1,234
edits
Changes
→Part 2: Set up web server
Except you won't be able to access it because of the firewall. We'll deal with that in the next section.
== Part 2: Set up the firewall ==
Recall that in our OPS courses we've been using iptables instead of firewalld, which is installed by default in CentOS. Let's make sure that our workers have that set up as well. In the same '''fabfile.py''' you've been using all along, add a new function like this:
<source lang="python">
# Will uninstall firewalld and replace it with iptables
def setupFirewall():
run("yum -y -d1 remove firewalld")
run("yum -y -d1 install iptables-services")
run("systemctl enable iptables")
run("systemctl start iptables")
</source>
That should by now look prett obvious. On the worker you're going to uninstall firewalld, install iptables, and make sure that the iptables service is running.
Execute the function for worker1 and double-check that it worked.
=== Allow access to Apache through the firewall ===
The default setup of iptables also doesn't allow access to our web server. We'll need to add some more to our function to allow it. This would probably make more sense in setupWebServer() but for now let's put it into setupFirewall():
<source lang="python">
run("iptables -I INPUT -p tcp --dport 80 -j ACCEPT")
run("iptables-save /etc/sysconfig/iptables")
</source>
Easy enough, but there's on problem - if we run this more than once, we're going to end up with duplicate iptables rules for port 80 (check with iptables -L).
In order to avoid that - we have to first check whether the rule exists before we add it. We can do that like this:
<source lang="bash">iptables -C INPUT -p tcp --dport 80 -j ACCEPT"</source>
Unfortunately that command answers "yes" or "no" by succeeding or failing depending on whether that rule exists. In Fabric when a command fails - the entire fab file execution stops, assuming that it's an unrecoverable error. We need to prevent that with another with statement:
<source lang="python">
with settings(warn_only=True):
firewallAlreadySetUp = run("iptables -C INPUT -p tcp --dport 80 -j ACCEPT")
if firewallAlreadySetUp.return_code == 1:
... move your iptables rules setup here ...
</source>
= LAB 8 SIGN-OFF (SHOW INSTRUCTOR) =
