You are currently viewing all posts in the general category.

Route Highlighting

Route Highlighting

A 4 gram highlighter makes route planning much easier. Carry one.

Yonder, to the Alpine Lakes

Mountains lie all about, with many difficult turns leading here and there. The trails run up and down; we are martyred with obstructing rocks. No matter how well we keep the path, if we miss one single step, we shall never know safe return. But whoever has the good fortune to penetrate that wilderness, for his labors will gain a beatific reward, for he shall find there his heart’s delight. The wilderness abounds in whatsoever the ears desire to hear, whatsoever would please the eye: so that no one could possible wish to be anywhere else. And this I well know; for I have been there.

Gottfried von Strassburg, Tristan and Isolde

Day One

Up the Foss River. Trout Lake to Copper Lake to Big Heart.

Towards the High Country

Sign for Malachite and Copper

Stones to Copper Lake

Early Evening at Big Heart Lake

Big Heart Lake Reflections

Day Two

Cross-country along the High Route. Big Heart Lake, Angeline, and Chetwoot.

High Route to Chetwoot Lake

Big Heart Lake from the Ridge

Peaks of the Alpine Lakes

Resting Along the High Route

A Bedroom

Day Three

Down and out along the Foss.

Returning to Copper Lake

Little Heart Lake

Copper Lake

Yonders and yonders.

A Pack For the Mountains

A Pack for the Mountains

We have packed everything we need for the trip in a backpack. If the backpack is light, we will walk more easily. With a heavy pack, we walk with bended knees, and a slower pace.

Having a lot of belongings takes a toll. Things can determine how we live, requiring monthly payments, maintenance and repair.

When we can carry all our life’s necessities on our backs, we can go where we want.

On a journey, we sleep on the ground. We cook food over a fire. Life is simple. Everyone who pursues simple life, does so by choice.

On a journey, whatever we can’t do without is a life necessity. This is the question raised during the journey by actual situations, what is needed for a society based on life-necessities. Is there something better than what we experience in our daily life, and if so, what is it? Why do we practice simple life? Does exertion have any positive value? Almost everything in simple life requires more exertion that our daily life.

Having nice things and being comfortable has become the norm in our society, which consumes steadily more resources so that we can live more and more comfortably. This is characteristic of an industrial growth society.

When we take with us only our life’s necessities, our equipment must last, it must be of high quality.

Roger and Sarah Isberb, Simple Life “Friluftsliv”: People Meet Nature

Up Ingalls Way

I gained the pass just before noon. On the other side, the ridge fell to reveal Jack Creek, Mount Stuart and the other paths I had traveled the year before. It’s pleasing to see that country again, and I gaze off into the Wilderness as I recall some of the moments of that past trip. I’m also satisfied that my route finding had gone perfectly to plan.

Jack Creek

Last night, camped back beyond Lake Anne, I had taken out map and compass and, while dinner sat in the cozy, planned today’s route. The cross country section was only a couple miles, but I find it useful to plan carefully, whether the route is two miles or 20.

Route Planning

I had come in on the De Roux trailhead, which climbed up a ways from the Teanaway valley before reaching Gallagher Head Lake. My plans for this piece of rambling were uncertain. I had an idea or two, but no certain plan. Summer was late this year. I wasn’t sure what sort of snow I would hit, or where. Whatever conditions I did meet would factor into determining my route.

At Gallagher I met a couple who had camped the previous night at Lake Anne. We greeted one another and they asked where I was headed. “Up Ingalls way,” I said, with a vague waving of the hand. I told them that I knew I was heading to Lake Anne, and then from there I’d leave the trail, heading toward Ingalls Peak, to see what I would see.

Gallgher Head Lake

After lunch at the lake, I continued down the trail, making my way north and west to the other side of Esmeralda Peaks.

Along the Trail

Moon Above Esmeralda Peaks

South of Anne Lake, I decided to make a late afternoon camp. I went off the trail aways and found a spot just on the edge of a cliff overlooking the Esmeralda basin. With the tarp pitched, I wandered down to a small creek for water. There, I had dinner, as well, before climbing back up to where I had made camp.

Camp

The long summer evening gave me plenty of time to take in the view and. That night, there were thousands of stars that needed gazing.

The following morning I had broken camp and climbed over the final saddle to Lake Anne. From there, I left the trail, aiming for an unnamed pass just north of Ingalls Peak. My intention was to climb over that, descend into the Jack Creek valley, and then climb back up to Stuart Pass. From there, I would go to Lake Ingalls and head back down, effectively circumnavigating the peak.

Toward the Pass

After enjoying the view at the top of the pass, I turned to the more immediate matter of the descent. The east side of the ridge was steeper than the west, and covered with crumbling talus. I tried three different ways down, but on all them I eventually had to turn around and climb back up. I try not to climb down anything I can’t climb up. Some rope and hardware would have been handy, but I had none. I had packed my ice ax, thinking it likely that there would be more snow here at 7,000 feet, but, except for the occasional small field, it was melted. Had I come a week or two earlier, most of the ridge probably would have been snow covered, which would have made the descent simpler. As it was, no route presented itself. I decided that instead of making Lake Ingalls, I would retrace my steps to last night’s camp and head down and out along Esmeralda Basin.

A Descent

First, though, came lunch. On the map, someone had drawn an imaginary line along the top of this ridge, designated one side as the Alpine Lakes Wilderness, and the other as just plain old National Forest. I decided that as long as I was up here, I would enjoy my overly-rehydrated beans in the Alpine Lakes. So, I went 50 feet or so down the west side again, till I happened upon a spot to sit.

Mount Stuart

After lunch I spent some time scrambling around on the northern most peak of Ingalls, before retracing my steps back to an unmarked meadow. From there, I made for Lake Anne, regaining the trail at the lake’s northern outlet.

Creek in Hidden Meadow

As I make my way towards Esmeralda, and then proceed into the basin, I enter day-hiking range and find the trail cluttered with swarms of day trippers. There are three or four backpackers mixed in among them. Near the end of the trail, I have my first meeting with that most curious specimen, the iPhone backpacker. I had heard that these people exist, going into the backcountry with only the GPS on their cell phone for navigation, but wasn’t quite sure if it was all a joke. Apparently not. He was making for Lake Anne, and I tried to point out on my map where I thought some good camping would be if Anne was overly crowded, but it was clear he did not know how to read it.

At the end of the trail I reached the road. The De Roux trailhead, my final destination is still a few miles further. I make it a mile down the road before being stopped by a woman I had greeted back up in the high country somewhere. She had come out behind me, and offered me a ride the rest of the way to De Roux.

The Road Out

Fire Starting with the Trail Designs Ti-Tri Inferno

On our last morning in the Red Buttes Wilderness, Avagdu and I woke up to a very wet camp. We wanted fire, but neither of us had brought any dry wood into our shelters the night before. Everything was soaked.

We gathered what we could – branches from dead fall that were up off the ground, as well as dead lower branches from standing trees – but the trees were so sparse in the area that, even after splitting, much of this wood was still wet. (I should mention that we wanted a fire, but did not need one. I, at least, was not hugely motivated to put a large amount of energy into batoning. So a small amount of our failure ought to be attributed to laziness.)

After failing to get a blaze going with the wet wood, even after using a bit of inner tube to extend the flame, I hit on the idea of using the Inferno.

I’ve had my Trail Designs Ti-Tri for two and a half years now. It’s been my primary stove system for all of that time. Last Fall, I contacted Trail Designs and had them send me an Inferno insert for the system. The Inferno consists of a second, inverted cone and a grate. The grate raises the base of the fire up off of the ground, allowing for an improved air flow, and the second cone creates a double-walled stove. This turns the Ti-Tri into a wood gassifier, similar to the Four Dogs Bushcooker or the ever-popular Bushbuddy.

So, back at camp, I thought the Inferno might help. I had never used it before solely to start a camp fire, but I knew from previous experience using it to cook my dinner that it was efficient enough to burn damp wood. It would give us a raised platform, allowing us to build the fire up off of the saturated ground, and the cone would provide a wall to keep the heat in and help dry the wood.

It was a success.

Inferno Fire

We split a bit more wood, and did a bit more feathering. It was all still as damp as before, but shortly we achieved a small blaze inside the Inferno. From there, it was simply a matter of building the fire up and around the Inferno. With the heat put out by the cone, even the wet, unprocessed wood would dry and burn. As the fire built up, the Inferno could be pulled out with a multi-tool or a couple sticks, and packed away with the rest of the Ti-Tri, ready to cook the next meal.

The weight of the Inferno insert varies. It is dependent on the size of the outer Caldera cone, which in turns varies based on the size of the pot. For my system, which is built around a 900mL pot from Titanium Goat, the pieces that comprise the Inferno weigh in at a collective 38 grams (1.34 ounces). Given that it not only increases the Ti-Tri’s efficiency as a wood burning stove, but also functions as an emergency fire starter, I’m happy to haul the extra weight.

An Ubuntu VPS for Django

Three years ago I wrote a guide to building a VPS web server for serving sites in a PHP environment. That setup served me well for some time, but most of the sites I run now – including this one – are now written in Python. Earlier this year I built another web server to reflect this. It’s similar to before; I still use Ubuntu and I still like to serve pages with nginx. But PHP has been replaced with Python, and many of the packages used to build the environment have changed as a result. As with the last time, I decided to compile my notes into a guide, both for my own reference and in case anyone else would like to duplicate it. So far, the server has proven to be fast and efficient. It serves Python using uWSGI, uses a PostgreSQL database, and includes a simple mail server provided by Postfix. I think it’s a good setup for serving simple Django-based websites.

Basic Setup

As with last time, I recommend following Slicehost’s basic server setup article. It discusses user administration, SSH security, and firewalls. I no longer use Slicehost as my VPS provider, but I find that Slicehost’s articles provide an excellent base regardless of the host.

Packages

Packages should upgraded immediately to address any known security vulnerabilities.

1
2
$ sudo apt-get update
$ sudo apt-get upgrade

After the repositories have been updated, I install some essential packages.

1
$ sudo apt-get install build-essential screen dnsutils

Build-essential includes necessary tools to compile programs. I am incapable of using a computer that does not have screen on it, so that gets installed too. The third package, dnsutils, is optional, but includes dig which is useful for troubleshooting DNS issues.

DenyHosts

Slicehost’s setup article recommends turning off password authentication in SSH, forcing users to login with keys only. I use keys whenever I can, but I appreciate the option of being able to login to my server from any computer, when I may or may not have my SSH key with me. So I leave password authentication enabled. This presents the possibility of brute-force attacks. Enter DenyHosts. DenyHosts, which I have discussed previously attempts to protect against SSH attacks by banning hosts after a certain number of failed login attempts. When password authentication is enabled, running DenyHosts is a smart move.

1
2
$ sudo apt-get install denyhosts
$ sudo vim /etc/denyhosts.conf

Personalize the Environment

I use update-alternatives to set my default editor to vim.

1
$ sudo update-alternatives --config editor

All of my personal configuration files are kept in a github repository. I’ll check out that repository into ~/src and install the files.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
$ mkdir ~/src
$ cd ~/src
$ sudo apt-get install git-core
$ git clone git://github.com/pigmonkey/dotfiles.git
$ ln -s ~/src/dotfiles/bash_profile ~/.bash_profile
$ ln -s ~/src/dotfiles/bashrc ~/.bashrc
$ ln -s ~/src/dotfiles/bash_aliases ~/.bash_aliases
$ ln -s ~/src/dotfiles/bash_colors ~/.bash_colors
$ ln -s ~/src/dotfiles/vimrc ~/.vimrc
$ ln -s ~/src/dotfiles/vim ~/.vim
$ ln -s ~/src/dotfiles/screenrc ~/.screenrc
$ source ~/.bash_profile

Time

The next step is to set the server’s timezone and sync the clock with NTP.

1
2
$ sudo dpkg-reconfigure tzdata
$ sudo apt-get install ntp

Rootkits

There’s no reason not to run both chkrootkit and rkhunter to check for rootkits and related vulnerabilities.

chrkrootkit

Slicehost has an excellent article for setting up and using chkrootkit.

Later on I’ll be installing some Python development packages. One of them creates a directory called /usr/lib/pymodules/python2.6/.path, which sets off a warning in chkrootkit. Part of chkrootkit’s desgin philosophy is to not include any whitelists: if chkrootkit finds something that it doesn’t like, you’re going to hear about it. I have cron run chkrootkit nightly and I want to receive any warnings, but I don’t want to receive the same false positive every morning in my inbox.

The solution is to create a file that contains chkrootkit’s warning. I call that file whitelist and store it in the same directory as chkrootkit. When chkrootkit is run, any output is redirected to a file. That file is compared to the whitelist using diff and the output of that – if any – is then read. At the end, the file containing chkrootkit’s output is deleted so that the working directory is ready for the next run. The effect is that I only hear warnings from chkrootkit that I have not explicit whitelisted. All of this can be accomplished in a single crontab entry.

1
0 3 * * * (cd /home/demo/src/chkrootkit-0.49; ./chkrootkit -q > message 2>&1; diff -w whitelist message; rm -f message)

rkhunter

I’m sure it doesn’t surprise you that I’m going to recommend reading Slicehost’s article on rkhunter.

Unlike chkrootkit, rkhunter does allow for whitelists. On a clean Ubuntu 10.04 system, I find that I need to whitelist a few items in the config.

1
2
3
4
5
6
7
$ sudo vim /etc/rkhunter.conf

SCRIPTWHITELIST="/usr/sbin/adduser /usr/bin/ldd /bin/which"
ALLOWHIDDENDIR="/dev/.udev /dev/.initramfs"
APP_WHITELIST="openssl:0.9.8k gpg:1.4.10"

$ sudo /usr/local/bin/rkhunter --propupd

The script that my cronjob runs is slightly different from the one demonstrated in the Slicehost article. Their script executes a few commands, groups the output together, and sends it to mail to email the system administrator. This results in daily emails, regardless of whether rkhunter finds any warnings or not. My script is simpler and does not result in so many messages.

1
2
3
4
#!/bin/sh
/usr/local/bin/rkhunter --versioncheck -q
/usr/local/bin/rkhunter --update -q
/usr/local/bin/rkhunter --cronjob --report-warnings-only

The version check and update commands both have the -q switch, which disables any output – I don’t care to know whether rkhunter updated itself or not. The final line actually executes the scan. Notice that there’s no reference to mail. This script does not send any messages. The reason for that is that rkhunter itself provides the mail functionality. Inside of /etc/rkhunter.conf there is a MAIL-ON-WARNING variable. As long as the machine has an smtp server on it (which I’ll get to later in this guide), simply filling in this variable will result in any warnings being emailed to the system administrator.

Web Server

With the basics complete, it’s time to start serving something! In my previous article I covered serving a PHP-based Wordpress site via FastCGI and nginx. This time around the stack will be different: nginx, uWSGI, Python, and Django.

A few basic packages will help flesh out the server’s Python development environment:

1
$ sudo apt-get install python-psycopg2 python-setuptools python2.6-dev psmisc python-imaging locate python-dateutil libxml2-dev python-software-properties

uWSGI

Installing uWSGI is a simple matter of compiling it and moving the resulting binary into one of your system’s bin directories.

1
2
3
4
5
6
$ cd ~/src/
$ wget http://projects.unbit.it/downloads/uwsgi-0.9.8.tar.gz
$ tar xvzf ~/uwsgi-0.9.8.tar.gz
$ cd uwsgi-0.9.8/
$ make -f Makefile.Py26
$ sudo cp uwsgi /usr/local/sbin

nginx

The nginx package in Ubuntu’s official repositories is always notoriously outdated. It used to be you had to compile the server from source, but there is now an Ubuntu PPA for the latest stable versions. As described by the nginx wiki, all that is needed is to add the PPA to your sources.list and apt-get away!

1
2
3
$ sudo add-apt-repository ppa:nginx/stable
$ sudo apt-get update 
$ sudo apt-get install nginx

Python and Django

If you do Python development and haven’t heard of virtualenv, it is well worth reading up on. It allows the user to create an isolated, virtual Python environment for each project. This helps immensely when developing (or serving) multiple projects on a single machine. Needless to say, I consider it to be a required package.

Install

I’ll be installing virtualenv and virtualenvwrapper (a set of scripts to facilitate working with virtual environments). I also prefer pip over easy_install for managing Python packages.

1
2
3
$ sudo easy_install -U pip 
$ sudo pip install virtualenv
$ sudo pip install virtualenvwrapper

Setup a virtual environment

Virtual environments can be stored wherever you fancy. For now, I keep them in a hidden folder in my home directory. For these examples, I’ll setup an environment called myproject.

1
2
3
$ mkdir ~/.virtualenvs
$ cd ~/.virtualenvs
$ virtualenv --no-site-packages --distribute myproject

Notice the --no-site-packages switch. That tells virtualenv to create this environment without any of the Python packages already installed, creating a completely fresh, clean environment. The --distribute switch causes the new virtual environment to be setup with distribute, a replacement for the old and rather broken setuptools.

All that’s needed to get virtualenvwrapper up and running is to add two lines to your .bashrc and re-source the file.

1
2
3
4
5
6
$ vim ~/.bashrc

export WORKON_HOME=$HOME/.virtualenvs
source /usr/local/bin/virtualenvwrapper.sh

$ . ~/.bashrc

We can now use commands like workon to ease the process of activating a certain environment.

I’ll go ahead and install yolk in the environment to help manage packages.

1
2
3
$ workon myproject
$ pip install yolk
$ yolk -l

The last command will cause yolk to list all packages installed in the environment. Try deactivating the environment and then running yolk again.

1
2
3
$ deactivate
$ yolk -l
yolk: command not found

‘yolk’ wasn’t found, because it was only installed within the virtual environment. Neat!

Install Django

Finally, it’s time to install Django! The process is simple enough.

1
2
$ workon myproject
$ pip install django

And that’s it!

The Python Imaging Library is likely to be needed for any Django project. I installed it in the beginning of this section, but because I used the --no-site-packages when creating my virtual environment, it is not available for use within the project. To fix that, I’ll just link the package in. I also previously installed psyopg2, which Python will need to communicate with my PostgreSQL database, so I’ll link that in as well. psyopg2 depends on mx, which was also previously installed but still must be made available in the environment.

1
2
3
4
5
$ cdsitepackages
$ ln -s /usr/lib/python2.6/dist-packages/PIL
$ ln -s /usr/lib/python2.6/dist-packages/PIL.pth
$ ln -s /usr/lib/python2.6/dist-packages/psycopg2
$ ln -s /usr/lib/python2.6/dist-packages/mx

That wasn’t too painful!

Create a Django project

While I’m still in the virtual environment, I’ll go ahead and create a new Django project. The project will have the same name as the environment: myproject. For this tutorial, I’ll stick with the precedence set by the Slicehost tutorials and use demo as the name of both my user and group on the server.

I like to keep my sites in the /srv/ directory. I structure them so that the code that runs the site, any public files, logs, and backups are all stored in separate sub-directories.

1
2
3
4
5
6
7
8
9
$ cd /srv/
$ sudo mkdir -p myproject.com/{code,public,logs,backup}
$ sudo mkdir -p myproject.com/public/{media,static}
$ sudo chown -R demo:demo myproject.com
$ cd myproject.com
$ sudo chown -R :www-data logs public
$ sudo chmod -R g+w logs public
$ cd code/
$ django-admin.py startproject myproject

Notice that the logs and public directories were chowned to the www-data group. That is the name of the user and group that nginx will run as. The web server will need permissions to write to those locations.

Save Requirements

With the environment setup and all the necessary packages installed, now is a good time to tell pip to freeze all the packages and their versions. I keep this file in a deploy folder in my project.

1
2
$ mkdir /srv/myproject.com/code/deploy
$ pip freeze > /srv/myproject.com/code/deploy/requirements.txt

Now, if I needed to recreate the virtual environment somewhere else, I could just tell pip to install all the packages from that file.

1
$ pip install -r /srv/myproject.com/code/deploy/requirements.txt

Configure uWSGI

Now that I have something to serve, I’ll configure uWSGI to serve it. The first step is to create a configuration file for the project. I call mine wsgi.py and store it in /srv/myproject.com/code/myproject/. It appends the current directory to the Python path, specifies the Django settings file for the project, and registers the WSGI handler.

1
2
3
4
5
6
7
8
9
import sys
import os

sys.path.append(os.path.abspath(os.path.dirname(__file__)))
os.environ['DJANGO_SETTINGS_MODULE'] = 'myproject.settings'

import django.core.handlers.wsgi

application = django.core.handlers.wsgi.WSGIHandler()

With that done, the next step is to decide how uWSGI should be run. I’m going to use Ubuntu’s upstart to supervise the service. I keep the upstart script in my project’s deploy/ directory.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
$ vim /srv/myproject.com/code/deploy/uwsgi.conf

description "uWSGI server for My Project"

start on runlevel [2345]
stop on runlevel [!2345]

respawn
exec /usr/local/sbin/uwsgi \
--home /home/demo/.virtualenvs/myproject/ \
--socket /var/run/myproject.com.sock \
--chmod-socket \
--pythonpath /srv/myproject.com/code/ \
--module myproject.wsgi \
--process 2 \
--harakiri 30 \
--master \
--logto /srv/myproject.com/logs/uwsgi.log

Sadly, upstart doesn’t seem to recognize links. Rather than linking the config file into /etc/init/, I have to copy it.

1
$ sudo cp /srv/myproject.com/code/deploy/uwsgi.conf /etc/init/uwsgi-myproject.conf

Configure nginx

Nginx’s configuration is pretty straight-forward. If you’ve never configured the server before, Slicehost’s articles can set you down the right path. My own nginx config looks something like this:

user www-data www-data;
worker_processes 4;
pid /var/run/nginx.pid;

events {
        worker_connections 768;
        use epoll;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 30;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
    gzip_proxied any;
    gzip_comp_level 2;

    # gzip_vary on;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

I keep the virtual host config for my project inside the project’s code/deploy/ directory. A basic virtual host for a Django project would looks like this:

server {
    listen 80;
    server_name www.myproject.com;
    rewrite ^/(.*) http://myproject.com/$1 permanent;
}

server {
    listen 80;
    server_name myproject.com;

    access_log /srv/myproject.com/logs/access.log;
    error_log /srv/myproject.com/logs/error.log;

    location /media {
        root /srv/myproject.com/public/;
    }

    location /static {
        root /srv/myproject.com/public/;
    }

    location / {
        uwsgi_pass unix:///var/run/myproject.com.sock;
        include uwsgi_params;
    }
}

To install and enable the virtual host, I’ll link the configuration file first to the nginx sites-available directory, and then link that link to the sites-enabled directory.

1
2
$ sudo ln -s /srv/myproject.com/code/deploy/nginx.conf /etc/nginx/sites-available/myproject.com
$ sudo ln -s /etc/nginx/sites-available/myproject.com /etc/nginx/sites-enabled/myproject.com

SSL

If you need to encrypt communications, Linode has a tutorial on using both self-signed certificates and commercial certificates with nginx.

Fire it Up

Nginx should be set to talk to uWSGI, which should be set to talk to the Django project. Time for a test run!

1
2
$ sudo start uwsgi-myproject
$ sudo /etc/init.d/nginx start

memcached

Django has a very good built-in cache framework. I like to take advantage of it with a memory-based backend: namely, memcached. It’s fast, efficient, and easy to setup.

All that’s needed is to install memcached on the server, followed by the Python API python-memcached.

1
2
3
$ sudo apt-get install memcached
$ workon myproject
$ pip install python-memcached

The default configuration file in Ubuntu lives at /etc/memcached.conf. I usually stick with the defaults, but sometimes end up changing the port that memchached runs on or the amount of memory it is allowed to use.

logrotate

With the web server more-or-less complete, I like to setup logrotate to manage the logs in my project’s directory. Once again, Slicehost has an excellent introduction to logrotate and an example config for virtual hosts.

I maintain a configuration file for each of the domains being served by the machine. The file for a domain lives in – you guessed it – the associated project’s deploy/ folder. Each contains two entries: one for the nginx virtual host and one for the uWSGI instance. The reason for this is that each config block needs a postrotate section to restart the associated server after the logs have been rotated. I don’t want nginx to be restarted everytime a uWSGI log is rotated, and I don’t want uWSGI restarted everytime an nginx log is rotated.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
$ vim /srv/myproject.com/code/deploy/logrotate

/srv/myproject.com/logs/access.log /srv/myproject.com/logs/error.log {
    rotate 14
    daily
    compress
    delaycompress
    sharedscripts
    postrotate
        [ ! -f /var/run/nginx.pid ] || kill -USR1 `cat /var/run/nginx.pid`
    endscript
}

/srv/myproject.com/logs/uwsgi.log {
    rotate 14
    daily
    compress
    delaycompress
    postrotate
       restart --quiet uwsgi-myproject
    endscript
}

This file is linked in to the /etc/logrotate.d/ directory. Logrotate will automatically include any file in that directory inside its configuration.

1
$ sudo ln -s /srv/myproject.com/code/deploy/logrotate /etc/logrotate.d/myproject

Database Server

A web server isn’t much use without a database these days. I use PostgreSQL.

Install

1
$ sudo apt-get install postgresql

Configure

PostgreSQL has some unique terminology and ways of doing things. When I first set it up for the first time, having coming from a MySQL background, not everything was completely straightforward. As usual, Slicehost has a number of articles that will provide a foundation.

In the /etc/postgresql/8.4/main/postgresql.conf file, I uncomment the following two lines:

track_counts = on
autovacuum = on

Then restart the database server.

1
$ sudo /etc/init.d/postgresql-8.4 restart

After that I’ll change the password for the postgres user and the postgres database role.

1
2
3
4
$ sudo passwd postgres
$ sudo -u postgres psql
\password postgres
\q

To allow local socket connections to the database using passwords, I open up /etc/postgresql/8.4/main/pg_hba.conf and find the following line:

local   all         all                               ident

Which I then change to:

local   all         all                               md5

After which another restart is in order.

1
$ sudo /etc/init.d/postgresql-8.4 restart

Create a database

The next step is to create a user (or role, in PostgreSQL’s parlance) and database for the project. I use the same name for both.

1
2
$ sudo -u postgres createuser -PE myproject
$ sudo -u postgres createdb -O myproject myproject

After that, I should be able to connect.

1
$ psql -U myproject

Import the Database

If I’m restoring a previous database from a backup, now would be the time to import the backup.

1
$ psql -U myproject < myproject.postgresql

And now Django should be able to connect!

The basic server is setup and secure. Django, uWSGI, nginx and PostgreSQL are all running and getting along swimmingly. At this point, many people would be done, but I also like to have a minimal mail server.

Mail Server

Most of my domains use Google Apps, so I don’t need a full-blown mail server. I do want programs and scripts to be able to send mail, and I prefer not to do so through an external SMTP server – I’d rather just deal with having sendmail running on my own box. And I do have a few domains that do not use Google Apps. They have one or two aliases associated with them, so the server needs to receive messages for those domains and forward them off to an external address. If any of this sounds vaguely familiar, it’s because it’s the same thing I detailed last time. My setup now is the same as then, so I won’t repeat any of it here.

For a more detailed explanation of running Postfix, you can read the Slicehost articles.

A Note on Git

I use Git to keep track of the code for all my projects. (If you’re new to Git, you ought to skim the Git Reference or Everyday GIT With 20 Commands Or So). To manage websites, I create a repository of the directory with the code that runs the site (in this case, /srv/myproject.com/code/) and another empty, bare repository to work as a hub. With a post-update and post-commit, the end result is an excellent web workflow:

  • A copy of the hub can be checked out on a local machine for development. Whenever a change is committed, a simple git push will push the code to the web server and automatically make it live.
  • Changes can be made on the server in the actual live website directory. (This is not a best practice, but I do it more often than I should probably admit.) Whenever a change is committed, it is automatically pushed to the hub, so that a simple git pull is all that’s needed on the development machine to update its repository.

A more detailed explanation of this workflow is at Joe Maller’s blog.

To start, I need to create a repository for the new project I created in this tutorial. And, since this is a new server, I need to give Git my name and email address to record with every commit.

1
2
3
4
$ git config --global user.name "Pig Monkey"
$ git config --global user.email "pm@pig-monkey.com"
$ cd /srv/myproject.com/code/
$ git init

Before adding the files, I create a .gitignore file in the repository root to tell Git to ignore compiled Python files.

$ vim .gitignore

*.pyc

Now I add all the files to the repository, confirm that it worked, and commit the files.

1
2
3
$ git add .
$ git status -s
$ git commit -m "Initial commit of myproject.com"

I create the bare hub directory directly along side the projects code/.

1
2
3
4
$ cd ../
$ mkdir hub.git
$ cd hub.git
$ git --bare init

With the hub created, I need to add it as the remote for the main repository and push the master branch to it.

1
2
3
4
$ cd ../code
$ git remote add hub /srv/myproject.com/hub.git
$ git remote show hub
$ git push hub master

Now the hub needs a post-update script so that every time something is pushed to it, that change is automagically pulled into the live website directory.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
$ vim /srv/myproject.com/hub.git/hooks/post-update

#!/bin/sh
echo
echo "**** Pulling changes into live"
echo

cd /srv/myproject.com/code || exit
unset GIT_DIR
git pull hub master

exec git-update-server-info

$ chmod +x /srv/myproject.com/hub.git/hooks/post-update

And the live website directory requires a post-commit script so that every time something is committed inside of it, that change is automagically pushed to the hub.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
$ vim /srv/myproject.com/code/.git/hooks/post-commit

#!/bin/sh
echo
echo "**** pushing changes to Hub"
echo

git push hub

$ chmod +x /srv/myproject.com/code/.git/hooks/post-commit

All that’s left is to check out the hub onto the development machine – my laptop, in this case!

1
2
3
$ mkdir ~/work/myproject/
$ cd ~/work/myproject/
$ git clone ssh://myserver.com/srv/myproject.com/hub.git code

To test things out, we can add a file to the repository on the development machine.

1
2
3
4
5
$ cd code/
$ touch test
$ git add test
$ git commit -m "A test"
$ git push

Now go back to the server, and the file should be there! To test things the other way around, I’ll delete the file from the live repository.

1
2
3
4
5
$ cd /srv/myproject.com/code/
$ ls
myproject test
$ git rm test
$ git commit -m "Removing the test file"

And once again to the development machine:

1
2
3
$ git pull
$ ls
deploy  myproject

No more test! It’s pretty dandy.

Restoring

If I was building a new server and restoring a project from an old server, I would simply mirror the old hub and then clone that in the live directory.

1
2
3
$ cd /srv/myproject.com/
$ git clone --mirror ssh://myoldserver.com/srv/myproject.com/hub.git
$ git clone hub.git code/

Resources

Prior to building this server, I was new to a lot of this – particularly, uWSGI and virtualenv. The following tutorials helped me a good deal in putting together the perfect setup for my needs.

Into the Red Buttes Wilderness

Avagdu and I pulled into the trailhead around 7 PM. After getting our gear together, we decided to take advantage of the long summer evening to log a few miles. The trail into the Red Buttes Wilderness climbs steadily through pine woods. It’s dry and dusty with the lack of rain. But that’s to be expected. We’re back in California, after all.

Occasional glimpses of large slides and the valley below can be had through the trees. Soon enough, the sun sets behind the hills. I remove the headlamp from my pack and throw it around my neck. Avagdu stops a minute later to do the same. There’s another hour or so of good hiking to be got yet.

Our destination this night is Echo Lake. I don’t think it’s too much further down the trail. After I wet my feet in a stream crossing, I figure we must be close, but the sun is down, the moon not yet risen, and I’m worried I’ll miss the spur trail that goes off to the lake. Shortly after the crossing we’re surprised by a small wilderness camp: a shelter made of 4 upright posts and a few pine boughs for a roof, a table, a bit of firewood, and what is either an attempt at a chair or a Nessmuk-style fire. I can’t tell which. It’s an impressive setup. “Someone Ray Mears-ed it up,” Avagdu says. The only thing we can’t figure out is why the shelter is lashed together with duct tape rather than cordage. Or why the bundle of firewood is wrapped in duct tape.

Wilderness Camp

It’s a bit after 10 PM now. We decide to take advantage of our luck and spend the night here. The shelter doesn’t look waterproof, but there’s no other flat ground around. It doesn’t feel like rain tonight anyway. There’s enough room for us both to throw our bivvies down underneath.

I had eaten before reaching the trail. The meal is still sitting in my belly. Forgoing dinner, I go off to hang my food. Avagdu decides to cook a small meal for himself – out of hunger, or just so that he’ll have a few less ounces to carry tomorrow. While we’re sitting around the fire pit, I spot a small mouse scurrying around the shelter. He seems disappointed that new tenants have moved in. Particularly because we had moved the old sock (his bed, I think) from the ground of the shelter to the table. After sniffing around for a while he scurries off.

Wilderness Camp Table

We’re off early in the morning, with expectations of a short climb before arriving at the lake for breakfast.

Things don’t go as planned.

The grade steepens, as expected, but the trail keeps going on. Eventually we break out of the trees into a muddy meadow. Snow patches begin to appear. Somewhere in the meadow I loose the trail. By 10 AM we both feel that we should have reached Echo Lake. The mileage posted at the trailhead was only 4 miles, which we’ve certainly accomplished by now. I’m getting hungry, so I decide to stop in a patch of trees for a bowl of oatmeal. We both eat. After cleaning my pot I get out the map. It’s a large, ungainly thing. I plot our position and get a bearing to the lake. Not too far off, but I still don’t trust the mileage. It’s definitely further than 4 miles from the trailhead.

Red Buttes Wilderness

We climb up higher. The snow is constant now. We end up on a small knob above the lake. Echo Lake is surrounded by snow and looks to be still partially frozen over. Neither of us feel like venturing down for a visit. Our route now takes us up out of the basin onto the Siskiyou Crest. If we went down to the lake we’d just have to climb back up again. So we decide to forgo the lake and instead head higher, aiming for the saddle between Red Butte and Cook and Green Butte.

The slope we’re climbing is facing north. I hope that once we get over to the other side the snow will be gone. Or at least less. Before leaving for the trip I hadn’t been able to find any recent reports or conditions for the area. I figured we wouldn’t be getting very high and, hey, it’s California (the whole state is a desert, right?), so we didn’t plan for much snow.

Climbing to the Saddle

I’m wearing my Merrell Trail Gloves, which aren’t exactly ideal for kicking steps. But going uphill isn’t too much trouble. We reach a bare scree field, climb it, and gain the saddle. I’m pleased to see that both the top of the ridge and the south slope are covered not by snow, but by Manzanita.

Atop the Ridge

Just on the other side of the ridge is our goal: the Pacific Crest Trail. We’ll be on the PCT for the next few miles, which ought to help us make up for time lost in the snow. The PCT is the superhighway of the mountains – wide, tame, and well groomed compared to most wilderness trails.

Pacific Crest Trail

Our route takes us west along the ridge, toward Red Butte. Only a few yards down the trail we come upon a group of three camped on the ridge. They had planned the same route as we, but also did not expect the trail to Echo Lake to be so long nor the snow to be so prevalent. It had upset their schedule. They no longer had time to complete the loop. Instead, they decided to spend some time enjoying the view from the ridgetop before descending and heading out.

The trail is wide and dry. It goes on for a bit before intersecting an old logging road. Just west of the junction both road and trail continue into a snow-filled basin. So much for dry feet! There’s a good stream of snow melt flowing here which we use to fill up our reservoirs, not sure where the next good source will be.

Water Break

From there, the trail climbs over a ridge and down into another basin, which holds Lily Pad Lake. The road parallels the trail and ends in the same lake basin. I choose to follow the road, which is easier to spot under snow. The basin provides views of the other side of Red Butte, the namesake of this Wilderness.

Red Butte Basin

Once across, both road and trail take a steep route up and out of the basin. I decide to take a route slightly longer but easier given the snow. Once gaining the other side, we’re once again in mostly dry territory with only occasional patches of snow. I find the PCT and follow that for a bit before loosing it in another snow field. On the other side, I find the road. Good enough.

End of the Road

The road ends at a fence made of stacked rocks. From there we can look down into this new basin and see the PCT. Lily Pad Lake sits below it. Both hold more snow. The ridge on the west side of the basin has more snow and looks steeper than any field we’ve yet encountered. We must climb that, but not yet. It’s early afternoon and my stomach calls for lunch.

Rock Fence and Gate

It’s windy up on the ridge. There’s a small notch in the rock fence where I setup my stove, keeping it out of the wind. A pot full of noodles, a few mouthfuls of granola with dark chocolate chips, and I’m feeling copacetic in the sun. But we’re not getting any closer to the other side of the basin and Avagdu has finished his crackers and MRE peanut butter. It’s time to move on.

Preparing for Lily Pad Lake

Climbing down from the end of the road we regain the the PCT. It is soon obscured by snow. The slope is indeed steep here – steep enough that I don’t feel safe crossing it without an ice axe or traction devices. But there’s a bare spot above. I make for that, where we can cross above the snow field and then come back down on the other side. I’m having flashbacks of last year in the Glacier Peak Wilderness.

We make it to the top, and across, but before heading back down to where we need to be there’s a finger of the snow field to descend. Avagdu goes first, sitting down on the snow and attempting a controlled descent that ends up being a glissade to the other side. I do the same.

A Tricky Descent

It’s not much further till we reach a similar obstacle. But this time we can’t go up and around the snow. The only choice is to go straight across. I lead this one, slowly kicking steps across the field. It’s easier to cross on a diagonal line, heading slightly uphill. Eventually I end up above where I need to be, with Avagdu behind me. Below, the snow continues for 30 feet before reaching the trail, which at that point is bare. It’s a steep glissade without an ice axe to control the descent. The best option looks to be to sit and attempt to crab walk down, kicking in my heels to make steps as I descend. This works till about halfway, where a step fails and I slip, sliding down the rest of the way. It’s close – I almost miss the bare spot and end up in a tree well further down the mountain – but I’m able to slide enough to the right that I make it, with no problem other than cold hands from digging into the snow.

Meanwhile, Avagdu is above, watching the performance with some amount of trepidation. He sits down for his turn and I attempt to guide him in, instructing him to kick steps with his heels and aim for the log on the trail. The beginning is good. Then he slips and starts the glissade. He’s further to the left than I was, but he’s reaching for the handholds on the exposed trail and it looks like he’ll make it without trouble, until his reach turns into a somersault. Luckily the somersault takes him in the right direction and he crashes into a branch of the log or a bit of rock. I can’t see which. Later, he says that whatever hit him did so on his heavily padded hip-belt, which probably saved him some discomfort and bruising on the hip.

After a well deserved breather and a bit of water, we continue. It’s not too much longer before, predictably, the trail once again crosses into snow and enters a steep slope. This time it looks like we can go up and around along a tricky scree field, but a group of large boulders prevents me from seeing what is held in store for us on the other side.

We go for it, carefully making our way across the scree along the edge of the snow. It’s the most difficult part yet. On the other side, I climb up the group of boulders to getter a better view of the route above. It’s not a good sight. We’re almost at the top of the ridge, but directly across from us is another steep, snow covered slope. There’s no way around it, above or below, and I don’t want to attempt another crossing so steep without more tools. Directly above us is steep as well. We might be able to make it, climbing with both hands and feet, but there look to be a few cornices up there at the top. That makes me uncomfortable. Avagdu has come around by this time and points out a possible route, saying that there’s a few trees along there to break our fall. I start laughing. That’s exactly what I look for when I’m scouting out a route, but hearing it voiced out loud is somehow humorous. “Yeah, don’t worry, there’s some ground down there to break our fall!”

Another look around. It doesn’t look good. I still can’t see over the top of this ridge, so even if we make it up I’m not sure what waits for us further on. More of the same, likely, which will upset our schedule.

I suggest we turn around. Avagdu agrees. If we’re careful, we can take Avagdu’s suggested route a little further along, which will put is in intermittent trees. We can glissade from tree to tree, hopefully avoiding any big wells, and make it down to the bottom of the basin. From there, it’s a simple matter of crossing the basin (while avoiding a fall into the lake, which is still partially obscured by snow). The other side of the basin is clear of snow, so we can switchback our way up till we hit the trail or road, and then backtrack to the saddle between the two buttes where we first climbed up out of the basin and Echo Lake.

Lily Pad Lake

We reached the spot where we first joined the PCT. The camp belonging to the group of 3 is gone. They must have packed out ahead of us.

I scout out the ridge a bit, checking to see if there’s a better way down the north side than the route we took up. There doesn’t seem to be anything. Looking down from the spot where we finally gained the ridge on the way up, our path looks steeper than before. Funny how that works.

Avagdu and I both relax for a bit, enjoying the view and watching a few clouds roll in. The slope isn’t getting any less steep. After chucking a few rocks down to see where they land, we decide to go for it.

We descend the bare scree field and are back in the snow. Luckily, we can glissade down this time rather than having to climb up. It’s quick, and fun.

Just below where we now know Echo Lake to be we come upon the remains of an old fire ring. There are flat spots around that will make decent spots for us to pitch our tarps, but with the lake on one side and the muddy meadow on the other it looks like it will become too buggy for my tastes. We opt to continue down further, crossing the meadow and descending back into the woods.

Descending into the Trees

At 7 PM we reach a spot with wide flat areas at the base of a cliff. There’s a small trickle of water in the back and the trees are sparse enough to let the sunlight in and allow some views of the sky. This will do for camp.

An abundance of dead wood lies on the floor. The novelty of actually picking dry firewood off the ground rather than having to break it out of trees encourages me to start collecting the makings of a fire. While Avagdu is pitching his tarp I take a spade-shaped rock to dig a small pit. Then I build a basic lay. Soon the flames are jumping.

The night brings heavy rain. The noise on the tarp is enough to wake me up a few times during the night. In the morning I wake but don’t rise for a couple hours, hoping that the rain will soon die down. When it turns to a light sprinkle, I venture out. Our camp has certainly become wet. Avagdu is up and about. He didn’t pack much in the way of insulating layers, so he’s chilly and wants a fire. All of the wood is now sodden. Even that up in the trees is wet, none of the branches being thick enough to protect those below them. It takes some doing, but eventually, with a bit of splitting, feathering, and a few other tricks, we rekindle the fire.

A Soggy Fire

After breakfast the rain picks up again. Neither of us want to sit around outside getting wet, so we retreat to the tarps. The rain puts out our unattended fire.

We have no firm plans for this day. By late morning it appears that the rain won’t give up. We decide that rather than staying in the wet woods all day, it will be better for us to head out and continue on our road trip back up to Washington. A few hours on the road today will make us more likely to accomplish our goal of being in Portland for a meeting on the morrow.

As we break camp the rain continues. We descend lower into the valley. The rain becomes heavier. The sky seems like a torrent by the time we reach the bottom, and both of us are wet. The trailhead is reached shortly after, and there: shelter and some dry clothes.

I leave the mountains, sure in the knowledge that I will return. Perhaps to a different range, but to mountains none the less.

Give him a far reach of eye, the grasses rippling, the small streams talking, buttes swimming clear a hundred miles away. Give him… the clean, ungodly upthrust of the Tetons. They were some.

A.B. Guthrie, Jr., Fair Land, Fair Land

Red Butte

Late Spring in the Alpine Lakes Wilderness

In the Alpine Lakes

The snow is still sitting at 4,000 feet. This weekend I stayed low and enjoyed sleeping on bare ground.

I have a feeling that an ice axe and pair of microspikes will be fairly permanent additions to my pack this summer.