initial import for Open Source 🎉

config_app/conf/dhparams.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAk7fEh4MFr446aU61ZGxCl8VHvcJhDGcdd+3zaNxdWF7Wvr5QE8zX
+QswoM5K2szlK7klcJOXer2IToHHQQn00nuWO3m6quZGV6EPbRmRKfRGa8pzSwH+R
+Ph0OUpEQPh7zvegeVwEbrblD7i53ookbHlYGtxsPb28Y06OP5/xpks9C815Zy4gy
+tx2yHi4FkFo52yErBF9jD/glsZYVHCo42LFrVGa5/7V0g++fG8yXCrBnqmz2d8FF
+uU6/KJcmDCUn1m3mDfcf5HgeXSIsukW/XMZ3l9w1fdluJRwdEE9W2ePgqMiG3eC0
+2T1sPfXCdXPQ7/5Gzf1eMtRZ/McipxVbgwIBAg==
+-----END DH PARAMETERS-----

config_app/conf/gunicorn_local.py

@@ -0,0 +1,26 @@
+import sys
+import os
+sys.path.append(os.path.join(os.path.dirname(__file__), "../"))
+
+import logging
+
+from Crypto import Random
+from config_app.config_util.log import logfile_path
+
+
+logconfig = logfile_path(debug=True)
+bind = '0.0.0.0:5000'
+workers = 1
+worker_class = 'gevent'
+daemon = False
+pythonpath = '.'
+preload_app = True
+
+def post_fork(server, worker):
+  # Reset the Random library to ensure it won't raise the "PID check failed." error after
+  # gunicorn forks.
+  Random.atfork()
+
+def when_ready(server):
+  logger = logging.getLogger(__name__)
+  logger.debug('Starting local gunicorn with %s workers and %s worker class', workers, worker_class)

config_app/conf/gunicorn_web.py

@@ -0,0 +1,26 @@
+import sys
+import os
+sys.path.append(os.path.join(os.path.dirname(__file__), "../"))
+
+import logging
+
+from Crypto import Random
+from config_app.config_util.log import logfile_path
+
+
+logconfig = logfile_path(debug=True)
+
+bind = 'unix:/tmp/gunicorn_web.sock'
+workers = 1
+worker_class = 'gevent'
+pythonpath = '.'
+preload_app = True
+
+def post_fork(server, worker):
+  # Reset the Random library to ensure it won't raise the "PID check failed." error after
+  # gunicorn forks.
+  Random.atfork()
+
+def when_ready(server):
+  logger = logging.getLogger(__name__)
+  logger.debug('Starting local gunicorn with %s workers and %s worker class', workers, worker_class)

config_app/conf/htpasswd

@@ -0,0 +1 @@
+quayconfig:

config_app/conf/http-base.conf

@@ -0,0 +1,49 @@
+# vim: ft=nginx
+
+set_real_ip_from 0.0.0.0/0;
+real_ip_recursive on;
+log_format lb_logs '$remote_addr ($proxy_protocol_addr) '
+                   '- $remote_user [$time_local] '
+                   '"$request" $status $body_bytes_sent '
+                   '"$http_referer" "$http_user_agent" '
+                   '($request_time $request_length $upstream_response_time)';
+
+types_hash_max_size 2048;
+include /etc/opt/rh/rh-nginx112/nginx/mime.types;
+
+default_type application/octet-stream;
+
+access_log /var/log/nginx/access.log;
+error_log /var/log/nginx/error.log;
+client_body_temp_path /tmp/nginx 1 2;
+proxy_temp_path /tmp/nginx-proxy;
+fastcgi_temp_path /tmp/nginx-fastcgi;
+uwsgi_temp_path /tmp/nginx-uwsgi;
+scgi_temp_path /tmp/nginx-scgi;
+
+sendfile on;
+
+gzip on;
+gzip_http_version 1.0;
+gzip_proxied any;
+gzip_min_length 500;
+gzip_disable "MSIE [1-6]\.";
+gzip_types text/plain text/xml text/css
+           text/javascript application/x-javascript
+           application/javascript image/svg+xml
+           application/octet-stream;
+
+map $proxy_protocol_addr $proper_forwarded_for {
+  ""      $proxy_add_x_forwarded_for;
+  default $proxy_protocol_addr;
+}
+
+map $http_x_forwarded_proto $proper_scheme {
+  default $scheme;
+  https   https;
+}
+
+upstream web_app_server {
+    server unix:/tmp/gunicorn_web.sock fail_timeout=0;
+}
+

config_app/conf/logging.conf

@@ -0,0 +1,33 @@
+[loggers]
+keys=root,gunicorn.error,gunicorn.access
+
+[handlers]
+keys=console
+
+[formatters]
+keys=generic,json
+
+[logger_root]
+level=INFO
+handlers=console
+
+[handler_console]
+class=StreamHandler
+formatter=generic
+args=(sys.stdout, )
+
+[formatter_generic]
+format=%(asctime)s [%(process)d] [%(levelname)s] [%(name)s] %(message)s
+class=logging.Formatter
+
+[logger_gunicorn.error]
+level=ERROR
+handlers=console
+propagate=0
+qualname=gunicorn.error
+
+[logger_gunicorn.access]
+handlers=console
+propagate=0
+qualname=gunicorn.access
+level=DEBUG

config_app/conf/logging_debug.conf

@@ -0,0 +1,38 @@
+[loggers]
+keys=root,boto,gunicorn.error,gunicorn.access
+
+[handlers]
+keys=console
+
+[formatters]
+keys=generic,json
+
+[logger_root]
+level=DEBUG
+handlers=console
+
+[logger_boto]
+level=INFO
+handlers=console
+qualname=boto
+
+[logger_gunicorn.access]
+handlers=console
+propagate=0
+qualname=gunicorn.access
+level=DEBUG
+
+[handler_console]
+class=StreamHandler
+formatter=generic
+args=(sys.stdout, )
+
+[logger_gunicorn.error]
+level=ERROR
+handlers=console
+propagate=0
+qualname=gunicorn.error
+
+[formatter_generic]
+format=%(asctime)s [%(process)d] [%(levelname)s] [%(name)s] %(message)s
+class=logging.Formatter

config_app/conf/logging_debug_json.conf

@@ -0,0 +1,38 @@
+[loggers]
+keys=root,boto,gunicorn.error,gunicorn.access
+
+[handlers]
+keys=console
+
+[formatters]
+keys=generic,json
+
+[logger_root]
+level=DEBUG
+handlers=console
+
+[logger_boto]
+level=INFO
+handlers=console
+qualname=boto
+
+[logger_gunicorn.access]
+handlers=console
+propagate=0
+qualname=gunicorn.access
+level=DEBUG
+
+[handler_console]
+class=StreamHandler
+formatter=json
+args=(sys.stdout, )
+
+[logger_gunicorn.error]
+level=ERROR
+handlers=console
+propagate=0
+qualname=gunicorn.error
+
+[formatter_generic]
+format=%(asctime)s [%(process)d] [%(levelname)s] [%(name)s] %(message)s
+class=logging.Formatter

config_app/conf/logging_json.conf

@@ -0,0 +1,33 @@
+[loggers]
+keys=root,gunicorn.error,gunicorn.access
+
+[handlers]
+keys=console
+
+[formatters]
+keys=json,generic
+
+[logger_root]
+level=INFO
+handlers=console
+
+[handler_console]
+class=StreamHandler
+formatter=json
+args=(sys.stdout, )
+
+[formatter_generic]
+format=%(asctime)s [%(process)d] [%(levelname)s] [%(name)s] %(message)s
+class=logging.Formatter
+
+[logger_gunicorn.error]
+level=ERROR
+handlers=console
+propagate=0
+qualname=gunicorn.error
+
+[logger_gunicorn.access]
+handlers=console
+propagate=0
+qualname=gunicorn.access
+level=DEBUG

config_app/conf/nginx.conf

@@ -0,0 +1,26 @@
+# vim: ft=nginx
+
+include root-base.conf;
+
+http {
+    include http-base.conf;
+
+    ssl_certificate /quay-registry/config_app/quay-config.cert;
+    ssl_certificate_key /quay-registry/config_app/quay-config.key;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
+    ssl_protocols TLSv1.1 TLSv1.2;
+    ssl_session_cache shared:SSL:60m;
+    ssl_session_timeout 2h;
+    ssl_session_tickets on;
+    ssl_prefer_server_ciphers on;
+    ssl_dhparam dhparams.pem;
+
+    server {
+        include server-base.conf;
+
+        listen 8443 ssl http2 default;
+
+        access_log /var/log/nginx/access.log lb_logs;
+        error_log /var/log/nginx/error.log warn;
+    }
+}

config_app/conf/root-base.conf

@@ -0,0 +1,15 @@
+# vim: ft=nginx
+
+pid /tmp/nginx.pid;
+error_log /var/log/nginx/error.log;
+
+worker_processes auto;
+worker_priority -10;
+worker_rlimit_nofile 10240;
+
+daemon off;
+
+events {
+    worker_connections 10240;
+    accept_mutex off;
+}

config_app/conf/server-base.conf

@@ -0,0 +1,21 @@
+# vim: ft=nginx
+
+server_name _;
+
+# Proxy Headers
+proxy_set_header X-Forwarded-For $proper_forwarded_for;
+proxy_set_header X-Forwarded-Proto $proper_scheme;
+proxy_set_header Host $host;
+proxy_redirect off;
+
+proxy_set_header Transfer-Encoding $http_transfer_encoding;
+
+# The DB migrations sometimes take a while, so increase timeout so we don't report an error.
+proxy_read_timeout 500s;
+
+location / {
+    auth_basic "Quay config tool";
+    auth_basic_user_file htpasswd;
+    proxy_pass   http://web_app_server;
+}
+

config_app/conf/supervisord.conf

@@ -0,0 +1,44 @@
+; TODO: Dockerfile - pip install supervisor supervisor-stdout
+
+[supervisord]
+nodaemon=true
+
+[unix_http_server]
+file=%(ENV_QUAYDIR)s/config_app/conf/supervisord.sock
+user=root
+
+[supervisorctl]
+serverurl=unix:///%(ENV_QUAYDIR)s/config_app/conf/supervisord.sock
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[eventlistener:stdout]
+environment=
+  PYTHONPATH=%(ENV_QUAYDIR)s
+command = supervisor_stdout
+buffer_size = 1024
+events = PROCESS_LOG
+result_handler = supervisor_stdout:event_handler
+
+[program:gunicorn-config]
+environment=
+  PYTHONPATH=%(ENV_QUAYDIR)s
+command=gunicorn -c %(ENV_QUAYDIR)s/config_app/conf/gunicorn_web.py config_application:application
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stdout
+stderr_logfile_maxbytes=0
+stdout_events_enabled = true
+stderr_events_enabled = true
+
+[program:nginx]
+environment=
+  PYTHONPATH=%(ENV_QUAYDIR)s
+command=nginx -c %(ENV_QUAYDIR)s/config_app/conf/nginx.conf
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stdout
+stderr_logfile_maxbytes=0
+stdout_events_enabled = true
+stderr_events_enabled = true