diff --git a/horizon/Dockerfile b/horizon/Dockerfile
index 3a3d72b..cff54e3 100644
--- a/horizon/Dockerfile
+++ b/horizon/Dockerfile
@@ -16,20 +16,29 @@ RUN set -x \
python-openstackclient \
&& apt-get -y clean
-EXPOSE 80
+
+EXPOSE 80 443
+
+COPY openstack-dashboard.conf /etc/apache2/conf-available/openstack-dashboard.conf
COPY local_settings.py /etc/openstack-dashboard/local_settings.py
# Add a redirect to /keystone instead of the "It works! page"
COPY 000-default.conf /etc/apache2/sites-available
+COPY run.sh /etc/run.sh
+
RUN chown -R www-data: /var/lib/openstack-dashboard/
RUN touch /var/log/horizon.log
RUN chown www-data: /var/log/horizon.log
-RUN chown horizon: /var/lib/openstack-dashboard/secret_key
+RUN a2enmod ssl
+RUN a2enmod headers
+RUN a2enmod rewrite
-CMD apachectl -DFOREGROUND
+RUN chown /var/lib/openstack-dashboard/secret_key horizon
+
+CMD /etc/run.sh
diff --git a/horizon/local_settings.py b/horizon/local_settings.py
index 47fcad6..2897fdb 100644
--- a/horizon/local_settings.py
+++ b/horizon/local_settings.py
@@ -37,7 +37,7 @@ EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
#EMAIL_HOST_PASSWORD = 'top-secret!'
OPENSTACK_HOST = os.environ['KEYSTONE_HOST']
-OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST
+OPENSTACK_KEYSTONE_URL = "https://%s:5000/v3" % OPENSTACK_HOST
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_"
@@ -266,7 +266,6 @@ TIME_ZONE = "UTC"
# ('default', 'Default', 'themes/default'),
# ('material', 'Material', 'themes/material'),
#]
-
LOGGING = {
'version': 1,
# When set to True this will disable all logging except
@@ -288,11 +287,12 @@ LOGGING = {
},
'console': {
# Set the level to "DEBUG" for verbose output logging.
- 'level': 'INFO',
- 'class': 'logging.StreamHandler',
+ 'level': 'DEBUG',
+ 'class': 'logging.FileHandler',
+ 'filename': '/var/log/horizon.log',
},
'operation': {
- 'level': 'INFO',
+ 'level': 'DEBUG',
'class': 'logging.StreamHandler',
'formatter': 'operation',
},
@@ -516,3 +516,12 @@ ALLOWED_HOSTS = '*'
COMPRESS_OFFLINE = True
ALLOWED_PRIVATE_SUBNET_CIDR = {'ipv4': [], 'ipv6': []}
+
+WEBSSO_ENABLED = True
+
+WEBSSO_CHOICES = (
+ ("credentials", _("Keystone Credentials")),
+ ("mapped", _("Security Assertion Markup Language"))
+ )
+
+WEBSSO_INITIAL_CHOICE = "mapped"
diff --git a/horizon/openstack-dashboard.conf b/horizon/openstack-dashboard.conf
new file mode 100644
index 0000000..3b591e0
--- /dev/null
+++ b/horizon/openstack-dashboard.conf
@@ -0,0 +1,35 @@
+
+ RedirectMatch "^/$" "/horizon"
+ ServerName oscloudtest01.hpc.rug.nl
+ RewriteEngine On
+ RewriteCond %{HTTPS} off
+ RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
+
+
+ RedirectMatch "^/$" "/horizon"
+ ServerName oscloudtest01.hpc.rug.nl
+
+ SSLEngine On
+ SSLCertificateFile "/certs/oscloudtest01.hpc.rug.nl.crt"
+ SSLCertificateKeyFile "/certs/oscloudtest01.hpc.rug.nl.key"
+ SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
+
+ # HTTP Strict Transport Security (HSTS) enforces that all communications
+ # with a server go over SSL. This mitigates the threat from attacks such
+ # as SSL-Strip which replaces links on the wire, stripping away https prefixes
+ # and potentially allowing an attacker to view confidential information on the
+ # wire
+ Header add Strict-Transport-Security "max-age=15768000"
+
+ Alias /horizon/static /var/lib/openstack-dashboard/static/
+ Alias /static /var/lib/openstack-dashboard/static/
+
+
+ Require all granted
+
+
+ WSGIScriptAlias /horizon /usr/share/openstack-dashboard/openstack_dashboard/wsgi/django.wsgi process-group=horizon
+ WSGIDaemonProcess horizon user=www-data group=www-data processes=3 threads=10 display-name=%{GROUP}
+ WSGIProcessGroup horizon
+
+
diff --git a/horizon/run.sh b/horizon/run.sh
new file mode 100755
index 0000000..dbbe712
--- /dev/null
+++ b/horizon/run.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+#Making the console log console again...
+tail -f /var/log/horizon.log &
+
+apachectl -DFOREGROUND
diff --git a/nova_compute/Dockerfile b/nova_compute/Dockerfile
index 109e763..ddb6b17 100644
--- a/nova_compute/Dockerfile
+++ b/nova_compute/Dockerfile
@@ -12,7 +12,7 @@ RUN set -x \
python-openstackclient \
nova-compute \
neutron-linuxbridge-agent \
- neutron-l3-agent \
+ neutron-l3-agent \
neutron-dhcp-agent \
neutron-metadata-agent \
python-ceph \