tomcat-only, linux, non-root

[Etienne Dysli-Metref]

On 11/08/16 01:39, Peter Schober wrote:
> Trying to support institutions where admins are only "allowed" to run
> their IDP on RHEL/CentOS (v7 is what I aimed for) I've researched a
> bit wrt non-root deployments and have now fully documented 2 more
> methods:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPLinuxNonRoot

Thank you for linking to the "systemd house of horror"! :) That's one of
my current favourites. Too bad it fell off the web.

I've searched a bit further and wondered whether Tomcat could benefit
from systemd's socket activation: systemd creates the socket on a low
port then hands it to Tomcat, no root required. After a bit of reading,
I doubt this will ever happen with Java programs because you need to use
systemd's API... (For example Twisted seems to support this [1].)

But I stumbled upon an interesting solution: systemd-socket-proxyd [2]:

> systemd-socket-proxyd is a generic socket-activated network socket 
> forwarder proxy daemon for IPv4, IPv6 and UNIX stream sockets. It may
> be used to bi-directionally forward traffic from a local listening
> socket to a local or remote destination socket.
> 
> One use of this tool is to provide socket activation support for 
> services that do not natively support socket activation. On behalf of
> the service to activate, the proxy inherits the socket from systemd,
> accepts each client connection, opens a connection to a configured
> server for each client, and then bidirectionally forwards data
> between the two.

The man page [2] also contains an example for nginx. Since
systemd-socket-proxyd is part of systemd, there is nothing else to
install and only two unit files to configure. :D

  Etienne

[1] https://twistedmatrix.com/documents/13.2.0/core/howto/systemd.html
[2]
https://www.freedesktop.org/software/systemd/man/systemd-socket-proxyd.html

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20160811/7e26ecde/attachment.sig>