAGERS = ADMINS
|
|
|
|
# Database settings to use PostgreSQL for development.
|
|
DATABASES = {
|
|
'default': {
|
|
'ENGINE': 'transaction_hooks.backends.postgresql_psycopg2',
|
|
'NAME': 'awx-dev',
|
|
'USER': 'awx-dev',
|
|
'PASSWORD': 'AWXsome1',
|
|
'ATOMIC_REQUESTS': True,
|
|
'HOST': 'postgres',
|
|
'PORT': '',
|
|
}
|
|
}
|
|
|
|
# Use SQLite for unit tests instead of PostgreSQL. If the lines below are
|
|
# commented out, Django will create the test_awx-dev database in PostgreSQL to
|
|
# run unit tests.
|
|
if is_testing(sys.argv):
|
|
DATABASES = {
|
|
'default': {
|
|
'ENGINE': 'transaction_hooks.backends.sqlite3',
|
|
'NAME': os.path.join(BASE_DIR, 'awx.sqlite3'),
|
|
'TEST': {
|
|
# Test database cannot be :memory: for celery/inventory tests.
|
|
'NAME': os.path.join(BASE_DIR, 'awx_test.sqlite3'),
|
|
},
|
|
}
|
|
}
|
|
|
|
MONGO_DB = 'system_tracking_test'
|
|
|
|
# Celery AMQP configuration.
|
|
BROKER_URL = "amqp://{}:{}@{}/{}".format(os.environ.get("RABBITMQ_USER"),
|
|
os.environ.get("RABBITMQ_PASS"),
|
|
os.environ.get("RABBITMQ_HOST"),
|
|
os.environ.get("RABBITMQ_VHOST"))
|
|
|
|
CHANNEL_LAYERS = {
|
|
'default': {'BACKEND': 'asgi_amqp.AMQPChannelLayer',
|
|
'ROUTING': 'awx.main.routing.channel_routing',
|
|
'CONFIG': {'url': BROKER_URL}}
|
|
}
|
|
|
|
# Mongo host configuration
|
|
MONGO_HOST = NotImplemented
|
|
|
|
# Set True to enable additional logging from the job_event_callback plugin
|
|
JOB_CALLBACK_DEBUG = False
|
|
|
|
# Absolute filesystem path to the directory to host projects (with playbooks).
|
|
# This directory should NOT be web-accessible.
|
|
PROJECTS_ROOT = '/projects/'
|
|
|
|
# Absolute filesystem path to the directory for job status stdout
|
|
# This directory should not be web-accessible
|
|
JOBOUTPUT_ROOT = os.path.join(BASE_DIR, 'job_status')
|
|
|
|
# The UUID of the system, for HA.
|
|
SYSTEM_UUID = '00000000-0000-0000-0000-000000000000'
|
|
|
|
# Local time zone for this installation. Choices can be found here:
|
|
# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name
|
|
# although not all choices may be available on all operating systems.
|
|
# On Unix systems, a value of None will cause Django to use the same
|
|
# timezone as the operating system.
|
|
# If running in a Windows environment this must be set to the same as your
|
|
# system time zone.
|
|
TIME_ZONE = None
|
|
|
|
# Language code for this installation. All choices can be found here:
|
|
# http://www.i18nguy.com/unicode/language-identifiers.html
|
|
LANGUAGE_CODE = 'en-us'
|
|
|
|
# SECURITY WARNING: keep the secret key used in production secret!
|
|
# Hardcoded values can leak through source control. Consider loading
|
|
# the secret key from an environment variable or a file instead.
|
|
SECRET_KEY = 'p7z7g1ql4%6+(6nlebb6hdk7sd^&fnjpal308%n%+p^_e6vo1y'
|
|
|
|
# HTTP headers and meta keys to search to determine remote host name or IP. Add
|
|
# additional items to this list, such as "HTTP_X_FORWARDED_FOR", if behind a
|
|
# reverse proxy.
|
|
REMOTE_HOST_HEADERS = ['REMOTE_ADDR', 'REMOTE_HOST']
|
|
|
|
# If Tower is behind a reverse proxy/load balancer, use this setting to
|
|
# whitelist the proxy IP addresses from which Tower should trust custom
|
|
# REMOTE_HOST_HEADERS header values
|
|
# REMOTE_HOST_HEADERS = ['HTTP_X_FORWARDED_FOR', ''REMOTE_ADDR', 'REMOTE_HOST']
|
|
# PROXY_IP_WHITELIST = ['10.0.1.100', '10.0.1.101']
|
|
# If this setting is an empty list (the default), the headers specified by
|
|
# REMOTE_HOST_HEADERS will be trusted unconditionally')
|
|
PROXY_IP_WHITELIST = []
|
|
|
|
# Define additional environment variables to be passed to subprocess started by
|
|
# the celery task.
|
|
#AWX_TASK_ENV['FOO'] = 'BAR'
|
|
|
|
# If set, use -vvv for project updates instead of -v for more output.
|
|
# PROJECT_UPDATE_VVV=True
|
|
|
|
# Set verbosity for inventory import command when running inventory updates.
|
|
# INVENTORY_UPDATE_VERBOSITY=1
|
|
|
|
###############################################################################
|
|
# EMAIL SETTINGS
|
|
###############################################################################
|
|
|
|
# Email address that error messages come from.
|
|
SERVER_EMAIL = 'root@localhost'
|
|
|
|
# The email backend to use. For possible shortcuts see django.core.mail.
|
|
# The default is to use the SMTP backend.
|
|
# Third-party backends can be specified by providing a Python path
|
|
# to a module that defines an EmailBackend class.
|
|
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
|
|
|
|
# Host for sending email.
|
|
EMAIL_HOST = 'localhost'
|
|
|
|
# Port for sending email.
|
|
EMAIL_PORT = 25
|
|
|
|
# Optional SMTP authentication information for EMAIL_HOST.
|
|
EMAIL_HOST_USER = ''
|
|
EMAIL_HOST_PASSWORD = ''
|
|
EMAIL_USE_TLS = False
|
|
|
|
# Default email address to use for various automated correspondence from
|
|
# the site managers.
|
|
DEFAULT_FROM_EMAIL = 'webmaster@localhost'
|
|
|
|
# Subject-line prefix for email messages send with django.core.mail.mail_admins
|
|
# or ...mail_managers. Make sure to include the trailing space.
|
|
EMAIL_SUBJECT_PREFIX = '[AWX] '
|
|
|
|
###############################################################################
|
|
# LOGGING SETTINGS
|
|
###############################################################################
|
|
|
|
# Enable logging to syslog. Setting level to ERROR captures 500 errors,
|
|
# WARNING also logs 4xx responses.
|
|
|
|
LOGGING['handlers']['syslog'] = {
|
|
'level': 'WARNING',
|
|
'filters': ['require_debug_false'],
|
|
'class': 'django.utils.log.NullHandler',
|
|
'formatter': 'simple',
|
|
}
|
|
|
|
# Enable the following lines to also log to a file.
|
|
#LOGGING['handlers']['file'] = {
|
|
# 'class': 'logging.FileHandler',
|
|
# 'filename': os.path.join(BASE_DIR, 'awx.log'),
|
|
# 'formatter': 'simple',
|
|
#}
|
|
|
|
# Enable the following lines to turn on lots of permissions-related logging.
|
|
#LOGGING['loggers']['awx.main.access']['propagate'] = True
|
|
#LOGGING['loggers']['awx.main.signals']['propagate'] = True
|
|
#LOGGING['loggers']['awx.main.permissions']['propagate'] = True
|
|
|
|
# Enable the following line to turn on database settings logging.
|
|
#LOGGING['loggers']['awx.conf']['level'] = 'DEBUG'
|
|
|
|
# Enable the following lines to turn on LDAP auth logging.
|
|
#LOGGING['loggers']['django_auth_ldap']['handlers'] = ['console']
|
|
#LOGGING['loggers']['django_auth_ldap']['level'] = 'DEBUG'
|
|
|
|
###############################################################################
|
|
# SCM TEST SETTINGS
|
|
###############################################################################
|
|
|
|
# Define these variables to enable more complete testing of project support for
|
|
# SCM updates. The test repositories listed do not have to contain any valid
|
|
# playbooks.
|
|
|
|
try:
|
|
path = os.path.expanduser(os.path.expandvars('~/.ssh/id_rsa'))
|
|
TEST_SSH_KEY_DATA = file(path, 'rb').read()
|
|
except IOError:
|
|
TEST_SSH_KEY_DATA = ''
|
|
|
|
TEST_GIT_USERNAME = ''
|
|
TEST_GIT_PASSWORD = ''
|
|
TEST_GIT_KEY_DATA = TEST_SSH_KEY_DATA
|
|
TEST_GIT_PUBLIC_HTTPS = 'https://github.com/ansible/ansible.github.com.git'
|
|
TEST_GIT_PRIVATE_HTTPS = 'https://github.com/ansible/product-docs.git'
|
|
TEST_GIT_PRIVATE_SSH = 'git@github.com:ansible/product-docs.git'
|
|
|
|
TEST_HG_USERNAME = ''
|
|
TEST_HG_PASSWORD = ''
|
|
TEST_HG_KEY_DATA = TEST_SSH_KEY_DATA
|
|
TEST_HG_PUBLIC_HTTPS = 'https://bitbucket.org/cchurch/django-hotrunner'
|
|
TEST_HG_PRIVATE_HTTPS = ''
|
|
TEST_HG_PRIVATE_SSH = ''
|
|
|
|
TEST_SVN_USERNAME = ''
|
|
TEST_SVN_PASSWORD = ''
|
|
TEST_SVN_PUBLIC_HTTPS = 'https://github.com/ansible/ansible.github.com'
|
|
TEST_SVN_PRIVATE_HTTPS = 'https://github.com/ansible/product-docs'
|
|
|
|
# To test repo access via SSH login to localhost.
|
|
import getpass
|
|
TEST_SSH_LOOPBACK_USERNAME = getpass.getuser()
|
|
TEST_SSH_LOOPBACK_PASSWORD = ''
|
|
|
|
###############################################################################
|
|
# INVENTORY IMPORT TEST SETTINGS
|
|
###############################################################################
|
|
|
|
# Define these variables to enable more complete testing of inventory import
|
|
# from cloud providers.
|
|
|
|
# EC2 credentials
|
|
TEST_AWS_ACCESS_KEY_ID = ''
|
|
TEST_AWS_SECRET_ACCESS_KEY = ''
|
|
TEST_AWS_REGIONS = 'all'
|
|
# Check IAM STS credentials
|
|
TEST_AWS_SECURITY_TOKEN = ''
|
|
|
|
# Rackspace credentials
|
|
TEST_RACKSPACE_USERNAME = ''
|
|
TEST_RACKSPACE_API_KEY = ''
|
|
TEST_RACKSPACE_REGIONS = 'all'
|
|
|
|
# VMware credentials
|
|
TEST_VMWARE_HOST = ''
|
|
TEST_VMWARE_USER = ''
|
|
TEST_VMWARE_PASSWORD = ''
|
|
|
|
# OpenStack credentials
|
|
TEST_OPENSTACK_HOST = ''
|
|
TEST_OPENSTACK_USER = ''
|
|
TEST_OPENSTACK_PASSWORD = ''
|
|
TEST_OPENSTACK_PROJECT = ''
|
|
|
|
# Azure credentials.
|
|
TEST_AZURE_USERNAME = ''
|
|
TEST_AZURE_KEY_DATA = ''
|