New parameter GHC_VERIFY_SSL to enable / disable SSL verification for…

… python request calls (get / post) (#427)

* update config_main.py, config_site.py, probe.py and Dockerfile based on issue #282

* add GHC_VERIFY_SSL parameter to the documentation

* update GHC_VERIFY_SSL parameter in the documentation

Co-authored-by: Malte Lange <m.lange@dvz-mv.de>

Dockerfile

@@ -35,6 +35,7 @@ ENV LC_ALL="en_US.UTF-8" \
 	GHC_RUNNER_IN_WEBAPP=False \
 	GHC_REQUIRE_WEBAPP_AUTH=False \
 	GHC_BASIC_AUTH_DISABLED=False \
+	GHC_VERIFY_SSL=True \
 	GHC_LOG_LEVEL=30 \
 	GHC_LOG_FORMAT='%(asctime)s - %(name)s - %(levelname)s - %(message)s' \
 	GHC_NOTIFICATIONS_EMAIL='you2@example.com,them@example.com' \

GeoHealthCheck/config_main.py

@@ -53,6 +53,7 @@
 GHC_RUNNER_IN_WEBAPP = True
 GHC_REQUIRE_WEBAPP_AUTH = False
 GHC_BASIC_AUTH_DISABLED = False
+GHC_VERIFY_SSL = True
 # 10=DEBUG 20=INFO 30=WARN(ING) 40=ERROR 50=FATAL/CRITICAL
 GHC_LOG_LEVEL = 30
 GHC_LOG_FORMAT = '%(asctime)s - %(name)s - %(levelname)s - %(message)s'

GeoHealthCheck/probe.py

@@ -306,13 +306,15 @@ def perform_get_request(self, url):
         return self._session.get(
             url,
             timeout=App.get_config()['GHC_PROBE_HTTP_TIMEOUT_SECS'],
+            verify=App.get_config()['GHC_VERIFY_SSL'],
             headers=self.get_request_headers())
 
     def perform_post_request(self, url_base, request_string):
         """ Perform actual HTTP POST request to service"""
         return self._session.post(
             url_base,
             timeout=App.get_config()['GHC_PROBE_HTTP_TIMEOUT_SECS'],
+            verify=App.get_config()['GHC_VERIFY_SSL'],
             data=request_string,
             headers=self.get_request_headers())
 

docker/config_site.py

@@ -64,6 +64,7 @@ def str2None(v):
 GHC_RUNNER_IN_WEBAPP = str2bool(os.environ['GHC_RUNNER_IN_WEBAPP'])
 GHC_REQUIRE_WEBAPP_AUTH = str2bool(os.environ['GHC_REQUIRE_WEBAPP_AUTH'])
 GHC_BASIC_AUTH_DISABLED = str2bool(os.environ['GHC_BASIC_AUTH_DISABLED'])
+GHC_VERIFY_SSL = str2bool(os.environ['GHC_VERIFY_SSL'])
 GHC_LOG_LEVEL = int(os.environ['GHC_LOG_LEVEL'])
 GHC_LOG_FORMAT = os.environ['GHC_LOG_FORMAT']
 

docs/config.rst

@@ -36,6 +36,7 @@ The configuration options are:
 - **GHC_METADATA_CACHE_SECS**: metadata, "Capabilities Docs", cache expiry time, default 900 secs, -1 to disable
 - **GHC_REQUIRE_WEBAPP_AUTH**: require authentication (login or Basic Auth) to access GHC webapp and APIs (default: ``False``)
 - **GHC_BASIC_AUTH_DISABLED**: disable Basic Authentication to access GHC webapp and APIs (default: ``False``), see below when to set to `True`
+- **GHC_VERIFY_SSL**: perform SSL verification for Probe HTTPS requests (default: ``True``)
 - **GHC_RUNNER_IN_WEBAPP**: should the GHC Runner Daemon be run in webapp (default: ``True``), more below
 - **GHC_LOG_LEVEL**: logging level: 10=DEBUG 20=INFO 30=WARN(ING) 40=ERROR 50=FATAL/CRITICAL (default: 30, WARNING)
 - **GHC_MAP**: default map settings