From 220d18acda63a9714e56af5b80b783344acfcfbf Mon Sep 17 00:00:00 2001 From: Luis Moreno Date: Thu, 7 Nov 2019 13:44:25 -0400 Subject: [PATCH 1/5] Scormxblock with s3 --- playbooks/roles/nginx/defaults/main.yml | 2 ++ .../sites-available/extra_locations_lms.j2 | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/playbooks/roles/nginx/defaults/main.yml b/playbooks/roles/nginx/defaults/main.yml index acb2bfd9e21..498aa8bceee 100644 --- a/playbooks/roles/nginx/defaults/main.yml +++ b/playbooks/roles/nginx/defaults/main.yml @@ -67,6 +67,8 @@ NGINX_SSL_PROTOCOLS: "TLSv1.1 TLSv1.2" NGINX_DH_PARAMS_PATH: "/etc/ssl/private/dhparams.pem" NGINX_DH_KEYSIZE: 2048 +S3_DJFS_PYFS_BUCKET: !!null + # This can be one of 'p_combined' or 'ssl_combined' by default. If you # wish to specify your own format then define it in a configuration file # located under `nginx_conf_dir` and then use the format name specified diff --git a/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/extra_locations_lms.j2 b/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/extra_locations_lms.j2 index 2cbd6fa017f..1241be00d0c 100644 --- a/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/extra_locations_lms.j2 +++ b/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/extra_locations_lms.j2 @@ -9,3 +9,21 @@ expires 604800s; } {% endif %} +{% if S3_DJFS_PYFS_BUCKET %} + + location ^~ /media/djfs-pyfs/ { + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_set_header Authorization ''; + proxy_set_header Host {{ S3_DJFS_PYFS_BUCKET }}.s3.amazonaws.com; + proxy_hide_header x-amz-id-2; + proxy_hide_header x-amz-request-id; + proxy_hide_header x-amz-meta-server-side-encryption; + proxy_hide_header x-amz-server-side-encryption; + proxy_hide_header Set-Cookie; + proxy_ignore_headers Set-Cookie; + proxy_intercept_errors on; + add_header Cache-Control max-age=31536000; + proxy_pass https://{{ S3_DJFS_PYFS_BUCKET }}.s3.amazonaws.com/{{ S3_DJFS_PYFS_BUCKET }}/; + } +{% endif %} From da6a85a90d7d780a867c11879d50c5b811f4edc7 Mon Sep 17 00:00:00 2001 From: jfavellar90 Date: Wed, 20 Jan 2021 12:55:08 -0500 Subject: [PATCH 2/5] Bypassing CORS for fonts --- .../templates/edx/app/nginx/sites-available/static-files.j2 | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/static-files.j2 b/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/static-files.j2 index f2cc1966324..1916f42e6b3 100644 --- a/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/static-files.j2 +++ b/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/static-files.j2 @@ -25,9 +25,7 @@ # Prevent the browser from doing MIME-type sniffing add_header X-Content-Type-Options nosniff; -{% if EDXAPP_CORS_ORIGIN_WHITELIST|length > 0 %} - add_header Access-Control-Allow-Origin $cors_origin; -{% endif %} + add_header Access-Control-Allow-Origin *; try_files /staticfiles/$collected /course_static/$collected =404; } From 0c6c78a40a06b69dbde85da386febc93844aefa4 Mon Sep 17 00:00:00 2001 From: Eric Herrera Date: Wed, 7 Apr 2021 16:48:20 -0500 Subject: [PATCH 3/5] Add celery flags to workers command to avoid problems when incrementing the number of async servers. --- playbooks/roles/edxapp/defaults/main.yml | 2 ++ .../edx/app/supervisor/conf.d.available/workers.conf.j2 | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/playbooks/roles/edxapp/defaults/main.yml b/playbooks/roles/edxapp/defaults/main.yml index 6fc671faee5..6f4a57b6c46 100644 --- a/playbooks/roles/edxapp/defaults/main.yml +++ b/playbooks/roles/edxapp/defaults/main.yml @@ -1750,6 +1750,8 @@ edxapp_cms_variant: cms # Worker Settings worker_django_settings_module: '{{ EDXAPP_SETTINGS }}' EDXAPP_CELERY_HEARTBEAT_ENABLED: true +EDXAPP_CELERY_GOSSIP_ENABLED: true +EDXAPP_CELERY_MINGLE_ENABLED: true # Add default service worker users SERVICE_WORKER_USERS: diff --git a/playbooks/roles/edxapp/templates/edx/app/supervisor/conf.d.available/workers.conf.j2 b/playbooks/roles/edxapp/templates/edx/app/supervisor/conf.d.available/workers.conf.j2 index 245eb933c42..81a14566223 100644 --- a/playbooks/roles/edxapp/templates/edx/app/supervisor/conf.d.available/workers.conf.j2 +++ b/playbooks/roles/edxapp/templates/edx/app/supervisor/conf.d.available/workers.conf.j2 @@ -7,7 +7,7 @@ directory={{ edxapp_code_dir }} stdout_logfile={{ supervisor_log_dir }}/%(program_name)s-stdout.log stderr_logfile={{ supervisor_log_dir }}/%(program_name)s-stderr.log -command={{ edxapp_app_dir }}/worker.sh --app={{ w.service_variant }}.celery:APP --loglevel=info --queues=edx.{{ w.service_variant }}.core.{{ w.queue }} --hostname=edx.{{ w.service_variant }}.core.{{ w.queue }}.%%h --concurrency={{ w.concurrency }} {{ '--maxtasksperchild ' + w.max_tasks_per_child|string if w.max_tasks_per_child is defined else '' }} {{ '--without-heartbeat' if not EDXAPP_CELERY_HEARTBEAT_ENABLED|bool else '' }} {{ '-O ' + w.prefetch_optimization if w.prefetch_optimization is defined else '' }} +command={{ edxapp_app_dir }}/worker.sh --app={{ w.service_variant }}.celery:APP --loglevel=info --queues=edx.{{ w.service_variant }}.core.{{ w.queue }} --hostname=edx.{{ w.service_variant }}.core.{{ w.queue }}.%%h --concurrency={{ w.concurrency }} {{ '--maxtasksperchild ' + w.max_tasks_per_child|string if w.max_tasks_per_child is defined else '' }} {{ '--without-heartbeat' if not EDXAPP_CELERY_HEARTBEAT_ENABLED|bool else '' }} {{ '--without-gossip' if not EDXAPP_CELERY_GOSSIP_ENABLED|bool else '' }} {{ '--without-mingle' if not EDXAPP_CELERY_MINGLE_ENABLED|bool else '' }} {{ '-O ' + w.prefetch_optimization if w.prefetch_optimization is defined else '' }} killasgroup=true stopwaitsecs={{ w.stopwaitsecs | default(EDXAPP_WORKER_DEFAULT_STOPWAITSECS) }} ; Set autorestart to `true`. The default value for autorestart is `unexpected`, but celery < 4.x will exit From 6b446c26800f9181c145adf9141bea2059acc7c2 Mon Sep 17 00:00:00 2001 From: nadeemshahzad Date: Wed, 13 Apr 2022 13:33:30 +0500 Subject: [PATCH 4/5] fix: git clone (cherry picked from commit cedeb5a273b98e217d00af93faed7301ff31acd7) --- playbooks/roles/git_clone/tasks/main.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/playbooks/roles/git_clone/tasks/main.yml b/playbooks/roles/git_clone/tasks/main.yml index 09d3bf32dff..bad56a2c0c2 100644 --- a/playbooks/roles/git_clone/tasks/main.yml +++ b/playbooks/roles/git_clone/tasks/main.yml @@ -57,6 +57,7 @@ - name: Check that working tree is clean shell: test ! -e "{{ item }}" || git -C "{{ item }}" status --porcelain --untracked-files=no register: dirty_files + become_user: "{{ repo_owner }}" # Using the map here means that the items will only be the DESTINATION strings, # rather than the full GIT_REPOS structures, which have data we don't want to log, # so we don't have to use no_log on this task. @@ -113,7 +114,7 @@ - name: Run git clean after checking out code shell: cd {{ item.DESTINATION }} && git clean -xdf - become: true + become_user: "{{ repo_owner }}" with_items: "{{ GIT_REPOS }}" no_log: "{{ GIT_CLONE_NO_LOGGING }}" tags: From bb926b63f1cace2b457ed08a0e65292c381ab3db Mon Sep 17 00:00:00 2001 From: nadeemshahzad Date: Fri, 15 Apr 2022 16:26:44 +0500 Subject: [PATCH 5/5] fix: add safe directory config and use escalated privileges with git clean (cherry picked from commit 1f4ff355d9df684a215617ea7e3d8802864b6f8a) --- playbooks/roles/git_clone/tasks/main.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/playbooks/roles/git_clone/tasks/main.yml b/playbooks/roles/git_clone/tasks/main.yml index bad56a2c0c2..646b6536be5 100644 --- a/playbooks/roles/git_clone/tasks/main.yml +++ b/playbooks/roles/git_clone/tasks/main.yml @@ -112,9 +112,18 @@ - install - install:code +- name: Run git safe.directory + shell: git config --global --add safe.directory {{ item.DESTINATION }} + become: true + with_items: "{{ GIT_REPOS }}" + no_log: "{{ GIT_CLONE_NO_LOGGING }}" + tags: + - install + - install:code + - name: Run git clean after checking out code shell: cd {{ item.DESTINATION }} && git clean -xdf - become_user: "{{ repo_owner }}" + become: true with_items: "{{ GIT_REPOS }}" no_log: "{{ GIT_CLONE_NO_LOGGING }}" tags: