Forum OpenACS Development: Re: Proposed corrections to OpenACS default nsopenssl configuration

Collapse
16: Re: Proposed corrections to OpenACS default nsopenssl configuration (response to 1)
Posted by Richard Hamilton on 11/01/10 12:03 AM
Jim,

When I said whoever last edited it, I didn't mean literally 'the last person to touch it'! I hadn't checked who it was, and I certainly wasn't trying to blame Gustaf!! God forbid! 😊

What is needed there is:

if { $database eq "oracle } {
    blah blah blah
  } else {
    ns_section "ns/db/driver/postgres"
    ns_param    pgbin        /usr/local/pgsql/bin
}

I also had assumed that the path to psql was derived from the PATH environment variable for the user Aolserver was running as, but today I learned from my efforts that this is not in fact the case. On my installations, when I run 'nsd -it /path/to/config.tcl -u user -g group' from inittab, and then log into nscp and type 'env get path', the value for PATH in the nsd environment is not the same as the PATH value that the user sees in a tty.

Correct me if I am wrong, but I conclude therefore that Aolserver therefore doesn't source the user's environment when launched from inittab with '-u user'. This would be analogous to the case of 'su user' vs. 'su - user'.

Consequently, this config parameter would seem to be essential. Adding it solved the problem for me!

Regards
Richard

Collapse
17: Re: Proposed corrections to OpenACS default nsopenssl configuration (response to 16)
Posted by Jim Lynch on 11/01/10 04:36 AM
Heya Richard,

Hmm, inittab... didn't realize that was how you were starting it, but it seems it could work out the same:

#!/bin/bash

export PATH=/usr/local/pgsql/bin:$PATH
export LD_LIBRARY_PATH=/usr/local/pgsql/lib

# with these exports, you should be able to run nsd and
# it should pick up PATH and LD_LIBRARY_PATH as set above.

nsd -it /path/to/config.tcl -u user -g group
# or
exec nsd -it /path/to/config.tcl -u user -g group

# as far as I know, it was never needed to put the pg dirs
# in the config file as long as they properly got
# transmitted to the process. For example, take a look at
# $service/etc/daemontools/run

Collapse
20: Re: Proposed corrections to OpenACS default nsopenssl configuration (response to 17)
Posted by Richard Hamilton on 11/01/10 11:47 AM
Jim,

On my distribution the PATH that the user switched Aolserver is passed is that niether of root nor the user to which it is switched.

I am sure that there probably is a way to do this with the environment variables, but why bother fiddling with that when a config entry specifically configures the server? In any case, if you want to configure a server to a specific version of PostgreSQL (i.e. also running an old ACS 4.6.3 site), this provides an elegant mechanism for doing it.

This config declaration certainly used to be in the config file and has been in my own config.tcl for over ten years.

Also, adding it completes the param structure and results in symmetry! 😉 Perhaps it is my obsessive nature, but why leave something out that has potential benefits just because it can be left out?

Regards
Richard

Collapse
21: Re: Proposed corrections to OpenACS default nsopenssl configuration (response to 20)
Posted by Jim Lynch on 11/01/10 01:44 PM
Heya Richard
I am sure that there probably is a way to do this with the environment variables,

Yes, there is definitely a way to do it with env vars, and I posted an example script in this thread which sets the env vars appropriately, and calls nsd with the example parameters you posted. There is another one floating around called nsd-postgres that feeds parameters fed to it to the nsd.

but why bother fiddling with that when a config entry specifically configures the server?

Because in at least the config file you show for your personal config, it's a hard wiring that IMO shouldn't appear in the config file.

Also in many postgres (and oracle too) installations, the dynamic libraries are not in the usual system-wide places in all dists, so setting a second environment variable, namely LD_LIBRARY_PATH is sometimes necessary. In the case of a postgres compiled in the default place (/usr/local/pgsql), this -is- the case and so setting the variable -is- necessary.

Collapse
22: Re: Proposed corrections to OpenACS default nsopenssl configuration (response to 21)
Posted by Jim Lynch on 11/01/10 01:50 PM
And so, why not set both vars, and leave out having to specify the pg bin and lib dirs in the config file.

One more clarification, it's perfectly OK for you to have your config file do anything you want; I didn't mean to imply otherwise, what I meant was that the default config supplied by openacs should be free of having to do that.

Collapse
23: Re: Proposed corrections to OpenACS default nsopenssl configuration (response to 22)
Posted by Richard Hamilton on 11/01/10 02:08 PM
Jim,

On my distribution I do have to set LD_LIBRARY_PATH in order to compile postgres (plus a few other nasty obscure little steps!). However, I run each Aolserver as a different user for each site for security reasons.

This would require that I set the two env vars for every username running nsd on the system instead of just for user postgres. Not a big ask, but extra configuration nonetheless.

On my setup I simply duplicate the config file and adjust the service specific details.

There is also the possibility that someone new to this would struggle with the environment variables whilst being able to fill in the gaps in the config.tcl.

I don't feel strongly either way, I am just feeding back the things I found as I updated by own config.tcl to match the latest default.

Certainly, anything we can do to remove obstacles to people getting it all running can only be good.

Thanks for the replies.

Regards
Richard