Run the web application on port 80

[avivace]

sudo setcap 'cap_net_bind_service=+ep' /usr/bin/python2.7

Allows python to bind flask to port 80, without having to be run as root.

However, trying to run flask causes OpenCV to stop working, probably detecting the system change (the python binary can access the ports < 1024 without root access).

pi@coderbot:~/coderbot $ python init.py

******************************************************************
* FATAL ERROR:                                                   *
* This OpenCV build doesn't support current CPU/HW configuration *
*                                                                *
* Use OPENCV_DUMP_CONFIG=1 environment variable for details      *
******************************************************************

Required baseline features:
NEON - NOT AVAILABLE
OpenCV Error: Assertion failed (Missing support for required CPU baseline features. Check OpenCV build configuration and required CPU/HW setup.) in initialize, file /home/pi/opencv-3.3.0/modules/core/src/system.cpp,
 line 518
terminate called after throwing an instance of 'cv::Exception'
  what():  /home/pi/opencv-3.3.0/modules/core/src/system.cpp:518: error: (-215) Missing support for required CPU baseline features. Check OpenCV build configuration and required CPU/HW setup. in function initialize

Aborted

How we should handle this, considering that accessing the web applicaition without having to type the port is critical?

I suggest to install nginx or apache2 and set a simple reverse proxy 80 --> 8080 OR remove the assertion in OpenCV.

[previ]

According to some posts about setcap and capabilities in general
it seems that enabling cap_net_bind_service to the interpreter actually inhibits reading some environment variables, such that LD_LIBRARY_PATH.

Setting all of the variables could be troublesome, a possible different approach, other than the proposed reverse proxy, could be working on internal routing the 80 port to the 8080:
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080

[avivace]

Makes sense. I'll try this today and report back.

[previ]

In order to make iptables persistent (survive reboot):

sudo apt-get install iptables-persistent

[avivace]

Working as expected running iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080 at boot.

Flask is not meant for production, and having apache2/nginx as reserve proxy could work also as WSGI server, as suggested. If new reasons against the built in flask server for production (or in favour of a dedicated proper server) come up, we should reconsider this.

[avivace]

Implemented in CoderBotOrg/system-install@09d6070