search

ucphhpc / docker-migrid

Containerized MiG
GNU General Public License v2.0
3 stars 6 forks source link

Remove explicit IP bind in Apache Config #56

Open benibr opened 5 months ago

benibr commented 5 months ago

To make the whole setup ready for deployment on multiple hosts, I guess it's a good idea to remove the Apache Listens on the different domains and let them listen on 0.0.0.0 & ::/0 per default and only selecting vhosts by hostname. That way container could be started easily on any host enabling the option for having multiple IPs per Domain in DNS, using a Loadbalancer which forwards traffic to application servers running Migrid or even using Anycast Routing. Also this would make the Apache config way simple :-)

jonasbardino commented 5 months ago

Thanks for the suggestion - the use cases you mention seem quite reasonable especially in a future fully distributed container setup. I think this would mainly have to be implemented as a generateconf option in the core migrid codebase, and I can see at least one immediate issue with using it on existing sites where the webdavs service happens to run on the same host/vm as apache. In that situation apache will hijack port 443 on all IPs including the IO host, which is normally used for webdavs, even if only firewall forwarded to an actual high port where the non-privileged mig user can listen. The openid service also preferably should be exposed on port 443 for firewall-friendliness, but I think that part is already solved with the transparent apache proxy to the high port. A similar solution could perhaps be developed for webdavs, and in that case would probably gain performance from moving the whole TLS-handling into apache and only proxy internally to the raw openid service.

benibr commented 5 months ago

Ah okay, since I only remember WebDAVs using port 4443 I thought that would already be the same as with OpenID. Anyway I think the MiGrid project should be guided into a direction without those IP bindings to become more flexible and easy to configure. I strongly advise against making this an option in generateconfs.py as the apache config generation is already extremely complicated and would suffer even more. I also agree that TLS offloading in Apache is a good idea.