Unpolished proof of concept for the use of Vagrant for local Mentat development.

Original idea wa to use Docker for this purpose, but it turned out full
featured virtual server will be much better suited for this task due to
the comlexity of the whole environment.

(Redmine issue: #7041)

.gitignore

 !.gitignore
 .directory
+.vagrant
 .coverage
 *~
 *.aux
@@ -71,9 +72,6 @@ parsetab.py
 /doc/sphinx/_doclib/_inc_bin.cfg-daemon.rst
 /doc/sphinx/_doclib/_inc_bin.cfg-script.rst
 
-# Ignore local lightweight chroot.
-/chroot/
-
 # Ignore local .dotenv configuration file
 .env
 
@@ -83,3 +81,9 @@ parsetab.py
 *.substvars
 /packaging/debian/mentat-ng/
 /packaging/debian/files
+
+# Ignore custom stuff.
+/conf/install.pip
+/chroot/
+/data/
+/var/

.vagrantenv/.bashrc

+# ~/.bashrc: executed by bash(1) for non-login shells.
+# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
+# for examples
+
+# If not running interactively, don't do anything
+case $- in
+    *i*) ;;
+      *) return;;
+esac
+
+# don't put duplicate lines or lines starting with space in the history.
+# See bash(1) for more options
+HISTCONTROL=ignoreboth
+
+# append to the history file, don't overwrite it
+shopt -s histappend
+
+# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
+HISTSIZE=1000
+HISTFILESIZE=2000
+
+# check the window size after each command and, if necessary,
+# update the values of LINES and COLUMNS.
+shopt -s checkwinsize
+
+# If set, the pattern "**" used in a pathname expansion context will
+# match all files and zero or more directories and subdirectories.
+#shopt -s globstar
+
+# make less more friendly for non-text input files, see lesspipe(1)
+[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
+
+# set variable identifying the chroot you work in (used in the prompt below)
+if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
+    debian_chroot=$(cat /etc/debian_chroot)
+fi
+
+# set a fancy prompt (non-color, unless we know we "want" color)
+case "$TERM" in
+    xterm-color|*-256color) color_prompt=yes;;
+esac
+
+# uncomment for a colored prompt, if the terminal has the capability; turned
+# off by default to not distract the user: the focus in a terminal window
+# should be on the output of commands, not on the prompt
+#force_color_prompt=yes
+
+if [ -n "$force_color_prompt" ]; then
+    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
+	# We have color support; assume it's compliant with Ecma-48
+	# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
+	# a case would tend to support setf rather than setaf.)
+	color_prompt=yes
+    else
+	color_prompt=
+    fi
+fi
+
+if [ "$color_prompt" = yes ]; then
+    export GIT_PS1_SHOWDIRTYSTATE=1
+    export GIT_PS1_SHOWSTASHSTATE=1
+    export GIT_PS1_SHOWUNTRACKEDFILES=1
+    export GIT_PS1_SHOWUPSTREAM="auto verbose"
+
+    if [[ ${EUID} == 0 ]] ; then
+       PS1='${debian_chroot:+($debian_chroot)}\[\033[01;31m\]\h\[\033[01;34m\] \W \$\[\033[00m\] '
+       #PS1='${debian_chroot:+($debian_chroot)}\[\033[01;31m\]\h\[\033[01;34m\]:\[\033[01;34m\]\w\[\033[00m\]\[\033[01;33m\]$(__git_ps1 " [%s]")\[\033[00m\]\$ '
+    else
+       #PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\] \[\033[01;34m\]\w \$\[\033[00m\] '
+       PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\[\033[01;33m\]$(__git_ps1 " [%s]")\[\033[00m\]\$ '
+    fi
+else
+    PS1='${debian_chroot:+($debian_chroot)}\u@\h \w \$ '
+fi
+unset color_prompt force_color_prompt
+
+# If this is an xterm set the title to user@host:dir
+case "$TERM" in
+xterm*|rxvt*)
+    PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1"
+    ;;
+*)
+    ;;
+esac
+
+# enable color support of ls and also add handy aliases
+if [ -x /usr/bin/dircolors ]; then
+    test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
+    alias ls='ls --color=auto'
+    #alias dir='dir --color=auto'
+    #alias vdir='vdir --color=auto'
+
+    alias grep='grep --color=auto'
+    alias fgrep='fgrep --color=auto'
+    alias egrep='egrep --color=auto'
+fi
+
+# colored GCC warnings and errors
+#export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'
+
+# some more aliases
+alias ll='ls -alF'
+alias la='ls -A'
+alias l='ls -CF'
+alias cd..='cd ..'
+alias ..='cd ..'
+alias ...='cd ../..'
+alias ....='cd ../../..'
+alias cdm='cd /vagrant/'
+alias entervenv='. venv/bin/activate'
+alias mentatvenv='. /var/mentat/venv/bin/activate'
+
+# enable programmable completion features (you don't need to enable
+# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
+# sources /etc/bash.bashrc).
+if ! shopt -oq posix; then
+  if [ -f /usr/share/bash-completion/bash_completion ]; then
+    . /usr/share/bash-completion/bash_completion
+  elif [ -f /etc/bash_completion ]; then
+    . /etc/bash_completion
+  fi
+fi

.vagrantenv/apt.list

+vim

.vagrantenv/finalize.sh

+#!/bin/bash
+#-------------------------------------------------------------------------------
+# Installing environment suitable for Mentat development
+#
+# Copyright (C) since 2011 CESNET, z.s.p.o
+# Use of this source is governed by the MIT license, see LICENSE file.
+#-------------------------------------------------------------------------------
+
+echo "==========> <BEGIN> finalize.sh"
+
+sudo -u mentat /var/mentat/venv/bin/python /vagrant/bin/mentat-dbmngr.py --command init
+sudo -u mentat bash -c "source /var/mentat/venv/bin/activate ; hawat-cli db stamp head"
+sudo -u mentat bash -c "source /var/mentat/venv/bin/activate ; /etc/mentat/scripts/sqldb-migrate.sh stamp head"
+
+sudo -u mentat /var/mentat/venv/bin/python /vagrant/bin/mentat-precache.py --allow-empty
+
+/etc/mentat/scripts/sqldb-optimize.sh
+
+sudo -u postgres psql -c "SELECT usename FROM pg_catalog.pg_user;" | grep root > /dev/null
+if [ $? -ne 0 ]; then
+    echo "Creating default PostgreSQL user 'root'"
+    sudo -u postgres psql -c "CREATE USER root SUPERUSER WITH PASSWORD 'root';"
+fi
+
+echo "==========> <DONE> finalize.sh"

.vagrantenv/postfix.main.cf

+# See /usr/share/postfix/main.cf.dist for a commented, more complete version
+
+
+# Debian specific:  Specifying a file name will cause the first
+# line of that file to be used as the name.  The Debian default
+# is /etc/mailname.
+#myorigin = /etc/mailname
+
+smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
+biff = no
+
+# appending .domain is the MUA's job.
+append_dot_mydomain = no
+
+# Uncomment the next line to generate "delayed mail" warnings
+#delay_warning_time = 4h
+
+readme_directory = no
+
+# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
+# fresh installs.
+compatibility_level = 2
+
+
+
+# TLS parameters
+smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
+smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
+smtpd_use_tls=yes
+smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
+smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+
+# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
+# information on enabling SSL in the smtp client.
+
+# http://www.postfix.org/STANDARD_CONFIGURATION_README.html
+smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
+myhostname = buster.lan
+alias_maps = hash:/etc/aliases
+alias_database = hash:/etc/aliases
+relayhost = 127.0.0.1:1025
+mydestination =
+mailbox_size_limit = 0
+recipient_delimiter = +
+inet_interfaces = loopback-only
+inet_protocols = all

.vagrantenv/provision.sh

+#!/bin/bash
+#-------------------------------------------------------------------------------
+# Installing environment suitable for Mentat development
+#
+# Copyright (C) since 2011 CESNET, z.s.p.o
+# Use of this source is governed by the MIT license, see LICENSE file.
+#-------------------------------------------------------------------------------
+
+echo "==========> <BEGIN> provision.sh"
+
+echo "==========> Linking default configurations"
+if [ ! -L /etc/default/mentat ] ; then
+  ln -s /vagrant/etc/default/mentat /etc/default/mentat
+fi
+if [ ! -L /etc/mentat ] ; then
+  ln -s /vagrant/conf /etc/mentat
+fi
+. /etc/default/mentat
+. /etc/mentat/scripts/lib.sh
+
+echo "==========> Configuring timezone and locales"
+echo "Europe/Prague" > /etc/timezone
+dpkg-reconfigure -f noninteractive tzdata && \
+  sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \
+  sed -i -e 's/# cs_CZ.UTF-8 UTF-8/cs_CZ.UTF-8 UTF-8/' /etc/locale.gen && \
+  echo 'LANG="en_US.UTF-8"'>/etc/default/locale && \
+  dpkg-reconfigure --frontend=noninteractive locales && \
+  update-locale LANG=en_US.UTF-8
+
+echo "==========> Creating Mentat user"
+if ! getent passwd mentat > /dev/null 2>&1; then
+    useradd -m -s /bin/bash -U mentat --groups sudo
+    cp -pr /home/vagrant/.ssh /home/mentat/
+    chown -R mentat:mentat /home/mentat
+    echo "%mentat ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/mentat
+fi
+
+echo "==========> Linking additional configuration files"
+ensure_linked_file /vagrant/.vagrantenv/.bashrc /home/vagrant/.bashrc
+ensure_linked_file /vagrant/.vagrantenv/.bashrc /home/mentat/.bashrc
+
+echo "==========> Installing common dependencies"
+apt-get update -qq \
+  && DEBIAN_FRONTEND=noninteractive apt-get -yq dist-upgrade \
+  && DEBIAN_FRONTEND=noninteractive apt-get install -yq --no-install-recommends \
+    build-essential \
+    gnupg2 \
+    curl \
+    wget \
+    less \
+    git \
+    vim \
+    bash-completion \
+    sudo \
+    openssl \
+    ssl-cert \
+  && apt-get clean \
+  && rm -rf /tmp/* /var/tmp/*
+
+echo "==========> Installing third party package repository - PostgreSQL"
+if [ ! -f /etc/apt/sources.list.d/pgdg.list ] ; then
+  curl -sSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
+  echo 'deb http://apt.postgresql.org/pub/repos/apt/ buster-pgdg main' $PG_MAJOR > /etc/apt/sources.list.d/pgdg.list
+fi
+
+echo "==========> Installing third party package repository - NodeJS"
+if [ ! -f /etc/apt/sources.list.d/nodesource.list ] ; then
+  curl -sL https://deb.nodesource.com/setup_$NODE_MAJOR.x | bash -
+fi
+
+echo "==========> Installing third party package repository - Yarn"
+if [ ! -f /etc/apt/sources.list.d/yarn.list ] ; then
+  curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
+  echo 'deb http://dl.yarnpkg.com/debian/ stable main' > /etc/apt/sources.list.d/yarn.list
+fi
+
+echo "==========> Installing application dependencies"
+apt-get update -qq \
+  && DEBIAN_FRONTEND=noninteractive apt-get install -yq --no-install-recommends \
+    python3 \
+    python3-dev \
+    python3-setuptools \
+    python3-pip \
+    python3-venv \
+    postgresql-13 \
+    postgresql-13-ip4r \
+    postgresql-client-13 \
+    postgresql-server-dev-13 \
+    libpq-dev \
+    nodejs \
+    yarn=$YARN_VERSION-1 \
+    rrdtool \
+    librrd-dev \
+    libdb5.3 \
+    libdb5.3-dev \
+    postfix \
+    mailutils \
+    apache2 \
+    libapache2-mod-wsgi-py3 \
+  && apt-get clean \
+  && rm -rf /tmp/* /var/tmp/*
+
+echo "==========> Installing GeoIPupdate tool"
+if [ ! -f /usr/bin/geoipupdate ] && [ ! -e /usr/bin/geoipupdate ] ; then
+  wget -O /tmp/geoipupdate_4.6.0_linux_amd64.deb https://github.com/maxmind/geoipupdate/releases/download/v4.6.0/geoipupdate_4.6.0_linux_amd64.deb && \
+    dpkg -i /tmp/geoipupdate_4.6.0_linux_amd64.deb && \
+    rm -f /tmp/geoipupdate_4.6.0_linux_amd64.deb
+fi
+
+echo "==========> Installing Grunt task runner"
+if [ ! -f /usr/bin/grunt ] && [ ! -e /usr/bin/grunt ] ; then
+  npm install -g grunt-cli
+fi
+
+echo "==========> Installing application installation PIP file"
+if [ ! -f /etc/mentat/install.pip ] ; then
+  echo '--editable "/vagrant/"' > /etc/mentat/install.pip
+fi
+
+echo "==========> Configuring Apache to serve development server"
+if [ ! -L /etc/apache2/sites-enabled/site_mentat_vagrant.conf ] ; then
+  ensure_linked_file /vagrant/conf/apache/site_mentat_vagrant.conf /etc/apache2/sites-available/site_mentat_vagrant.conf
+  sed -i.bak s/APACHE_RUN_USER=www-data/APACHE_RUN_USER=mentat/g /etc/apache2/envvars
+  sed -i.bak s/APACHE_RUN_GROUP=www-data/APACHE_RUN_GROUP=mentat/g /etc/apache2/envvars
+  rm -f /etc/apache2/envvars.bak
+
+  a2enmod rewrite
+  a2enmod ssl
+  a2enmod wsgi
+  a2dissite 000-default.conf
+  a2dissite default-ssl.conf
+  a2ensite site_mentat_vagrant.conf
+
+  systemctl restart apache2.service
+fi
+
+echo "==========> Preparing Python development environment"
+if ! [ -d "${MENTAT_VENV}" ]; then
+    python3 -m venv "${MENTAT_VENV}"
+fi
+${MENTAT_VENV}/bin/pip install pip --upgrade
+${MENTAT_VENV}/bin/pip install -r /etc/mentat/requirements-dev.pip
+
+
+echo "==========> Configuring email services for development"
+ensure_linked_file /vagrant/.vagrantenv/postfix.main.cf /etc/postfix/main.cf
+systemctl restart postfix.service
+
+ensure_linked_file /vagrant/etc/systemd/system/sendria.service /etc/systemd/system/sendria.service
+systemctl daemon-reload
+systemctl start sendria.service
+
+echo "==========> <DONE> provision.sh"

Makefile

@@ -217,8 +217,12 @@ venv: FORCE
 #
 develop: deps install-whl-dev build-webui
 
+develop-docker: deps-docker translations-compile build-webui
+
 deps: deps-prerequisites deps-lwchroot deps-python deps-python-dev deps-editable deps-webui deps-geoip deps-negistry deps-postgresql translations-compile
 
+deps-docker: deps-prerequisites deps-dirs-docker deps-python deps-python-dev deps-editable deps-webui deps-geoip-docker deps-negistry-docker
+
 clean: clean-pycs clean-build-docs clean-build-python clean-build-debian
 
 docs: docs-sync docs-sphinx
@@ -276,7 +280,11 @@ deps-prerequisites: FORCE
 #
 deps-lwchroot: FORCE
 	@echo "\n$(GREEN)*** Creating local lightweight chroot subdirectory structure ***$(NC)\n"
-	@./scripts/lwchroot-init.sh
+	@./conf/scripts/lwchroot-init.sh
+
+deps-dirs-docker: FORCE
+	@echo "\n$(GREEN)*** Creating local lightweight chroot subdirectory structure ***$(NC)\n"
+	@./conf/scripts/devdirs-init.sh
 
 #
 # Install project`s Python dependencies using pip requirements file. The dependencies
@@ -357,12 +365,23 @@ deps-geoip: FORCE
 	@geoipupdate --verbose --database-directory $(shell realpath ./chroot/usr/share/GeoIP)
 	@echo ""
 
+deps-geoip-docker: FORCE
+	@echo "\n$(GREEN)*** Installing IP geolocation databases ***$(NC)\n"
+	@mkdir -p /usr/share/GeoIP
+	#@geoipupdate --verbose --database-directory /usr/share/GeoIP
+	@echo ""
+
 #
 # Fetch and install Negistry whois database.
 #
 deps-negistry: FORCE
 	@echo "\n$(GREEN)*** Installing Negistry whois database ***$(NC)\n"
-	@./scripts/fetch-negistry.sh --stub --target=$(shell realpath ./chroot/var/mentat/whois-negistry.json)
+	@./conf/scripts/fetch-negistry.sh --stub --target=$(shell realpath ./chroot/var/mentat/whois-negistry.json)
+	@echo ""
+
+deps-negistry-docker: FORCE
+	@echo "\n$(GREEN)*** Installing Negistry whois database ***$(NC)\n"
+	@./conf/scripts/fetch-negistry.sh --stub --target=/var/mentat/whois-negistry.json
 	@echo ""
 
 #
@@ -370,7 +389,7 @@ deps-negistry: FORCE
 #
 deps-postgresql: FORCE
 	@echo "\n$(GREEN)*** Installing and configuring PostgreSQL database ***$(NC)\n"
-	@./scripts/sqldb-init.sh
+	@./conf/scripts/sqldb-init.sh
 	@echo ""
 
 
@@ -389,7 +408,7 @@ run-mentat-dev:
 run-webui-dev:
 	@echo "\n$(GREEN)*** Running development web server with development configuration on $(DEV_SERVER):$(DEV_PORT) ***$(NC)\n"
 	#APP_ROOT_PATH=$(shell realpath ./chroot) hawat-cli run --host $(DEV_SERVER) --port $(DEV_PORT)
-	HAWAT_CONFIG_FILE=$(shell realpath ./hawat.local.conf) hawat-cli run --host $(DEV_SERVER) --port $(DEV_PORT)
+	HAWAT_CONFIG_FILE=$(shell realpath ./hawat.local.conf) hawat-cli run --host "0.0.0.0" --port $(DEV_PORT)
 
 run-mailserver-dev:
 	@echo "\n$(GREEN)*** Running development mail server on $(DEV_MAIL_SERVER):$(DEV_MAIL_PORT) ***$(NC)\n"
@@ -467,6 +486,22 @@ presentations: FORCE
 	done
 
 
+db-data-fetch: FORCE
+	@echo "\n$(GREEN)*** Fetching latest production database dump ***$(NC)\n"
+	@rm -rf ./data
+	@mkdir -p ./data
+	@scp mentat-alt:/var/mentat/production-dump/mentat_psqldb_latest.tar.gz ./data/
+	@cd ./data/ && tar -xzvf ./mentat_psqldb_latest.tar.gz
+	@rm -f ./data/mentat_psqldb_latest.tar.gz
+	@mv ./data/var/mentat/tmp/mentat_* ./data/mentat_psqldb_latest
+	@rm -rf ./data/var
+	@echo ""
+
+db-data-import: FORCE
+	@echo "\n$(GREEN)*** Importing latest production database dump ***$(NC)\n"
+	@sudo -u postgres pg_restore --verbose --format=d --dbname=mentat_main /vagrant/data/mentat_psqldb_daily_latest/main
+	@echo ""
+
 #-------------------------------------------------------------------------------
 
 

Vagrantfile

+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+Vagrant.configure('2') do |config|
+  config.vm.hostname = 'mentat-devel.local'
+  config.vm.box = 'debian/contrib-buster64'
+
+  # Flask development server
+  config.vm.network 'forwarded_port', guest: 5000, host: 5000
+  # Apache web server
+  config.vm.network 'forwarded_port', guest: 443, host: 4443
+  # Sendria
+  config.vm.network 'forwarded_port', guest: 1080, host: 1080
+
+  # Create a private network, which allows host-only access to the machine
+  # using a specific IP.
+  # config.vm.network "private_network", ip: "192.168.33.10"
+
+  # Create a public network, which generally matched to bridged network.
+  # Bridged networks make the machine appear as another physical device on
+  # your network.
+  # config.vm.network "public_network"
+
+  # Share an additional folder to the guest VM. The first argument is
+  # the path on the host to the actual folder. The second argument is
+  # the path on the guest to mount the folder. And the optional third
+  # argument is a set of non-required options.
+  # config.vm.synced_folder "../data", "/vagrant_data"
+
+  # Provider-specific configuration so you can fine-tune various
+  # backing providers for Vagrant. These expose provider-specific options.
+  # Example for VirtualBox:
+  #
+  # config.vm.provider "virtualbox" do |vb|
+  #   # Display the VirtualBox GUI when booting the machine
+  #   vb.gui = true
+  #
+  #   # Customize the amount of memory on the VM:
+  #   vb.memory = "1024"
+  # end
+  #
+
+  config.vm.provision 'shell', inline: <<-SHELL
+    bash /vagrant/.vagrantenv/provision.sh
+    bash /vagrant/packaging/debian/postinst
+    bash /vagrant/.vagrantenv/finalize.sh
+  SHELL
+  #config.vm.provision :ansible do |ansible|
+  #  ansible.playbook = '.vagrantenv/provision.yml'
+  #end
+
+  VAGRANT_COMMAND = ARGV[0]
+  config.ssh.username = 'mentat' if VAGRANT_COMMAND == 'ssh'
+end

conf/apache/site_mentat_vagrant.conf

+#-------------------------------------------------------------------------------
+# Example APACHE web server configuration file for HAWAT - development version
+#
+# This is an example configuration for authentication based on SSO service
+# Shibboleth. Please adjust the configuration file according to your needs.
+# In most cases customization of following directives should be enough to
+# get it working properly and quickly:
+#
+#   * ServerAdmin
+#   * ServerName
+#   * SSLCertificateFile
+#   * SSLCertificateKeyFile
+#   * SSLCertificateChainFile
+#
+# This file is part of Mentat system (https://mentat.cesnet.cz/).
+#
+# Copyright (C) since 2011 CESNET, z.s.p.o (http://www.ces.net/)
+# Use of this source is governed by the MIT license, see LICENSE file.
+#-------------------------------------------------------------------------------
+
+WSGIPythonHome /var/mentat/venv
+
+<IfModule mod_ssl.c>
+    <VirtualHost _default_:443>
+        ServerAdmin webmaster@mentat.organization.org
+        ServerName mentat.organization.org
+
+        <IfModule mod_headers.c>
+                # Enforce HTTPS protocol at all times.
+                Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+                # Deny access to content via HTML iframe.
+                Header always set X-Frame-Options DENY
+        </IfModule>
+
+        DocumentRoot /var/www
+
+        WSGIDaemonProcess hawat user=mentat group=mentat threads=5 python-home=/var/mentat/venv
+        WSGIScriptAlias /mentat /vagrant/bin/mentat-hawat-dev.wsgi
+
+        <Location />
+            Require all granted
+        </Location>
+
+        <Directory /vagrant/lib/hawat>
+            WSGIProcessGroup hawat
+            WSGIApplicationGroup %{GLOBAL}
+            Require all granted
+        </Directory>
+
+        <Location /mentat/auth_env/login>
+            AuthType Basic
+            AuthName "Mentat system login"
+            AuthUserFile /etc/mentat/apache/htpasswd.example
+            Require valid-user
+        </Location>
+        <Location /mentat/auth_env/register>
+            AuthType Basic
+            AuthName "Mentat system registration"
+            AuthUserFile /etc/mentat/apache/htpasswd.example
+            Require valid-user
+        </Location>
+
+        RewriteEngine on
+        # Rewrite the path when accessed without a trailing slash.
+        RewriteRule ^/mentat$ /mentat/ [R]
+        # Rewrite webserver root to mentat application.
+        RewriteRule ^/$ /mentat/ [R]
+
+
+        ErrorLog ${APACHE_LOG_DIR}/error.log
+
+        # Possible values: debug, info, notice, warn, error, crit, alert, emerg.
+        LogLevel warn
+
+        CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
+
+        SSLEngine on
+        #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+
+        # Using default self-signed server certificates
+        SSLCertificateFile  /etc/ssl/certs/ssl-cert-snakeoil.pem
+        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
+
+        # Using custom server certificates
+        #SSLCertificateFile      /etc/ssl/servercert/cert.pem
+        #SSLCertificateKeyFile   /etc/ssl/servercert/key.pem
+        #SSLCertificateChainFile /etc/ssl/servercert/chain.pem
+
+        # Enforce only strong SSL protocols. Generator as of August 2016. This
+        # tool is available at https://mozilla.github.io/server-side-tls/ssl-config-generator/
+        # Resource: https://httpd.apache.org/docs/trunk/ssl/ssl_howto.html#onlystrong
+        SSLProtocol         all -SSLv3 -TLSv1 -TLSv1.1
+        SSLCipherSuite      ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
+        SSLHonorCipherOrder on
+        SSLCompression      off
+        SSLSessionTickets   off
+
+        <FilesMatch "\.(cgi|shtml|phtml|php)$">
+                SSLOptions +StdEnvVars
+        </FilesMatch>
+        <Directory /usr/lib/cgi-bin>
+                SSLOptions +StdEnvVars
+        </Directory>
+
+        BrowserMatch "MSIE [2-6]" \
+                nokeepalive ssl-unclean-shutdown \
+                downgrade-1.0 force-response-1.0
+        # MSIE 7 and newer should be able to use keepalive
+        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
+
+    </VirtualHost>
+</IfModule>

conf/core/database.json.conf

@@ -8,7 +8,9 @@
         # SQL storage connection settings.
         #
         "sqlstorage": {
-            "url": "postgresql://mentat:mentat@localhost/mentat_main",
+            # Connect to the PostgreSQL running on outer host machine.
+            # "url": "postgresql://mentat:mentat@10.0.2.2:5432/mentat_main",
+            "url": "postgresql://mentat:mentat@localhost:5432/mentat_main",
             "echo": false
         },
 
@@ -19,6 +21,8 @@
             "dbname":   "mentat_events",
             "user":     "mentat",
             "password": "mentat",
+            # Connect to the PostgreSQL running on outer host machine.
+            # "host":     "10.0.2.2",
             "host":     "localhost",
             "port":     5432
         }

conf/requirements-dev.pip

@@ -4,5 +4,6 @@ nose==1.3.7
 coverage==5.0.4
 pyflakes==2.1.1
 pylint==2.4.4
+sendria==2.2.2
 sphinx==2.4.4
 sphinx-rtd-theme==0.4.3