cyclades: Remove hard coded state
Set required umask for snf-manage commands

In order to communicate with Archipelago, Pithos backend needs to create
named pipes (under '/var/run/shm/posixfd') that can be read/written by the
group that Archipelago is running. This is achieved by using 'setgid' in the
specified directory combined with a proper 'umask'. For Gunicorn workers, the
umask is set by gunicorn-hooks. However, snf-manage commands did not set the
needed umask which resulted in wrong permissions.

This commits includes an ugly workaround to bypass this issue by setting
the needed umask in 'SynnefoManagementUtility' for subcommands that are
handling images, snapshots and files and for subcommands that define
the 'umask' class attribute.
deploy: Do not override default file of snf-image

Up until now, snf-deploy used /etc/default/snf-image as a template with
default snf-image settings commented. These settings were never
updated and as a result they were different from the ones the package is
shipped with. This patch, after package installation, moves original
/etc/default/snf-image to snf-image.orig and then overwrites it with
the template that includes only the settings that deploy wants to
change.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Disable IPv6 on testing VM

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Download base image once

Both Image and Kamaki download the debian base image. In order
to download it just once we store it under /tmp and check
if it exists before downloading it again.

Use -4 option in wget in order not to use IPv6.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Use synnefo system user and group

In short make gunicorn and snf-dispatcher run as
synnefo:synnefo, and Archipelago as archipelago:synnefo.

This way the synnefo components that run as synnefo:synnefo
(Cyclades, Pithos, etc.) can access the backing storage only through
Archipelago (i.e. named pipes in /dev/shm/posixfd/) and not
directly.

Since we are using NFS we let archipelago user and synnefo group
with common uid and gid respectively across all nodes. The
Archipelago dir to be exported will be owned by archipelago:synnefo
and have group write permissions.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: A workaround for Archipelago bug

Due to a bug in Archipelago [2] we chown /dev/shm/posixfd after
Archipelago restart.

This should be reverted after this PR is merged and a
new Archipelago version is released.

[2] https://github.com/grnet/archipelago/pull/44

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
webproject: Change user in gunicorn example file

..shipped under /etc/gunicorn.d/synnefo.example.

Let gunicorn run as synnefo:synnefo

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Workaround for snf-pithos-webclient conf

..until a proper postinst script that uses dpkg-statoverride
to modify the owners and permissions of its own conf files
is included in the package.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
astakos: Fix oa2 settings file name

It was 20-snf-astakos-oa2-app-settings.py.
Make it 20-snf-astakos-app-oa2.conf.

This way the postinst script will find it and dpkg-statoverride
properly.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Add log-file option in gunicorn conf

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update centos install guide wrt synnefo user

Additionally change the NFS dirs to /srv/pithos/{blocks,maps,locks}.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update debian install guide wrt synnefo user

In short Synnefo will run as synnefo:www-data while Archipelago as
synnefo:synnefo. The exported directories in NFS should be
root:synnefo with g+ws.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update admin guide wrt synnefo user

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update upgrade notes wrt synnefo user

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Add CA component and ca role

The ca role will be a separate node able to create and sign
certificates. All components that need a certificate will get it
from this node. Since we are going to have one common certificate
for the synnefo.live CN including all DNS alternatives (astakos,
cyclades, vnc, etc.) this certificate will be created in advance and
everyone will get it during setup.

The cacert.pem will be added to the firefox db via certutil -A.

snf-vncauthproxy will use the corresponding cert.pem and key.pem.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Add vnc role

snf-vncauthproxy can now run on a separate node.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Use the certificate issued by our CA

Apache and VNC will use the certificate previously issued by our CA.
For the Client we add this certificate to the system wide accepted
ones via update-ca-certificates and to the firefox database via
certutil.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Configure cyclades for remote VNC proxy

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Cleanup useless actions wrt certificates

Since we are using a proper CA we do not need cert_override.txt
nor we should update-ca-certificates for skakeoil cert.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>