fix: add safe directory config and use escalated privileges with git (lilac.ednx)

playbooks/roles/edxapp/defaults/main.yml

@@ -1750,6 +1750,8 @@ edxapp_cms_variant: cms
 # Worker Settings
 worker_django_settings_module: '{{ EDXAPP_SETTINGS }}'
 EDXAPP_CELERY_HEARTBEAT_ENABLED: true
+EDXAPP_CELERY_GOSSIP_ENABLED: true
+EDXAPP_CELERY_MINGLE_ENABLED: true
 
 # Add default service worker users
 SERVICE_WORKER_USERS:

playbooks/roles/edxapp/templates/edx/app/supervisor/conf.d.available/workers.conf.j2

@@ -7,7 +7,7 @@ directory={{ edxapp_code_dir }}
 stdout_logfile={{ supervisor_log_dir }}/%(program_name)s-stdout.log
 stderr_logfile={{ supervisor_log_dir }}/%(program_name)s-stderr.log
 
-command={{ edxapp_app_dir }}/worker.sh --app={{ w.service_variant }}.celery:APP --loglevel=info --queues=edx.{{ w.service_variant }}.core.{{ w.queue }} --hostname=edx.{{ w.service_variant }}.core.{{ w.queue }}.%%h --concurrency={{ w.concurrency }} {{ '--maxtasksperchild ' + w.max_tasks_per_child|string if w.max_tasks_per_child is defined else '' }} {{ '--without-heartbeat' if not EDXAPP_CELERY_HEARTBEAT_ENABLED|bool else '' }} {{ '-O ' + w.prefetch_optimization if w.prefetch_optimization is defined else '' }}
+command={{ edxapp_app_dir }}/worker.sh --app={{ w.service_variant }}.celery:APP --loglevel=info --queues=edx.{{ w.service_variant }}.core.{{ w.queue }} --hostname=edx.{{ w.service_variant }}.core.{{ w.queue }}.%%h --concurrency={{ w.concurrency }} {{ '--maxtasksperchild ' + w.max_tasks_per_child|string if w.max_tasks_per_child is defined else '' }} {{ '--without-heartbeat' if not EDXAPP_CELERY_HEARTBEAT_ENABLED|bool else '' }} {{ '--without-gossip' if not EDXAPP_CELERY_GOSSIP_ENABLED|bool else '' }} {{ '--without-mingle' if not EDXAPP_CELERY_MINGLE_ENABLED|bool else '' }} {{ '-O ' + w.prefetch_optimization if w.prefetch_optimization is defined else '' }}
 killasgroup=true
 stopwaitsecs={{ w.stopwaitsecs | default(EDXAPP_WORKER_DEFAULT_STOPWAITSECS) }}
 ; Set autorestart to `true`. The default value for autorestart is `unexpected`, but celery < 4.x will exit

playbooks/roles/git_clone/tasks/main.yml

@@ -57,6 +57,7 @@
 - name: Check that working tree is clean
   shell: test ! -e "{{ item }}" || git -C "{{ item }}" status --porcelain --untracked-files=no
   register: dirty_files
+  become_user: "{{ repo_owner }}"
   # Using the map here means that the items will only be the DESTINATION strings,
   # rather than the full GIT_REPOS structures, which have data we don't want to log,
   # so we don't have to use no_log on this task.
@@ -111,6 +112,15 @@
     - install
     - install:code
 
+- name: Run git safe.directory
+  shell: git config --global --add safe.directory {{ item.DESTINATION }}
+  become: true
+  with_items: "{{ GIT_REPOS }}"
+  no_log: "{{ GIT_CLONE_NO_LOGGING }}"
+  tags:
+    - install
+    - install:code
+
 - name: Run git clean after checking out code
   shell: cd {{ item.DESTINATION }} && git clean -xdf
   become: true

playbooks/roles/nginx/defaults/main.yml

@@ -67,6 +67,8 @@ NGINX_SSL_PROTOCOLS: "TLSv1.1 TLSv1.2"
 NGINX_DH_PARAMS_PATH: "/etc/ssl/private/dhparams.pem"
 NGINX_DH_KEYSIZE: 2048
 
+S3_DJFS_PYFS_BUCKET: !!null
+
 # This can be one of 'p_combined' or 'ssl_combined' by default. If you
 # wish to specify your own format then define it in a configuration file
 # located under `nginx_conf_dir` and then use the format name specified

playbooks/roles/nginx/templates/edx/app/nginx/sites-available/extra_locations_lms.j2

@@ -9,3 +9,21 @@
         expires 604800s;
     }
 {% endif %}
+{% if S3_DJFS_PYFS_BUCKET %}
+
+    location ^~ /media/djfs-pyfs/ {
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_set_header Authorization '';
+        proxy_set_header Host {{ S3_DJFS_PYFS_BUCKET }}.s3.amazonaws.com;
+        proxy_hide_header x-amz-id-2;
+        proxy_hide_header x-amz-request-id;
+        proxy_hide_header x-amz-meta-server-side-encryption;
+        proxy_hide_header x-amz-server-side-encryption;
+        proxy_hide_header Set-Cookie;
+        proxy_ignore_headers Set-Cookie;
+        proxy_intercept_errors on;
+        add_header Cache-Control max-age=31536000;
+        proxy_pass https://{{ S3_DJFS_PYFS_BUCKET }}.s3.amazonaws.com/{{ S3_DJFS_PYFS_BUCKET }}/;
+    }
+{% endif %}

playbooks/roles/nginx/templates/edx/app/nginx/sites-available/static-files.j2

@@ -25,9 +25,7 @@
         # Prevent the browser from doing MIME-type sniffing
         add_header X-Content-Type-Options nosniff;
 
-{% if EDXAPP_CORS_ORIGIN_WHITELIST|length > 0 %}
-        add_header Access-Control-Allow-Origin $cors_origin;
-{% endif %}
+        add_header Access-Control-Allow-Origin *;
         try_files /staticfiles/$collected /course_static/$collected =404;
     }