From 5c68050ce0e896cfef960edd071d1a52a00fa237 Mon Sep 17 00:00:00 2001 From: catborise Date: Sun, 18 Oct 2026 22:32:54 +0300 Subject: [PATCH] build: LDAP login's packages are optional django-auth-ldap, python-ldap and pyasn1 move to conf/requirements-ldap.txt. Installs without LDAP no longer need the openldap and sasl headers that pip builds python-ldap with; the installer and the README's system packages drop them, and the README's LDAP section installs them with that file. The settings already work without the module. The Docker image and dev/requirements.txt keep LDAP, so CI still builds and audits python-ldap. --- Dockerfile | 4 ++-- README.md | 20 +++++++++++++++----- conf/requirements-ldap.txt | 6 ++++++ conf/requirements.txt | 4 ---- dev/requirements.txt | 1 + webvirtcloud.sh | 12 ++++++------ 6 files changed, 30 insertions(+), 17 deletions(-) create mode 100644 conf/requirements-ldap.txt diff --git a/Dockerfile b/Dockerfile index 30635cc5..d7d5a875 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,11 +17,11 @@ RUN apt-get update -qqy \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* WORKDIR /srv/webvirtcloud -COPY conf/requirements.txt conf/requirements.txt +COPY conf/requirements.txt conf/requirements-ldap.txt conf/ # hadolint ignore=DL3013,DL3042 RUN python3 -m venv venv \ && venv/bin/pip install --no-cache-dir -U pip wheel \ - && venv/bin/pip install --no-cache-dir -r conf/requirements.txt + && venv/bin/pip install --no-cache-dir -r conf/requirements.txt -r conf/requirements-ldap.txt FROM phusion/baseimage:noble-1.0.3 diff --git a/README.md b/README.md index 942722d1..43a73cc5 100644 --- a/README.md +++ b/README.md @@ -95,13 +95,13 @@ The panel and its console are at `http://`. The database and secret k Run the steps from a root shell (`sudo -i`). In step 3, replace the example `ALLOWED_HOSTS` with the names/IPs the panel (and the cloud-init datasource) is reached by. -The virtualenv is created with `--system-site-packages`: `libvirt-python` and `python-ldap` come from the distro packages when their version satisfies `conf/requirements.txt`; otherwise pip builds them, which needs the `-dev`/`-devel` packages listed below. Everything else, including `lxml`, comes from pip. +The virtualenv is created with `--system-site-packages`: `libvirt-python` comes from the distro packages when its version satisfies `conf/requirements.txt`; otherwise pip builds it, which needs the `-dev`/`-devel` packages listed below. Everything else, including `lxml`, comes from pip. #### Ubuntu 22.04 / 24.04, Debian 12 ```bash # 1. System packages -apt-get update && apt-get -y install git python3-venv python3-dev python3-lxml python3-libvirt libvirt-dev zlib1g-dev libxslt1-dev nginx libsasl2-modules gcc pkg-config python3-guestfs libsasl2-dev libldap2-dev libssl-dev +apt-get update && apt-get -y install git python3-venv python3-dev python3-lxml python3-libvirt libvirt-dev zlib1g-dev libxslt1-dev nginx libsasl2-modules gcc pkg-config python3-guestfs libssl-dev # 2. Code git clone https://github.com/retspen/webvirtcloud /srv/webvirtcloud @@ -138,7 +138,7 @@ nginx -t && systemctl restart nginx ```bash # 1. System packages (libvirt-devel is in the CRB repository) dnf -y install epel-release && crb enable -dnf -y install git python3-devel libvirt-devel python3-libvirt python3-ldap python3-lxml cyrus-sasl-devel cyrus-sasl-md5 openldap-devel openssl-devel glibc gcc nginx python3-libguestfs iproute-tc +dnf -y install git python3-devel libvirt-devel python3-libvirt python3-lxml cyrus-sasl-md5 openssl-devel glibc gcc nginx python3-libguestfs iproute-tc # 2. Code git clone https://github.com/retspen/webvirtcloud /srv/webvirtcloud @@ -180,7 +180,7 @@ systemctl enable nginx && nginx -t && systemctl restart nginx ```bash # 1. System packages (Python 3.11 stack) -zypper --non-interactive install -y git hostname python311 python311-base python311-devel python311-pip python311-libvirt-python python311-lxml python311-ldap libvirt-devel openldap2-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config nginx +zypper --non-interactive install -y git hostname python311 python311-base python311-devel python311-pip python311-libvirt-python python311-lxml libvirt-devel libopenssl-devel gcc pkg-config nginx # 2. Code git clone https://github.com/retspen/webvirtcloud /srv/webvirtcloud @@ -325,6 +325,15 @@ datasource: The options below are set in `webvirtcloud/settings.py`. Variants for Active Directory and OpenLDAP are shown; this is a minimal config, see the [django-auth-ldap documentation](https://django-auth-ldap.readthedocs.io) for more. +The Docker image includes the LDAP packages. On an installer or manual install, add them to the virtualenv first; pip builds `python-ldap` against these headers: + +```bash +apt-get -y install libldap2-dev libsasl2-dev # Ubuntu / Debian +dnf -y install openldap-devel cyrus-sasl-devel # RHEL / Rocky / AlmaLinux +zypper --non-interactive install -y openldap2-devel cyrus-sasl-devel # openSUSE +/srv/webvirtcloud/venv/bin/pip3 install -r /srv/webvirtcloud/conf/requirements-ldap.txt +``` + Enable the LDAP backend: ```bash @@ -472,7 +481,7 @@ Move the `environment=` values of that config into `/etc/default/webvirtcloud` ( - a literal `SECRET_KEY = "..."` (older installers wrote it there): put the value into `data/secret_key` instead, or every user is signed out; - `SHOW_PROFILE_EDIT_PASSWORD`: keep it for this one `migrate` if you have it (migration `accounts.0008` reads it), then delete it. -3. Install, migrate, and fix ownership and modes (`nginx:nginx` instead of `www-data:www-data` on RHEL / openSUSE). On openSUSE first `zypper --non-interactive install -y openldap2-devel`: pip builds `python-ldap` in the venv: +3. Install, migrate, and fix ownership and modes (`nginx:nginx` instead of `www-data:www-data` on RHEL / openSUSE). With LDAP, also run `venv/bin/pip3 install -U -r conf/requirements-ldap.txt` (headers: [LDAP](#ldap)): ```bash venv/bin/pip3 install -U -r conf/requirements.txt && @@ -606,6 +615,7 @@ A version from before v3.0.0 has no worker: `systemctl disable --now webvirt-wor - The SQLite database must be on a local file system (WAL). - Outside compose, stop the Docker container with `docker stop -t 95` so the worker can finish running jobs. - Installer and manual installations run the panel as systemd units (`webvirt-cloud`, `webvirt-novncd`, `webvirt-socketiod`, `webvirt-worker`) and computes run `webvirt-gstfsd`, instead of supervisor; see [Moving from supervisor to systemd](#moving-from-supervisor-to-systemd). Service settings go into `/etc/default/webvirtcloud`, service output into the journal (`journalctl -u webvirt-cloud`); the app log stays in `data/`. +- LDAP login's packages are in `conf/requirements-ldap.txt` and no longer installed by default, nor their build headers by the installer; the Docker image keeps them. An existing virtualenv keeps them, but only installing that file updates them (see [LDAP](#ldap) and step 3). ## Usage diff --git a/conf/requirements-ldap.txt b/conf/requirements-ldap.txt new file mode 100644 index 00000000..cf4f6cf6 --- /dev/null +++ b/conf/requirements-ldap.txt @@ -0,0 +1,6 @@ +# LDAP login (README: LDAP); pip builds python-ldap against the system's +# openldap and sasl headers +django-auth-ldap==5.3.0 +# the venv can otherwise keep older distro copies (openSUSE 15.6) +python-ldap>=3.4.5 +pyasn1>=0.6.4 diff --git a/conf/requirements.txt b/conf/requirements.txt index 97502329..24bf0c57 100644 --- a/conf/requirements.txt +++ b/conf/requirements.txt @@ -2,10 +2,6 @@ Django==5.2.18 django_bootstrap5==26.3 django-bootstrap-icons==0.9.0 django-otp==1.7.4 -django-auth-ldap==5.3.0 -# the installer's venv can otherwise keep older distro copies (openSUSE 15.6) -python-ldap>=3.4.5 -pyasn1>=0.6.4 # for django-bootstrap-icons and websockify; a host's python3-requests would # otherwise bring idna, requests and urllib3 with advisories idna>=3.15 diff --git a/dev/requirements.txt b/dev/requirements.txt index 6f071a4e..7dc6868a 100644 --- a/dev/requirements.txt +++ b/dev/requirements.txt @@ -1,4 +1,5 @@ -r ../conf/requirements.txt +-r ../conf/requirements-ldap.txt coverage==7.16.2 # compiles the themes (manage.py build_themes) libsass==0.23.0 diff --git a/webvirtcloud.sh b/webvirtcloud.sh index fdc1eeaf..496c678e 100755 --- a/webvirtcloud.sh +++ b/webvirtcloud.sh @@ -567,7 +567,7 @@ case $distro in progress echo "* Installing OS requirements." - PACKAGES="git python3-venv python3-virtualenv python3-pip python3-dev python3-lxml libvirt-dev zlib1g-dev libxslt1-dev libsasl2-dev libldap2-dev nginx smbios-utils libsasl2-modules gcc pkg-config python3-guestfs uuid" + PACKAGES="git python3-venv python3-virtualenv python3-pip python3-dev python3-lxml libvirt-dev zlib1g-dev libxslt1-dev nginx smbios-utils libsasl2-modules gcc pkg-config python3-guestfs uuid" install_packages @@ -597,7 +597,7 @@ case $distro in progress echo "* Installing OS requirements." - PACKAGES="git python3-venv python3-virtualenv python3-pip python3-dev python3-lxml libvirt-dev zlib1g-dev libxslt1-dev libsasl2-dev libldap2-dev nginx libsasl2-modules gcc pkg-config python3-guestfs" + PACKAGES="git python3-venv python3-virtualenv python3-pip python3-dev python3-lxml libvirt-dev zlib1g-dev libxslt1-dev nginx libsasl2-modules gcc pkg-config python3-guestfs" install_packages set_hosts @@ -633,7 +633,7 @@ case $distro in log "yum -y install wget epel-release" echo "* Installing OS requirements." - PACKAGES="git python3-virtualenv python3-devel libvirt-devel python3-libvirt python3-ldap glibc gcc nginx python3-lxml python3-libguestfs iproute-tc cyrus-sasl-md5 openldap-devel cyrus-sasl-devel openssl-devel" + PACKAGES="git python3-virtualenv python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute-tc cyrus-sasl-md5 openssl-devel" install_packages set_hosts @@ -723,11 +723,11 @@ case $distro in progress echo "* Installing OS requirements." - # On SUSE, install Python 3.11 stack to satisfy Python >= 3.10 requirement along with native libvirt and ldap bindings + # On SUSE, install Python 3.11 stack to satisfy Python >= 3.10 requirement along with the native libvirt bindings if zypper se -s python311-devel >/dev/null 2>&1; then - PACKAGES="git hostname python311 python311-base python311-devel python311-pip python311-libvirt-python python311-lxml python311-ldap libvirt-devel openldap2-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config nginx" + PACKAGES="git hostname python311 python311-base python311-devel python311-pip python311-libvirt-python python311-lxml libvirt-devel libopenssl-devel gcc pkg-config nginx" else - PACKAGES="git hostname python3-devel python3-pip python3-virtualenv libvirt-devel python3-libvirt python3-lxml openldap2-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config nginx" + PACKAGES="git hostname python3-devel python3-pip python3-virtualenv libvirt-devel python3-libvirt python3-lxml libopenssl-devel gcc pkg-config nginx" fi install_packages