packaging: use simplified template when handling ovirt-engine-proxy.conf.in

Change-Id: I7031884c602e2bd5dfffb34b42e5925cf2f39afa
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: less intrusive method for httpd integration

CURRENT IMPLEMENTATION

ovirt-engine proxy all requests, disallow any additional application to
be hosted on the same web server.

NEW IMPLEMENTATION

proxy only ovirt-engine URI prefixes. By default ovirt-engine is at:

  http://host/ovirt-engine

Optionally add redirect from / to /ovirt-engine during setup.

SIDE EFFECTS

In order to handle redirects of 404.html, we require some valid URI to
redirect into, as a result the welcome page of root will not be
index.html but ovirt-engine.html, same for style.css which was renamed
to ovirt-engine-style.css

Change-Id: I89a47a99e28de0905183dc502cb0b35c80f77e6d
Signed-off-by: Alex Lourie <alourie@redhat.com>
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: remove redundant file from spec

Change-Id: Icf65792b0ce1ab1774852a8d2f17a409a92e1620
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: /etc/ovirt-engine should not be owned by engine

engine does not and should not write into it.

Change-Id: Ic24afe853410a56bd27dd613764bb8dd8b18e1c3
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: /etc/ovirt-engine/engine.conf* should not be owned by engine

engine does not and should not write into it.

if there is secret configuration it can be explicitly written owned by
engine.

Change-Id: I6d9ca270bd1d3a16591a3d4fae65bbaac65c8654
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
pki: set ownership of apache key to root

Apache reads the keys before dropping privileges, correct permissions
are read by root.

Change-Id: I7f3ab38f6e3f4e03244878877d4bab0fd72bc3c4
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
pki: set keys permission to world readable and owned by root

This enables all applications to access the keys.

Each key is protected by its own permissions, so we are not exposing
anything new. Engine does not generate new keys so no need to be
writable by engine.

Change-Id: Iedd916d41aca4f80a25c9ab13a240b57a5577b0b
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
pki: delete cacert alias from keystore before import

Java keystore will not overwrite certificate, leaving the previous one.

Change-Id: Ib0ea2404ff43c106f40ddc89cf13cb2b8d7caeab
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: engine-service: cleanup pyflakes warnings

Change-Id: I2186d79e96aaf2789ee860e7e7e34a20d71e6287
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: engine-service: cleanup: merge check for running process

Change-Id: I20238c634c418029c669bdf2b4b77e329b39faa1
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: engine-service: rework start pid file handling

There is no reason to force user to explicit stop and start the service
in case pid file contains non running process.

Change-Id: I8d8a7f8f8b7f5941f447df3d279686b973b5c393
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: engine-service: recover from corrupted pid file

The case in which pidfile is empty is common.

Change-Id: I1b2a175cd0ef14bb6f60822f510059ee5be23c43
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: engine-service: use python daemon instead of own implementation

Change-Id: I6b533fbdbde47d8fdb62964d60aa22e98c1e57c3
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: engine-service: add options for wrappers

In order to be used at other environments, with their own init.d layout,

Add:
  --quiet
  --pidfile
  --foreground

Change-Id: I00d868fc51ec73800cae2eb24002feb933744851
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
pki: cleanup: dos2unix

Change-Id: I2ca4f0e10057a86c4548432e46da0a5e47cc9fb5
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
pki: remove unused files

Setup.txt is of windows.
installCA_dev.sh is obsolete by new installer.

Change-Id: Ic1cfb80f349a0b30ffe828b8970758d7c9bf3c35
pki: cleanup: use .keep convention

Change-Id: I592145f93a7e40de8ae15be3dfdb666500b89200
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
pki: do not override ca database in packaging

ca database should be created when CreateCA.sh is executed, not by
packaging. As subsequent installations should not override these unless
the ca is recreated.

serial and database should have actually been in /var/lib, but for now
we keep them at /etc.

Change-Id: I288864dbfb2908d4159fdbd44724d4674a1f4eee
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
packaging: engine-setup re-write using otopi

Change-Id: I4d5e3ac7927802326e324c9b98ada75b421638aa
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>
Signed-off-by: Sandro Bonazzola <sbonazzo@redhat.com>
Signed-off-by: Alex Lourie <alourie@redhat.com>