SE-2170 Port changes not yet merged to upstream into our juniper release branch #225

CHANGELOG.md

@@ -2,6 +2,9 @@
 All notable changes to this project will be documented in this file.
 Add any new changes to the top(right below this line).
 
+- Role: edxapp
+  - Added `EDXAPP_SITE_CONFIGURATION` to allow creating/updating the `SiteConfiguration` values during provisioning.
+
 - Role: edxapp BREAKING_CHANGE
   - The sandbox environment that runs instructor written python code used to run python 2.7. We update the default to
     python 3.5 but provide a new variable to be able to go back to the old setting.  If `edxapp_sandbox_python_version`

playbooks/roles/ecommerce/defaults/main.yml

@@ -83,6 +83,7 @@ ECOMMERCE_SOCIAL_AUTH_REDIRECT_IS_HTTPS: false
 # Settings for affiliate cookie tracking
 ECOMMERCE_AFFILIATE_COOKIE_NAME: '{{ EDXAPP_AFFILIATE_COOKIE_NAME | default("dev_affiliate_id") }}'
 
+ECOMMERCE_OSCAR_DEFAULT_CURRENCY: 'USD'
 ECOMMERCE_OSCAR_FROM_EMAIL: 'oscar@example.com'
 
 # NOTE: The contents of the certificates should be set in private configuration
@@ -194,9 +195,13 @@ ECOMMERCE_CORS_ALLOW_CREDENTIALS: false
 
 ECOMMERCE_USERNAME_REPLACEMENT_WORKER: "OVERRIDE THIS WITH A VALID USERNAME"
 
+ECOMMERCE_SECURE_PROXY_SSL_HEADER: !!null
+
 ecommerce_service_config_overrides:
+  SECURE_PROXY_SSL_HEADER: '{{ ECOMMERCE_SECURE_PROXY_SSL_HEADER }}'
   LANGUAGE_COOKIE_NAME: '{{ ECOMMERCE_LANGUAGE_COOKIE_NAME }}'
   EDX_API_KEY: '{{ ECOMMERCE_EDX_API_KEY }}'
+  OSCAR_DEFAULT_CURRENCY: '{{ ECOMMERCE_OSCAR_DEFAULT_CURRENCY }}'
   OSCAR_FROM_EMAIL: '{{ ECOMMERCE_OSCAR_FROM_EMAIL }}'
 
   ENTERPRISE_SERVICE_URL: '{{ ECOMMERCE_ENTERPRISE_URL }}/enterprise/'

playbooks/roles/edx_django_service/templates/edx/app/nginx/sites-available/concerns/handle-ip-disclosure.j2

@@ -2,6 +2,11 @@
 # there is a TLS redirect to same box, and a TLS redirect to externally terminated TLS
 # version of this in nginx and in edx_django_service role.
 
+{% if NGINX_ALLOW_PRIVATE_IP_ACCESS %}
+# This regexp matches only public IP addresses.
+if ($host ~ "(\d+)(?<!10)\.(\d+)(?<!192\.168)(?<!172\.(1[6-9]|2\d|3[0-1]))\.(\d+)\.(\d+)") {
+{% else %}
 if ($host ~ "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") { 
+{% endif %}
   	return 403;
 } 

playbooks/roles/edx_django_service/templates/edx/app/nginx/sites-available/concerns/handle-tls-terminated-elsewhere-ip-disclosure.j2

@@ -3,7 +3,12 @@
 # there is a TLS redirect to same box, and a TLS redirect to externally terminated TLS
 # version of this in nginx and in edx_django_service role.
 
+{% if NGINX_ALLOW_PRIVATE_IP_ACCESS %}
+# This regexp matches only public IP addresses.
+if ($host ~ "(\d+)(?<!10)\.(\d+)(?<!192\.168)(?<!172\.(1[6-9]|2\d|3[0-1]))\.(\d+)\.(\d+)") {
+{% else %}
 if ($host ~ "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") { 
+{% endif %}
   set $test_ip_disclosure  A; 
 } 
 

playbooks/roles/edx_django_service_with_rendered_config/templates/edx/app/nginx/sites-available/concerns/handle-ip-disclosure.j2

@@ -2,6 +2,11 @@
 # there is a TLS redirect to same box, and a TLS redirect to externally terminated TLS
 # version of this in nginx and in edx_django_service_with_rendered_config role.
 
+{% if NGINX_ALLOW_PRIVATE_IP_ACCESS %}
+# This regexp matches only public IP addresses.
+if ($host ~ "(\d+)(?<!10)\.(\d+)(?<!192\.168)(?<!172\.(1[6-9]|2\d|3[0-1]))\.(\d+)\.(\d+)") {
+{% else %}
 if ($host ~ "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") { 
+{% endif %}
   	return 403;
 } 

playbooks/roles/edx_django_service_with_rendered_config/templates/edx/app/nginx/sites-available/concerns/handle-tls-terminated-elsewhere-ip-disclosure.j2

@@ -3,7 +3,12 @@
 # there is a TLS redirect to same box, and a TLS redirect to externally terminated TLS
 # version of this in nginx and in edx_django_service_with_rendered_config role.
 
+{% if NGINX_ALLOW_PRIVATE_IP_ACCESS %}
+# This regexp matches only public IP addresses.
+if ($host ~ "(\d+)(?<!10)\.(\d+)(?<!192\.168)(?<!172\.(1[6-9]|2\d|3[0-1]))\.(\d+)\.(\d+)") {
+{% else %}
 if ($host ~ "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") { 
+{% endif %}
   set $test_ip_disclosure  A; 
 } 
 

playbooks/roles/edxapp/defaults/main.yml

@@ -1741,3 +1741,23 @@ EDXAPP_LMS_LOCAL_CONFIG_FILE: "{{ UNENCRYPTED_CFG_DIR }}/lms.yml"
 EDXAPP_CMS_LOCAL_CONFIG_FILE: "{{ UNENCRYPTED_CFG_DIR }}/studio.yml"
 
 edxapp_staticfiles_storage_overrides: !!null
+
+# Accepts a list of dictionaries of the following form.
+# EDXAPP_SITE_CONFIGURATION:
+#   - site_id: 1
+#     values:
+#       foo: true
+#       bar: false
+#   - domain: example.com
+#     values:
+#       abc: true
+#   - values:
+#       xyz: true
+#
+# In each dictionary, the 'site_id' and the 'domain' keys are optional and the 'values' key
+# is required. However, only one of 'site_id', 'domain' can be specified due to the behaviour
+# of the 'create_or_update_site_configuration' management command. The 'values' key accepts a
+# dictionary of keys and values corresponding to the SiteConfiguration paramters to be added to the
+# SiteConfiguration instance.
+
+EDXAPP_SITE_CONFIGURATION: {}

playbooks/roles/edxapp/tasks/main.yml

@@ -27,7 +27,6 @@
     - { path: "{{ edxapp_theme_dir }}" }
     - { path: "{{ edxapp_staticfile_dir }}" }
     - { path: "{{ edxapp_course_static_dir }}" }
-    - { path: "{{ edxapp_course_data_dir }}" }
     # var should have more permissive permissions than the rest
     - { path: "{{ edxapp_data_dir }}", mode: "0775" }
     # directory to import the courses from github

playbooks/roles/edxapp/tasks/service_variant_config.yml

@@ -302,3 +302,11 @@
   tags:
     - gather_static_assets
     - assets
+
+- name: Create or update SiteConfiguration
+  include: site_configuration.yml
+  when: celery_worker is not defined and EDXAPP_SITE_CONFIGURATION
+  with_items: "{{ EDXAPP_SITE_CONFIGURATION }}"
+  become_user: "{{ edxapp_user }}"
+  tags:
+    - create_or_update_site_configuration

playbooks/roles/edxapp/tasks/site_configuration.yml

@@ -0,0 +1,42 @@
+---
+- name: Create or update SiteConfiguration
+  block:
+    - name: Create the SiteConfiguration JSON file
+      template:
+        src: "site_configuration.json.j2"
+        dest: "/tmp/site_configuration.json"
+
+    - name: Use the site_id if it is provided
+      set_fact:
+        site_identifier: "--site-id {{ item.site_id }}"
+      when: item.site_id is defined and item.domain is not defined
+
+    - name: Use the domain name if it is provided
+      set_fact:
+        site_identifier: "{{ item.domain }}"
+      when: item.domain is defined and item.site_id is not defined
+
+    - name: Fail if both site_id and domain are provided
+      fail:
+        msg: "Cannot specify the site_id and domain at the same time in {{ item }}"
+      when: item.domain is defined and item.site_id is defined
+
+    - name: Get the default SITE_ID
+      shell: ". {{ edxapp_app_dir }}/edxapp_env && {{ edxapp_venv_bin }}/python {{ edxapp_code_dir }}/manage.py lms print_setting SITE_ID 2>/dev/null"
+      register: default_site_id
+      when: item.site_id is not defined and item.domain is not defined
+
+    - name: Use the default SITE_ID as the site identifier
+      set_fact:
+        site_identifier: "--site-id {{ default_site_id.stdout }}"
+      when: item.site_id is not defined and item.domain is not defined
+
+    - name: Run create_or_update_site_configuration
+      shell: |
+        . {{ edxapp_app_dir }}/edxapp_env
+        {{ edxapp_venv_bin }}/python {{ edxapp_code_dir }}/manage.py lms create_or_update_site_configuration -f /tmp/site_configuration.json --enabled {{ site_identifier }}
+
+    - name: Remove the generated SiteConfiguration JSON file
+      file:
+        path: "/tmp/site_configuration.json"
+        state: absent

playbooks/roles/edxapp/templates/site_configuration.json.j2

@@ -0,0 +1 @@
+{{ item['values'] | to_nice_json }}

playbooks/roles/nginx/defaults/main.yml

@@ -35,6 +35,8 @@ PROSPECTUS_PREVIEW_NGINX_USERS:
 
 NGINX_ENABLE_SSL: False
 NGINX_REDIRECT_TO_HTTPS: False
+# Disable handling IP disclosure for private IP addresses. This is needed for ELB to run the health checks while using `NGINX_ENABLE_SSL`.
+NGINX_ALLOW_PRIVATE_IP_ACCESS: False
 NGINX_HSTS_MAX_AGE: 31536000
 # Set these to real paths on your
 # filesystem, otherwise nginx will

playbooks/roles/nginx/templates/edx/app/nginx/sites-available/handle-ip-disclosure.j2

@@ -2,6 +2,11 @@
 # there is a TLS redirect to same box, and a TLS redirect to externally terminated TLS
 # version of this in nginx and in edx_django_service role.
 
+{% if NGINX_ALLOW_PRIVATE_IP_ACCESS %}
+# This regexp matches only public IP addresses.
+if ($host ~ "(\d+)(?<!10)\.(\d+)(?<!192\.168)(?<!172\.(1[6-9]|2\d|3[0-1]))\.(\d+)\.(\d+)") {
+{% else %}
 if ($host ~ "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") { 
+{% endif %}
   	return 403;
 } 

playbooks/roles/nginx/templates/edx/app/nginx/sites-available/handle-tls-terminated-elsewhere-ip-disclosure.j2

@@ -2,7 +2,12 @@
 # there is a TLS redirect to same box, and a TLS redirect to externally terminated TLS
 # version of this in nginx and in edx_django_service role.
 
+{% if NGINX_ALLOW_PRIVATE_IP_ACCESS %}
+# This regexp matches only public IP addresses.
+if ($host ~ "(\d+)(?<!10)\.(\d+)(?<!192\.168)(?<!172\.(1[6-9]|2\d|3[0-1]))\.(\d+)\.(\d+)") {
+{% else %}
 if ($host ~ "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") { 
+{% endif %}
   set $test_ip_disclosure  A; 
 } 
 

playbooks/roles/simple_theme/files/default_skeleton/lms/static/sass/discussion/lms-discussion-bootstrap.scss

@@ -0,0 +1,2 @@
+@import 'lms/static/sass/discussion/lms-discussion-bootstrap';
+@import '../lms-overrides';

playbooks/roles/simple_theme/files/default_skeleton/lms/static/sass/partials/lms/theme/_variables-v1.scss

@@ -0,0 +1,2 @@
+@import '../common-variables';
+@import 'lms/static/sass/partials/lms/theme/variables-v1';

playbooks/roles/simple_theme/files/default_skeleton/lms/static/sass/partials/lms/theme/_variables.scss

@@ -0,0 +1,2 @@
+@import '../common-variables';
+@import 'lms/static/sass/partials/lms/theme/variables';

playbooks/roles/simple_theme/tasks/deploy.yml

@@ -91,7 +91,6 @@
   with_items:
     # List of files from ./templates to be processed
     - "lms/static/sass/common-variables.scss"
-    - "lms/static/sass/partials/lms/theme/_variables-v1.scss"
     - "lms/static/sass/_lms-overrides.scss"
 
 # Copying static files is done in two steps: create directories + copy files