Creating my Dream Server for Django

2009/2/13 An updated version of this article using Ubuntu Intrepid can be viewed here.

Note: This article has been reworked to use Nginx as frontend to Apache2, instead of the fairly unusual configuration shown in this article. You probably want to view the reworked version instead.

When you are building something important to you, you want to build it on a solid foundation. There is nothing more frustrating than trying to build a great piece of software and then running it on a poorly configured server. Recently I decided to stop having that feeling and I rebuilt my server, here are my instructions.

The end product is an Ubuntu Feisty server using Apache2 and mod_python to serve Django, and lighttpd to serve static media. It uses memcached as its caching backend, and uses Postgres8.2 as its database. The machine built using these instructions is in fact running this blog, which is a Django application. I performed this installation on a SliceHost 256 meg slice, but they would apply equally well to any Ubuntu server (not so well to shared hosting).

On to the fun stuff.

Credit

This setup guide is a consolidation of a huge number of other resources written by a wide number of individuals. Here are the resources I used during this setup process, I will try to also link to them in the context that I used them.

• [Guide to doing anything server related with feisty][server]
• [Starter guide to setting up feisty][start]
• [Upgrading your SliceHost slice to Ubuntu Feisty][feisty]
• [Setting up a mySQL Django server on SliceHost][start]
• [Installing Postgres on Ubuntu][postgres]
• [Setting up CentOS on SliceHost for Django with Postgres by DjangoJoe][centos]
• [Configuring Lighttpd as a file server for Apache][lighttpd]

Upgrading Ubuntu Dapper to Feisty

These instructions were taken from [here][feisty].

Upgrading from Ubuntu Dapper (SliceHost's current Ubuntu OS) to Feisty is quick and painless. You do need to do the upgrades in order though, skipping straight to feisty is likely to make your installation unstable. The final 'lsb_release -a' is simply to confirm that the upgrade has occured. It should show that you now have Ubuntu Feisty installed.

### My article

My list entry one
My list entry two

<code class="python">def x (a, b):
return a * b</code>

Adding Apache & Other Libraries

Mostly taken from [here][apache].

We install a number of libraries here. Some of them will have fun little installation screens to walk through. None of them were particularly difficult though. You may notice that psyco_pg2 is not being installed via apt-get, thats because the psyco_pg2 in the apt-get repository didn't work for me (kept causing segment faults).

 ### My article

My list entry one
My list entry two

@@ python
def x (a, b):
return a * b

This will be the easiest section of the installation. Still nice while it lasted.

PostgreSQL

Instructions taken from [here][postgres] and [here][centos].

Make sure to use your own password instead of just 'password' in the code below.

import myproject.myapp.markdownpp as markdownpp

And then we edit the pg_hba.conf file.

class Entry(models.Model):
     title = models.CharField(maxlength=200)
     body = models.TextField()
     body_html = models.TextField(blank=True, null=True)
     use_markdown = models.BooleanField(default=True)

Go to the end of the file and comment out all lines that start with host (unless you will be accessing your database remotely). Finally the local line should look like

    def save(self):
        if self.use_markdown:
            self.body_html = markdownpp.markdown(self.html)
        else:
            self.body_html = self.body
        super(Entry,self).save()

Finally we'll want to restart Postgres:

class Resource(models.Model):
    title = models.CharField(maxlength=50)
    markdown_id = models.CharField(maxlength=50)
    content = models.FileField(upload_to="myapp/resource")

Configuring memcached

Now we are going to setup memcached. This is pretty easy to do, and it is going to provide a great caching system for your Django system. The first step is:

class Entry(models.Model):
     title = models.CharField(maxlength=200)
     body = models.TextField()
     body_html = models.TextField(blank=True, null=True)
     use_markdown = models.BooleanField(default=True)

On Ubuntu the user www-data is the user that runs the webserver, making it very similar to the apache user on some other distributions. Running memcached with the -u www-data option means that we'll be running memcached with the same user as the webserver. Port 11211 is the default for memcached, and probably should not be changed unless you are running multiple memcached instances. I chose to start my memcached instance with 32 megs of memory because my slice only has 256 meg total, and my Django app simply doesn't have very much information to cache. You may want to devote more of your memory to memcached, especially if you have a larger slice.

Next we need to get python-memcached, which is a python memcached client. There is an alternate cmemcached library for Python that is twice as fast as python-memcached, but I had trouble getting it to compile (I believe because I installed memcached from a repository instead of from source). Python-memcached is easy to get:

    def save(self):
        if self.use_markdown:
            pieces = [self.html,]
            for res in Resource.objects.all():
                 ref = u'\n\n[%s]: %s "%s"\n\n' % (
                    res.markdown_id,
                    res.get_content_url(),
                    res.title,
                    )
                pieces.append(res)
            content = u"\n".join(pieces)
            self.body_html = markdownpp.markdown(content)
        else:
            self.body_html = self.body
        super(Entry,self).save()

And that should be that.

At this exact moment (July 12, 2007) the current svn version of Django is broken with python-memcached. A patch has been submitted and is working its way through the submission system, so hopefully this issue will resolve itself soon. If anyone is affected by this situation, send me an email or leave a comment and I'll update this guide to include the required modifications.

Setting Up a Non-Root Account

Now for some security minded things. Not that I know very much about security, but every bit helps.

refs = entry.resources.all()

Copy the line for root and replicate it for your new account.

Now you'll want to close ssh and ssh back in as the new user your just made.

Then you'll want to disable the root account.

def save:
    super(Entry,self).save()
    res = self.resources.all()
    # etc etc
    super(Entry,self).save()

The line of thought behind disabling the root account is that it is bad to have a commonly known name that is available to SSH. Its also bad to have it accessible to a quick su. Admittedly your new account will still be accessible, but at least it will be your account and not an universally known one.

Setting up automatic SSH login with keys

This is more of a convience solution, but it is also a boost to your security once we disable password based access (although you might opt not to). I am assuming you have a set of rsa keys already on your local machine at ~/.ssh . If you don't have them (or you are using Windows, etc), you'd be better off looking for a more detailed guide.

import time, thread
from django.db import models
from django.dispatch import dispatcher
from django.db.models import signals
#######################
### your models go here ###
#######################

Remote login should now be automatic. Now we will restrict SSH a bit more

You will want to make these changes

def resave_object(sender, instance, signal, *args, **kwargs):
    def do_save():
        time.sleep(3)
        try:
            instance.save()
        except:
            pass
    id = unicode(instance) + unicode(instance.id)
    try:
        should_resave = resave_hist[id]
    except KeyError:
        resave_hist[id] = True
        should_resave = True
    if should_resave is True:
        resave_hist[id] = False
        thread.start_new_thread(do_save, ())
    else:
        resave_hist[id] = True

resave_hist = {}
dispatcher.connect(resave_object, signal=signals.post_save, sender=Entry)

(PAM helps prevent brute force SSH logins, which no longer applies since password based login is disabled.)

Now only users with valid keys can ssh in... which means only your one account can ssh in. If you want to allow others to log in you can have them send you their public rsa keys, or you could temporarily enable password based login while they set up ssh.

Configuring iptables

Yep... I don't know how to do this yet on Ubuntu. Which is to say I don't know where the config file is. The command line tool is killing me. I refuse to learn another mini-language! Do we really need mini-languages for every mundane tasks?

That said, you should do this. Hopefully I'll crack open the helpfiles soon and update this afterwards.

Setting up Django, etc

Now we are going to setup Django. We will first create a postgres user for our Django app: