Geonode: Changing of GeoServer default password will prevail GeoNode from uploading layers

[gannebamm]

I changed the default password from GeoServer user 'admin' (u: 'admin', p: 'geoserver') for production. After doing this I was unable to upload layers. GeoServer log lists it was unable to authenticate the user 'admin'. Is this an expected behaviour? How to change the default password for production? Do I have to change the geofence or OAuth settings?

[frafra]

ADMIN_PASSWORD for SPCGeonode, while you should change django.env for standard Docker setup.

[gannebamm]

For SPCGeonode I see where the docker-compose.yml variable ADMIN_PASSWORD is used:
https://github.com/GeoNode/geonode/blob/master/scripts/spcgeonode/geoserver/docker-entrypoint.sh#L58

But for the 'plain' GeoNode compose setup there is no GEOSERVER_PASSWORD:
https://github.com/GeoNode/geonode/blob/master/scripts/docker/env/production/django.env

https://github.com/GeoNode/geonode/blob/master/scripts/docker/env/production/geoserver.env

the docker image itself is built differently and there is no creation of a password:

https://github.com/GeoNode/geoserver-docker

We really should merge / create one docker-compose ready setup for production. For me it seems like the 'plain' docker-compose is not intended for this purpose.

[frafra]

I prefer to use SPCGeonode because I find it more suitable for production. Maybe we should just deprecate the old one and check if something is missing in spc.

[gannebamm]

I prefer to use SPCGeonode because I find it more suitable for production. Maybe we should just deprecate the old one and check if something is missing in spc.

I just tried SPCGeonode and while the setup is nice (straightforward) and you are able to change all passwords and usernames, I am unable to reach the geoserver via the UI. As logged in admin user the button sends me to 'nginx/geoserver/'.

And the current docker-compose.yml does extensivly use -dev and Debug=True for images and as environment variable.

@frafra Would you mind to share a 'production ready' docker-compose file with some words about the config?

[t-book]

@frafra Would you mind to share a 'production ready' docker-compose file with some words about the config?

+1 as this would be of help for other Users https://lists.osgeo.org/pipermail/geonode-users/2019-March/005434.html.

@gannebamm Some time ago @afabiani posted a really helpful geonode-docker primer. Unsure if it covers 'going live' as well. I remember darkly it was on google docs. Will grep my Bookmarks for it.

[frafra]

Here it is!

version: '3.4'

# Common Django template for Geonode, Celery and Celerycam services below
x-common-django:
  &default-common-django
  image: registry.gitlab.com/nina-data/geonode/master-branded-nina/django:latest
  environment:
    # editable in .env
    - HTTP_HOST=geodata.nina.no
    - HTTP_PORT=80
    - HTTPS_HOST=geodata.nina.no
    - HTTPS_PORT=443
    - ADMIN_USERNAME=admin
    - ADMIN_PASSWORD=${PASSWORD}
    - [email protected]
    - GEOSERVER_ADMIN_USER=admin
    - GEOSERVER_ADMIN_PASSWORD=${PASSWORD}
    - REGISTRATION_OPEN=False
    - TIME_ZONE=Europe/Oslo
    - ALLOWED_HOSTS=['nginx','127.0.0.1','localhost','geodata.nina.no']
    - SECRET_KEY=${SECRET_KEY}
    # hardcoded
    - DEBUG=False
    - DJANGO_SETTINGS_MODULE=geonode.settings
    - DATABASE_URL=postgres://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres
    - BROKER_URL=amqp://rabbitmq:5672
    - STATIC_ROOT=/spcgeonode-static/
    - MEDIA_ROOT=/spcgeonode-media/
    - STATIC_URL=/static/
    - MEDIA_URL=/uploaded/
    - GEOSERVER_LOCATION=https://geodata.nina.no/geoserver/
    - ASYNC_SIGNALS=True
    # TODO : we should probably remove this and set Celery to use JSON serialization instead of pickle
    - C_FORCE_ROOT=True
    # We get an exception after migrations on startup (it seems the monitoring app tries to resolve the geoserver domain name after it's migration, which can happen before oauth migrations on which geoserver startup depends...)
    - MONITORING_ENABLED=False
  volumes:
    - /data/dockerdata/geodata-public/static:/spcgeonode-static/
    - /data/dockerdata/geodata-public/media:/spcgeonode-media/
  restart: on-failure
  depends_on:
    - geoserver
    - postgres
    - rabbitmq

services:

  # Our custom django application. It includes Geonode.
  django:
    << : *default-common-django
    healthcheck:
      test: "curl --fail --silent --write-out 'HTTP CODE : %{http_code}\n' --output /dev/null http://127.0.0.1:8001/"
      interval: 60s
      timeout: 10s
      retries: 1
      start_period: 60s
    entrypoint: ["/spcgeonode/scripts/spcgeonode/django/docker-entrypoint.sh"]
    command: "uwsgi --chdir=/spcgeonode --module=geonode.wsgi --socket=:8000 --http=127.0.0.1:8001 --processes=5"

  # Celery worker that executes celery tasks created by Django.
  celery:
    << : *default-common-django
    entrypoint: []
    command: 'celery worker --app=geonode.celery_app:app -l info -E'

  # Celery beat that triggers scheduled tasks
  celerybeat:
    << : *default-common-django
    entrypoint: []
    command: 'celery beat --app=geonode.celery_app:app --pidfile="/celerybeat.pid" -l info'

  # Celery camera that monitors celery tasks and populate the djcelery django admin interface
  celerycam:
    << : *default-common-django
    entrypoint: []
    command: 'celery events --app=geonode.celery_app:app --pidfile="/celeryev.pid" --camera=django_celery_monitor.camera.Camera --frequency=2.0 -l info'

  # Nginx is serving django static and media files and proxies to django and geonode
  nginx:
    image: olivierdalang/spcgeonode:nginx-2.10rc4.1
    environment:
      - HTTP_HOST=geodata.nina.no
      - LETSENCRYPT_MODE=disabled
      - RESOLVER=127.0.0.11
    ports:
      - "8040:80"
    volumes:
      - /data/dockerdata/geodata-public/static:/spcgeonode-static/
      - /data/dockerdata/geodata-public/media:/spcgeonode-media/
    restart: on-failure

  # Geoserver backend
  geoserver:
    image: olivierdalang/spcgeonode:geoserver-2.10rc4.1
    healthcheck:
      test: "curl --fail --silent --write-out 'HTTP CODE : %{http_code}\n' --output /dev/null http://127.0.0.1:8080/geoserver/rest/workspaces/geonode.html"
      interval: 60s
      timeout: 10s
      retries: 1
      start_period: 60s
    environment:
      - HTTP_HOST=geodata.nina.no
      - HTTP_PORT=80
      - HTTPS_HOST=geodata.nina.no
      - HTTPS_PORT=443
      - ADMIN_USERNAME=admin
      - ADMIN_PASSWORD=${PASSWORD}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - DATABASE_URL=postgres://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres
    volumes:
      - /data/dockerdata/geodata-public/data:/spcgeonode-geodatadir/
    restart: on-failure

  # PostGIS database.
  postgres:
    image: mdillon/postgis:9.6-alpine
    command: postgres -c 'wal_level=archive' -c 'archive_mode=on' -c 'archive_command=cp %p /var/lib/postgresql/data/archive/%f'
    ports:
      - "8432:5432"
    volumes:
      - /data/dockerdata/geodata-public/db:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    restart: on-failure

  # Vanilla RabbitMQ service. This is needed by celery
  rabbitmq:
    image: rabbitmq:3.7-alpine
    restart: on-failure
    volumes:
      - /data/dockerdata/geodata-public/rabbitmq:/var/lib/rabbitmq

As you can see there are some differences, like:

• Bind mounts instead of volumes
• No letsencrypt (https managed by a different server) nor pgdump (trying to use WAL archiving)
• Custom geonode image built from master
• Some URLs

HTTP and HTTPS host and ports, together with GEOSERVER_LOCATION are crucial.

[gannebamm]

@gannebamm Some time ago @afabiani posted a really helpful geonode-docker primer. Unsure if it covers 'going live' as well. I remember darkly it was on google docs. Will grep my Bookmarks for it.

The mentioned google doc primer:
https://docs.google.com/document/d/1S0ac9IR9IW9tUjMu7JETPLUjnfQ6P87m1PKNko8IPWY

It does not cover a production setup. But it covers how to change localhost to an IP or domain.

[gannebamm]

I think we all agree that the docker setup needs an update.
There are ongoing discussions about how to update the GNIP: GeoNode/geonode#3707 which is already in place but outdated. These discussions will be held on the geonode gitter (https://gitter.im/GeoNode/general) and a subgitter group (https://gitter.im/spatialists/community)

SPC GeoNode is able to change the username and password for geonode and geoserver respectivly but has some other flaws.

[frafra]

@gannebamm
Have a look at this issue too: https://github.com/GeoNode/geonode/issues/4303
It seems that you should explicitly set SITEURL and GEOSERVER_WEB_UI_LOCATION, until we figure out why the Docker entrypoint variables are ignored.

[gannebamm]

The new SPC setup is fine and will be able to work for (small to medium scale) productino environments. I am not sure how to change those values on the 'vanilla' docker setup @francbartoli, could you shed some light on this here. Than we could close this issue, as it is outdated.

[francbartoli]

@gannebamm the change of admin password is not implemented yet. I had a look at spc implementation and it looks like the entrypoint updates it every time the container is restarted. Is that right?

[gannebamm]

@francbartoli
Yes, It is part of initialize.py which will get called by docker-entrypoint.sh on startup.

[francbartoli]

@gannebamm in this case, I wouldn't consider that behavior safe

[frafra]

I am in favor of setting the password when the container starts and override it if another password has been set; otherwise the parameter would work only in some cases and not others. Many images, including the official Postgres image, override the whole configuration based on the parameters, including the password.

[francbartoli]

I totally agree with you @frafra

[gannebamm]

@gannebamm in this case, I wouldn't consider that behavior safe

I totally agree with you @frafra

I do not understand if you @francbartoli are in favor of overwriting the passwords on restart, if the passwords were changed, or not.

I am in favor for doing it like mdillon and postgis. The env parameter will configure the container on startup. Which will lead to a new password, if the .env file will be changed between startups.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[lleoooell]

hello there, is there any update on this ? can we some way change geoserver admin password ?

[gannebamm]

@lleoooell We will do a docker rework soon and tackle this issue. In the meantime I would recommend to use SPC geonode for production docker compositions - see https://github.com/GeoNode/geonode/tree/master/scripts/spcgeonode

[francbartoli]

@lleoooell can you try with geonode-project repo where now there should be this feature?

[gannebamm]

To change the password in GeoNode (non SPC Deployment): https://docs.geonode.org/en/master/install/basic/index.html#fourth-step-secure-your-production-deployment-change-the-admin-passwords-and-oauth2-keys