vhosts and workers

[Christopher Garrett <mi...@inixoma.com>]

I'm in the process of configuration Tomcat 4.1.27 to communicate with Apache
1.3.28 through mod_jk on a single machine. I have several virtual hosts set up
on my server in the following way: /home/vhost1, /home/vhost2, etc.. I would
like to configure Apache/Tomcat to allow users of these vhosts to serve
JSPs/Servlets from beneath their home directories, e.g.:
/home/vhost1/public_html/webapps/ and /home/vhost2/public_html/webapps/. From my
reading, I understand that this can be accomplished by:
- setting the appBase attribute of the <Home> tag in the server.xml to those
absolute directories:
    <Home appBase="/home/vhost1/public_html/webapps/"...>
    ...
    <Home appBase="/home/vhost2/public_html/webapps/"...>
- setting the docBase/path attributes in the child <Context> tag to some
directory within the appBase path:
    <Home appBase="/home/vhost1/public_html/webapps/"...>
        <Context docBase="app1" path="/app1"...>
    ...
    <Home appBase="/home/vhost2/public_html/webapps/"...>
        <Context docBase="app1" path="/app1"...>
This would cause the primarly application "app1" to be served out of vhost1's
home from /home/vhost1/public_html/webapps/app1, and another applicationed
"app1" belonging to vhost2 to be served out of
/home/vhost2/public_html/webapps/app1. This is my understanding of these
attributes, though I don't quite get what the distinction between docBase and
path is, as I've not found a decent enough description nor a solid example to
set these in stone for me.

My questions:
1: Would the aforementioned configuration properly serve JSPs/Servlets from
locations beneath vhost1 and vhost2's home directories?
2: What exactly do the docBase and path attributes define within the Context
tag? What is the distinction?
3: It is possible to have a single worker handle requests for more than one web
application belonging to more than one virtual host/user. How beneficial would
it be to have a single worker handle requests sent to it from Apache for more
than one virtual host? Would it be more efficient to have one worker for each
virtual host and have a load balancing worker to manage those subordinate
workers?
4: What sort of mechanisms to workers use to handle requests? Does a worker
receive a request, fork(), child process handles the request, communicates with
the Tomcat JVM, and returns the result to the requesting client, while the
parent simply sits and listens for more connections? If this is the case, would
a load balancer really serve to benefit anything if all this is taking place on
a single machine, given that all the workers would be of type ajp13?

I'm trying to achieve and optimal, secure configuration. One that would allow
the users to manage their own web applications within their home directories so
I don't have to open up rwx access to the world beneath the $TOMCAT_HOME
directory. Granted, I'll still have to amend server.xml to insert new contexts
for users adding new WARs, but this is trivial. I've read a number of articles
and even the manual describing configuration options, etc., but it seems that
there are just a few points missing that would really put things into
perspective for me, so I'm sending these, probably simple, questions to the
list, as my last resort. Any information or links would be greatly appreciated,
and hopefully I'll be able to get everything organized efficiently and securely.


Christopher Garrett III
Inixoma, Incorporated

Re: vhosts and workers

[John Turner <to...@johnturner.com>]

Christopher Garrett wrote:

>     <Home appBase="/home/vhost1/public_html/webapps/"...>
>     ...
>     <Home appBase="/home/vhost2/public_html/webapps/"...>
> - setting the docBase/path attributes in the child <Context> tag to some
> directory within the appBase path:
>     <Home appBase="/home/vhost1/public_html/webapps/"...>
>         <Context docBase="app1" path="/app1"...>
>     ...
>     <Home appBase="/home/vhost2/public_html/webapps/"...>
>         <Context docBase="app1" path="/app1"...>

I'm assuming you mean "Host" instead of "Home".

> My questions:
> 1: Would the aforementioned configuration properly serve JSPs/Servlets from
> locations beneath vhost1 and vhost2's home directories?

Yes.

> 2: What exactly do the docBase and path attributes define within the Context
> tag? What is the distinction?

Path = URL.  docBase = webapp root.  If you have a virtual host 
www.domain.com, and path = "/demo" with a docBase of "demo", then the 
webapp called "demo" will be reached by:

http://www.domain.com/demo

and the webapp will be located at appBase/demo.

> 3: It is possible to have a single worker handle requests for more than one web
> application belonging to more than one virtual host/user. How beneficial would
> it be to have a single worker handle requests sent to it from Apache for more
> than one virtual host? Would it be more efficient to have one worker for each
> virtual host and have a load balancing worker to manage those subordinate
> workers?

Yes. Mostly. No...load balancing is typically for multiple Tomcat 
instances.  If you have just one, stick with one worker.  I run several 
dozen virtual hosts, each with several Contexts (webapps) and have no 
problems whatsoever with one worker under significant load.

> 4: What sort of mechanisms to workers use to handle requests? Does a worker
> receive a request, fork(), child process handles the request, communicates with
> the Tomcat JVM, and returns the result to the requesting client, while the
> parent simply sits and listens for more connections? If this is the case, would
> a load balancer really serve to benefit anything if all this is taking place on
> a single machine, given that all the workers would be of type ajp13?

If a single Tomcat instance, no.  If multiple Tomcat instances, 
possibly, but the only definite answer is "test and see for yourself" 
since everyone's configuration is different.  From my experience, one 
worker and a single instance of Tomcat 4.1.x is just fine.  If I went to 
multiple instances of Tomcat, I would use separate machines.

> I'm trying to achieve and optimal, secure configuration. One that would allow
> the users to manage their own web applications within their home directories so
> I don't have to open up rwx access to the world beneath the $TOMCAT_HOME
> directory. Granted, I'll still have to amend server.xml to insert new contexts
> for users adding new WARs, but this is trivial. I've read a number of articles
> and even the manual describing configuration options, etc., but it seems that
> there are just a few points missing that would really put things into
> perspective for me, so I'm sending these, probably simple, questions to the
> list, as my last resort. Any information or links would be greatly appreciated,
> and hopefully I'll be able to get everything organized efficiently and securely.

If you train your users to use Tomcat's manager application (and ideally 
ant) then you won't ever have to do anything...they can deploy, stop, 
start, and restart their web applications as they wish, without your 
intervention, the only thing you would have to manage is the 
tomcat-users.xml file to give them the appropriate access permissions 
and the Host nodes in server.xml.  Contexts (webapps) can be autodeployed.

HTH

John

Re: vhosts and workers

[Fred Kreek <f....@amc.uva.nl>]

At 07:03 27/08/03, you wrote:
>I'm in the process of configuration Tomcat 4.1.27 to communicate with Apache
>1.3.28 through mod_jk on a single machine. I have several virtual hosts set up
>on my server in the following way: /home/vhost1, /home/vhost2, etc.. I would
>like to configure Apache/Tomcat to allow users of these vhosts to serve
>JSPs/Servlets from beneath their home directories, e.g.:
>/home/vhost1/public_html/webapps/ and /home/vhost2/public_html/webapps/. 
> From my
>reading, I understand that this can be accomplished by:
>- setting the appBase attribute of the <Home> tag in the server.xml to those
>absolute directories:
>     <Home appBase="/home/vhost1/public_html/webapps/"...>
>     ...
>     <Home appBase="/home/vhost2/public_html/webapps/"...>
>- setting the docBase/path attributes in the child <Context> tag to some
>directory within the appBase path:
>     <Home appBase="/home/vhost1/public_html/webapps/"...>
>         <Context docBase="app1" path="/app1"...>
>     ...
>     <Home appBase="/home/vhost2/public_html/webapps/"...>
>         <Context docBase="app1" path="/app1"...>

sorry, should be app2 :~

>This would cause the primarly application "app1" to be served out of vhost1's
>home from /home/vhost1/public_html/webapps/app1, and another applicationed
>"app1" belonging to vhost2 to be served out of
>/home/vhost2/public_html/webapps/app1. This is my understanding of these
>attributes, though I don't quite get what the distinction between docBase and
>path is, as I've not found a decent enough description nor a solid example to
>set these in stone for me.
>
>My questions:
>1: Would the aforementioned configuration properly serve JSPs/Servlets from
>locations beneath vhost1 and vhost2's home directories?

you can also use something linke appBase="webapps/app1/" then your base will
be at $CATALINA_BASE/webapps/app1/

>2: What exactly do the docBase and path attributes define within the Context
>tag? What is the distinction?

path= the virtual path in the URI. so path=/app1 (for your 
my.first.virtualhost) makes
you app available at my.first.virtualhost/app1/.....
docBase tells tomcat where to find the application locally (when not 
starting with
a slash, it is relative to you appBase)

you do not need to define your contexts within the server.xml, it is also 
possible to
do that in web.xml files

>3: It is possible to have a single worker handle requests for more than 
>one web
>application belonging to more than one virtual host/user. How beneficial would
>it be to have a single worker handle requests sent to it from Apache for more
>than one virtual host? Would it be more efficient to have one worker for each
>virtual host and have a load balancing worker to manage those subordinate
>workers?

yes, put the second engine in the first service element. (and remove the second
service element:)

>4: What sort of mechanisms to workers use to handle requests? Does a worker
>receive a request, fork(), child process handles the request, communicates 
>with
>the Tomcat JVM, and returns the result to the requesting client, while the
>parent simply sits and listens for more connections? If this is the case, 
>would
>a load balancer really serve to benefit anything if all this is taking 
>place on
>a single machine, given that all the workers would be of type ajp13?

dunno exactly really. that loadbalancing was from a example workers.properties

>I'm trying to achieve and optimal, secure configuration. One that would allow
>the users to manage their own web applications within their home 
>directories so
>I don't have to open up rwx access to the world beneath the $TOMCAT_HOME
>directory. Granted, I'll still have to amend server.xml to insert new contexts
>for users adding new WARs, but this is trivial. I've read a number of articles
>and even the manual describing configuration options, etc., but it seems that
>there are just a few points missing that would really put things into
>perspective for me, so I'm sending these, probably simple, questions to the
>list, as my last resort. Any information or links would be greatly 
>appreciated,
>and hopefully I'll be able to get everything organized efficiently and 
>securely.
>
>
>Christopher Garrett III
>Inixoma, Incorporated
>
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: tomcat-user-help@jakarta.apache.org

Sorry 'bout the strange setup i gave you. But i am running mulptiple 
versions of
tomcat on one machine. So it is easier to have absolute path names in my
server.xml.

Fred


"There are 10 types of people when it comes to binary, those that 
understand it.. and those who don't."