10.4. Configure the Dashboard

Procedure 10.2. Configuring Connections and Logging for the Dashboard

1. Set the ALLOWED_HOSTS parameter with a comma-separated list of host/domain names that the application can serve. For example:

   ALLOWED_HOSTS = ['horizon.example.com', 'localhost', '192.168.20.254', ]

2. Update the CACHES settings with the memcached values:

   SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
   CACHES = {
   	'default': {
   		'BACKEND' : 'django.core.cache.backends.memcached.MemcachedCache',
   		'LOCATION' : 'memcacheURL:port',
   	}
   }
   

   Replace the following values:

   • Replace memcacheURL with IP address of the host on which memcached was installed.
   • Replace port with the value from the PORT parameter in the /etc/sysconfig/memcached file.
3. Specify the host URL for the Identity service endpoint. For example:

   OPENSTACK_KEYSTONE_URL="127.0.0.1"

4. Update the dashboard's time zone:

   TIME_ZONE="UTC"

   The time zone can also be updated using the dashboard GUI.
5. To ensure the configuration changes take effect, restart the Apache service:

   # systemctl restart httpd.service

Procedure 10.3. Configuring the Dashboard to use HTTPS

1. Open the /etc/openstack-dashboard/local_settings file in a text editor, and uncomment the following parameters:

   SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')
   CSRF_COOKIE_SECURE = True
   SESSION_COOKIE_SECURE = True

   The latter two settings instruct the browser to only send dashboard cookies over HTTPS connections, ensuring that sessions will not work over HTTP.
2. Open the /etc/httpd/conf/httpd.conf file in a text editor, and add the following line:

   NameVirtualHost *:443

3. Open the /etc/httpd/conf.d/openstack-dashboard.conf file in a text editor.
   1. Delete the following lines:

      WSGIDaemonProcess dashboard
      WSGIProcessGroup dashboard
      WSGISocketPrefix run/wsgi
      
      WSGIScriptAlias /dashboard /usr/share/openstack-dashboard/openstack_dashboard/wsgi/django.wsgi
      Alias /static /usr/share/openstack-dashboard/static/
      
      <Directory /usr/share/openstack-dashboard/openstack_dashboard/wsgi>
          <IfModule mod_deflate.c>
            SetOutputFilter DEFLATE
            <IfModule mod_headers.c>
              # Make sure proxies don’t deliver the wrong content
              Header append Vary User-Agent env=!dont-vary
            </IfModule>
          </IfModule>
      
        Order allow,deny
        Allow from all
      </Directory>
      <Directory /usr/share/openstack-dashboard/static>
        <IfModule mod_expires.c>
          ExpiresActive On
          ExpiresDefault "access 6 month"
        </IfModule>
        <IfModule mod_deflate.c>
          SetOutputFilter DEFLATE
        </IfModule>
      
        Order allow,deny
        Allow from all
      </Directory>
      
        RedirectMatch permanent ^/$ https://xxx.xxx.xxx.xxx:443/dashboard
      

   2. Add the following lines:

      WSGIDaemonProcess dashboard
      WSGIProcessGroup dashboard
      WSGISocketPrefix run/wsgi
      LoadModule ssl_module modules/mod_ssl.so
      
      <VirtualHost *:80>
        ServerName openstack.example.com
        RedirectPermanent / https://openstack.example.com/
      </VirtualHost>
      
      <VirtualHost *:443>
          ServerName openstack.example.com
          SSLEngine On
          SSLCertificateFile /etc/httpd/SSL/openstack.example.com.crt
          SSLCACertificateFile /etc/httpd/SSL/openstack.example.com.crt
          SSLCertificateKeyFile /etc/httpd/SSL/openstack.example.com.key
          SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
          WSGIScriptAlias / /usr/share/openstack-dashboard/openstack_dashboard/wsgi/django.wsgi
          WSGIDaemonProcess horizon user=apache group=apache processes=3 threads=10
          RedirectPermanent /dashboard https://openstack.example.com
          Alias /static /usr/share/openstack-dashboard/static/
          <Directory /usr/share/openstack-dashboard/openstack_dashboard/wsgi>
            Order allow,deny
            Allow from all
          </Directory>
      </VirtualHost>
      
      <Directory /usr/share/openstack-dashboard/static>
        <IfModule mod_expires.c>
          ExpiresActive On
          ExpiresDefault "access 6 month"
        </IfModule>
        <IfModule mod_deflate.c>
          SetOutputFilter DEFLATE
        </IfModule>
      
      Order allow,deny
      Allow from all
      </Directory>
      
      RedirectMatch permanent ^/$ /dashboard/
      

   In the new configuration, Apache listens on port 443 and redirects all non-secured requests to the HTTPS protocol. The <VirtualHost *:443> section defines the required options for this protocol, including private key, public key, and certificates.
4. Restart the Apache service and the memcached service:

   # systemctl restart httpd.service
   # systemctl restart memcached.service

Procedure 10.4. Changing the Default Role for the Dashboard

1. Set up the shell to access keystone as the administrative user:

   # source ~/keystonerc_admin

2. Create the new role:

   [(keystone_admin)]# keystone role-create --name NEW_ROLE
   +----------+----------------------------------+
   | Property |              Value               |
   +----------+----------------------------------+
   | id       | 8261ac4eabcc4da4b01610dbad6c038a |
   | name     |              NEW_ROLE            |
   +----------+----------------------------------+

   Replace NEW_ROLE with a name for the role.
3. Open the /etc/openstack-dashboard/local_settings file in a text editor, and change the value of the following parameter:

   OPENSTACK_KEYSTONE_DEFAULT_ROLE = 'NEW_ROLE'

   Replace NEW_ROLE with the name of the role you created in the previous step.
4. Restart the Apache service for the change to take effect:

   # systemctl restart httpd.service

Procedure 10.5. Configuring SELinux to Allow Connections from the Apache Service

1. Check the status of SELinux on the system:

   # getenforce

2. If the resulting value is 'Enforcing' or 'Permissive', allow connections between the httpd service and the Identity service:

   # setsebool -P httpd_can_network_connect on

Procedure 10.6. Configuring the Firewall to Allow Dashboard Traffic

1. Open the /etc/sysconfig/iptables configuration file in a text editor:

   • To allow incoming connections using only HTTPS, add the following firewall rule:

     -A INPUT -p tcp --dport 443 -j ACCEPT

   • To allow incoming connections using both HTTP and HTTPS, add the following firewall rule:

     -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

2. Restart the iptables service for the changes to take effect:

   # systemctl restart iptables.service