Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/scripts/setup/configure-rabbitmq

25 lines
983 B
Plaintext
Raw Permalink Normal View History

Add support for running OpenBSD in development environment.
2016-01-12 13:08:43 +01:00
#!/usr/bin/env bash
[manual] Use rabbitmq queue to process UserActivity. Before this is deployed, we need to install rabbitmq and pika on the target server (see the puppet part of this commit for how). When this is deployed, we need to start the new user activity bot: ./manage.py process_user_activity in the screen session on the relevant server, or user_activity logs won't be processed (which will eventually result in all users getting notifications about how their mirrors are out of date). (imported from commit 44d605aca0290bef2c94fb99267e15e26b21673b)
2013-01-11 21:16:42 +01:00
#
Change Humbug => Zulip in text/comments. (imported from commit 2f9d73431ae40e1b9e9e11bc2f4f62f566ae758a)
2013-08-06 21:32:15 +02:00
# Delete the "guest" default user and replace it with a Zulip user
[manual] Use rabbitmq queue to process UserActivity. Before this is deployed, we need to install rabbitmq and pika on the target server (see the puppet part of this commit for how). When this is deployed, we need to start the new user activity bot: ./manage.py process_user_activity in the screen session on the relevant server, or user_activity logs won't be processed (which will eventually result in all users getting notifications about how their mirrors are out of date). (imported from commit 44d605aca0290bef2c94fb99267e15e26b21673b)
2013-01-11 21:16:42 +01:00
# with a real password
configure-rabbitmq: Set -u, and not -x.
2021-12-17 01:39:34 +01:00
set -eu
[manual] Use rabbitmq queue to process UserActivity. Before this is deployed, we need to install rabbitmq and pika on the target server (see the puppet part of this commit for how). When this is deployed, we need to start the new user activity bot: ./manage.py process_user_activity in the screen session on the relevant server, or user_activity logs won't be processed (which will eventually result in all users getting notifications about how their mirrors are out of date). (imported from commit 44d605aca0290bef2c94fb99267e15e26b21673b)
2013-01-11 21:16:42 +01:00
CVE-2021-43799: Set a secure Erlang cookie. The RabbitMQ docs state ([1]): RabbitMQ nodes and CLI tools (e.g. rabbitmqctl) use a cookie to determine whether they are allowed to communicate with each other. [...] The cookie is just a string of alphanumeric characters up to 255 characters in size. It is usually stored in a local file. ...and goes on to state (emphasis ours): If the file does not exist, Erlang VM will try to create one with a randomly generated value when the RabbitMQ server starts up. Using such generated cookie files are **appropriate in development environments only.** The auto-generated cookie does not use cryptographic sources of randomness, and generates 20 characters of `[A-Z]`. Because of a semi-predictable seed, the entropy of this password is thus less than the idealized 26^20 = 94 bits of entropy; in actuality, it is 36 bits of entropy, or potentially as low as 20 if the performance of the server is known. These sizes are well within the scope of remote brute-force attacks. On provision, install, and upgrade, replace the default insecure 20-character Erlang cookie with a cryptographically secure 255-character string (the max length allowed). [1] https://www.rabbitmq.com/clustering.html#erlang-cookie
2021-12-07 21:55:38 +01:00
# If the RabbitMQ distribution cookie is insecure, reset it and
# restart RabbitMQ.
configure-rabbitmq: Remove use of sudo. It already runs as root everywhere except in provision_inner, so move the sudo there. Signed-off-by: Anders Kaseorg <anders@zulip.com>
2022-04-16 01:05:21 +02:00
"$(dirname "$0")/generate-rabbitmq-cookie"
CVE-2021-43799: Set a secure Erlang cookie. The RabbitMQ docs state ([1]): RabbitMQ nodes and CLI tools (e.g. rabbitmqctl) use a cookie to determine whether they are allowed to communicate with each other. [...] The cookie is just a string of alphanumeric characters up to 255 characters in size. It is usually stored in a local file. ...and goes on to state (emphasis ours): If the file does not exist, Erlang VM will try to create one with a randomly generated value when the RabbitMQ server starts up. Using such generated cookie files are **appropriate in development environments only.** The auto-generated cookie does not use cryptographic sources of randomness, and generates 20 characters of `[A-Z]`. Because of a semi-predictable seed, the entropy of this password is thus less than the idealized 26^20 = 94 bits of entropy; in actuality, it is 36 bits of entropy, or potentially as low as 20 if the performance of the server is known. These sizes are well within the scope of remote brute-force attacks. On provision, install, and upgrade, replace the default insecure 20-character Erlang cookie with a cryptographically secure 255-character string (the max length allowed). [1] https://www.rabbitmq.com/clustering.html#erlang-cookie
2021-12-07 21:55:38 +01:00
Move bin/get-django-setting to scripts/.
2016-05-08 04:02:32 +02:00
RABBITMQ_USERNAME=$("$(dirname "$0")/../get-django-setting" RABBITMQ_USERNAME)
RABBITMQ_PASSWORD=$("$(dirname "$0")/../get-django-setting" RABBITMQ_PASSWORD)
rabbitmq: Support non-/ vhosts. Fixes: #30255.
2024-05-31 17:47:15 +02:00
RABBITMQ_VHOST=$("$(dirname "$0")/../get-django-setting" RABBITMQ_VHOST)
configure-rabbitmq: Allow running as root. This makes it possible to run this in production without access to sudo.
2019-03-15 01:08:55 +01:00
configure-rabbitmq: Switch to await_startup.
2024-05-31 17:43:36 +02:00
rabbitmqctl await_startup
configure-rabbitmq: Remove use of sudo. It already runs as root everywhere except in provision_inner, so move the sudo there. Signed-off-by: Anders Kaseorg <anders@zulip.com>
2022-04-16 01:05:21 +02:00
rabbitmqctl delete_user "$RABBITMQ_USERNAME" || true
rabbitmqctl delete_user zulip || true
rabbitmqctl delete_user guest || true
rabbitmqctl add_user "$RABBITMQ_USERNAME" "$RABBITMQ_PASSWORD"
rabbitmqctl set_user_tags "$RABBITMQ_USERNAME" administrator
rabbitmq: Support non-/ vhosts. Fixes: #30255.
2024-05-31 17:47:15 +02:00
if ! rabbitmqctl list_vhosts --no-table-headers --quiet | grep -qx "$RABBITMQ_VHOST"; then
rabbitmqcql add_vhost "$RABBITMQ_VHOST"
fi
rabbitmqctl set_permissions -p "$RABBITMQ_VHOST" "$RABBITMQ_USERNAME" '.*' '.*' '.*'