Subject: Some questions about configuration and the pgadmin4-v1-web package

From: Josh Berkus <[email-masked]>
Date: Thu, 20 Apr 2017 13:50:09 -0700

pgAdmin team, Devrim:

If I install the pgadmin4-v1-web package from Yum, it's a bit unclear on
what actual configuration needs to be done after that. Things I know
need to be done:

* running setup.py
* copying the httpd/conf.d/pgadmin4-web.conf.example file to a .conf file

Things I don't know if they need to be done:

1. creating data and log directories and assigning permissions on them
2. changing the permissions on the sqlite db
3. creating a config_local.py file and setting the five settings in it

Can you clarify?  I'm working on a container, and I'll also be happy to
contribute a doc if you can clarify via email.  Thanks.

-- 
Josh Berkus
Containers & Databases Oh My!

-- 
Sent via pgadmin-hackers mailing list ([email-masked])
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgadmin-hackers

---

From: Dave Page <[email-masked]>
Date: Fri, 21 Apr 2017 09:33:11 +0100

> contribute a doc if you can clarify via email.  Thanks.

I don't know how much of that work is done by the RPMs, so Devrim will need
to chime in on this one. I suspect you will need to do 1-3 though.

For a source/pip installation (would a pure Python installation be a better
basis for a container?), the docs at
https://www.pgadmin.org/docs4/1.x/server_deployment.html should cover
everything (patches to improve are always welcome of course).

-- 
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

---

From: Devrim Gündüz <[email-masked]>
Date: Fri, 21 Apr 2017 09:57:02 +0100

Hi Josh,

On Thu, 2017-04-20 at 13:50 -0700, Josh Berkus wrote:
> Can you clarify?  

On RHEL 7 / Fedora 25:

* systemctl enable pgadmin4-v1.service; systemctl start pgadmin4-v1.service
* cp /etc/httpd/conf.d/pgadmin4-v1.conf.sample /etc/httpd/conf.d/pgadmin4-
v1.conf
* systemctl start httpd.service

should be enough, at least this is what I just tested on my Fedora 25 box.

Regards,

-- 
Devrim Gündüz
EnterpriseDB: http://www.enterprisedb.com
PostgreSQL Danışmanı/Consultant, Red Hat Certified Engineer
Twitter: @DevrimGunduz , @DevrimGunduzTR

---

From: Josh Berkus <[email-masked]>
Date: Fri, 21 Apr 2017 09:56:29 -0700

> should be enough, at least this is what I just tested on my Fedora 25 box.

OK, Thanks!

Now I just have to decide if I want to ship a systemd container.
Probably not, because that will restrict folks using it.

---

From: Josh Berkus <[email-masked]>
Date: Fri, 21 Apr 2017 10:45:46 -0700

Devrim,

> * cp /etc/httpd/conf.d/pgadmin4-v1.conf.sample /etc/httpd/conf.d/pgadmin4-

One more question: the sample .conf doesn't have the
threads-and-1-process configuration recommended in the pgadmin docs.  Is
there a reason it doesn't need it?

---

From: Josh Berkus <[email-masked]>
Date: Fri, 21 Apr 2017 14:40:44 -0700

On 04/21/2017 02:14 PM, Josh Berkus wrote:
> So I just tried this, and it doesn't do any of the setup.
> 
> There's no config_local, and as far as I can tell the database isn't
> created.  It's hard to know for sure, though, because without a
> config_local I'm not sure where it would be located.
> 
> Error: [Fri Apr 21 21:02:32.080337 2017] [wsgi:error] [pid 26] [remote
> 76.115.138.49:35628] FileNotFoundError: [Errno 2] No such file or
> directory: '/usr/share/httpd/.pgadmin/pgadmin4.log'
> 
> ... certainly there is no /usr/share/httpd/.pgadmin directory
> 

Aha, here's the problem.  Setup is getting run as root, not as the user
httpd.  This means it's dropping .pgadmin into /root/, which the web
server can't access; it's "home" directory is /usr/share/httpd.
However, that directory isn't writable by the apache user, either.

There isn't an easy fix for this; on a default Fedora or CentOS system,
the only directory the apache user has read/write to is /tmp, as far as
I know.

Ideas?

---

From: Dave Page <[email-masked]>
Date: Mon, 24 Apr 2017 09:20:05 +0100

> there a reason it doesn't need it?

That's definitely required, otherwise you will end up with multiple DB
connection managers and have no way for client sessions to maintain
affinity with the right one.

---

From: Dave Page <[email-masked]>
Date: Mon, 24 Apr 2017 09:23:27 +0100

> the only directory the apache user has read/write to is /tmp, as far as

This is covered in the docs:
https://www.pgadmin.org/docs4/1.x/server_deployment.html

Create a directory, setup the config to use it as required, then chown the
database after running setup (which is probably easier than trying to run
it as the apache user directly).

---

From: Josh Berkus <[email-masked]>
Date: Tue, 25 Apr 2017 08:24:22 -0700

On 04/24/2017 01:23 AM, Dave Page wrote:
> Create a directory, setup the config to use it as required, then chown
> the database after running setup (which is probably easier than trying
> to run it as the apache user directly).
> 

I know how to fix my personal install (and container image).  But I want
to fix the RPM package so that it's fixed for most users.  Right now,
install from RPM is kind of broken.

Here's the changes that need to happen on the RPM:

1. Remove the QT dependencies for pgadmin4-v1-web

2. Have the RPM create /usr/share/httpd/.pgadmin, owned by apache user.
   (is this the best location?  If not, what is?)

3. Fix the systemd unit file so that the pgadmin4 unit is owned by apache.

4. (optional) set up files according to FDL standards, putting configs
for pgadmin4 in /etc/pgadmin and the db in /var/run/pgadmin (or similar).

Devrim, where is the source for this rpm build?

---

From: Josh Berkus <[email-masked]>
Date: Fri, 5 May 2017 19:43:57 -0700

> Devrim, where is the source for this rpm build?

Devrim?

---

From: Devrim Gündüz <[email-masked]>
Date: Mon, 08 May 2017 11:57:25 +0100

Hi Josh,

Sorry for the late response, I have 10K unread emails as of now:

> 1. Remove the QT dependencies for pgadmin4-v1-web

Why? I thought we need them to run pgadmin4?

>    (is this the best location?  If not, what is?)

Good question. I think that location is good.

> 3. Fix the systemd unit file so that the pgadmin4 unit is owned by apache.

Why? I did not read all the emails in this thread (yet), but all of the unit
files are owned by root, and I see no exception on my system.

> for pgadmin4 in /etc/pgadmin and the db in /var/run/pgadmin (or similar).

Red Hat does not care about that that much, does it? Especially for /etc part.

> Devrim, where is the source for this rpm build?

https://yum.postgresql.org/srpms/testing/10/redhat/rhel-7-x86_64/repoview/pgadmin4-v1.html

Regards,

---

From: Dave Page <[email-masked]>
Date: Mon, 8 May 2017 12:06:34 +0100

> Why? I thought we need them to run pgadmin4?

Only in desktop mode. For web-only use, no Qt should be needed.

> Red Hat does not care about that that much, does it? Especially for /etc

Debian does though. That's been on my TODO list for a while. It's pretty
easy to do though - we can have a config option in config.py to specify the
location of config_local.py, defaulting to the current location. Packagers
could then override that in config_distro.py.

---

From: Josh Berkus <[email-masked]>
Date: Mon, 8 May 2017 10:20:45 -0700

> Why? I thought we need them to run pgadmin4?

Not for pgadmin-web, see upthread.  Just for the desktop version.

And pulling in QT on RH/Fedora means pulling in all of Xorg, some 200MB
of additional packages.

> Good question. I think that location is good.

Going to go back on this, because I looked at Freedesktop standards.  It
should go in /var/lib/pgadmin or /var/run/pgadmin. This will mean
creating a config_local.py file to support this.

> files are owned by root, and I see no exception on my system.

Not the file itself, the *process*.  Right how you have the process
starting as root, which means that the permissions on the pgadmin
database are set wrong.

> Red Hat does not care about that that much, does it? Especially for /etc part.

True about the /etc/ part.  However, I can tell you that RH is pushing
security standards where nothing can write to /usr/ or /opt/ at runtime,
so I don't want to put the db in either of those master directories.

> https://yum.postgresql.org/srpms/testing/10/redhat/rhel-7-x86_64/repoview/pgadmin4-v1.html

No, I mean the rpm template files, not the source of the software.

---

From: Devrim Gündüz <[email-masked]>
Date: Wed, 10 May 2017 10:32:19 +0100

Hi,

> No, I mean the rpm template files, not the source of the software.

They are in git repo:

https://git.postgresql.org/gitweb/?p=pgrpms.git;a=tree;f=rpm/redhat/10/pgadmin4-v1/F-25;h=38dd5c1ad761688b3e8c9602fb1b2b48ccbda983;hb=HEAD

Regards,

---

From: Josh Berkus <[email-masked]>
Date: Wed, 10 May 2017 09:39:33 -0700

> https://git.postgresql.org/gitweb/?p=pgrpms.git;a=tree;f=rpm/redhat/10/pgadmin4-v1/F-25;h=38dd5c1ad761688b3e8c9602fb1b2b48ccbda983;hb=HEAD

Why am I not seeing a pgadmin-v1-web package here?  There is one in the
Yum repo.

---

From: Josh Berkus <[email-masked]>
Date: Wed, 10 May 2017 10:02:29 -0700

> Why am I not seeing a pgadmin-v1-web package here?  There is one in the

Oh, I see.  -web is defined as a variant package with additional
requirements.

So to make this work, pgadmin-v1-web needs to be a completely separate
package, no?

---

From: Devrim Gündüz <[email-masked]>
Date: Thu, 11 May 2017 08:54:40 +0100

Hi,

> So to make this work, pgadmin-v1-web needs to be a completely separate

I don't think so, we can define Requires: part separately.

Give me some time please, let me push today's releases out first, then next
week I can work on this while pushing 1.5 RPMs.

Can you please do me a favor, and create a ticket?

https://redmine.postgresql.org/projects/pgrpms/issues/new

You will be asked for your community user/pass.

Thanks!

Regards,

---

From: Josh Berkus <[email-masked]>
Date: Thu, 15 Jun 2017 14:32:39 -0700

> Can you please do me a favor, and create a ticket?

Created two tickets, actually.  Sorry about the delay, May was
conference-heavy.