Anyhow, back to the subject of this post, which is the CDs. If you are living in the UK and want an Ubuntu CD, a Kubuntu CD or an Ubuntu Server CD (or combination thereof) then you are most welcome to one. Please follow the procedure and I will send one out to you. For a while I will also include an 11.04 CD until I run out of them. If you want more than one CD then do ask me and we will try and work something out particularly if you are wanting to distribute them at a University or similar.

I almost forgot to mention, I removed their old Kubuntu 11.04 CD and washed the muck off and stuck it in a desktop, it still boots!

[19:01] good morning/afternoon/evening all
[19:01] welcome to this Application Developer week session on Python
[19:02] so after jderose turning things up to 11 we are going to go back and start with 1 2 3
[19:02] This session is an introduction to Python from the very very beginning, I going to do my best to assume no prior knowledge at all.
[19:02] just so I can see who is here say hi in the #ubuntu-classroom-chat channel o/
[19:03] great, I love to have an audience
[19:03] so Python is a programming language, but not a scary hard one.
[19:03] Python is kind of like BASIC, except you don't have to be embarrassed about saying you are a Python programmer!
[19:04] we are going to write a computer program, which is a set of instructions to the computer to tell it to do some interesting stuff for us.
[19:04] Lets get set up first, we are going to need a text editor to write the instructions in and a terminal to tell the computer to do the instructions.
[19:05] hopefully you will find them next to each other in the Applications-Accessories menu
[19:05] or if you are using unity hit the super key and type gedit and return for the editor
[19:05] and terminal for the terminal
[19:06] they are also somewhere to be found in the apps lens, but that is another story altogether
[19:06] so open both of them now and get comfortable with the three windows on screen, IRC, terminal and gedit
[19:06] are we sitting comfortably?
[19:07] plain old text editor is perfect, none of your fancy IDEs for this session
[19:08] Traditionally the first program you should write in any language is one to get the computer to say hello to the world! so lets do that.
[19:08] in the text editor type the following:
[19:08] print "Hello, World!"
[19:09] that is it, your first program, now lets save it and run it (I did tell you it looked like BASIC)
[19:09] file-save as and call it hello.py
[19:09] this will save it into your home directory by default, fine for now, but you would probably want to be a bit more organised when doing something serious
[19:10] feel free to be more organised right now if you like
[19:10] ok, now in the terminal lets run the program
[19:10] python hello.py
[19:10] did it say hello to you?
[19:12] as I saved it in the home directory and terminal starts there by default it should just work, if you are putting things in folders you might need to navigate to it with the cd command or specify the path to the program
[19:13] ok, so that was running the program by running python then the name of our application, but we can do it a different way, by telling Ubuntu that our program is executable
[19:13] What we are going to do now is try to make our program directly executable, in the terminal we are going to CHange the MODe of the program to tell Ubuntu that it is eXecutable
[19:13] so at the $ prompt of the terminal type:
[19:13] chmod +x hello.py
[19:14] now we can try to run it
[19:14] again at the $ prompt
[19:14] ./hello.py
[19:14] oh noes!!!
[19:14] Warning: unknown mime-type for "Hello, World!" -- using "application/octet-stream"
[19:14] everyone get that?
[19:16] ubuntu doesn't know how to run this application yet, we need to add some extra magic at the top of our program to help it understand what to do with it.
[19:16] back in the editor, above the print "Hello, World!" add the following line
[19:16] #!/usr/bin/env python
[19:16] so the /usr/bin/env bit is some magic that helps it find stuff, and the thing it needs to run this application is python
[19:16] now you should be able to save that and flip back to the terminal and run your program
[19:17] ./hello.py
[19:17] that should now run
[19:18] as has been pointed out in python 3 you need to put brackets round the string so
[19:18] print ("hello world")
=== mohammed is now known as Guest99895
[19:19] which works in all versions of python
[19:20] OK, lets go on to the next concept, giving our program some structure
[19:20] back to the editor, and between the two lines we have already add a new line
[19:20] while 2+2==4:
[19:20] and on the next line put four spaces before the print ("Hello, World!")
[19:20] and save that
[19:21] Moshanator asked: can i just ./hello.py?
[19:21] lunzie asked: ​ are the quote brackets proper form?
[19:21] the brackets round the quotes are better form as they work on python 3
[19:22] so the while statement we added starts a loop, in this instance it will carry on until 2+2 is equal to something other than 4
[19:22] the double equals means "is equal to" a single equals is used to assign a value to something (more on that later)
[19:23] the colon at the end is an important part of the while statement
[19:23] There is no "until" "wend" "end while" type statement at the end, as you might expect to find in lesser languages
=== yofel_ is now known as yofel
[19:23] the indentation of the print statement is not just cosmetic and for our benefit
[19:23] the indentation level is part of the language, when the indentation stops that is the end of the loop (or other structure that you might expect to have an end)
[19:24] this means that python always looks neat and tidy (or it doesn't work)
[19:24] Always use four spaces to indent, not three, not five and certainly not a tab.
[19:24] Other indentations will work, but if you ever have to work with anyone else you must always be using the same indentation, so we all get in the habit of using four spaces.
[19:24] in gedit you can set it up to use 4 spaces instead of a tab
[19:25] edit-preferences, on the editor tab choose tab width 4 and insert spaces instead of tabs
[19:25] many other editors and IDEs have a similar option
[19:25] Lets run our new program, just save it in the editor and run it again in the terminal with ./hello.py
[19:26] and that is 4 spaces per level of indentation you want so if you have a loop in a loop then the inner one will be 8 spaces indented
[19:26] now we can wait for 2+2 to be something other than 4
[19:26] * AlanBell taps fingers
[19:27] or, if you are in a hurry, you can press ctrl+c
[19:28] ok, so ctrl+c is handy for breaking in to an out-of-control python program
[19:28] you can do other fun stuff with the print statement, if you change it to read:
[19:28] print "Ubuntu totally rocks! ",
[19:28] and run it again (note the comma at the end)
[19:29] print ("Ubuntu totally rocks! "), <- for the python 3 contingent I should think
[19:30] it should fill the terminal with text
[19:30] the comma prevents it doing a newline
[19:31] ctrl+c again to break out of it
[19:31] lets do something different now
[19:31] in the terminal, type python at the $ prompt and hit return
[19:31] you should have a >>> prompt and a cursor
[19:32] this is the interactive python console
[19:32] you can type print("hello") here if you want
[19:32] or do some maths like:
[19:32] print 2**1000
[19:32] which will show you the result of 2 multiplied by itself a thousand times
[19:33] python is kinda good at maths
[19:33] you don't need the print statement here either
[19:33] so 2**1000 should work in python 2.7 or 3
[19:34] you could even try 2**100000 it won't take long, and you can always stop it with ctrl+c
[19:35] while we are on the subject of maths, lets get the value of pi
[19:36] print pi won't do anything useful (but feel free to try it)
[19:36] we need more maths ability than the python language has built in
[19:37] so we need to get a library of specialist maths stuff, so type
[19:37] import math
[19:37] it will look like it did nothing, but don't worry
[19:37] now type
[19:37] math.pi
[19:37] >>> import math
[19:37] >>> math.pi
[19:37] 3.141592653589793
[19:38] So we have seen here how to import a library of functions to do something, and called one of the functions from the library (to return the value of pi)
[19:39] ok, so what is in the math package, apart from pi?
[19:39] try typing dir(math) at the python console
[19:39] ['__doc__', '__name__', '__package__', 'acos', 'acosh', 'asin', 'asinh', 'atan', 'atan2', 'atanh', 'ceil', 'copysign', 'cos', 'cosh', 'degrees', 'e', 'exp', 'fabs', 'factorial', 'floor', 'fmod', 'frexp', 'fsum', 'hypot', 'isinf', 'isnan', 'ldexp', 'log', 'log10', 'log1p', 'modf', 'pi', 'pow', 'radians', 'sin', 'sinh', 'sqrt', 'tan', 'tanh', 'trunc']
[19:40] you can also look at http://docs.python.org/library/math.html
[19:40] callaghan asked: Is there a way to see which functions are in the imported library?
[19:40] yes
[19:41] and to get more descriptive help on each one try help(math)
[19:41] so dir() lists the names and help() lists names, parameters and a little bit of help text
[19:43] TheOpenSourcerer asked: is help() a python function useful for anything else?
[19:43] try help(help)
[19:44] it is a function that could be used, I can't off hand think of any particularly useful use of it other than for getting help
[19:44] Mipixal asked: Your favourite IDE for dev with Python, on bigger projects. (In before IDE flame wars :p )
[19:45] honestly my favourite is gedit
[19:45] I have used eclipse and pydev
[19:45] and I liked stani's python editor (SPE) for a bit
[19:46] but all I really want is a text editor with syntax highlighting
[19:46] and normally several terminal windows open across a couple of monitors
[19:46] All this command line stuff is all very well, but we want to do applications that have pretty windows and stuff!
[19:47] In the interactive console type or paste the following
[19:47] import gtk
[19:47] which will load a library full of stuff to do with the gtk toolkit that powers the gnome desktop
[19:47] now type
[19:47] foo=gtk.Window(gtk.WINDOW_TOPLEVEL)
[19:47] that assigns a window object to a variable called foo
[19:47] (the name doesn't matter, the single equals does)
[19:48] but nothing much seems to have happened yet, so type:
[19:48] foo.show()
[19:48] yay, a real live little window should be on screen now!
[19:49] lets see what we can do to it with dir(foo)
[19:49] quite a lot! lets try:
[19:49] foo.set_title("my little window")
[19:49] go ahead and change the title a few times
[19:50] so if you type "foo.show"
[19:50]
[19:50] There are 10 minutes remaining in the current session.
[19:51] you get printed out a reference to where the code for the show function is
[19:51] you need to do foo.show() to actually call the function
[19:51] ahayzen asked: In gedit is there anyway of adding code completion for python programming, like pydev in eclipse, via a plugin?
[19:51] teemperor asked: is there any naming convention in python? (because of set_title)
[19:52] ahayzen: I believe there are some plugins for that, last time I tried one it was rubbish though
[19:53] if anyone has any good ones I would be interested to know of them
[19:53] teemperor: http://www.python.org/dev/peps/pep-0008/ here is the python style guide
[19:54] many projects have their own more detailed conventions for object names
[19:54] everyone agrees on the indentation levels though
[19:54] Alliancemd asked: In a program changelog I saw a developer saying that he ported the code from python to java to make it faster and he said "because java is sometimes x10-x100 times faster than python". We know that java is very slow, does python have this big impact on speed?
[19:55] this is a myth
[19:55] There are 5 minutes remaining in the current session.
[19:55] sometimes java does take a while to start if it has to launch a JVM, this gave applets a reputation for being slow
[19:56] once up and running it is not particularly slow
[19:56] unless you are doing something massively time sensitive (where every nanosecond counts) then any language will do any task
[19:57] the performance problem is never the language, it is always the algorithm
[19:57] normally rewriting code so that it does fewer disk or database accesses will speed it up thousands of times more than changing the language it is implemented in
[19:58] Alliancemd asked: What do u think of PyQt? Is it that good how people say?
[19:58] mohammedalieng asked: what about python performance compared to Java ?
[19:58] callaghan asked: will there be a follow-up lesson, or where should unexperienced python-devs go from here?
[19:59] not played with Qt much
[19:59] there are some great books
[19:59] snake wrangling for kids is excellent
[20:00] and the dive into python book is in the repos, you can install it from software centre
[20:00] I believe there are other python classes in this channel so check the schedule
[20:00] Logs for this session will be available at http://irclogs.ubuntu.com/2011/09/05/%23ubuntu-classroom.html
[20:00] ok, think I am out of time
[20:00] thanks everyone o/

It was great fun to do, and thanks to David Planella and the classroom team for putting on these regular educational events.

Keyboard made from pure awesome

Today I got a new keyboard, nothing unusual and particularly blogworthy in that you might think, but look a little closer, especially at the two little keys on the bottom row that traditionally host two little adverts for a legacy operating system – they are gone! The little flags (previously discussed in the context of Google ChromeOS) are replaced with the Circle of Friends, the Ubuntu Logo that symbolises friendship and freedom. So where, I hear you ask, did I get such a marvel of modern clavicula engineering? Well the answer to that is from our friends at the Keyboard Company where they distribute and customise high end and specialist keyboards. This one is a Filco Majestouch which they modified by replacing the super keys with custom printed ones with the Circle of Friends on. Now you might note the price tag for this keyboard is £95 ex VAT, and yes this is a high end keyboard. It has a solid quality feel to it and the key action is superb. In fact when ordering you can specify one of three different key actions, tactile action, click action or linear action. I got the tactile one, which is not clicky, but has a point of resistance to push past in the travel at the actuation point. Kind of like pushing the accelerator on an automatic car past the bump to get it to kick down a gear.

It also does N Key rollover, which is great. Most cheap keyboards have a matrix of wires and switches that link keys into groups and when pressing multiple keys together this can lead to ambiguous signals that cause ghosting (keys being signalled as pressed which were not) and jamming (keys pressed, but not signaled). This keyboard has each key individually addressable, you can press a whole bunch of keys at once and it will know exactly which ones you have got pressed. This helps for the rapid typist and in gameplay where you might be holding down a bunch of keys to move a character whilst jumping, turning and firing. A missed keypress in this scenario could lead to an almost tragic loss of virtual life.

Qwerty to Steno keyboard mapping

I am not really a gamer, but the N-Key rollover does interest me for a completely different reason, it means I can try out the chorded keyboard typing with Plover. This allows you to write instead of one key at a time by pressing a chord of multiple keys like a court reporter would do on a stenotype machine, this can in theory allow you to communicate at a blistering 250wpm. This open source software reads what you are typing using the steno chords and maps it from a kind of syllable level shorthand into what you intended to say.

If you would like to have one of these fine keyboards you can order them from the keyboard company, at the same price as the version with the flag key, just specify in the additional information box on the order form that you would like the Ubuntu Circle of Friends on the super key. They can ship anywhere and do them in pretty much any international layout, so if you want AZERTY or whatever then they can oblige. I would love to see them listed as a product in the Ubuntu store but as yet I have been unable to contact a human there, if anyone knows how to do that then do leave a comment.

Bored chicken with last year's distro

They started the upgrade by reading the CD sleeve carefully

Clarabelle reads the fine manual

and then installed the new Kubuntu 11.04 on a piece of string in the run so they can peck at it and check their feathers in the mirror.

Installing Kubuntu 11.04

After the upgrade I took their old Kubuntu 10.10 CD and gave it a bit of a wash, when it stopped smelling too much I put it in my laptop and booted it, there was a bit of a crack on the outside edge and it didn’t fully boot, but it got to the bootloader and did about 15 seconds of productive loading before it failed. Check back in 6 months to find out how the Kubuntu 11.04 CD boots.

So now we need to decide how best to use the remaining 49 Kubuntu CDs, 50 Ubuntu Server CDs and 250 Ubuntu CDs. Preferably in a slightly less frivolous way than entertaining livestock.

Now that shipit has stopped doing individual CD requests we are going to reserve some for people on dialup who want CDs. The procedure for this is as follows.

• Email me, alanbell at ubuntu.com with a clear subject line saying you would like a CD.
• I will then respond with my snail mail address.
• You send me a stamped self addressed envelope big enough to hold a CD.
• I put CD in envelope and send it back to you.

So this is mildly inconvenient, and costs you more than free, but only about a quid, in postage. If you are on dialup (or an obsessive Ubuntu CD collector) this is still well worth doing, those on broadband have probably already got the .iso and burned it already.

Another batch will go to people distributing recycled PCs pre-installed with Ubuntu like Remploy I want these PCs to go out with an official CD in the pack, and some information about the LoCo team for the end user. Any company or charity involved with recycling PCs for distribution in the UK through the RaceOnline initiative or anything else is welcome to contact me to arrange CDs and help with doing an OEM build image for cloning (so on first boot it asks the user their name). These kind of organisations are not going to engage Canonical services, they just don’t have the margins, working constructively with them is certainly something we can do as a community team.

The rest will go to events and conferences where we have a presence, which means we need to have a presence at some events. I would really like the team to run a few bring-a-box installfests at university computing societies. If you want to help organise one that would be great, I am happy to support it with CDs and help get some people along to help.

If you have further ideas on how to use the CDs then do comment here, on the Ubuntu-UK mailing list or at the next team meeting on IRC.

Application that wants to speak “hello world” -> speech dispatcher -> speech synthesizer -> audio output

By default the speech synthesizer is one called espeak which has a number of synthetic voices (they sound like a robot should sound). You can try this now, go to a terminal window and enter the following:

spd-say "hello world"

If all is working you should hear your computer talking. So this is the default voice that is included on the size restricted Ubuntu CD. Whilst espeak is pretty good and synthetic voices perform well when speeded up (some blind people listen very very fast) there are more realistic voices and more sophisticated speech synthesizers available. The one I think is probably the most promising is called OpenMARY. This has a range of voices available including a number based on the rather good Hidden Markov Model technique. OpenMARY runs as a web server with a REST API, you go to the right URL and you get back a .wav file with the sound you asked for. Feel free to have a play with an OpenMARY server I installed on one of our servers, I have installed a bunch of decent hmm voices, try saying different things with them. So this is all rather fun and you can hear the difference in quality between the rather robotic espeak and the nearly human sounding OpenMARY, the next step is to get it working through speech dispatcher.

To do this I am using the speech dispatcher generic module which is a simple way of getting them to play together. Writing a proper module specific to OpenMary would allow a few more features to be used. To try this out we will be installing just a configuration file on your machine which tells speech dispatcher to pass the text it wants to say out to our OpenMARY server on the internet, you get back a wav file and it plays it. This is just meant for playing about really, don’t rely on our server to be there all the time and this also means that if I felt like it I could look at a log file on the server and see what you are saying (I can’t be bothered, and I don’t care what you say).

• Check that spd-say “hello world” actually works. If it doesn’t then go fix that first.
• Download the config file from http://people.ubuntu.com/~alanbell/openmary.conf

  wget http://people.ubuntu.com/~alanbell/openmary.conf

• Copy the config file to /etc/speech-dispatcher/modules/

  sudo cp openmary.conf /etc/speech-dispatcher/modules/

• edit the speech dispatcher config to load your new module configuration file

  sudo nano /etc/speech-dispatcher/speechd.conf

• Find the bit with all the AddModule lines (most are commented out with a #) and add a line containing:

  AddModule "openmary" "sd_generic" "openmary.conf"

• Save and exit

  Ctrl+x, y

• stop the speech dispatcher service if it is running

  sudo killall speech-dispatcher

• Try it out

  spd-say -o openmary "hello world"

If you want to run your own openmary server locally (possibly better performance, works offline, more privacy) then edit the openmary.conf file and change the mumble.libertus.co.uk bits to localhost (or whatever server you want to point it at). To use your new voice in Orca go to the preferences window and select speech dispatcher and openmary as the synthesizer. The generic module only seems to allow you to use the default voice (it doesn’t report the list of voices available back to Orca). A proper module would do that and get other features available for Orca to control. If anyone wants to help with that it would be great.

-Edit-

As Stephane Graber pointed out you may need the sox and curl packages for this to work, I thought they were part of the default install, but maybe not. The bit that makes the magic happen is this line:

"curl "http://mumble.libertus.co.uk:59125/process?INPUT_TEXT=`echo $DATA|sed 's/ /%20/g'`&INPUT_TYPE=TEXT&OUTPUT_TYPE=AUDIO&AUDIO=WAVE_FILE&LOCALE=en_GB&VOICE=$VOICE" > $TMPDIR/openmary.wav && play $TMPDIR/openmary.wav >/dev/null"

which inserts $DATA (The phrase it wants to say) and $VOICE into a URL which returns a wav file, curl retrieves the file and we output it to /tmp/openmary.wav. Then we use the play command to turn the wav file we just downloaded into sound.

This year we have a new plan, the Gobby server is still available as a fallback, but we also have an etherpad server which I have been helping to get integrated into the main summit schedule. So the way this works is the summit website is a series of pages like this one: http://summit.ubuntu.com/uds-o/2011-05-09/ which list all the sessions going on. Each one has a little pen and pad icon on it, click that and you get to a page providing all the information about that one session, the time, room etc at the top, and the list of attendees and links to blueprints and wiki pages at the bottom. In the middle is the pad, where you can type stuff. There is no save button, everything is saved all the time.

For example have a look at http://summit.ubuntu.com/uds-o/meeting/community-o-unity-developer-participation/ you can see at the top I have put some hashtags (they will become clickable links when that bit gets turned on) and you can just type freeform text. If you are the first person to open a particular notes page there is a big button to click on to create the pad. We might jiggle the theme about in the next few days to add a panel at the side where you can see the names of the people typing in the pad. This approach means that the schedule itself is the index to the notes pages, the notes just work in a browser, on any platform and through firewalls and proxies with no special configuration. I hope (and I am pretty confident) that this will enhance the work done at UDS by people there in person and following on remotely.

In this post I’ll describe our current way of providing SSL encrypted access to a shiny new OpenERP server running on Ubuntu 10.04 LTS Server.

We’re using the Apache webserver to act as a proxy and do SSL termination for web client access and for WebDAV/CalDAV access. The GTK client will also be running over an encrypted XMLRPC link directly to the OpenERP Server. Apache is the most widely used webserver in the world and there is oodles of documentation about it so I do not plan to go into any great detail about the configuration choices. One document that is worth pointing out however is the information about how to configure and administer Apache specifically under Debian/Ubuntu. The way Apache is packaged and set up is quite different from most other Linux distributions. A very useful document can be found here /usr/share/doc/apache2.2-common/README.Debian.gz on your server.

NB: For the purposes of this how to, we’ll be using self-signed certificates. A discussion of the pros and cons of this choice is beyond the scope of this article.

Step 1. Install Apache and required modules

On your server install apache2 by typing

sudo apt-get install apache2

Now we’ll tell apache that we want to use a few modules (mod_ssl, mod_proxy, mod_proxy_http, mod_headers and mod_rewrite [optional]) that are not enabled by default:

sudo a2enmod ssl proxy_http headers rewrite

Next, we need to generate a SSL certificate and key.

Step 2. Create your cert and key

I create the files in a temporary directory then move them to their final resting place once they have been built (the first cd is just to make sure we are in our home directory to start with):

cd
mkdir temp
cd temp

Then we generate a new key, you will be asked to enter a passphrase and confirm:

openssl genrsa -des3 -out server.pkey 1024

We don’t really want to have to enter a passphrase every time the server starts up so we remove the passphrase by doing this:

openssl rsa -in server.pkey -out server.key

Next we need to create a signing request which will hold the data that will be visible in your final certificate:

openssl req -new -key server.key -out server.csr

This will generate a series of prompts like this: Enter the information as requested:

You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:
Email Address []:

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:The Client’s Company

And finally we self-sign our certificate.

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

We only need two of the files in the working directory, the key and the certificate. But before we can use them they need to have their ownership and access rights altered:

sudo chown openerp:root server.crt server.key
sudo chmod 640 server.crt server.key

And then we put them in a sensible place:

sudo mkdir /etc/ssl/openerp
sudo chown openerp:root /etc/ssl/openerp
sudo chmod 710 /etc/ssl/openerp
sudo mv server.crt server.key /etc/ssl/openerp/

Now the key and certificate are safely stored away, we can tell Apache where they are:

Step 3. Create the Apache site configuration file

We create a new Virtual Host configuration file

sudo nano /etc/apache2/sites-available/openerp-ssl

with the following content:

<VirtualHost *:443>

SSLEngine on
SSLCertificateFile /etc/ssl/openerp/server.crt
SSLCertificateKeyFile /etc/ssl/openerp/server.key

ProxyRequests Off

<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ProxyVia On

ProxyPass /webdav/ http://127.0.0.1:8069/webdav/
<Location /webdav/ >
ProxyPassReverse /webdav/
<Limit OPTIONS PROPFIND GET REPORT MKACTIVITY PROPPATCH PUT MOVE COPY DELETE LOCK UNLOCK>
Order Deny,Allow
Allow from all
Satisfy Any
</Limit>
</Location>

ProxyPass / http://127.0.0.1:8080/
<location / >
ProxyPassReverse /
</location>

RequestHeader set "X-Forwarded-Proto" "https"

# Fix IE problem (httpapache proxy dav error 408/409)
SetEnv proxy-nokeepalive 1

</VirtualHost>

Note there are two Proxy configurations. One for /webdav/ and one for /. If you do not intend to use WebDAV or CalDAV then you can remove that section. But essentially, we are telling apache that WebDAV traffic needs to go to the XMLRPC port on the OpenERP server, and normal web traffic needs to go to the web client that is listening on port 8080. The order is also important. If / came before /webdav/ then it wouldn’t work.

And then we can enable the new site configuration.

sudo a2ensite openerp-ssl

Optionally, you can use mod_rewrite to redirect any normal (non-encrypted) web browser traffic to the SSL port (443).

To do this, add the following lines (outside of the <directory> config blocks) into the file /etc/apache2/sites-available/default

RewriteEngine on
RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^(.*)$ https://%{SERVER_NAME}$1 [L,R]

Step 4. Change the OpenERP server and web-client configuration files

The next step is to re-configure the OpenERP server and Web client so that the non-encrypted services are not accessible from the outside world.

In /etc/openerp-server.conf the two non-encrypted services will only listen on localhost, i.e. not from external connections so in effect only traffic from Apache will be accepted. We also tell the XMLRPC-SSL service where to find the necessary key and certificate.

Make the following changes:

sudo nano /etc/openerp-server.conf

xmlrpc = True
xmlrpc_interface = 127.0.0.1
xmlrpc_port = 8069

netrpc = True
netrpc_interface = 127.0.0.1
netrpc_port = 8070

xmlrpcs = True
xmlrpcs_interface =
xmlrpcs_port = 8071
secure_pkey_file = /etc/ssl/openerp/server.key
secure_cert_file = /etc/ssl/openerp/server.crt

If you want to have WebDAV/CalDAV access add the following at the bottom of the config file.

[webdav]
enable = True
vdir = webdav

Then in the web client config file /etc/openerp-web.conf make the following changes so that it also only accepts traffic from localhost:

sudo nano /etc/openerp-web.conf

# Some server parameters that you may want to tweak
server.socket_host = “127.0.0.1″

# Set to True if you are deploying your App behind a proxy
# e.g. Apache using mod_proxy
tools.proxy.on = True

# If your proxy does not add the X-Forwarded-Host header, set
# the following to the *public* host url.
tools.proxy.base = ‘https://your-ip-or-domain’

# Set to false to disable CSRF checks
tools.csrf.on = False

That’s it.

Step 5. Try it out

Restart the services to load the new configurations

sudo service openerp-server restart
sudo service openerp-web restart
sudo service apache2 restart

You should not be able to connect to the web client on port 8080 and the GTK client should not connect on either the NetRPC (8070) or XMLRPC (8069) services. For the web access you just need to visit https://your-ip-or-domain and in the GTK client you will need to use port 8071 and choose the XMLRPC (Secure) protocol.

For CalDAV access the URL to a calendar will be something like this:

https://your-ip-or-domain/webdav/DB_NAME/calendars/users/USERNAME/c/CALENDAR_NAME

I hope that is helpful and obviously we’d love to hear comments and suggestions for improvements.

Installing OpenERP isn’t really that hard, but having seen several other “How Tos” on-line describing various methods where none seemed to do the whole thing in what I consider to be “the right way”, I thought I’d explain how we do it. There are a few forum posts that I’ve come across where the advice is just plain wrong too, so do be careful.

As we tend to host OpenERP on servers that are connected to the big wide Internet, our objective is to end up with a system that is:

A: Accessible only via encrypted (SSL) services from the GTK client, Web browser, WebDAV and CalDAV
B: Readily upgradeable and customisable

One of my friends said to me recently, “surely it’s just sudo apt-get install openerp-server isn’t it?” Fair enough; this would actually work. But there are several problems I have with using a packaged implementation in this instance:

• Out-of-date. The latest packaged version I could see, in either the Ubuntu or Debian repositories, was 5.0.15. OpenERP is now at 6.0.3 and is a major upgrade from the 5.x series.
• Lack of control. Being a business application, with many configuration choices, it can be harder to tweak your way when the packager determined that one particular way was the “true path”.
• Upgrades and patches. Knowing how, where and why your OpenERP instance is installed the way it is, means you can decide when and how to update it and patch it, or add custom modifications.

So although the way I’m installing OpenERP below is manual, it gives us a much more fine-grained level of control. Without further ado then here is my way as it stands currently (“currently” because you can almost always improve things. HINT: suggestions for improvement gratefully accepted).

[Update 18/08/2011: I've updated this post for the new 6.0.3 release of OpenERP]

Step 1. Build your server

I install just the bare minimum from the install routine (you can install the openssh-server during the install procedure or install subsequently depending on your preference).

After the server has restarted for the first time I install the openssh-server package (so we can connect to it remotely) and denyhosts to add a degree of brute-force attack protection. There are other protection applications available: I’m not saying this one is the best, but it’s one that works and is easy to configure and manage. If you don’t already, it’s also worth looking at setting up key-based ssh access, rather than relying on passwords. This can also help to limit the potential of brute-force attacks. [NB: This isn't a How To on securing your server...]

sudo apt-get install openssh-server denyhosts

Now make sure you are running all the latest patches by doing an update:

sudo apt-get update
sudo apt-get dist-upgrade

Although not always essential it’s probably a good idea to reboot your server now and make sure it all comes back up and you can still login via ssh.

Now we’re ready to start the OpenERP install.

Step 2. Create the OpenERP user that will own and run the application

sudo adduser --system --home=/opt/openerp --group openerp

This is a “system” user. It is there to own and run the application, it isn’t supposed to be a person type user with a login etc. In Ubuntu, a system user gets a UID below 1000, has no shell (well it’s actually /bin/false) and has logins disabled. Note that I’ve specified a “home” of /opt/openerp, this is where the OpenERP server, and optional web client, code will reside and is created automatically by the command above. The location of the server code is your choice of course, but be aware that some of the instructions and configuration files below may need to be altered if you decide to install to a different location.

Step 3. Install and configure the database server, PostgreSQL

sudo apt-get install postgresql

Then configure the OpenERP user on postgres:

First change to the postgres user so we have the necessary privileges to configure the database.

sudo su - postgres

Now create a new database user. This is so OpenERP has access rights to connect to PostgreSQL and to create and drop databases. Remember what your choice of password is here; you will need it later on:

createuser --createdb --username postgres --no-createrole --no-superuser --pwprompt openerp
Enter password for new role: ********
Enter it again: ********

[Update 18/08/2011: I have added the --no-superuser switch. There is no need for the openerp database user to have superuser privileges.]

Finally exit from the postgres user account:

exit

Step 4. Install the necessary Python libraries for the server

sudo apt-get install python python-psycopg2 python-reportlab \
python-egenix-mxdatetime python-tz python-pychart python-mako \
python-pydot python-lxml python-vobject python-yaml python-dateutil \
python-pychart python-webdav

And if you plan to use the Web client install the following:

sudo apt-get install python-cherrypy3 python-formencode python-pybabel \
python-simplejson python-pyparsing

Step 5. Install the OpenERP server, and optional web client, code

I tend to use wget for this sort of thing and I download the files to my home directory.

Make sure you get the latest version of the application files. At the time of writing this it’s 6.0.2 6.0.3; I got the download links from their download page.

wget http://www.openerp.com/download/stable/source/openerp-server-6.0.3.tar.gz

And if you want the web client:

wget http://www.openerp.com/download/stable/source/openerp-web-6.0.3.tar.gz

Now install the code where we need it: cd to the /opt/openerp/ directory and extract the tarball(s) there.

cd /opt/openerp
sudo tar xvf ~/openerp-server-6.0.3.tar.gz
sudo tar xvf ~/openerp-web-6.0.3.tar.gz

Next we need to change the ownership of all the the files to the openerp user and group.

sudo chown -R openerp: *

And finally, the way I have done this is to copy the server and web client directories to something with a simpler name so that the configuration files and boot scripts don’t need constant editing (I call them, rather unimaginatively, server and web). I started out using a symlink solution, but I found that when it comes to upgrading, it seems to make more sense to me to just keep a copy of the files in place and then overwrite them with the new code. This way you keep any custom or user-installed modules and reports etc. all in the right place.

sudo cp -a openerp-server-6.0.3 server
sudo cp -a openerp-web-6.0.3 web

As an example, should OpenERP 6.0.4 come out next, I can extract the tarballs into /opt/openerp/ as above. I can do any testing I need, then repeat the copy command (replacing 6.0.3 obviously) so that the modified files will overwrite as needed and any custom modules, report templates and such will be retained. Once satisfied the upgrade is stable, the older 6.0.3 directories can be removed if wanted.

That’s the OpenERP server and web client software installed. The last steps to a working system are to set up the two (server and web client) configuration files and associated init scripts so it all starts and stops automatically when the server boots and shuts down.

Step 6. Configuring the OpenERP application

The default configuration file for the server (in /opt/openerp/server/doc/) could really do with laying out a little better and a few more comments in my opinion. I’ve started to tidy up this config file a bit and here is a link to the one I’m using at the moment (with the obvious bits changed). You need to copy or paste the contents of this file into /etc/ and call the file openerp-server.conf. Then you should secure it by changing ownership and access as follows:

sudo chown openerp:root /etc/openerp-server.conf
sudo chmod 640 /etc/openerp-server.conf

The above commands make the file owned and writeable only by the openerp user and only readable by openerp and root.

To allow the OpenERP server to run initially, you should only need to change one line in this file. Toward to the top of the file change the line db_password = ******** to have the same password you used way back in step 3. Use your favourite text editor here. I tend to use nano, e.g. sudo nano /etc/openerp-server.conf

Once the config file is edited, you can start the server if you like just to check if it actually runs.

/opt/openerp/server/bin/openerp-server.py --config=/etc/openerp-server.conf

It won’t really work just yet as it isn’t running as the openerp user. It’s running as your normal user so it won’t be able to talk to the PostgreSQL database. Just type CTL+C to stop the server.

Step 7. Installing the boot script

For the final step we need to install a script which will be used to start-up and shut down the server automatically and also run the application as the correct user. Here’s a link to the one I’m using currently.

Similar to the config file, you need to either copy it or paste the contents of this script to a file in /etc/init.d/ and call it openerp-server. Once it is in the right place you will need to make it executable and owned by root:

sudo chmod 755 /etc/init.d/openerp-server
sudo chown root: /etc/init.d/openerp-server

In the config file there’s an entry for the server’s log file. We need to create that directory first so that the server has somewhere to log to and also we must make it writeable by the openerp user:

sudo mkdir /var/log/openerp
sudo chown openerp:root /var/log/openerp

Step 8. Testing the server

To start the OpenERP server type:

sudo /etc/init.d/openerp-server start

You should now be able to view the logfile and see that the server has started.

less /var/log/openerp/openerp-server.log

If there are any problems starting the server now you need to go back and check. There’s really no point ploughing on if the server doesn’t start…

OpenERP - First Login

If you now start up the GTK client and point it at your new server you should see a message like this:

Which is a good thing. It means the server is accepting connections and you do not have a database configured yet. I will leave configuring and setting up OpenERP as an exercise for the reader. This is a how to for installing the server. Not a how to on using and configuring OpenERP itself…

What I do recommend you do at this point is to change the super admin password to something nice and strong. By default it is “admin” and with that a user can create, backup, restore and drop databases (in the GTK client, go to the file menu and choose the Databases -> Administrator Password option to change it). This password is written as plain text into the /etc/openerp-server.conf file. Hence why we restricted access to just openerp and root.

One rather strange thing I’ve just realised is that when you change the super admin password and save it, OpenERP completely re-writes the config file. It removes all comments and scatters the configuration entries randomly throughout the file. I’m not sure as of now if this is by design or not.

Now it’s time to make sure the server stops properly too:

sudo /etc/init.d/openerp-server stop

Check the logfile again to make sure it has stopped and/or look at your server’s process list.

Step 9. Automating OpenERP startup and shutdown

If everything above seems to be working OK, the final step is make the script start and stop automatically with the Ubuntu Server. To do this type:

sudo update-rc.d openerp-server defaults

You can now try rebooting you server if you like. OpenERP should be running by the time you log back in.

If you type ps aux | grep openerp you should see a line similar to this:

openerp 708 3.8 5.8 181716 29668 ? Sl 21:05 0:00 python /opt/openerp/server/bin/openerp-server.py -c /etc/openerp-server.conf

Which shows that the server is running. And of course you can check the logfile or use the GTK client too.

Step 10. Configure and automate the Web Client

Although it’s called the web client, it’s really another server-type application which [ahem] serves OpenERP to users via a web browser instead of the GTK desktop client.

If you want to use the web client too, it’s basically just a repeat of steps 6, 7, 8 and 9.

The default configuration file for the web client (can also be found in /opt/openerp/web/doc/openerp-web.cfg) is laid out more nicely than the server one and should work as is when both the server and web client are installed on the same machine as we are doing here. I have changed one line to turn on error logging and point the file at our /var/log/openerp/ directory. For our installation, the file should reside in /etc/, be called openerp-web.conf and have it’s owner and access rights set as with the server configuration file:

sudo chown openerp:root /etc/openerp-web.conf
sudo chmod 640 /etc/openerp-web.conf

Here is a web client boot script. This needs to go into /etc/init.d/, be called openerp-web and be owned by root and executable.

sudo chmod 755 /etc/init.d/openerp-web
sudo chown root: /etc/init.d/openerp-web

You should now be able to start the web server by entering the following command:

sudo /etc/init.d/openerp-web start

Check the web client is running by looking in the log file, looking at the process log and, of course, connecting to your OpenERP server with a web browser. The web client by default runs on port 8080 so the URL to use is something like this: http://my-ip-or-domain:8080

Make sure the web client stops properly:

sudo /etc/init.d/openerp-web stop

And then configure it to start and stop automatically.

sudo update-rc.d openerp-web defaults

You should now be able to reboot your server and have the OpenERP server and web client start and stop automatically.

I think that will do for this post. It’s long enough as it is!

I’ll do a part 2 in a little while where I’ll cover using apache, ssl and mod_proxy to provide encrypted access to all services.

[UPDATE: Part 2 is here]