cyclades: Remove hard coded state
Set required umask for snf-manage commands

In order to communicate with Archipelago, Pithos backend needs to create
named pipes (under '/var/run/shm/posixfd') that can be read/written by the
group that Archipelago is running. This is achieved by using 'setgid' in the
specified directory combined with a proper 'umask'. For Gunicorn workers, the
umask is set by gunicorn-hooks. However, snf-manage commands did not set the
needed umask which resulted in wrong permissions.

This commits includes an ugly workaround to bypass this issue by setting
the needed umask in 'SynnefoManagementUtility' for subcommands that are
handling images, snapshots and files and for subcommands that define
the 'umask' class attribute.
deploy: Add PITHCAT_UMASK setting to snf-image

PITHCAT_UMASK is needed if Archipelago does not run as root.
If the above setting is missing, the pithcat becomes really slow.

Up until now, snf-deploy used /etc/default/snf-image as a template with
default snf-image settings commented. These settings were never
updated and as a result they were different from the ones the package is
shipped with. This patch, after package installation, moves original
/etc/default/snf-image to snf-image.orig and then overwrites it with
the template that includes only the settings that deploy wants to
change.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Disable IPv6 on testing VM

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Download base image once

Both Image and Kamaki download the debian base image. In order
to download it just once we store it under /tmp and check
if it exists before downloading it again.

Use -4 option in wget in order not to use IPv6.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Use synnefo user and group

In short make Archipelago, gunicorn and snf-dispatcher run as
synnefo:synnefo.

Since we are using NFS we create synnefo group with common
gid across all nodes. The Archipelago dir to be exported
will be owned by root:synnefo and have group write permissions.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: A workaround for Archipelago bug

Due to a bug in Archipelago [2] we chown /dev/shm/posixfd after
Archipelago restart.

This should be reverted after this PR is merged and a
new Archipelago version is released.

[2] https://github.com/grnet/archipelago/pull/44

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
webproject: Change user in gunicorn example file

..shipped under /etc/gunicorn.d/synnefo.example.

Let gunicorn run as synnefo:synnefo

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Workaround for snf-pithos-webclient conf

..until a proper postinst script that uses dpkg-statoverride
to modify the owners and permissions of its own conf files
is included in the package.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
astakos: Fix oa2 settings file name

It was 20-snf-astakos-oa2-app-settings.py.
Make it 20-snf-astakos-app-oa2.conf.

This way the postinst script will find it and dpkg-statoverride
properly.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Let Archipelago run as archipelago:synnefo

..and make NFS directory owned by archipelago:archipelago. This way the
synnefo components that run as synnefo:synnefo (Cyclades, Pithos,
etc.) can access the backing storage only through Archipelago (i.e.
named pipes in /dev/shm/posixfd/) and not directly.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update centos install guide wrt synnefo user

Additionally change the NFS dirs to /srv/pithos/{blocks,maps,locks}.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update debian install guide wrt synnefo user

In short Synnefo will run as synnefo:www-data while Archipelago as
synnefo:synnefo. The exported directories in NFS should be
root:synnefo with g+ws.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update upgrade notes wrt synnefo user

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update admin guide wrt synnefo user

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>