Merge branch 'role_netmaker'

common/handlers/main.yml

@@ -0,0 +1,2 @@
+- name: reload_sysctl
+  command: sysctl --system

common/tasks/aliases.yml

@@ -0,0 +1,20 @@
+- name: General aliases
+  blockinfile:
+      path: "{{ ansible_facts.env.HOME }}/.bashrc"
+      marker: "# {mark} ANSIBLE MANAGED BLOCK | General aliases"
+      block: |
+        alias clr="clear"
+        alias hgrep="history | grep"
+        alias syslog="tail -f --lines=100 /var/log/syslog"
+        alias cp="rsync -hlAXEptgoDS --numeric-ids --info=progress2"
+
+- name: ls aliases and colors
+  blockinfile:
+      path: "{{ ansible_facts.env.HOME }}/.bashrc"
+      marker: "# {mark} ANSIBLE MANAGED BLOCK | ls aliases and colors"
+      block: |
+        export LS_OPTIONS='--color=auto'
+        eval "`dircolors`"
+        alias ls='ls $LS_OPTIONS'
+        alias ll='ls $LS_OPTIONS -l'
+        alias l='ls $LS_OPTIONS -la'

common/tasks/main.yml

@@ -0,0 +1,7 @@
+- import_tasks: ./packages.yml
+
+- import_tasks: ./ssh.yml
+
+- import_tasks: ./packages.yml
+
+- import_tasks: ./aliases.yml

common/tasks/packages.yml

@@ -0,0 +1,20 @@
+- name: Update Packages
+  apt:
+      update_cache: yes
+      upgrade: yes
+  when: ansible_facts.distribution == "Debian"
+
+- name: Install Packages
+  package:
+      name:
+          - gpg
+          - htop
+          - iotop
+          - slurm
+          - sudo
+          - screen
+          - curl
+          - rsync
+          - zstd
+      state: latest
+  when: ansible_facts.distribution == "Debian"

common/tasks/ssh.yml

@@ -0,0 +1,12 @@
+- name: Disable SSH password auth
+  lineinfile:
+      dest: /etc/ssh/sshd_config
+      regexp: '^PasswordAuthentication\s*yes'
+      line: "PasswordAuthentication no"
+  register: sshd_config
+
+- name: Restart SSH daemon
+  service:
+      name: sshd
+      state: restarted
+  when: sshd_config.changed

docker/files/docker-compose

@@ -0,0 +1,2 @@
+#!/bin/sh
+docker compose $@

docker/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: restart_docker
+  service:
+      name: "docker"
+      state: restarted

docker/tasks/main.yml

@@ -0,0 +1,40 @@
+#- name: Check if docker is already installed
+#  stat:
+#    path: /usr/bin/docker
+#  register: docker_file
+
+- name: Install Packages
+#  when: docker_file.stat.exists == False
+  package:
+      name:
+          - gpg
+          - gpg-agent
+
+- name: Add docker-key
+  apt_key:
+      url: https://download.docker.com/linux/debian/gpg
+      state: present
+
+- name: Add docker-repository
+  apt_repository:
+      repo: "deb https://download.docker.com/linux/{{ ansible_facts.distribution | lower }} {{ ansible_facts.distribution_release }} stable"
+      state: present
+      filename: docker
+      update_cache: yes
+
+- name: Install docker
+  package:
+      name:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-compose-plugin
+          - pass
+      state: latest
+
+- name: Deploy docker-compose command to new docker compose plugin
+  ansible.builtin.copy:
+    src: docker-compose
+    dest: "/usr/local/bin/docker-compose"
+    mode: preserve
+

netmaker/defauls/netmaker.yml

@@ -0,0 +1,4 @@
+netclient:
+  # Token to join default-network
+  #  leave empty to ignore
+  join_network_token:

netmaker/meta/main.yml

@@ -0,0 +1,3 @@
+---
+  dependencies:
+    - role: docker

netmaker/tasks/certs.yml

@@ -0,0 +1,4 @@
+- name: Deploy CA Certificate
+  ansible.builtin.copy:
+    src: secret_files/netmaker_server/ca/ca.crt
+    dest: /etc/ssl/certs/netmaker-ca.pem

netmaker/tasks/install.yml

@@ -0,0 +1,25 @@
+- name: Install Packages
+#  when: docker_file.stat.exists == False
+  package:
+    name:
+      - gpg
+      - gpg-agent
+
+- name: Add netmaker-key
+  apt_key:
+    url: https://apt.netmaker.org/gpg.key
+    state: present
+
+- name: Add netmaker-repository
+  apt_repository:
+    repo: "deb https:apt.netmaker.org stable main"
+    state: present
+    filename: netmaker
+    update_cache: yes
+
+- name: Install wireguard & netclient
+  package:
+    name:
+      - wireguard
+      - netclient
+    state: latest

netmaker/tasks/join-network.yml

@@ -0,0 +1,5 @@
+- name: Join netmaker-network
+  when: "netclient.join_network_token is defined"
+  command: "netclient join -t {{ netclient.join_network_token }}"
+  failed_when: command.rc != 0
+  register: command

netmaker/tasks/main.yml

@@ -0,0 +1,5 @@
+- import_tasks: ./certs.yml
+
+- import_tasks: ./install.yml
+
+- import_tasks: ./join-network.yml

netmaker_server/defaults/credentials.yml

@@ -0,0 +1,5 @@
+netmaker_creds:
+  rqlite_password: 
+  mq_admin_password: 
+
+  master_key: 

netmaker_server/defaults/main.yml

@@ -0,0 +1,28 @@
+# Overwrite for specific nodes to force dynamic-ip (disable setting public-ip and forces external lookup for public-ip)
+#  When false, will check itself for dynamic-ip (based on private-ip)
+netmaker_dynamicIp: false
+
+netmaker_nginx:
+  # Listen-port
+  tls_port:       51820
+  # Advertise-Port for services
+  #  (must also be reachable by internal services!)
+  advertise_port: 51820
+
+# This is the base-domain used for generating hostnames for services
+netmaker_base_domain: 
+
+# host + base_domain
+netmaker_api:
+  host: netmaker-api
+netmaker_ui:
+  host: netmaker-ui
+# MQTT-broker
+netmaker_broker:
+  tls_host:     netmaker-broker
+
+# host + node_hostname
+netmaker_rqlite:
+  http_host:    netmaker-rqlite-http
+  cluster_host: netmaker-rqlite-cluster
+    

netmaker_server/files/opt/netmaker_server/docs/architecture.puml

@@ -0,0 +1,37 @@
+@startuml
+
+interface ng_TLS
+
+component netmaker_server {
+  component nginx {
+    component ng_stream
+    component ng_http
+
+    ng_stream -up- ng_TLS 
+
+    ng_stream -right-> ng_http : tls-termination
+  }
+
+  component nm_ui
+  nm_ui -up- nm_ui_http
+  ng_http -down-( nm_ui_http
+
+  component Mosquitto
+  Mosquitto -up- mq_plain
+  Mosquitto -up- mq_tls
+  ng_stream -down-( mq_tls
+
+  component rqlite
+  rqlite -up- rq_http
+  rqlite -up- rq_cluster
+  ng_stream -down-( rq_cluster
+  ng_http -down-( rq_http
+
+  component nm_api
+  nm_api -down- nm_api_http
+  ng_http --( nm_api_http
+  nm_api -up-( ng_TLS : db-connection to rqlite-master
+  nm_api --( mq_plain
+}
+
+@enduml

netmaker_server/files/opt/netmaker_server/mosquitto/config/mosquitto.conf

@@ -0,0 +1,12 @@
+per_listener_settings false
+
+listener 8883
+allow_anonymous false
+certfile /certs/node.crt
+keyfile /certs/node.key
+
+listener 1883
+allow_anonymous false
+
+plugin /usr/lib/mosquitto_dynamic_security.so
+plugin_opt_config_file /mosquitto/data/dynamic-security.json

netmaker_server/files/opt/netmaker_server/mosquitto/config/wait.sh

@@ -0,0 +1,23 @@
+#!/bin/ash
+
+wait_for_netmaker() {
+  echo "SERVER: ${NETMAKER_SERVER_HOST}"
+  until curl --output /dev/null --silent --fail --head \
+    --location "${NETMAKER_SERVER_HOST}/api/server/health"; do
+    echo "Waiting for netmaker server to startup"
+    sleep 1
+  done
+}
+
+main(){
+ # wait for netmaker to startup
+ apk add curl
+ wait_for_netmaker
+ echo "Starting MQ..."
+ # Run the main container command.
+ /docker-entrypoint.sh
+ /usr/sbin/mosquitto -c /mosquitto/config/mosquitto.conf
+
+}
+
+main "${@}"

netmaker_server/files/opt/netmaker_server/nginx/nginx.conf

@@ -0,0 +1,33 @@
+
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    include /etc/nginx/conf.d/*.conf;
+}
+include /etc/nginx/stream.d/*.conf;

netmaker_server/meta/main.yml

@@ -0,0 +1,3 @@
+---
+#  dependencies:
+#    - role: docker

netmaker_server/tasks/certs.yml

@@ -0,0 +1,40 @@
+- name: Generate PrivateKey
+  community.crypto.openssl_privatekey:
+    path: /opt/netmaker_server/certs/node.key
+    owner: 1883   #  Set owner to mosquitto-user (all other containers seem to run as root)
+
+- name: Generate Certificate-Signing-Request from privateKey
+  community.crypto.openssl_csr:
+    path: /opt/netmaker_server/certs/node.csr
+    privatekey_path: /opt/netmaker_server/certs/node.key
+    common_name: "{{ ansible_facts.nodename }}"
+    subject_alt_name: 
+     "DNS:{{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }},\
+      DNS:{{ netmaker_rqlite.cluster_host }}.{{ ansible_facts.nodename }},\
+      DNS:{{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }},\
+      DNS:{{ netmaker_api.host }}.{{ netmaker_base_domain }},\
+      DNS:{{ netmaker_ui.host }}.{{ netmaker_base_domain }}"
+
+- name: Fetch CSR
+  ansible.builtin.fetch:
+    src: /opt/netmaker_server/certs/node.csr
+    dest: tmp_files/
+
+- name: Sign CSR locally with CA
+  local_action: community.crypto.x509_certificate
+  args:
+    path: tmp_files/{{ inventory_hostname }}/opt/netmaker_server/certs/node.crt
+    csr_path: tmp_files/{{ inventory_hostname }}/opt/netmaker_server/certs/node.csr
+    ownca_path: secret_files/netmaker_server/ca/ca.crt
+    ownca_privatekey_path: secret_files/netmaker_server/ca/ca.key
+    provider: ownca
+  
+- name: Copy Signed Certificate
+  ansible.builtin.copy:
+    src: tmp_files/{{ inventory_hostname }}/opt/netmaker_server/certs/node.crt
+    dest: /opt/netmaker_server/certs/node.crt
+
+- name: Copy CA Certificate
+  ansible.builtin.copy:
+    src: secret_files/netmaker_server/ca/ca.crt
+    dest: /opt/netmaker_server/certs/ca.crt

netmaker_server/tasks/main.yml

@@ -0,0 +1,20 @@
+- import_tasks: ./prerequisites.yml
+
+- name: Copy folder-structure
+  ansible.builtin.copy:
+    src: opt/netmaker_server
+    dest: /opt/
+    mode: preserve
+
+- name: Deploy compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.template
+    dest: /opt/netmaker_server/docker-compose.yml
+
+- import_tasks: ./certs.yml
+
+- import_tasks: ./nginx.yml
+
+- import_tasks: ./rqlite.yml
+
+- import_tasks: ./netmaker.yml

netmaker_server/tasks/netmaker.yml

@@ -0,0 +1,57 @@
+- name: Start rest of netmaker-services
+  command: "docker-compose --project-directory /opt/netmaker_server/ up -d"
+  register: command
+  failed_when: command.rc != 0
+
+- name: Wait for netmaker-api to become available
+  uri:
+    url: 'https://{{ netmaker_api.host }}.{{ netmaker_base_domain }}:{{ netmaker_nginx.advertise_port }}'
+    return_content: yes
+    validate_certs: no
+    status_code:
+      - 404
+  until: uri_output.status == 404
+  retries: 24 # Retries for 24 * 5 seconds = 120 seconds = 2 minutes
+  delay: 5 # Every 5 seconds
+  register: uri_output
+
+# todo: check if exists?
+
+- name: Create default mesh-network 'server'
+  uri:
+    validate_certs: no
+    url: 'https://{{ netmaker_api.host }}.{{ netmaker_base_domain }}:{{ netmaker_nginx.advertise_port }}/api/networks'
+    method: POST
+    body:
+      netid: servnet
+      addressrange: 10.92.0.0/24
+      addressrange6: fd92::/64
+    body_format: json
+    headers:
+      Authorization: 'Bearer {{ netmaker_creds.master_key }}'
+      Content-Type: application/json
+  when: "inventory_hostname == groups['netmaker'][0]"
+  register: default_mesh
+  until: "default_mesh is not failed"
+  retries: 2
+  delay: 10
+
+# todo: check if exists?
+
+- name: Create token for default-network
+  uri:
+    validate_certs: no
+    url: 'https://{{ netmaker_api.host }}.{{ netmaker_base_domain }}:{{ netmaker_nginx.advertise_port }}/api/networks/servnet/keys' # todo: do implementation
+    method: POST
+    body:
+      name: ""
+      uses: 0
+    body_format: json
+    headers:
+      Authorization: 'Bearer {{ netmaker_creds.master_key }}'
+      Content-Type: application/json
+  when: "inventory_hostname == groups['netmaker'][0]"
+  register: default_mesh_key
+  until: "default_mesh_key is not failed"
+  retries: 2
+  delay: 10

netmaker_server/tasks/nginx.yml

@@ -0,0 +1,18 @@
+- name: Deploy nginx configs
+  template:
+    src: "{{item.src}}"
+    dest: "{{item.dst}}"
+  loop:
+    - { src: 'nginx/proxy.conf.template',       dst: '/opt/netmaker_server/nginx/conf/conf.d/proxy.conf' }
+    - { src: 'nginx/passthrough.conf.template', dst: '/opt/netmaker_server/nginx/conf/stream.d/passthrough.conf' }
+
+- name: Start nginx service
+  command: "docker-compose --project-directory /opt/netmaker_server/ up -d nginx"
+  register: command
+  failed_when: command.rc != 0
+
+- name: Waiting for nginx to accept connections
+  ansible.builtin.wait_for:
+    host: "{{ inventory_hostname }}"
+    port: 51820
+    state: started

netmaker_server/tasks/prerequisites.yml

@@ -0,0 +1,9 @@
+- name: Install wireguard
+  package:
+    name:
+      - wireguard
+    state: latest
+
+- name: Check if default-ipv4-address is private
+  set_fact:
+    private_ipv4_address: "{{ ansible_facts.default_ipv4.address | regex_search('^((10)|(192\\.168)|(172\\.((1[6-9])|(2[0-9])|(3[0-1])))|(100))\\.') }}"

netmaker_server/tasks/rqlite.yml

@@ -0,0 +1,42 @@
+- name: Deploy rqlite config
+  ansible.builtin.template:
+    src: rqlite-config.json.template
+    dest: /opt/netmaker_server/rqlite/config.json
+
+- name: Start rqlite service for 1st-node
+  command: "docker-compose --project-directory /opt/netmaker_server/ up -d rqlite"
+  register: command
+  failed_when: command.rc != 0
+  when: "inventory_hostname == groups['netmaker_server'][0]"
+
+- name: Waiting for rqlite to accept connections on 1st-node
+  uri:
+    url: 'https://{{ netmaker_rqlite.http_host }}.{{ inventory_hostname }}:{{ netmaker_nginx.advertise_port }}/status'
+    return_content: yes
+    validate_certs: no
+    status_code:
+      - 401
+  until: uri_output.status == 401
+  retries: 24 # Retries for 24 * 5 seconds = 120 seconds = 2 minutes
+  delay: 5 # Every 5 seconds
+  register: uri_output
+  when: "inventory_hostname == groups['netmaker_server'][0]"
+
+- name: Start rqlite service for other nodes
+  command: "docker-compose --project-directory /opt/netmaker_server/ up -d rqlite"
+  register: command
+  failed_when: command.rc != 0
+  when: "inventory_hostname != groups['netmaker_server'][0]"
+
+- name: Waiting for rqlite to accept connections on other nodes
+  uri:
+    url: 'https://{{ netmaker_rqlite.http_host }}.{{ inventory_hostname }}:{{ netmaker_nginx.advertise_port }}/status'
+    return_content: yes
+    validate_certs: no
+    status_code:
+      - 401
+  until: uri_output.status == 401
+  retries: 24 # Retries for 24 * 5 seconds = 120 seconds = 2 minutes
+  delay: 5 # Every 5 seconds
+  register: uri_output
+  when: "inventory_hostname != groups['netmaker_server'][0]"

netmaker_server/templates/docker-compose.yml.template

@@ -0,0 +1,128 @@
+version: "3.4"
+
+services:
+  nginx:
+    image: nginx
+    restart: unless-stopped
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro # Override nginx-config to add stream-import
+      - ./nginx/conf/conf.d/:/etc/nginx/conf.d:ro  # conf.d
+      - ./nginx/conf/stream.d/:/etc/nginx/stream.d:ro  # conf.d
+      - ./certs:/certs:ro # SSL-certificates
+    ports:
+      - {{ netmaker_nginx.tls_port }}:443
+
+  rqlite: # Distributed sqlite-db
+    image: rqlite/rqlite
+    restart: unless-stopped
+    hostname: "{{ ansible_facts.nodename }}"
+    volumes:
+      - "./rqlite/data:/rqlite/file"
+      - "./rqlite/config.json:/config.json:ro"
+      - "./certs:/certs:ro"
+      - ./certs/ca.crt:/etc/ssl/certs/netmaker-ca.pem:ro  # Add CA to system-trust-store
+    command: "
+    -http-adv-addr {{  netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}:{{ netmaker_nginx.advertise_port }}
+    -raft-addr     [::]:4002
+    -raft-adv-addr {{  netmaker_rqlite.cluster_host }}.{{ ansible_facts.nodename }}:{{ netmaker_nginx.advertise_port }}
+
+    -node-encrypt
+    -node-cert    /certs/node.crt
+    -node-key     /certs/node.key
+    -node-no-verify
+
+    -auth         /config.json
+
+{% if inventory_hostname != groups['netmaker'][0] %}
+    -join-as  netmaker
+    -join     https://{{  netmaker_rqlite.http_host }}.{{ groups['netmaker'][0] }}:{{ netmaker_nginx.advertise_port }}
+{% endif %}
+    "
+    # FIXME: /\ \/ Change http -> https
+
+  netmaker: # The Primary Server for running Netmaker
+    image: gravitl/netmaker:v0.16.1
+    depends_on:
+      - rqlite
+    cap_add: 
+      - NET_ADMIN
+      - NET_RAW
+      - SYS_MODULE
+    sysctls:
+      - net.ipv4.ip_forward=1
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv6.conf.all.disable_ipv6=0
+      - net.ipv6.conf.all.forwarding=1
+    restart: unless-stopped
+    volumes: # Volume mounts necessary for sql, coredns, and mqtt
+      - ./dnsconfig/:/root/config/dnsconfig
+      - ./mosquitto/data/:/etc/netmaker/
+      - ./certs/ca.crt:/etc/ssl/certs/netmaker-ca.pem:ro  # Add CA to system-trust-store
+    hostname: "{{ ansible_facts.nodename }}"
+    environment: # Necessary capabilities to set iptables when running in container
+      NODE_ID: "{{ ansible_facts.nodename }}"
+      MASTER_KEY: "{{ netmaker_creds.master_key }}" # The admin master key for accessing the API. Change this in any production installation.
+
+{% if not private_ipv4_address and not netmaker_dynamicIp %}
+      SERVER_HOST: "{{ ansible_facts.default_ipv4.address }}" # Set to public IP of machine.
+{% endif %}
+      SERVER_NAME: "{{  netmaker_broker.tls_host }}.{{ netmaker_base_domain }}" # The domain/host IP indicating the mq broker address
+      SERVER_HTTP_HOST: "{{  netmaker_api.host }}.{{ netmaker_base_domain }}" # Overrides SERVER_HOST if set. Useful for making HTTP available via different interfaces/networks.
+      SERVER_API_CONN_STRING: "{{  netmaker_api.host }}.{{ netmaker_base_domain }}:{{ netmaker_nginx.advertise_port }}"
+
+      DISABLE_REMOTE_IP_CHECK: "off" # If turned "on", Server will not set Host based on remote IP check. This is already overridden if SERVER_HOST is set. Turned "off" by default.
+      DNS_MODE: "off" # Enables DNS Mode, meaning all nodes will set hosts file for private dns settings.
+
+      API_PORT: "8081" # The HTTP API port for Netmaker. Used for API calls / communication from front end. If changed, need to change port of BACKEND_URL for netmaker-ui.
+      REST_BACKEND: "on" # Enables the REST backend (API running on API_PORT at SERVER_HTTP_HOST). Change to "off" to turn off.
+      RCE: "off" # Enables setting PostUp and PostDown (arbitrary commands) on nodes from the server. Off by default.
+      CORS_ALLOWED_ORIGIN: "*" # The "allowed origin" for API requests. Change to restrict where API requests can come from.
+      DISPLAY_KEYS: "on" # Show keys permanently in UI (until deleted) as opposed to 1-time display.
+      
+      DATABASE: "rqlite"
+      SQL_CONN: "https://netmaker:{{ netmaker_creds.rqlite_password }}@{{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}:{{ netmaker_nginx.advertise_port }}/"
+
+      MQ_HOST: "mosquitto"    # the address of the mq server. If running from docker compose it will be "mq". Otherwise, need to input address. If using "host networking", it will find and detect the IP of the mq container.
+      MQ_SERVER_PORT: "1883"  # the reachable port of MQ by the server - change if internal MQ port changes (or use external port if MQ is not on the same machine)
+      MQ_PORT: "{{ netmaker_nginx.advertise_port }}" # the reachable port of MQ - change if external MQ port changes (port on proxy, not necessarily the one exposed in docker-compose)
+      MQ_ADMIN_PASSWORD: "{{ netmaker_creds.mq_admin_password }}"
+      
+      HOST_NETWORK: "off" # whether or not host networking is turned on. Only turn on if configured for host networking (see docker-compose.hostnetwork.yml). Will set host-level settings like iptables.
+      PORT_FORWARD_SERVICES: "" # decide which services to port forward ("dns","ssh", or "mq")
+
+      # this section is for OAuth
+      AUTH_PROVIDER: ""   # "<azure-ad|github|google|oidc>"
+      CLIENT_ID: ""       # "<client id of your oauth provider>"
+      CLIENT_SECRET: ""   # "<client secret of your oauth provider>"
+      FRONTEND_URL: ""    # "https://dashboard.<netmaker base domain>"
+      AZURE_TENANT: ""    # "<only for azure, you may optionally specify the tenant for the OAuth>"
+      OIDC_ISSUER: ""     # https://oidc.yourprovider.com - URL of oidc provider
+      
+      VERBOSITY: "1" # logging verbosity level - 1, 2, or 3
+      TELEMETRY: "off" # Whether or not to send telemetry data to help improve Netmaker. Switch to "off" to opt out of sending telemetry.
+    ports:
+      - "51821-51830:51821-51830/udp" # wireguard ports
+
+  netmaker-ui:  # The Netmaker UI Component
+    image: gravitl/netmaker-ui:v0.16.1
+    depends_on:
+      - netmaker
+    links:
+      - "netmaker:api"
+    restart: unless-stopped
+    environment:
+      BACKEND_URL: "https://{{ netmaker_api.host }}.{{ netmaker_base_domain }}:{{ netmaker_nginx.advertise_port }}" # URL where UI will send API requests. Change based on SERVER_HOST, SERVER_HTTP_HOST, and API_PORT
+
+  mosquitto: # the MQTT broker for netmaker
+    image: eclipse-mosquitto:2.0.11-openssl
+    restart: unless-stopped
+    volumes:
+      - ./mosquitto/config:/mosquitto/config
+      - ./mosquitto/data:/mosquitto/data
+      - ./mosquitto/logs:/mosquitto/log
+      - "./certs:/certs:ro"
+    depends_on:
+      - netmaker
+    command: ["/mosquitto/config/wait.sh"]
+    environment:
+      NETMAKER_SERVER_HOST: "http://netmaker:8081"

netmaker_server/templates/nginx/passthrough.conf.template

@@ -0,0 +1,25 @@
+stream{
+    # Map target-hosts based on hostname
+    map $ssl_preread_server_name $target_host {
+        hostnames;  # Enable matching including prefix/suffix-mask
+
+        {{ netmaker_ui.host }}.{{ netmaker_base_domain }}   127.0.0.1:8443;
+        {{ netmaker_api.host }}.{{ netmaker_base_domain }}  127.0.0.1:8443;
+
+        {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}   mosquitto:8883; # todo: tls-terminate?
+
+        {{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}    127.0.0.1:8443;
+        {{ netmaker_rqlite.cluster_host }}.{{ ansible_facts.nodename }}   rqlite:4002;
+
+        default         127.0.0.1:1;
+    }
+
+    server {
+        resolver 127.0.0.11; # Explicitly set docker-resolver
+        
+        listen      443;
+        ssl_preread on;
+
+        proxy_pass  $target_host;
+    }
+}

netmaker_server/templates/nginx/proxy.conf.template

@@ -0,0 +1,27 @@
+map $host    $proxy_name {
+    hostnames;
+    
+    {{ netmaker_ui.host }}.{{ netmaker_base_domain }}               netmaker-ui:80;
+    {{ netmaker_api.host }}.{{ netmaker_base_domain }}              netmaker:8081;
+    
+    {{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}    rqlite:4001;
+
+    default         444;
+}
+
+server {
+    resolver 127.0.0.11; # Explicitly set docker-resolver
+
+    listen 8443 ssl;
+
+    ssl_certificate /certs/node.crt;
+    ssl_certificate_key /certs/node.key;
+
+    if ($proxy_name = 444){
+        return 444;
+    }
+
+    location / {
+        proxy_pass http://$proxy_name;
+    }
+}

netmaker_server/templates/rqlite-config.json.template

@@ -0,0 +1,5 @@
+[{
+    "username": "netmaker",
+    "password": "{{ netmaker_creds.rqlite_password }}",
+    "perms": ["all"]
+}]

zsh/files/.zshrc

@@ -0,0 +1,105 @@
+# If you come from bash you might have to change your $PATH.
+# export PATH=$HOME/bin:/usr/local/bin:$PATH
+
+# Path to your oh-my-zsh installation.
+export ZSH="$HOME/.oh-my-zsh"
+
+# Set name of the theme to load --- if set to "random", it will
+# load a random theme each time oh-my-zsh is loaded, in which case,
+# to know which specific one was loaded, run: echo $RANDOM_THEME
+# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
+ZSH_THEME="agnoster"
+
+# Set list of themes to pick from when loading at random
+# Setting this variable when ZSH_THEME=random will cause zsh to load
+# a theme from this variable instead of looking in $ZSH/themes/
+# If set to an empty array, this variable will have no effect.
+# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
+
+# Uncomment the following line to use case-sensitive completion.
+# CASE_SENSITIVE="true"
+
+# Uncomment the following line to use hyphen-insensitive completion.
+# Case-sensitive completion must be off. _ and - will be interchangeable.
+# HYPHEN_INSENSITIVE="true"
+
+# Uncomment one of the following lines to change the auto-update behavior
+# zstyle ':omz:update' mode disabled  # disable automatic updates
+# zstyle ':omz:update' mode auto      # update automatically without asking
+# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
+
+# Uncomment the following line to change how often to auto-update (in days).
+# zstyle ':omz:update' frequency 13
+
+# Uncomment the following line if pasting URLs and other text is messed up.
+# DISABLE_MAGIC_FUNCTIONS="true"
+
+# Uncomment the following line to disable colors in ls.
+# DISABLE_LS_COLORS="true"
+
+# Uncomment the following line to disable auto-setting terminal title.
+# DISABLE_AUTO_TITLE="true"
+
+# Uncomment the following line to enable command auto-correction.
+# ENABLE_CORRECTION="true"
+
+# Uncomment the following line to display red dots whilst waiting for completion.
+# You can also set it to another string to have that shown instead of the default red dots.
+# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
+# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
+# COMPLETION_WAITING_DOTS="true"
+
+# Uncomment the following line if you want to disable marking untracked files
+# under VCS as dirty. This makes repository status check for large repositories
+# much, much faster.
+# DISABLE_UNTRACKED_FILES_DIRTY="true"
+
+# Uncomment the following line if you want to change the command execution time
+# stamp shown in the history command output.
+# You can set one of the optional three formats:
+# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
+# or set a custom format using the strftime function format specifications,
+# see 'man strftime' for details.
+# HIST_STAMPS="mm/dd/yyyy"
+
+# Would you like to use another custom folder than $ZSH/custom?
+# ZSH_CUSTOM=/path/to/new-custom-folder
+
+# Which plugins would you like to load?
+# Standard plugins can be found in $ZSH/plugins/
+# Custom plugins may be added to $ZSH_CUSTOM/plugins/
+# Example format: plugins=(rails git textmate ruby lighthouse)
+# Add wisely, as too many plugins slow down shell startup.
+plugins=(
+    git
+    zsh-autosuggestions
+    fast-syntax-highlighting
+)
+
+source $ZSH/oh-my-zsh.sh
+
+# User configuration
+
+# export MANPATH="/usr/local/man:$MANPATH"
+
+# You may need to manually set your language environment
+# export LANG=en_US.UTF-8
+
+# Preferred editor for local and remote sessions
+# if [[ -n $SSH_CONNECTION ]]; then
+#   export EDITOR='vim'
+# else
+#   export EDITOR='mvim'
+# fi
+
+# Compilation flags
+# export ARCHFLAGS="-arch x86_64"
+
+# Set personal aliases, overriding those provided by oh-my-zsh libs,
+# plugins, and themes. Aliases can be placed here, though oh-my-zsh
+# users are encouraged to define aliases within the ZSH_CUSTOM folder.
+# For a full list of active aliases, run `alias`.
+#
+# Example aliases
+# alias zshconfig="mate ~/.zshrc"
+# alias ohmyzsh="mate ~/.oh-my-zsh"

zsh/tasks/main.yml

@@ -0,0 +1,44 @@
+- name: Check if user is not root
+  meta: end_play
+  when: ansible_facts.user_id == "root"
+
+- name: Install zsh
+  package:
+    name:
+      - zsh
+    state: latest
+  become: yes
+
+- name: Setup Oh-my-zsh using yay/pacman
+  community.general.pacman:
+    name: 
+      - oh-my-zsh
+      - oh-my-zsh-plugin-autosuggestions
+      - fast-syntax-highlighting
+    state: latest
+    executable: yay
+  when: ansible_facts.distribution == "Archlinux"
+  become: yes
+
+- name: Setup Oh-my-zsh using sh
+  command: 'sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"'
+  when: ansible_facts.distribution != "Archlinux"
+  become: yes
+
+- name: Symlink custom-plugins
+  file:
+    src: "/usr/share/zsh/plugins/fast-syntax-highlighting"
+    dest: "/usr/share/oh-my-zsh/custom/plugins/"
+    state: link
+
+
+- name: Deploy user-config-file
+  ansible.builtin.copy:
+    src: .zshrc
+    dest: "{{ ansible_facts.env.HOME }}/"
+
+- name: Symlink oh-my-zsh user-settings folder from shared
+  file:
+    src: "/usr/share/oh-my-zsh/"
+    dest: "{{ ansible_facts.env.HOME }}/.oh-my-zsh"
+    state: link