Hi Terry,

On Jun 22, 2010, at 7:30 PM, TRBarrette wrote:

Davide,
I'd really like to see how you got it work.

Note that my galaxy configuration relies on a local mirror of the UCSC genome browser. Our galaxy runs as a multiserver (2 web servers on ports 8081 and 8082, one runner on 8100). I've installed mod_xsendfile as Nate suggested (http://tn123.ath.cx/mod_xsendfile/) and enabled it:

LoadModule xsendfile_module /usr/lib/apache2/modules/mod_xsendfile.so

I've configured apache to bind a virtual host to port 8080, which is now proxying galaxy:

[begin apache conf for galaxy, I'll try to comment it]

NameVirtualHost *:8080

<VirtualHost *:8080>

        ServerAdmin davide.cittaro@ifom-ieo-campus.it

#Here comes the proxy stuff... I think you already have this :-)

        <Proxy localhost:8081>

                Order allow,deny

                Allow from all

        </Proxy>

        <Proxy localhost:8082>

                Order allow,deny

                Allow from all

        </Proxy>

        <Proxy balancer://multi-galaxy>

                BalancerMember http://localhost:8081

                BalancerMember http://localhost:8082

        </Proxy>

        ProxyPass / balancer://multi-galaxy

        RewriteEngine on

        RewriteRule ^(.*) http://localhost:8081$1 [P]

        RewriteRule ^/static/style/(.*) /data/galaxy_dist/static/june_2007_style/blue/$1 [L]

        RewriteRule ^/static/(.*) /data/galaxy_dist/static/$1 [L]

        RewriteRule ^/images/(.*) /data/galaxy_dist/static/images/$1 [L]

        RewriteRule ^/favicon.ico /data/galaxy_dist/static/favicon.ico [L]

        RewriteRule ^/robots.txt /data/galaxy_dist/static/robots.txt [L]

        <Location />

                AuthType Basic

                AuthName Galaxy

# Xsendfile as Nate suggested

                XSendFile On

                XSendFileAllowAbove On

# I'm using our internal ldap, querying for name and email

                AuthBasicProvider ldap

                AuthLDAPURL "ldap://ldap.ifom-ieo-campus.it/dc=ifom-ieo-campus,dc=it?cn,mail?sub?(cn=*)"

                AuthLDAPRemoteUserAttribute mail

                Require ldap-filter objectClass=posixAccount

        </Location>

# Set the http header to user e-mail so that galaxy is happy to authenticate :-)

        RequestHeader set REMOTE_USER %{AUTHENTICATE_MAIL}e

        <Location /root/display_as>

                Satisfy Any

                Order deny,allow

                Allow from genome.ifom-ieo-campus.it

        </Location>

        <LocationMatch /ucsc_(bam|big) >

# This is to enable bam and bigWig (or bigBEd in the future) by traversing the proxy

# Allow from our internal network

# and set the http header to a fake email address, this is required because of galaxy architecture...

                Satisfy any

                Order deny,allow

                Allow from 85.239.0.0/255.255.0.0

                RequestHeader set REMOTE_USER "ucsc_browser_display@ifom-ieo-campus.it"

        </LocationMatch>

        ErrorLog /var/log/apache2/galaxy-error.log

        LogLevel debug

        CustomLog /var/log/apache2/galaxy-access.log combined

        ServerSignature On

</VirtualHost>

[/end of apache conf file]

After this comes the galaxy configuration file... this is pretty much the original one, I'll write only the differences for this scope:

ucsc_display_sites = main,campus #where campus is our local mirror. I left "main" although we are behind a firewall and it cannot communicate...

use_remote_user = True

apache_xsendfile = True

#remote_user_maildomain =  #commented and left blank... well, this because I've already have the whole mail address in http header

Then there are some mods I've done in galaxy code and files:

In ${GALAXY_ROOT}/tool-data/shared/ucsc/ucsc_build_sites.txt I've added

#Harvested from http://genome.ifom-ieo-campus.it/cgi-bin/das/dsn

campus   http://genome.ifom-ieo-campus.it/cgi-bin/hgTracks?      hg19,hg18,hg17,mm9,mm8,rn4,danRer6,danRer5,ci2,ce6,ce4,cb3,dm3,sacCer2,sacCer1

To enable our "campus" UCSC mirror. Then I've modified a python file to enable our local mirror:

diff -r 4cdf4cca0f31 lib/galaxy/web/framework/middleware/remoteuser.py

--- a/lib/galaxy/web/framework/middleware/remoteuser.py Mon Jun 21 13:46:52 2010 -0400

+++ b/lib/galaxy/web/framework/middleware/remoteuser.py Wed Jun 23 10:34:03 2010 +0200

@@ -44,6 +44,7 @@

     'hgw6.cse.ucsc.edu',

     'hgw7.cse.ucsc.edu',

     'hgw8.cse.ucsc.edu',

+    'genome.ifom-ieo-campus.it',

 )

 UCSC_ARCHAEA_SERVERS = (

     'lowepub.cse.ucsc.edu',

@@ -55,7 +56,7 @@

         self.maildomain = maildomain

         self.allow_ucsc_main = False

         self.allow_ucsc_archaea = False

-        if 'main' in ucsc_display_sites or 'test' in ucsc_display_sites:

+        if 'main' in ucsc_display_sites or 'test' in ucsc_display_sites  or 'campus' in ucsc_display_sites:

             self.allow_ucsc_main = True

         if 'archaea' in ucsc_display_sites:

             self.allow_ucsc_archaea = True

@@ -69,7 +70,7 @@

                 host = None

             if ( self.allow_ucsc_main and host in UCSC_MAIN_SERVERS ) or \

                ( self.allow_ucsc_archaea and host in UCSC_ARCHAEA_SERVERS ):

-                environ[ 'HTTP_REMOTE_USER' ] = 'ucsc_browser_display@example.org'

+                environ[ 'HTTP_REMOTE_USER' ] = 'ucsc_browser_display@ifom-ieo-campus.it'

                 return self.app( environ, start_response )

         # Apache sets REMOTE_USER to the string '(null)' when using the

         # Rewrite* method for passing REMOTE_USER and a user is

I believe this is all... If your galaxy can communicate with main UCSC server you won't need some the patches above, but only the apache configuration.

HTH

d

/*

Davide Cittaro

Cogentech - Consortium for Genomic Technologies

via adamello, 16

20139 Milano

Italy

tel.: +39(02)574303007

e-mail: davide.cittaro@ifom-ieo-campus.it

*/