From f867c471fbfbcca02144cc619b6edb4d9144e73a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ga=C3=ABtan=20Trellu?= <gaetan.trellu@incloudus.com>
Date: Thu, 20 Jun 2019 13:08:53 -0400
Subject: [PATCH] Implement Apache WSGI for Qinling

Since this review[1], Qinling supports WSGI execution.

From a production perspective, Qinling should be deployed
using Apache and mod_wsgi.

"api_worker" option is not needed anymore because processes will
be handle by Apache mod_wsgi.

Qinling Docker image review[2] has ben created.

[1] https://review.opendev.org/661851
[2] https://review.opendev.org/666647

Change-Id: I9aaee4c2932f1e4ea9fe780a64e96a28fa6bccfb
Story: 2005920
Task: 34181
---
 ansible/roles/qinling/handlers/main.yml       |  1 +
 ansible/roles/qinling/tasks/config.yml        | 15 +++++++++
 .../qinling/templates/qinling-api.json.j2     | 10 +++++-
 .../roles/qinling/templates/qinling.conf.j2   |  1 -
 .../qinling/templates/wsgi-qinling.conf.j2    | 33 +++++++++++++++++++
 5 files changed, 58 insertions(+), 2 deletions(-)
 create mode 100644 ansible/roles/qinling/templates/wsgi-qinling.conf.j2

diff --git a/ansible/roles/qinling/handlers/main.yml b/ansible/roles/qinling/handlers/main.yml
index cf29b6ae00..01620ead60 100644
--- a/ansible/roles/qinling/handlers/main.yml
+++ b/ansible/roles/qinling/handlers/main.yml
@@ -21,6 +21,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or qinling_conf.changed | bool
+      or qinling_conf_wsgi.changed | bool
       or policy_overwriting.changed | bool
       or qinling_api_container.changed | bool
 
diff --git a/ansible/roles/qinling/tasks/config.yml b/ansible/roles/qinling/tasks/config.yml
index 207434c668..0207ad0369 100644
--- a/ansible/roles/qinling/tasks/config.yml
+++ b/ansible/roles/qinling/tasks/config.yml
@@ -69,6 +69,21 @@
   notify:
     - Restart {{ item.key }} container
 
+- name: Copying over wsgi-qinling files for services
+  vars:
+    service: "{{ qinling_services['qinling-api'] }}"
+  template:
+    src: "wsgi-qinling.conf.j2"
+    dest: "{{ node_config_directory }}/qinling-api/wsgi-qinling.conf"
+    mode: "0660"
+  become: true
+  register: qinling_conf_wsgi
+  when:
+    - inventory_hostname in groups[service.group]
+    - service.enabled | bool
+  notify:
+    - Restart qinling-api container
+
 - name: Copying over existing policy file
   template:
     src: "{{ qinling_policy_file_path }}"
diff --git a/ansible/roles/qinling/templates/qinling-api.json.j2 b/ansible/roles/qinling/templates/qinling-api.json.j2
index 230219f057..ad9b4f39ce 100644
--- a/ansible/roles/qinling/templates/qinling-api.json.j2
+++ b/ansible/roles/qinling/templates/qinling-api.json.j2
@@ -1,11 +1,19 @@
+{% set qinling_cmd = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %}
+{% set qinling_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %}
 {
-    "command": "qinling-api --config-file /etc/qinling/qinling.conf",
+    "command": "{{ qinling_cmd }} -DFOREGROUND",
     "config_files": [
         {
             "source": "{{ container_config_directory }}/qinling.conf",
             "dest": "/etc/qinling/qinling.conf",
             "owner": "qinling",
             "perm": "0600"
+        },
+        {
+            "source": "{{ container_config_directory }}/wsgi-qinling.conf",
+            "dest": "/etc/{{ qinling_dir }}/wsgi-qinling.conf",
+            "owner": "qinling",
+            "perm": "0600"
         }{% if qinling_policy_file is defined %},
         {
             "source": "{{ container_config_directory }}/{{ qinling_policy_file }}",
diff --git a/ansible/roles/qinling/templates/qinling.conf.j2 b/ansible/roles/qinling/templates/qinling.conf.j2
index b7b20c8258..230030812b 100644
--- a/ansible/roles/qinling/templates/qinling.conf.j2
+++ b/ansible/roles/qinling/templates/qinling.conf.j2
@@ -7,7 +7,6 @@ transport_url = {{ rpc_transport_url }}
 [api]
 port = {{ qinling_api_port }}
 host = {{ api_interface_address }}
-api_workers = {{ openstack_service_workers }}
 {% endif %}
 
 {% if service_name == 'qinling-engine' %}
diff --git a/ansible/roles/qinling/templates/wsgi-qinling.conf.j2 b/ansible/roles/qinling/templates/wsgi-qinling.conf.j2
new file mode 100644
index 0000000000..b642d0e033
--- /dev/null
+++ b/ansible/roles/qinling/templates/wsgi-qinling.conf.j2
@@ -0,0 +1,33 @@
+{% if kolla_base_distro == 'ubuntu' %}
+    {% set python_path = '/usr/lib/python3/dist-packages' if qinling_install_type == 'binary' else '/var/lib/kolla/venv/lib/python3.6/site-packages' %}
+{% else %}
+    {% set python_path = '/usr/lib/python2.7/site-packages' if qinling_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
+{% endif %}
+
+Listen {{ api_interface_address }}:{{ qinling_api_port }}
+
+ServerSignature Off
+ServerTokens Prod
+TraceEnable off
+
+<VirtualHost *:{{ qinling_api_port }}>
+
+  ## Vhost docroot
+  DocumentRoot "/var/www/cgi-bin/qinling"
+
+  ## Directories, there should at least be a declaration for /var/www/cgi-bin/qinling
+
+  <Directory "/var/www/cgi-bin/qinling">
+    Options Indexes FollowSymLinks MultiViews
+    Require all granted
+  </Directory>
+
+  ## Logging
+  ErrorLog "/var/log/kolla/qinling/qinling_api_wsgi_error.log"
+  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat
+  CustomLog "/var/log/kolla/qinling/qinling_api_wsgi_access.log" logformat
+  WSGIApplicationGroup %{GLOBAL}
+  WSGIDaemonProcess qinling group=qinling processes={{ openstack_service_workers }} threads=1 user=qinling python-path={{ python_path }}
+  WSGIProcessGroup qinling
+  WSGIScriptAlias / "/var/www/cgi-bin/qinling/wsgi.py"
+</VirtualHost>