> On 11 Jun 2018, at 1:37 am, Joel Weinfeld <[email protected]> wrote: > > Hi - > > I set the WSGIApplicationGroup to the group ... it did not solve the > problem > > BTW ... our apache run as the owner of that dir ... and the env variables are > set to point to the git settings
Not really a good idea to run the whole of Apache as a different user. Use mod_wsgi daemon mode and set up just that daemon process group to run as the different user, but only change the user for that even if it is essential. > > SELinux is disabled > > #-> cat /etc/httpd/conf.d/microservices.conf > LoadModule wsgi_module /usr/lib64/httpd/modules/mod_wsgi.so > WSGIScriptAlias / /opt/xxx/cloud_automation/micro-services/flask.wsgi > #WSGIPythonPath > /opt/xxx/cloud_automation/micro-services/:/usr/venv/lib/python3.6/site-packages > wSGIScriptReloading On WSGIScriptReloading is not needed. That is the default. > WSGIPassAuthorization On Only needed if your WSGI application is handling HTTP basic authentication. > WSGIRestrictStdout Off > WSGIRestrictStdin Off Neither of these is needed. They are the default. > WSGIRestrictSignal Off You should not disable the restrictions on setting signal handlers unless you have an absolute need. This can interfere with operation of Apache and mod_wsgi. Setting your own signal handlers will also only work in a very specific use case when using Apache with multi process and single thread configuration. > WSGIApplicationGroup xxx You should look at using daemon mode of mod_wsgi. Don't use embedded mode unless you have a very specific need that requires it. > SetEnv GIT_CONFIG /home/xxx/.gitconfig > SetEnv GIT_PYTHON_TRACE full These will not set process environment variables in the processes if that is what you are expecting. This likely is why things aren't working. You should use daemon mode. When you have daemon mode running, set the environment variables in os.environ at the start of your WSGI script file. Graham > .... > > > On Sun, Jun 10, 2018 at 1:25 AM, Graham Dumpleton <[email protected] > <mailto:[email protected]>> wrote: > Few things to be aware of. > > Your code under mod_wsgi by default runs as the Apache user. If you git > operations rely on picking up SSH keys from your home account, it will not > work. You would need to use daemon mode and set the user for the daemon mode > account to be your user for it to find your SSH keys. > > Next, ensure you are using daemon mode and that only that WSGI application is > delegated to the daemon process group. Then ensure using main interpreter > context by using: > > WSGIApplicationGroup %{GLOBAL} > > in appropriate context, or use the: > > application-group=%{GLOBAL} > > option to WSGIScriptAlias. > > Finally on RHEL, it may have in place SELinux restrictions which are > presenting the operation from succeeding. > > Graham > >> On 9 Jun 2018, at 3:34 am, Joel Weinfeld <[email protected] >> <mailto:[email protected]>> wrote: >> >> Hi - >> >> I am having a problem with apache using mod_wsgi and python 3.6 on RedHat >> 7.2 using the gitpython package .... specifically the push ... >> >> I get no errors ... the server that I am pushing to ... receives no push >> ... the result from the push is: >> 2018-06-08 13:03:17,584 - ProcessGit - INFO - push:[] >> Documentaion states: >> If the operation fails completely, the length of the returned IterableList >> will >> be null.""" >> >> >> The same code on the same machine running through Flask runserver ... Works >> 2018-06-08 11:48:01,593 - ProcessGit - INFO - push:[<git.remote.PushInfo >> object at 0x7f1c3cf34518>] >> >> The call that I am using is: >> ..... >> repo_origin = repo_ref.remotes.origin >> repo_origin.push() >> >> #-> /usr/sbin/httpd -V >> Server version: Apache/2.4.6 (Red Hat Enterprise Linux) >> Server built: Sep 17 2015 09:06:30 >> Server's Module Magic Number: 20120211:24 >> Server loaded: APR 1.4.8, APR-UTIL 1.5.2 >> Compiled using: APR 1.4.8, APR-UTIL 1.5.2 >> Architecture: 64-bit >> Server MPM: prefork >> threaded: no >> forked: yes (variable process count) >> Server compiled with.... >> -D APR_HAS_SENDFILE >> -D APR_HAS_MMAP >> -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled) >> -D APR_USE_SYSVSEM_SERIALIZE >> -D APR_USE_PTHREAD_SERIALIZE >> -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT >> -D APR_HAS_OTHER_CHILD >> -D AP_HAVE_RELIABLE_PIPED_LOGS >> -D DYNAMIC_MODULE_LIMIT=256 >> -D HTTPD_ROOT="/etc/httpd" >> -D SUEXEC_BIN="/usr/sbin/suexec" >> -D DEFAULT_PIDLOG="/run/httpd/httpd.pid" >> -D DEFAULT_SCOREBOARD="logs/apache_runtime_status" >> -D DEFAULT_ERRORLOG="logs/error_log" >> -D AP_TYPES_CONFIG_FILE="conf/mime.types" >> -D SERVER_CONFIG_FILE="conf/httpd.conf" >> >> >> >> -- >> You received this message because you are subscribed to the Google Groups >> "modwsgi" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] >> <mailto:[email protected]>. >> To post to this group, send email to [email protected] >> <mailto:[email protected]>. >> Visit this group at https://groups.google.com/group/modwsgi >> <https://groups.google.com/group/modwsgi>. >> For more options, visit https://groups.google.com/d/optout >> <https://groups.google.com/d/optout>. > > > -- > You received this message because you are subscribed to the Google Groups > "modwsgi" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] > <mailto:[email protected]>. > To post to this group, send email to [email protected] > <mailto:[email protected]>. > Visit this group at https://groups.google.com/group/modwsgi > <https://groups.google.com/group/modwsgi>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. > > > -- > You received this message because you are subscribed to the Google Groups > "modwsgi" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] > <mailto:[email protected]>. > To post to this group, send email to [email protected] > <mailto:[email protected]>. > Visit this group at https://groups.google.com/group/modwsgi > <https://groups.google.com/group/modwsgi>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. -- You received this message because you are subscribed to the Google Groups "modwsgi" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/modwsgi. For more options, visit https://groups.google.com/d/optout.
