Configure the dashboard

1. Specify the host for your OpenStack Identity Service endpoint in the /etc/openstack-dashboard/local_settings.py file with the OPENSTACK_HOST setting.

   The following example shows this setting:

   import os
   
   from django.utils.translation import ugettext_lazy as _
   
   DEBUG = False
   TEMPLATE_DEBUG = DEBUG
   PROD = True
   USE_SSL = False
   
   SITE_BRANDING = 'OpenStack Dashboard'
   
   # Ubuntu-specific: Enables an extra panel in the 'Settings' section
   # that easily generates a Juju environments.yaml for download,
   # preconfigured with endpoints and credentials required for bootstrap
   # and service deployment.
   ENABLE_JUJU_PANEL = True
   
   # Note: You should change this value
   SECRET_KEY = 'elj1IWiLoWHgryYxFT6j7cM5fGOOxWY0'
   
   # Specify a regular expression to validate user passwords.
   # HORIZON_CONFIG = {
   #     "password_validator": {
   #         "regex": '.*',
   #         "help_text": _("Your password does not meet the requirements.")
   #     }
   # }
   
   LOCAL_PATH = os.path.dirname(os.path.abspath(__file__))
   
   CACHES = {
   	'default': {
   		'BACKEND' : 'django.core.cache.backends.memcached.MemcachedCache',
   		'LOCATION' : '127.0.0.1:11211'
   	}
   }
   
   # Send email to the console by default
   EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
   # Or send them to /dev/null
   #EMAIL_BACKEND = 'django.core.mail.backends.dummy.EmailBackend'
   
   # Configure these for your outgoing email host
   # EMAIL_HOST = 'smtp.my-company.com'
   # EMAIL_PORT = 25
   # EMAIL_HOST_USER = 'djangomail'
   # EMAIL_HOST_PASSWORD = 'top-secret!'
   
   # For multiple regions uncomment this configuration, and add (endpoint, title).
   # AVAILABLE_REGIONS = [
   #     ('http://cluster1.example.com:5000/v2.0', 'cluster1'),
   #     ('http://cluster2.example.com:5000/v2.0', 'cluster2'),
   # ]
   
   OPENSTACK_HOST = "127.0.0.1"
   OPENSTACK_KEYSTONE_URL = "http://%s:5000/v2.0" % OPENSTACK_HOST
   OPENSTACK_KEYSTONE_DEFAULT_ROLE = "Member"
   
   # The OPENSTACK_KEYSTONE_BACKEND settings can be used to identify the
   # capabilities of the auth backend for Keystone.
   # If Keystone has been configured to use LDAP as the auth backend then set
   # can_edit_user to False and name to 'ldap'.
   #
   # TODO(tres): Remove these once Keystone has an API to identify auth backend.
   OPENSTACK_KEYSTONE_BACKEND = {
       'name': 'native',
       'can_edit_user': True
   }
   
   # OPENSTACK_ENDPOINT_TYPE specifies the endpoint type to use for the endpoints
   # in the Keystone service catalog. Use this setting when Horizon is running
   # external to the OpenStack environment. The default is 'internalURL'.
   #OPENSTACK_ENDPOINT_TYPE = "publicURL"
   
   # The number of Swift containers and objects to display on a single page before
   # providing a paging element (a "more" link) to paginate results.
   API_RESULT_LIMIT = 1000
   
   # If you have external monitoring links, eg:
   # EXTERNAL_MONITORING = [
   #     ['Nagios','http://foo.com'],
   #     ['Ganglia','http://bar.com'],
   # ]
   
   LOGGING = {
           'version': 1,
           # When set to True this will disable all logging except
           # for loggers specified in this configuration dictionary. Note that
           # if nothing is specified here and disable_existing_loggers is True,
           # django.db.backends will still log unless it is disabled explicitly.
           'disable_existing_loggers': False,
           'handlers': {
               'null': {
                   'level': 'DEBUG',
                   'class': 'django.utils.log.NullHandler',
                   },
               'console': {
                   # Set the level to "DEBUG" for verbose output logging.
                   'level': 'INFO',
                   'class': 'logging.StreamHandler',
                   },
               },
           'loggers': {
               # Logging from django.db.backends is VERY verbose, send to null
               # by default.
               'django.db.backends': {
                   'handlers': ['null'],
                   'propagate': False,
                   },
               'horizon': {
                   'handlers': ['console'],
                   'propagate': False,
               },
               'novaclient': {
                   'handlers': ['console'],
                   'propagate': False,
               },
               'keystoneclient': {
                   'handlers': ['console'],
                   'propagate': False,
               },
               'nose.plugins.manager': {
                   'handlers': ['console'],
                   'propagate': False,
               }
           }
   }
   

   The service catalog configuration in the Identity Service determines whether a service appears in the dashboard. For the full listing, see Horizon Settings and Configuration.

2. Restart Apache http server. For Ubuntu/Debian/SUSE:

   # service apache2 restart

   or for Fedora/RHEL/CentOS:

   # service httpd restart

   Next, restart memcached:

   # service memcached restart

The following example uses the domain, "http://openstack.example.com." Use a domain that fits your current setup.

1. In/etc/openstack-dashboard/local_settings.py update the following directives:

   USE_SSL = True
   CSRF_COOKIE_SECURE = True
   SESSION_COOKIE_SECURE = True
   SESSION_COOKIE_HTTPONLY = True

   The first option is required to enable HTTPS. The other recommended settings defend against cross-site scripting and require HTTPS.

2. Edit /etc/apache2/ports.conf and add the following line:

   NameVirtualHost *:443

3. Edit /etc/apache2/conf.d/openstack-dashboard.conf:

   Before:

   WSGIScriptAlias / /usr/share/openstack-dashboard/openstack_dashboard/wsgi/django.wsgi
   WSGIDaemonProcess horizon user=www-data group=www-data processes=3 threads=10
   Alias /static /usr/share/openstack-dashboard/openstack_dashboard/static/
   <Directory /usr/share/openstack-dashboard/openstack_dashboard/wsgi>
   # For Apache http server 2.2 and earlier:
   Order allow,deny
   Allow from all
   
   # For Apache http server 2.4 and later:
   # Require all granted
   </Directory>

   After:

   <VirtualHost *:80>
   ServerName openstack.example.com
   <IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{HTTPS} off
   RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
   </IfModule>
   <IfModule !mod_rewrite.c>
   RedirectPermanent / https://openstack.example.com
   </IfModule>
   </VirtualHost>
   <VirtualHost *:443>
   ServerName openstack.example.com
   
   SSLEngine On
   # Remember to replace certificates and keys with valid paths in your environment
   SSLCertificateFile /etc/apache2/SSL/openstack.example.com.crt
   SSLCACertificateFile /etc/apache2/SSL/openstack.example.com.crt
   SSLCertificateKeyFile /etc/apache2/SSL/openstack.example.com.key
   SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
   
   # HTTP Strict Transport Security (HSTS) enforces that all communications
   # with a server go over SSL. This mitigates the threat from attacks such
   # as SSL-Strip which replaces links on the wire, stripping away https prefixes
   # and potentially allowing an attacker to view confidential information on the
   # wire
   Header add Strict-Transport-Security "max-age=15768000"
   
   WSGIScriptAlias / /usr/share/openstack-dashboard/openstack_dashboard/wsgi/django.wsgi
   WSGIDaemonProcess horizon user=www-data group=www-data processes=3 threads=10
   Alias /static /usr/share/openstack-dashboard/openstack_dashboard/static/
   <Directory /usr/share/openstack-dashboard/openstack_dashboard/wsgi>
   # For Apache http server 2.2 and earlier:
   Order allow,deny
   Allow from all
   
   # For Apache http server 2.4 and later:
   # Require all granted
   </Directory>
   </VirtualHost>

   In this configuration, Apache http server listens on the port 443 and redirects all the hits to the HTTPS protocol for all the non-secured requests. The secured section defines the private key, public key, and certificate to use.

4. Restart Apache http server. For Debian/Ubuntu/SUSE:

   # service apache2 restart

   Or for Fedora/RHEL/CentOS:

   # service httpd restart

   Next, restart memcached:

   # service memcached restart

   If you try to access the dashboard through HTTP, the browser redirects you to the HTTPS page.

1. Edit /usr/share/pyshared/horizon/dashboards/nova/instances/templates/instances/_detail_vnc.html.

2. Modify the width and height parameters, as follows:

   <iframe src="{{ vnc_url }}" width="720" height="430"></iframe>