/etc/httpobs.conf for api about http-observatory

[april]

These accounts are setup by the Docker process and the passwords are here:

https://github.com/mozilla/http-observatory/blob/master/httpobs/database/schema.sql.docker.sql

If you have documentation on how to make the docker process work more smoothly, I'd love to add it.

[briner]

Oh I think we misunderstood each other.

Let me explain the context.

I did not use doker at all. I only used the docker-compose.yml as a documentation.

We see in docker-compose.yml that the api and the scanner users have a different user/password to connect to the database. In the same manner, we observe these users have different GRANT (here, here)

As I'm not using docker to run the whole software, I try to understand where and how I can setup a configuration file for the api and for the scanner, so that they read their respective user/password to connect to the database.

For the scanner, I found that it is reading /etc/httpobs.conf in the httpobs/conf module.

Now, for the api, I've setup the user/password as an environment in systemd. I do not really like that the process take its user/password within the environnement or within the systemd service.

So the question are:

• Where the api reads its configuration from ?
• Does it read it from /etc/httpobs.conf ?
• If so, what lines should I add to it to setup the user/password for api process.

[briner]

I finally decided to debug this part. I verifide that httpobs.conf was read by the process with a strace. So it did.

I modified the httpobs/conf/__init__.py to add some prints, and realize that it does read the pass stored in the section database. But scanner and the api does use the same user/password to connect to the database.

So I'm a bit stucked as the schema use two different users and that httpobs.conf does not give this abilitiy.

[april]

So the scanner and API were specifically designed to be run on separate machines for security reasons. There are fields that one can write to that the other can only read from.

That said, if you want to run them on the same machine, you have a couple options:

1. Create a user account for each, and put the configuration in ~/.httpobs.conf
2. Set the HTTPOBS_DATABASE_USER and HTTPOBS_DATABASE_PASS environmental variables for each of their respective processes. That's what I do for local development.

[briner]

Thanks for your clarification.

Seems good to me to close it.