deploy: Add PITHCAT_UMASK setting to snf-image

PITHCAT_UMASK is needed if archipelago does not run as root.
If the above setting is missing, the pithcat becomes really slow.

Up until now, snf-deploy used /etc/default/snf-image as a template with
default snf-image settings commented. These settings were never
updated and as a result they were different from the ones the package is
shipped with. This patch, after package installation, moves original
/etc/default/snf-image to snf-image.orig and then overrides it with
the template that includes only the settings that deploy wants to
change.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Disable IPv6 on testing VM

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Download base image once

Bowth Image and Kamaki download the debian base image. In order
to download it just once we store it under /tmp and check
if it exists before downloading it again.

Use -4 option in wget in order not to use IPv6.

TODO: Make deploy support IPv6 only setups.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Use synnefo user/group snf-common creates

Synnefo conf files are shipped as root:www-data for security issues.
The point is that they cannot be modified by anyone other than root
while being readable only by www-data group. There is a known bug in
gunicorn that does not set supplementary groups when changing uid
[1]. Therefore gunicorn should run with group www-data.

Currently archipelago can run as non root (archipelago:archipelago
by default). In order Pithos and Cyclades to be able to work with
archipelago, gunicorn must run as the same user. Let this user be
synnefo, the one that snf-common adds upon installation.

In short make archipelago run as synnefo:synnefo, gunicorn
as synnefo:www-data, and snf-dispatcher as www-data:www-data

Since we are using NFS we create synnefo group with common
gid across all nodes. The archipelago dir to be exported
will be root:synnefo with group write permissions.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=762448

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: A workaround for archipelago bug

Due to a bug in archipelago [2] we chown /dev/shm/posixfd after
archipelago restart.

This should be reverted after this PR is merged and a
new archipelago version is released.

[2] https://github.com/grnet/archipelago/pull/44

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Mention the synnefo group in upgrade notes

Synnefo will run as synnefo:www-data while archipelago as
synnefo:synnefo. Mention the changes that should be
made after package installation wrt mods and permissions.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>