Posted by Carlos Miranda Levy on November 14, 2007 at 10:00am
I recently upgraded to new servers and decided to use separate servers for Drupal and Gallery. This of course prevents the integration module from working, since it requires that the Gallery directory is locally accessible by Drupal.
The solution I came up was to use NFS to make the Gallery directory on the other server visible to the Drupal server.
I spent 22hr straight figuring out how to get NFS working on our servers, mostly, I admit, because of my limited experience with nfs and iptables.
But I finally got it to work correctly and went to bed. Sadly, I left the next day for the jungle for a month and never got to test the integration module. I'll take some time to test it next week.
I just wanted to share the solution (and check if it's the best option) with the group.
Since I had to mask my Ip's and domain names and I took these notes more than 3 months ago, I might have made a mistake or two, but I hope it helps and at least sends others on the right track, given that every server installation is different and minor changes might be required in each configuration....
Config on the client (the machine running Drupal)
Note: CC.CC.CC.CC is the IP of the NFS Client machine (the one running Drupal), CC2.CC2.CC2.CC2 is another client machine (optional, if you have another app in another machine that also requires local access to this folder) and SS.SS.SS.SS is the IP of the NFS server machine (the one running Gallery)
Contents of /etc/sysconfig/nfs:
------------------------------------------
# NFS port numbers
STATD_PORT=10002
STATD_OUTGOING_PORT=10003
MOUNTD_PORT=10004
RQUOTAD_PORT=10005
LOCKD_TCPPORT=10000
LOCKD_UDPPORT=10001
Contents of /etc/modprobe.conf:
------------------------------------------
alias eth0 tg3
alias scsi_hostadapter ata_piix
alias usb-controller ehci-hcd
alias usb-controller1 uhci-hcd
options lockd nlm_tcpport=10000 nlm_udpport=10001
Content of /etc/rpc:
------------------------------------------
...
rquotad 100011 rquotaprog quota rquota
...
Content of /etc/services:
------------------------------------------
...
rquotad 10005/tcp
rquotad 10005/udp
Output of showmount -e SS.SS.SS.SS
------------------------------------------
Export list for SS.SS.SS.SS:
/shareme CC2.CC2.CC2.CC2,drupaldomain.com
/home/galleyfolder/g2data CC2.CC2.CC2.CC2,drupaldomain.com
Create directory for mount
------------------------------------------
mkdir /mnt
For automounting at boot time:
Content of /etc/fstab
------------------------------------------
(...)
SS.SS.SS.SS:/home/galleryfolder/g2data /mnt/g2data nfs ro 0 0
Or do manual mount
------------------------------------------
mount -t nfs SS.SS.SS.SS:/home/galleryfolder/g2data /mnt/g2dataConfig on the nfs server (the machine running Gallery)
Note: CC.CC.CC.CC is the IP of the NFS Client machine (the one running Drupal), CC2.CC2.CC2.CC2 is another client machine (optional, if you have another app in another machine that also requires local access to this folder) and SS.SS.SS.SS is the IP of the NFS server machine (the one running Gallery)
Contents of /etc/exports:
------------------------------------------
/home/galeria/g2data CC.CC.CC.CC(ro,sync) CC2.CC2.CC2.CC2(ro,sync)
/shareme CC.CC.CC.CC(ro,sync) CC2.CC2.CC2.CC2(ro,sync)
Contents of /etc/hosts.deny:
------------------------------------------
portmap:ALL
lockd:ALL
mountd:ALL
rquotad:ALL
statd:ALL
# Note: Had to comment deny for portmap and rquota or nfs wouldn't start.
Contents of /etc/hosts.allow:
------------------------------------------
portmap: drupalserverdomain.com, SS.SS.SS.SS, CC.CC.CC.CC, CC2.CC2.CC2.CC2
lockrd: drupalserverdomain, SS.SS.SS.SS, CC.CC.CC.CC, CC2.CC2.CC2.CC2
rquotad: drupalserverdomain, SS.SS.SS.SS, CC.CC.CC.CC, CC2.CC2.CC2.CC2
mountd: drupalserverdomain, SS.SS.SS.SS, CC.CC.CC.CC, CC2.CC2.CC2.CC2
statd: drupalserverdomain, SS.SS.SS.SS, CC.CC.CC.CC, CC2.CC2.CC2.CC2
Verification: Output of exportfs
------------------------------------------
/home/galleryfolder/g2data
drupalserverdomain.com
/home/galeria/g2data
CC2.CC2.CC2.CC2
/shareme drupalserverdomain.com
/shareme CC2.CC2.CC2.CC2
Verification: Output of exportfs -rv
------------------------------------------
exporting CC2.CC2.CC2.CC2:/home/galleryfolder/g2data
exporting drupalserverdomain.com:/home/galleryfolder/g2data
exporting CC2.CC2.CC2.CC2:/shareme
exporting drupalserverdomain.com:/shareme
reexporting CC2.CC2.CC2.CC2:/home/galleryfolder/g2data to kernel
reexporting drupalserverdomain.com:/home/galleryfolder/g2data to kernel
reexporting CC2.CC2.CC2.CC2:/shareme to kernel
reexporting drupalserverdomain.com:/shareme to kernel
Configuring Auto-Start:
------------------------------------------
/sbin/chkconfig --level 345 nfs on
/sbin/chkconfig --level 345 nfslock on
/sbin/chkconfig --level 345 portmap on
Verification: Output of service portmap status
------------------------------------------
portmap (pid 2920) is running...
Verification: Output of service nfs status
------------------------------------------
rpc.mountd (pid 3093) is running...
nfsd (pid 3087 3086 3085 3084 3083 3082 3081 3080) is running...
rpc.rquotad (pid 3076) is running...
Verification: Output of service nfslock status
------------------------------------------
rpc.statd (pid 2939) is running...
Verification: Output of showmount -e
------------------------------------------
Export list for clientmachinename:
/shareme CC2.CC2.CC2.CC2,drupaldomain.com
/home/galleryfolder/g2data CC2.CC2.CC2.CC2,drupaldomain.com
Contents of /etc/sysconfig/nfs:
------------------------------------------
# NFS port numbers
STATD_PORT=10002
STATD_OUTGOING_PORT=10003
MOUNTD_PORT=10004
RQUOTAD_PORT=10005
LOCKD_TCPPORT=10000
LOCKD_UDPPORT=10001
Contents of /etc/modprobe.conf:
------------------------------------------
options lockd nlm_tcpport=10000 nlm_udpport=10001
Verification: Output of rpcinfo -p
------------------------------------------
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 10002 status
100024 1 tcp 10002 status
100011 1 udp 10005 rquotad
100011 2 udp 10005 rquotad
100011 1 tcp 10005 rquotad
100011 2 tcp 10005 rquotad
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100021 1 udp 10001 nlockmgr
100021 3 udp 10001 nlockmgr
100021 4 udp 10001 nlockmgr
100021 1 tcp 10000 nlockmgr
100021 3 tcp 10000 nlockmgr
100021 4 tcp 10000 nlockmgr
100005 1 udp 10004 mountd
100005 1 tcp 10004 mountd
100005 2 udp 10004 mountd
100005 2 tcp 10004 mountd
100005 3 udp 10004 mountd
100005 3 tcp 10004 mountd
391002 2 tcp 32768 sgi_fam
------------------------------------------
Note: Port for rquotad was not the one specified at /etc/sysconfig/nfs,
----- this was fixed by adding corresponding lines for its tcp and udp ports at /etc/services.
Note: Port for nlockmgr was not the one specified at /etc/modprobe.conf,
----- this was fixed by adding corresponding lines for its tcp and udp ports at /etc/sysconfig/nfs.
Content of /etc/rpc (verify rquotad is in):
------------------------------------------
...
rquotad 100011 rquotaprog quota rquota
...
Content of /etc/services (added at the end):
------------------------------------------
...
rquotad 10005/tcp
rquotad 10005/udp
Lines added to /etc/sysconfig/iptables
------------------------------------------
# According to http://www.redhat.com/magazine/010aug05/departments/tips_tricks/
#--------------------------
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 111 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 111 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 10001 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 10002:10005 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 10002:10005 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Lokkit-0-50-INPUT -j REJECT --reject-with icmp-port-unreachable
-A RH-Lokkit-0-50-OUTPUT -p tcp -m tcp --dport 111 -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -p udp -m udp --dport 111 -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -p tcp -m tcp --dport 2049 -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -p udp -m udp --dport 2049 -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -p udp -m udp --dport 10001 -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -p tcp -m tcp --dport 10002:10005 -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -p udp -m udp --dport 10002:10005 -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Lokkit-0-50-OUTPUT -j REJECT --reject-with icmp-port-unreachable
#--------------------------
# According to http://www.ba.infn.it/calcolo/documenti/NFSServer.html
#--------------------------
-A RH-Lokkit-0-50-INPUT -f -j ACCEPT -s 72.35.83.181
-A RH-Lokkit-0-50-INPUT -s CC.CC.CC.CC -d 0/0 10000:10005 -p 6 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s CC.CC.CC.CC -d 0/0 10000:10005 -p 17 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s CC.CC.CC.CC -d 0/0 2049 -p 17 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s CC.CC.CC.CC -d 0/0 2049 -p 6 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s CC.CC.CC.CC -d 0/0 111 -p 6 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s CC.CC.CC.CC -d 0/0 111 -p 17 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s 0/0 -d 0/0 -p 6 -j DENY --syn --log-level 5
-A RH-Lokkit-0-50-INPUT -s 0/0 -d 0/0 -p 17 -j DENY --log-level 5
------------------------------------------
Note: Output of iptables --list does not include any of the entries above.
I guess iptables is reading its config from somewhere else other than
/etc/sysconfig/iptables,
Output of iptables --list
------------------------------------------
(removed for security reasons, just check yours)
Output of service iptables restart
------------------------------------------
Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: filter [ OK ]
Unloading iptables modules: [ OK ]
Applying iptables firewall rules: iptables-restore: line 44 failed
[FAILED]
------------------------------------------
Note: This error was ocurring even when /etc/sysconfig/iptables had less than 44 lines, I was too tired to figure out what it was then.Please, excuse any errors in my typing and remember that each server config is different. Also note, that not being too familiar with iptables, I used some sample iptables I found on-line as reference for the configuration changes listed.
Comments
Gain?
Maybe I'm missing something (so please excuse my ignorance), but separate servers doesnt make much sense for embedded gallery. I mean the embedded Gallery2 will - of course - use the disk space on your second server, but all the load for php processing will reside on the Drupal server, not? It would IMO make much more sense to separate webserver and database server ... Usually disk space is no problem, cpu/memory load is.
They are stand-alone sites that grew appart
Scenario 1
In my case, the gallery is a stand-alone application independent from my Drupal sites and they have been running successfully on their own, each as separate communities.
By integrating them, I can add blogging and social features to my gallery community at the same time I add enhanced picture management to my Drupal community and can take advantage of the more than 20,000 pics already in the gallery site.
http://www.americaenfotos.com users get to have their own blog and other features, while http://www.miblog.org users get to have advanced gallery features.
That's the scenario where I had it running before (pictures in http://galeria.civila.com and blogs in http://blogs.civila.com ).
Scenario 2
Another scenario I am aiming for is using one gallery installation to serve more than one Drupal installation, so that the pictures from my large gallery can be used across several projects. I am not sure yet if this would create complications with the user synchronization routines, though.
Let me explain it to you with a practical example.
Currently I use the same gallery installation to share pictures of my Education, Virtual Communities and Travel Across America projects:
http://galeria.educar.org, http://galeria.civila.com and http://galeria.americasomostodos.com are all the same site and even the same theme with a simple customization routine that changes the header based on the domain name.
But, each of these projects has its own Drupal installation for interactive features: http://portal.civila.com, http://portal.educar.org and http://www.americasomostodos.com - These are all independent Drupal sites, engaging pictures across the Americas and the world.
It would be a waste of effort and resources to set up separate Galleries for them, when they will all be sharing pictures of the Americas and the world.
So my goal is to integrate the single gallery installation at http://www.americaenfotos.com (yet another alias for the same shared gallery) with each Drupal installation so that pictures can be shared across the sites.
Hope I was able to explain myself...
con paciencia y calma,
sube un burro a una palma.
con paciencia y calma,
sube un burro a una palma.