From b593a2874a7edb5905c6ac4ba8464720d6bfea48 Mon Sep 17 00:00:00 2001 From: Ruakij Date: Mon, 17 Oct 2022 14:48:02 +0200 Subject: [PATCH] Add role netmaker_server --- .../mosquitto/config/mosquitto.conf | 9 + .../netmaker_server/mosquitto/config/wait.sh | 23 +++ netmaker_server/meta/main.yml | 3 + netmaker_server/tasks/main.yml | 16 ++ netmaker_server/tasks/netmaker.yml | 29 +++ netmaker_server/tasks/prerequisites.yml | 10 + netmaker_server/tasks/rqlite.yml | 66 +++++++ .../templates/docker-compose.yml.template | 171 ++++++++++++++++++ .../templates/rqlite-config.json.template | 5 + 9 files changed, 332 insertions(+) create mode 100644 netmaker_server/files/opt/netmaker_server/mosquitto/config/mosquitto.conf create mode 100755 netmaker_server/files/opt/netmaker_server/mosquitto/config/wait.sh create mode 100644 netmaker_server/meta/main.yml create mode 100644 netmaker_server/tasks/main.yml create mode 100644 netmaker_server/tasks/netmaker.yml create mode 100644 netmaker_server/tasks/prerequisites.yml create mode 100644 netmaker_server/tasks/rqlite.yml create mode 100644 netmaker_server/templates/docker-compose.yml.template create mode 100644 netmaker_server/templates/rqlite-config.json.template diff --git a/netmaker_server/files/opt/netmaker_server/mosquitto/config/mosquitto.conf b/netmaker_server/files/opt/netmaker_server/mosquitto/config/mosquitto.conf new file mode 100644 index 0000000..299f632 --- /dev/null +++ b/netmaker_server/files/opt/netmaker_server/mosquitto/config/mosquitto.conf @@ -0,0 +1,9 @@ +per_listener_settings false +listener 8883 +allow_anonymous false + +listener 1883 +allow_anonymous false + +plugin /usr/lib/mosquitto_dynamic_security.so +plugin_opt_config_file /mosquitto/data/dynamic-security.json diff --git a/netmaker_server/files/opt/netmaker_server/mosquitto/config/wait.sh b/netmaker_server/files/opt/netmaker_server/mosquitto/config/wait.sh new file mode 100755 index 0000000..caf9d29 --- /dev/null +++ b/netmaker_server/files/opt/netmaker_server/mosquitto/config/wait.sh @@ -0,0 +1,23 @@ +#!/bin/ash + +wait_for_netmaker() { + echo "SERVER: ${NETMAKER_SERVER_HOST}" + until curl --output /dev/null --silent --fail --head \ + --location "${NETMAKER_SERVER_HOST}/api/server/health"; do + echo "Waiting for netmaker server to startup" + sleep 1 + done +} + +main(){ + # wait for netmaker to startup + apk add curl + wait_for_netmaker + echo "Starting MQ..." + # Run the main container command. + /docker-entrypoint.sh + /usr/sbin/mosquitto -c /mosquitto/config/mosquitto.conf + +} + +main "${@}" diff --git a/netmaker_server/meta/main.yml b/netmaker_server/meta/main.yml new file mode 100644 index 0000000..3f99ccf --- /dev/null +++ b/netmaker_server/meta/main.yml @@ -0,0 +1,3 @@ +--- +# dependencies: +# - role: docker diff --git a/netmaker_server/tasks/main.yml b/netmaker_server/tasks/main.yml new file mode 100644 index 0000000..2b1b967 --- /dev/null +++ b/netmaker_server/tasks/main.yml @@ -0,0 +1,16 @@ +- import_tasks: ./prerequisites.yml + +- name: Copy folder-structure + ansible.builtin.copy: + src: opt/netmaker_server + dest: /opt/ + mode: preserve + +- name: Deploy compose file + ansible.builtin.template: + src: docker-compose.yml.template + dest: /opt/netmaker_server/docker-compose.yml + +- import_tasks: ./rqlite.yml + +- import_tasks: ./netmaker.yml diff --git a/netmaker_server/tasks/netmaker.yml b/netmaker_server/tasks/netmaker.yml new file mode 100644 index 0000000..961e0d1 --- /dev/null +++ b/netmaker_server/tasks/netmaker.yml @@ -0,0 +1,29 @@ +- name: Start rest of netmaker-services + command: "docker-compose --project-directory /opt/netmaker_server/ up -d" + register: command + failed_when: command.rc != 0 + +- name: Wait for netmaker-api to become available + ansible.builtin.wait_for: + host: "{{ inventory_hostname }}" + port: 8081 + state: started + when: "inventory_hostname == groups['netmaker'][0]" + +- name: Create default mesh-network 'server' + uri: + url: 'http://netmaker-api.{{ netmaker.base_domain }}:8081/api/networks' + method: POST + body: + netid: servers + addressrange: 10.92.0.0/24 + addressrange6: fd92::/64 + body_format: json + headers: + Authorization: 'Bearer {{ netmaker.master_key }}' + Content-Type: application/json + when: "inventory_hostname == groups['netmaker'][0]" + register: default_mesh_ok + until: "default_mesh_ok is not failed" + retries: 2 + delay: 10 diff --git a/netmaker_server/tasks/prerequisites.yml b/netmaker_server/tasks/prerequisites.yml new file mode 100644 index 0000000..a9d91f9 --- /dev/null +++ b/netmaker_server/tasks/prerequisites.yml @@ -0,0 +1,10 @@ +- name: Install wireguard + package: + name: + - wireguard + state: latest + +- name: Check if default-ipv4-address is private + set_fact: + private_ipv4_address: "{{ ansible_facts.default_ipv4.address | regex_search('^((10)|(192\\.168)|(172\\.((1[6-9])|(2[0-9])|(3[0-1])))|(100))\\.') }}" + when: "netmaker.dynamicIp" diff --git a/netmaker_server/tasks/rqlite.yml b/netmaker_server/tasks/rqlite.yml new file mode 100644 index 0000000..7924969 --- /dev/null +++ b/netmaker_server/tasks/rqlite.yml @@ -0,0 +1,66 @@ +- name: Deploy rqlite config + ansible.builtin.template: + src: rqlite-config.json.template + dest: /opt/netmaker/rqlite/config.json + +# CERTIFICATE +- name: Generate PrivateKey + community.crypto.openssl_privatekey: + path: /opt/netmaker/rqlite/certs/node.key + +- name: Generate Certificate-Signing-Request from privateKey + community.crypto.openssl_csr: + path: /opt/netmaker/rqlite/certs/node.csr + privatekey_path: /opt/netmaker/rqlite/certs/node.key + common_name: "{{ ansible_facts.nodename }}" + +- name: Fetch CSR + ansible.builtin.fetch: + src: /opt/netmaker/rqlite/certs/node.csr + dest: tmp_files/ + +- name: Sign CSR locally with CA + local_action: community.crypto.x509_certificate + args: + path: tmp_files/{{ inventory_hostname }}/opt/netmaker_server/rqlite/certs/node.crt + csr_path: tmp_files/{{ inventory_hostname }}/opt/netmaker_server/rqlite/certs/node.csr + ownca_path: secret_files/netmaker_server/ca/ca.crt + ownca_privatekey_path: secret_files/netmaker_server/ca/ca.key + provider: ownca + +- name: Copy Signed Certificate + ansible.builtin.copy: + src: tmp_files/{{ inventory_hostname }}/opt/netmaker_server/rqlite/certs/node.crt + dest: /opt/netmaker_server/rqlite/certs/node.crt + +- name: Copy CA Certificate + ansible.builtin.copy: + src: secret_files/netmaker_server/ca/ca.crt + dest: /opt/netmaker_server/rqlite/certs/ca.crt +# CERTIFICATE + +- name: Start rqlite service for 1st-node + command: "docker-compose --project-directory /opt/netmaker_server/ up -d rqlite" + register: command + failed_when: command.rc != 0 + when: "inventory_hostname == groups['netmaker_server'][0]" + +- name: Waiting for rqlite to accept connections on 1st-node + ansible.builtin.wait_for: + host: "{{ inventory_hostname }}" + port: 4001 + state: started + when: "inventory_hostname == groups['netmaker_server'][0]" + +- name: Start rqlite service for other nodes + command: "docker-compose --project-directory /opt/netmaker_server/ up -d rqlite" + register: command + failed_when: command.rc != 0 + when: "inventory_hostname != groups['netmaker_server'][0]" + +- name: Waiting for rqlite to accept connections on other nodes + ansible.builtin.wait_for: + host: "{{ inventory_hostname }}" + port: 4001 + state: started + when: "inventory_hostname != groups['netmaker_server'][0]" diff --git a/netmaker_server/templates/docker-compose.yml.template b/netmaker_server/templates/docker-compose.yml.template new file mode 100644 index 0000000..9d689b3 --- /dev/null +++ b/netmaker_server/templates/docker-compose.yml.template @@ -0,0 +1,171 @@ +version: "3.4" + +services: + rqlite: # Distributed sqlite-db + image: rqlite/rqlite + restart: unless-stopped + hostname: "{{ ansible_facts.nodename }}" + volumes: + - "./rqlite/data:/rqlite/file" + - "./rqlite/config.json:/config.json:ro" + - "./rqlite/certs:/certs:ro" + ports: + - 4001:4001 + - 4002:4002 + # FIXME: "node-no-verify" Skipping certificate verification is bad! + #-http-ca-cert /certs/ca.crt + #-http-cert /certs/node.crt + #-http-key /certs/node.key + command: " + -node-encrypt + -node-ca-cert /certs/ca.crt + -node-cert /certs/node.crt + -node-key /certs/node.key + -node-no-verify + + -auth /config.json + +{% if inventory_hostname != groups['netmaker'][0] %} + -join-as netmaker + -join http://{{ groups['netmaker'][0] }}:4001 +{% endif %} + " + # FIXME: /\ \/ Change http -> https + + netmaker: # The Primary Server for running Netmaker + image: gravitl/netmaker:v0.16.1 + cap_add: + - NET_ADMIN + - NET_RAW + - SYS_MODULE + sysctls: + - net.ipv4.ip_forward=1 + - net.ipv4.conf.all.src_valid_mark=1 + - net.ipv6.conf.all.disable_ipv6=0 + - net.ipv6.conf.all.forwarding=1 + restart: unless-stopped + volumes: # Volume mounts necessary for sql, coredns, and mqtt + - ./dnsconfig/:/root/config/dnsconfig + - ./mosquitto/data/:/etc/netmaker/ + hostname: "{{ ansible_facts.nodename }}" + environment: # Necessary capabilities to set iptables when running in container + NODE_ID: "{{ ansible_facts.nodename }}" + MASTER_KEY: "{{ netmaker.master_key }}" # The admin master key for accessing the API. Change this in any production installation. + +{% if not private_ipv4_address %} + SERVER_HOST: "{{ ansible_facts.default_ipv4.address }}" # Set to public IP of machine. +{% endif %} + SERVER_NAME: "netmaker-broker.{{ netmaker.base_domain }}" # The domain/host IP indicating the mq broker address + SERVER_HTTP_HOST: "netmaker-api.{{ netmaker.base_domain }}" # Overrides SERVER_HOST if set. Useful for making HTTP available via different interfaces/networks. + SERVER_API_CONN_STRING: "netmaker-api.{{ netmaker.base_domain }}:8081" + + DISABLE_REMOTE_IP_CHECK: "off" # If turned "on", Server will not set Host based on remote IP check. This is already overridden if SERVER_HOST is set. Turned "off" by default. + DNS_MODE: "off" # Enables DNS Mode, meaning all nodes will set hosts file for private dns settings. + + API_PORT: "8081" # The HTTP API port for Netmaker. Used for API calls / communication from front end. If changed, need to change port of BACKEND_URL for netmaker-ui. + REST_BACKEND: "on" # Enables the REST backend (API running on API_PORT at SERVER_HTTP_HOST). Change to "off" to turn off. + RCE: "off" # Enables setting PostUp and PostDown (arbitrary commands) on nodes from the server. Off by default. + CORS_ALLOWED_ORIGIN: "*" # The "allowed origin" for API requests. Change to restrict where API requests can come from. + DISPLAY_KEYS: "on" # Show keys permanently in UI (until deleted) as opposed to 1-time display. + + DATABASE: "rqlite" + SQL_CONN: "http://netmaker:{{ netmaker.rqlite_password }}@rqlite:4001/" + + MQ_HOST: "mosquitto" # the address of the mq server. If running from docker compose it will be "mq". Otherwise, need to input address. If using "host networking", it will find and detect the IP of the mq container. + MQ_SERVER_PORT: "1883" # the reachable port of MQ by the server - change if internal MQ port changes (or use external port if MQ is not on the same machine) + MQ_PORT: "8883" # the reachable port of MQ - change if external MQ port changes (port on proxy, not necessarily the one exposed in docker-compose) + MQ_ADMIN_PASSWORD: "{{ netmaker.mq_admin_password }}" + + HOST_NETWORK: "off" # whether or not host networking is turned on. Only turn on if configured for host networking (see docker-compose.hostnetwork.yml). Will set host-level settings like iptables. + PORT_FORWARD_SERVICES: "" # decide which services to port forward ("dns","ssh", or "mq") + + # this section is for OAuth + AUTH_PROVIDER: "" # "" + CLIENT_ID: "" # "" + CLIENT_SECRET: "" # "" + FRONTEND_URL: "" # "https://dashboard." + AZURE_TENANT: "" # "" + OIDC_ISSUER: "" # https://oidc.yourprovider.com - URL of oidc provider + + VERBOSITY: "1" # logging verbosity level - 1, 2, or 3 + TELEMETRY: "off" # Whether or not to send telemetry data to help improve Netmaker. Switch to "off" to opt out of sending telemetry. + ports: + - "51821-51830:51821-51830/udp" # wireguard ports + - "8081:8081" # api port +{# labels: # only for use with traefik proxy (default) + - traefik.enable=true + - traefik.http.routers.netmaker-api.rule=Host(`netmaker-api.{{ netmaker.base_domain }}`) + - traefik.http.services.netmaker-api.loadbalancer.server.port=8081 #} + + netmaker-ui: # The Netmaker UI Component + image: gravitl/netmaker-ui:v0.16.1 + depends_on: + - netmaker + links: + - "netmaker:api" + restart: unless-stopped + environment: + #BACKEND_URL: "http://netmaker-api.{{ netmaker.base_domain }}:8081" # URL where UI will send API requests. Change based on SERVER_HOST, SERVER_HTTP_HOST, and API_PORT + BACKEND_URL: "http://tranio.ruekov.eu:8081" + ports: + - 8082:80 +{# labels: + - traefik.enable=true + - traefik.http.middlewares.nmui-security.headers.accessControlAllowOriginList=netmaker-dashboard.{{ netmaker.base_domain }} + - traefik.http.middlewares.nmui-security.headers.stsSeconds=31536000 + - traefik.http.middlewares.nmui-security.headers.browserXssFilter=true + - traefik.http.middlewares.nmui-security.headers.customFrameOptionsValue=SAMEORIGIN + - traefik.http.middlewares.nmui-security.headers.customResponseHeaders.X-Robots-Tag=none + - traefik.http.middlewares.nmui-security.headers.customResponseHeaders.Server= # Remove the server name + - traefik.http.routers.netmaker-ui.middlewares=nmui-security@docker + - traefik.http.routers.netmaker-ui.rule=Host(`netmaker-dashboard.{{ netmaker.base_domain }}`) + - traefik.http.services.netmaker-ui.loadbalancer.server.port=80 #} + + {# coredns: # The DNS Server. CoreDNS can be removed unless doing special advanced use cases + image: coredns/coredns + command: -conf /root/dnsconfig/Corefile + depends_on: + - netmaker + restart: unless-stopped + volumes: + - ./dnsconfig/:/root/dnsconfig #} + + mosquitto: # the MQTT broker for netmaker + image: eclipse-mosquitto:2.0.11-openssl + restart: unless-stopped + volumes: + - ./mosquitto/config:/mosquitto/config + - ./mosquitto/data:/mosquitto/data + - ./mosquitto/logs:/mosquitto/log + ports: + - "8883:8883" + depends_on: + - netmaker + command: ["/mosquitto/config/wait.sh"] + environment: + NETMAKER_SERVER_HOST: "http://netmaker:8081" +{# labels: + - traefik.enable=true + - traefik.tcp.routers.mqtts.rule=HostSNI(`netmaker-broker.{{ netmaker.base_domain }}`) + - traefik.tcp.routers.mqtts.tls.passthrough=true + - traefik.tcp.services.mqtts-svc.loadbalancer.server.port=8883 #} + + {# traefik: # the default proxy - can be replaced with caddy or nginx, but requires careful configuration + image: traefik:v2.6 + command: + - "--certificatesresolvers.http.acme.email=YOUR_EMAIL" + - "--certificatesresolvers.http.acme.storage=/letsencrypt/acme.json" + - "--certificatesresolvers.http.acme.tlschallenge=true" + - "--entrypoints.websecure.address=:443" + - "--entrypoints.websecure.http.tls=true" + - "--entrypoints.websecure.http.tls.certResolver=http" + - "--log.level=INFO" + - "--providers.docker=true" + - "--providers.docker.exposedByDefault=false" + - "--serverstransport.insecureskipverify=true" + restart: unless-stopped + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + - traefik_certs:/letsencrypt + ports: + - "443:443" #} diff --git a/netmaker_server/templates/rqlite-config.json.template b/netmaker_server/templates/rqlite-config.json.template new file mode 100644 index 0000000..5460bef --- /dev/null +++ b/netmaker_server/templates/rqlite-config.json.template @@ -0,0 +1,5 @@ +[{ + "username": "netmaker", + "password": "{{ netmaker.rqlite_password }}", + "perms": ["all"] +}]