feat: Working minimal, reproducible infrastructure.
commit
b470f36da0
GPG Key ID:
AD901CB0F3701434
|
|
@ -0,0 +1,35 @@
|
||||||
|
|
||||||
|
# You may want to customise this file depending on your Operating System
|
||||||
|
# and the editor that you use.
|
||||||
|
#
|
||||||
|
# We recommend that you use a Global Gitignore for files that are not related
|
||||||
|
# to the project. (https://help.github.com/articles/ignoring-files/#create-a-global-gitignore)
|
||||||
|
|
||||||
|
# OS
|
||||||
|
#
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/macOS.gitignore
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/Windows.gitignore
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/Linux.gitignore
|
||||||
|
.DS_STORE
|
||||||
|
Thumbs.db
|
||||||
|
|
||||||
|
# Editors
|
||||||
|
#
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/JetBrains.gitignore
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/VisualStudioCode.gitignore
|
||||||
|
.idea
|
||||||
|
.chrome
|
||||||
|
/*.log
|
||||||
|
.vscode/*
|
||||||
|
!.vscode/settings.json
|
||||||
|
!.vscode/tasks.json
|
||||||
|
!.vscode/launch.json
|
||||||
|
!.vscode/extensions.json
|
||||||
|
|
||||||
|
# Python
|
||||||
|
**/__pycache__
|
||||||
|
.venv
|
||||||
|
|
||||||
|
# Local Developer Notes
|
||||||
|
dev
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# EditorConfig is awesome: https://EditorConfig.org
|
||||||
|
root = true
|
||||||
|
|
||||||
|
# Unix-style newlines with a newline ending every file
|
||||||
|
[*]
|
||||||
|
end_of_line = lf
|
||||||
|
insert_final_newline = true
|
||||||
|
|
||||||
|
# Python
|
||||||
|
[*.py]
|
||||||
|
indent_style = tab
|
||||||
|
indent_size = 2
|
||||||
|
|
||||||
|
# Python
|
||||||
|
[*.toml]
|
||||||
|
indent_style = tab
|
||||||
|
indent_size = 2
|
||||||
|
|
||||||
|
# YML
|
||||||
|
[*.(yml|yaml)]
|
||||||
|
indent_style = space
|
||||||
|
indent_size = 2
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
|
||||||
|
# You may want to customise this file depending on your Operating System
|
||||||
|
# and the editor that you use.
|
||||||
|
#
|
||||||
|
# We recommend that you use a Global Gitignore for files that are not related
|
||||||
|
# to the project. (https://help.github.com/articles/ignoring-files/#create-a-global-gitignore)
|
||||||
|
|
||||||
|
# OS
|
||||||
|
#
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/macOS.gitignore
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/Windows.gitignore
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/Linux.gitignore
|
||||||
|
.DS_STORE
|
||||||
|
Thumbs.db
|
||||||
|
|
||||||
|
# Editors
|
||||||
|
#
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/JetBrains.gitignore
|
||||||
|
# Ref: https://github.com/github/gitignore/blob/master/Global/VisualStudioCode.gitignore
|
||||||
|
.idea
|
||||||
|
.chrome
|
||||||
|
/*.log
|
||||||
|
.vscode/*
|
||||||
|
!.vscode/settings.json
|
||||||
|
!.vscode/tasks.json
|
||||||
|
!.vscode/launch.json
|
||||||
|
!.vscode/extensions.json
|
||||||
|
**/neovide_backtraces.log
|
||||||
|
|
||||||
|
# Python
|
||||||
|
__pycache__/
|
||||||
|
*.py[cod]
|
||||||
|
*$py.class
|
||||||
|
.venv
|
||||||
|
.cache-trivy/
|
||||||
|
.hypothesis/
|
||||||
|
|
||||||
|
# Local Developer Notes
|
||||||
|
dev
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
repos:
|
||||||
|
- repo: https://github.com/compilerla/conventional-pre-commit
|
||||||
|
rev: v2.3.0
|
||||||
|
hooks:
|
||||||
|
- id: conventional-pre-commit
|
||||||
|
stages: [commit-msg]
|
||||||
|
args: [feat, fix, ci, chore] # list of Conventional Commits types to allow
|
||||||
|
|
@ -0,0 +1,67 @@
|
||||||
|
# Prerequisites
|
||||||
|
|
||||||
|
## Wireguard Key Generation
|
||||||
|
*TODO: Automate?*
|
||||||
|
|
||||||
|
Generate wg keys for all hosts:
|
||||||
|
```bash
|
||||||
|
wg genkey
|
||||||
|
pass insert path/to/private
|
||||||
|
pass /path/to/private | wg pubkey
|
||||||
|
pass insert /path/to/public
|
||||||
|
```
|
||||||
|
|
||||||
|
Save each in `password-store` under `<host>_<private|public>_key`.
|
||||||
|
|
||||||
|
Then, generate a "Pre-Shared Key" for each Peer-Peer:
|
||||||
|
```
|
||||||
|
wg genpsk > psk_peer_peer
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Persistence
|
||||||
|
This deployment has the following requirements in terms of persistence:
|
||||||
|
|
||||||
|
## auth
|
||||||
|
`authentik-postgres`:
|
||||||
|
1. **Low-Latency FS**: Storage for `postgres` database.
|
||||||
|
2. **FS**: Storage for `postgres` backups.
|
||||||
|
|
||||||
|
`authentik-redis`:
|
||||||
|
1. **FS** (*non-critical*): Storage for RDB + AOF Redis persistence.
|
||||||
|
|
||||||
|
## chat
|
||||||
|
`zulip-postgres`
|
||||||
|
1. **Low-Latency**: Storage for `postgres` database.
|
||||||
|
2. **FS**: Storage for `postgres` backups.
|
||||||
|
|
||||||
|
`zulip-redis`:
|
||||||
|
1. **FS** (*non-critical*): Storage for RDB + AOF Redis persistence.
|
||||||
|
|
||||||
|
`zulip`:
|
||||||
|
1. **FS/S3**: Storage for file uploads.
|
||||||
|
|
||||||
|
## git
|
||||||
|
`gitea`:
|
||||||
|
1. **FS/S3**: Attachments, lfs, avatars, repo-avatars, repo-archive, packages, actions_log, actions_artifact
|
||||||
|
2. **FS**: Repository Storage.
|
||||||
|
3. **Low-Latency FS**: Postgres Storage.
|
||||||
|
4. **Low-Latency FS**: Indexer (mellisearch) storage.
|
||||||
|
5. **FS**: Storage for `SQLite` backups.
|
||||||
|
|
||||||
|
`gitea-redis`:
|
||||||
|
1. **FS** (*non-critical*): Storage for RDB + AOF Redis persistence.
|
||||||
|
|
||||||
|
## mesh
|
||||||
|
`traefik`:
|
||||||
|
1. **FS** (*sensitive*): Storage for SSL Certificates.
|
||||||
|
|
||||||
|
## updater
|
||||||
|
`diun`:
|
||||||
|
1. **Low-Latency FS** (*non-critical*): Cache for Previous Image Updates.
|
||||||
|
|
||||||
|
## uptime
|
||||||
|
`uptime-kuma`:
|
||||||
|
1. **Low-Latency FS**: Storage for SQLite DB.
|
||||||
|
- **NOTE: We might be able to remove this by configuring it on startup.**
|
||||||
|
|
@ -0,0 +1,60 @@
|
||||||
|
# Complete Infrastructure for DTU Python Support
|
||||||
|
**Very heavily WIP**
|
||||||
|
|
||||||
|
This project describes and implements the complete infrastructure for DTUs Python Support group.
|
||||||
|
|
||||||
|
The repository provides the following user-facing services:
|
||||||
|
- timesigned.com: Modern, multilingual guide to using Python at DTU.
|
||||||
|
- SSG with [mdbook](https://rust-lang.github.io/mdBook/) w/plugins.
|
||||||
|
|
||||||
|
- chat.timesigned.com: Modern asynchronous communication and support channel for everybody using Python at DTU.
|
||||||
|
- Instance of [Zulip](https://zulip.com/).
|
||||||
|
|
||||||
|
- git.timesigned.com: Lightweight collaborative development for teams
|
||||||
|
- Instance of [Forgejo](https://forgejo.org/), itself a soft-fork of [Gitea](https://about.gitea.com/)
|
||||||
|
|
||||||
|
- auth.timesigned.com: Identity Provider allowing seamless, secure access to key services with their DTU Account.
|
||||||
|
- Instance of [Authentik](https://goauthentik.io/).
|
||||||
|
|
||||||
|
- uptime.timesigned.com: Black-box monitoring with notifications
|
||||||
|
- Instance of [Authentik](https://goauthentik.io/).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# References
|
||||||
|
|
||||||
|
## Wireguard / systemd-networkd
|
||||||
|
- `systemd-networkd` Network: <https://www.freedesktop.org/software/systemd/man/systemd.network.html>
|
||||||
|
- `systemd-networkd` NetDev: <https://man.archlinux.org/man/systemd.netdev.5>
|
||||||
|
- Setup Inspiration: <https://elou.world/en/tutorial/wireguard>
|
||||||
|
- Wireguard w/`systemd-networkd`: <https://wiki.archlinux.org/title/WireGuard#systemd-networkd>
|
||||||
|
- Network Test w/`iperf`: <https://www.redhat.com/sysadmin/network-testing-iperf3>
|
||||||
|
|
||||||
|
## Ansible
|
||||||
|
- DigitalOcean `droplet`: <https://docs.ansible.com/ansible/latest/collections/community/digitalocean/digital_ocean_droplet_module.html>
|
||||||
|
- CloudFlare `dns`: <https://docs.ansible.com/ansible/latest/collections/community/general/cloudflare_dns_module.html>
|
||||||
|
- `template`: <https://docs.ansible.com/ansible/latest/collections/ansible/builtin/template_module.html>
|
||||||
|
- `password-store`: <https://docs.ansible.com/ansible/latest/collections/community/general/passwordstore_lookup.html>
|
||||||
|
- `set-fact`: <https://docs.ansible.com/ansible/latest/collections/ansible/builtin/set_fact_module.html>
|
||||||
|
- `file`: <https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html>
|
||||||
|
|
||||||
|
### Docker Ansible
|
||||||
|
- Index: <https://docs.ansible.com/ansible/latest/collections/community/docker/index.html>
|
||||||
|
- Docker `swarm` Module: <https://docs.ansible.com/ansible/latest/collections/community/docker/docker_swarm_module.html>
|
||||||
|
- Docker `network` Module: <https://docs.ansible.com/ansible/latest/collections/community/docker/docker_network_module.html>
|
||||||
|
- Docker `prune` Module: <https://docs.ansible.com/ansible/latest/collections/community/docker/docker_prune_module.html>
|
||||||
|
- Docker `volume` Module: <https://docs.ansible.com/ansible/latest/collections/community/docker/docker_volume_module.html>
|
||||||
|
|
||||||
|
## rclone
|
||||||
|
- Docker Plugin Docs: <https://rclone.org/docker/>
|
||||||
|
- `rclone` mount: <https://rclone.org/commands/rclone_mount/>
|
||||||
|
- Docker Serve Docs: <https://rclone.org/commands/rclone_serve_docker/#options>
|
||||||
|
|
||||||
|
- S3 Backend: <https://rclone.org/s3/>
|
||||||
|
- Crypt Meta-Backend: <https://rclone.org/crypt/>
|
||||||
|
|
||||||
|
|
||||||
|
## Swarm Deployment
|
||||||
|
- The Funky Penguin: <https://geek-cookbook.funkypenguin.co.nz/docker-swarm>
|
||||||
|
- Traefik Certificate Auto-Renewal: <https://doc.traefik.io/traefik/https/acme/#automatic-renewals>
|
||||||
|
- Traefik Service: <https://doc.traefik.io/traefik/routing/services/#configuring-http-services>
|
||||||
|
|
@ -0,0 +1,149 @@
|
||||||
|
# Ansible / Dev TODO
|
||||||
|
Cluster/Ansible Setup
|
||||||
|
- [x] Setup Playbook
|
||||||
|
- [x] Root as local var: `work/dtu/python-support/*`
|
||||||
|
- [x] Get 2 DO Droplets
|
||||||
|
- [x] Provision DNS
|
||||||
|
- [ ] Key Fingerprint as local var
|
||||||
|
- [x] Setup Wireguard wg0 between DO Droplets
|
||||||
|
- [ ] Setup unattended-upgrades
|
||||||
|
|
||||||
|
Swarm
|
||||||
|
- [x] Install Docker
|
||||||
|
- [x] Check Swarm ports on wg0: https://docs.docker.com/engine/swarm/swarm-tutorial/
|
||||||
|
- [x] Init Swarm manager & worker
|
||||||
|
- [x] Install rclone volume plugin: https://rclone.org/docker/
|
||||||
|
- [ ] Label big one as 'storage'
|
||||||
|
|
||||||
|
Stack: cleanup
|
||||||
|
- [x] Security Audit
|
||||||
|
- [x] **Deploy Stack**
|
||||||
|
|
||||||
|
Stack: mesh
|
||||||
|
- [x] Install Configs
|
||||||
|
- [x] **Deploy Stack**
|
||||||
|
|
||||||
|
- [x] rclone `acme.json` to R2 w/crypt
|
||||||
|
- [ ] Security Audit
|
||||||
|
|
||||||
|
Stack: site-support
|
||||||
|
- [x] Generate Configs
|
||||||
|
- [x] Install Configs
|
||||||
|
- [x] **Deploy Stack**
|
||||||
|
|
||||||
|
- [ ] Security Audit
|
||||||
|
|
||||||
|
Stack: updater
|
||||||
|
- [ ] config: main
|
||||||
|
- [ ] config: cleanup
|
||||||
|
- [ ] config: mesh
|
||||||
|
- [ ] config: site-support
|
||||||
|
- [ ] Install Configs
|
||||||
|
- [ ] **Deploy Stack**
|
||||||
|
|
||||||
|
- [ ] Security Audit
|
||||||
|
|
||||||
|
Stack: auth
|
||||||
|
- [ ] Write Stack
|
||||||
|
- [ ] storage: authentik-postgres
|
||||||
|
- [ ] storage: authentik-redis
|
||||||
|
- [ ] *Test Deploy*
|
||||||
|
|
||||||
|
- [ ] configs: Blueprints (export from prototyping)
|
||||||
|
- [ ] Install Configs
|
||||||
|
- [ ] role: API Setup of Things
|
||||||
|
- [ ] **Deploy Stack**
|
||||||
|
|
||||||
|
- [ ] updater: Integrate update-check
|
||||||
|
- [ ] Security Audit
|
||||||
|
|
||||||
|
Stack: s3
|
||||||
|
- [ ] Write Stack
|
||||||
|
- https://geek-cookbook.funkypenguin.co.nz/recipes/minio/
|
||||||
|
- Restrict to 'storage' label.
|
||||||
|
|
||||||
|
- [ ] ...?
|
||||||
|
- [ ] Install Configs
|
||||||
|
- [ ] Install Secrets
|
||||||
|
- [ ] storage: minio
|
||||||
|
- [ ] *Test Deploy*
|
||||||
|
|
||||||
|
- [ ] role: API Setup of Things
|
||||||
|
- [ ] **Deploy Stack**
|
||||||
|
|
||||||
|
- [ ] auth: Integrate OIDC
|
||||||
|
- https://min.io/docs/minio/container/operations/external-iam.html
|
||||||
|
- https://goauthentik.io/integrations/services/minio/
|
||||||
|
- [ ] updater: integrate
|
||||||
|
- [ ] Security Audit
|
||||||
|
|
||||||
|
Stack: chat
|
||||||
|
- [ ] Write Stack
|
||||||
|
- https://geek-cookbook.funkypenguin.co.nz/recipes/minio/
|
||||||
|
- Restrict to 'storage' label.
|
||||||
|
|
||||||
|
- [ ] ...?
|
||||||
|
- [ ] Install Configs
|
||||||
|
- [ ] Install Secrets
|
||||||
|
- [ ] storage: zulip-postgres
|
||||||
|
- [ ] storage: zulip-rabbitmq
|
||||||
|
- [ ] storage: zulip-redis
|
||||||
|
- [ ] s3: zulip
|
||||||
|
- [ ] *Test Deploy*
|
||||||
|
|
||||||
|
- [ ] auth: Integrate OIDC
|
||||||
|
- https://zulip.readthedocs.io/en/latest/production/authentication-methods.html#openid-connect
|
||||||
|
- Backup SAML: https://goauthentik.io/integrations/services/zulip/
|
||||||
|
- [ ] role: API Setup of Things
|
||||||
|
- [ ] **Deploy Stack**
|
||||||
|
|
||||||
|
- [ ] updater: Integrate
|
||||||
|
- [ ] Security Audit
|
||||||
|
|
||||||
|
Stack: git
|
||||||
|
- [ ] Install Configs
|
||||||
|
- [ ] Install Secrets
|
||||||
|
- [ ] *Test Deploy*
|
||||||
|
|
||||||
|
- [ ] storage: gitea-redis
|
||||||
|
- [ ] storage: gitea-postgres
|
||||||
|
- [ ] storage: gitea-mellisearch
|
||||||
|
- https://www.meilisearch.com/docs/learn/cookbooks/docker
|
||||||
|
- [ ] s3: gitea
|
||||||
|
- [ ] s3 via rclone: gitea (repositories)
|
||||||
|
- [ ] role: API Setup of Things
|
||||||
|
- [ ] **Deploy Stack**
|
||||||
|
|
||||||
|
- [ ] Configure gitea-actions w/auto-setup
|
||||||
|
- [ ] manual: Migrate docker-mdbook, site-support.
|
||||||
|
|
||||||
|
|
||||||
|
Bonus:
|
||||||
|
- Play with `uptime`.
|
||||||
|
- Backups!
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Playbook Creation Notes
|
||||||
|
- [x] mesh should use a non-`local` driver.
|
||||||
|
- [ ] Implement rolling updates to services within stacks, whose configs have changed.
|
||||||
|
- Note `rolling_updates` in the `docker_config` ansible module.
|
||||||
|
- With a little information-gathering, I'm certain we can prevent actually stopping stacks on deploy and instead only do the secret rotation as described in the Docker documentation: https://docs.docker.com/engine/swarm/secrets/#example-rotate-a-secret
|
||||||
|
- NOTE that the rclone volume stuff is always gonna need manual stop/start. Is jank. Such is the life.
|
||||||
|
|
||||||
|
- [ ] Automatic R2 Bucket Creation
|
||||||
|
- [ ] Only do the delays when we actually need to stop stacks / unmount volumes
|
||||||
|
|
||||||
|
- [ ] Encrypted use of R2 bucket.
|
||||||
|
- https://rclone.org/crypt/
|
||||||
|
|
||||||
|
- [ ] Templated security.txt in site-support
|
||||||
|
- [ ] Templated limits to not kill the demo hosts in ex. site-support :)
|
||||||
|
|
||||||
|
- [ ] Please, please, a nice README.md in site-support?
|
||||||
|
|
||||||
|
- [ ] Move DNS stuff out to the stacks. Trust me!
|
||||||
|
- [ ] Invest in some delegation to roles. These playbooks be gettin messy.
|
||||||
|
|
||||||
|
- [ ] Figure out a way to deal with concurrent `acme.json` in Traefik. For now I've set it to one replica and `vfs_cache_mode=full` (I think `none` may be wonky with this particular need of Traefik?)
|
||||||
|
- Needs more testing!
|
||||||
|
|
@ -0,0 +1,65 @@
|
||||||
|
####################
|
||||||
|
# - Hosts - by Purpose
|
||||||
|
####################
|
||||||
|
service:
|
||||||
|
hosts:
|
||||||
|
raspberry.node.timesigned.com:
|
||||||
|
vars:
|
||||||
|
ansible_user: root
|
||||||
|
|
||||||
|
storage:
|
||||||
|
hosts:
|
||||||
|
blueberry.node.timesigned.com:
|
||||||
|
vars:
|
||||||
|
ansible_user: root
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Hosts - by Swarm Role
|
||||||
|
####################
|
||||||
|
leader:
|
||||||
|
## ONLY ==1 Host can be Leader
|
||||||
|
hosts:
|
||||||
|
raspberry.node.timesigned.com:
|
||||||
|
vars:
|
||||||
|
ansible_user: root
|
||||||
|
|
||||||
|
manager:
|
||||||
|
hosts:
|
||||||
|
raspberry.node.timesigned.com:
|
||||||
|
vars:
|
||||||
|
ansible_user: root
|
||||||
|
|
||||||
|
worker:
|
||||||
|
hosts:
|
||||||
|
blueberry.node.timesigned.com:
|
||||||
|
vars:
|
||||||
|
ansible_user: root
|
||||||
|
|
||||||
|
swarm:
|
||||||
|
hosts:
|
||||||
|
raspberry.node.timesigned.com:
|
||||||
|
blueberry.node.timesigned.com:
|
||||||
|
vars:
|
||||||
|
ansible_user: root
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Hosts - by L3 Network
|
||||||
|
####################
|
||||||
|
wg0:
|
||||||
|
hosts:
|
||||||
|
raspberry.node.timesigned.com:
|
||||||
|
wg0_ip: "10.9.8.1"
|
||||||
|
|
||||||
|
wg_private_key: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/wg/raspberry_private_key') }}"
|
||||||
|
wg_public_key: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/wg/raspberry_public_key') }}"
|
||||||
|
|
||||||
|
wg_psk_blueberry.node.timesigned.com: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/wg/psk_raspberry-blueberry') }}"
|
||||||
|
blueberry.node.timesigned.com:
|
||||||
|
wg0_ip: "10.9.8.2"
|
||||||
|
|
||||||
|
wg_private_key: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/wg/blueberry_private_key') }}"
|
||||||
|
wg_public_key: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/wg/blueberry_public_key') }}"
|
||||||
|
|
||||||
|
wg_psk_raspberry.node.timesigned.com: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/wg/psk_raspberry-blueberry') }}"
|
||||||
|
vars:
|
||||||
|
ansible_user: root
|
||||||
|
|
@ -0,0 +1,136 @@
|
||||||
|
- hosts: localhost
|
||||||
|
vars:
|
||||||
|
dns_root: "timesigned.com"
|
||||||
|
node_primary: "raspberry.node.timesigned.com"
|
||||||
|
|
||||||
|
digitalocean_droplet_token: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/digitalocean-droplet-token') }}"
|
||||||
|
|
||||||
|
cloudflare_email: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/cloudflare-email') }}"
|
||||||
|
cloudflare_dns_token: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/cloudflare-dns-token') }}"
|
||||||
|
|
||||||
|
droplet_service_image: "debian-12-x64"
|
||||||
|
## curl -X GET --silent "https://api.digitalocean.com/v2/images?per_page=999" -H "Authorization: Bearer $(pass work/dtu/python-support/digitalocean-droplet-token)" | jq | less
|
||||||
|
droplet_service_size: "s-1vcpu-1gb"
|
||||||
|
droplet_service_region: "fra1"
|
||||||
|
## curl -X GET --silent "https://api.digitalocean.com/v2/sizes?per_page=999" -H "Authorization: Bearer $(pass work/dtu/python-support/digitalocean-droplet-token)" | jq | less
|
||||||
|
|
||||||
|
droplet_storage_image: "debian-12-x64"
|
||||||
|
droplet_storage_size: "s-1vcpu-1gb"
|
||||||
|
droplet_storage_region: "fra1"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
####################
|
||||||
|
# - Prepare SSH Information
|
||||||
|
####################
|
||||||
|
- name: "Get SSH Public Key"
|
||||||
|
shell: "ssh-add -L"
|
||||||
|
register: "ssh_key_pub_cmdout"
|
||||||
|
|
||||||
|
- name: "Add SSH Public Key to DigitalOcean account"
|
||||||
|
digital_ocean_sshkey:
|
||||||
|
name: "key"
|
||||||
|
oauth_token: "{{ digitalocean_droplet_token }}"
|
||||||
|
ssh_pub_key: "{{ ssh_key_pub_cmdout.stdout }}"
|
||||||
|
state: "present"
|
||||||
|
register: "sshkey_result"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Create Digitalocean Nodes
|
||||||
|
####################
|
||||||
|
- name: "Create Storage Droplet"
|
||||||
|
digital_ocean_droplet:
|
||||||
|
name: "{{ item }}"
|
||||||
|
oauth_token: "{{ digitalocean_droplet_token }}"
|
||||||
|
ssh_keys: ["{{ sshkey_result.data.ssh_key.id }}"]
|
||||||
|
|
||||||
|
image: "{{ droplet_storage_image }}"
|
||||||
|
size: "{{ droplet_storage_size }}"
|
||||||
|
region: "{{ droplet_storage_region }}"
|
||||||
|
|
||||||
|
wait_timeout: 600
|
||||||
|
unique_name: "yes"
|
||||||
|
|
||||||
|
state: present
|
||||||
|
with_inventory_hostnames:
|
||||||
|
- storage
|
||||||
|
register: droplet_storage_result
|
||||||
|
|
||||||
|
- name: "Create Service Droplet"
|
||||||
|
digital_ocean_droplet:
|
||||||
|
name: "{{ item }}"
|
||||||
|
oauth_token: "{{ digitalocean_droplet_token }}"
|
||||||
|
ssh_keys: ["{{ sshkey_result.data.ssh_key.id }}"]
|
||||||
|
|
||||||
|
image: "{{ droplet_service_image }}"
|
||||||
|
size: "{{ droplet_service_size }}"
|
||||||
|
region: "{{ droplet_service_region }}"
|
||||||
|
|
||||||
|
wait_timeout: 600
|
||||||
|
unique_name: "yes"
|
||||||
|
|
||||||
|
state: present
|
||||||
|
with_inventory_hostnames:
|
||||||
|
- service
|
||||||
|
register: droplet_service_result
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Set DNS A Records => Hosts
|
||||||
|
####################
|
||||||
|
- name: "Set Storage DNS A => *.node.{{ dns_root }}"
|
||||||
|
cloudflare_dns:
|
||||||
|
api_token: "{{ cloudflare_dns_token }}"
|
||||||
|
|
||||||
|
zone: "{{ dns_root }}"
|
||||||
|
type: "A"
|
||||||
|
|
||||||
|
record: "{{ item.data.droplet.name }}"
|
||||||
|
value: "{{ item.data.ip_address }}"
|
||||||
|
with_items: "{{ droplet_storage_result.results }}"
|
||||||
|
|
||||||
|
- name: "Set Service DNS A => *.node.{{ dns_root }}"
|
||||||
|
cloudflare_dns:
|
||||||
|
api_token: "{{ cloudflare_dns_token }}"
|
||||||
|
|
||||||
|
zone: "{{ dns_root }}"
|
||||||
|
type: "A"
|
||||||
|
|
||||||
|
record: "{{ item.data.droplet.name }}"
|
||||||
|
value: "{{ item.data.ip_address }}"
|
||||||
|
with_items: "{{ droplet_service_result.results }}"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Set DNS CNAME Record => @
|
||||||
|
####################
|
||||||
|
- name: "Set DNS CNAME => Primary Node"
|
||||||
|
cloudflare_dns:
|
||||||
|
api_token: "{{ cloudflare_dns_token }}"
|
||||||
|
|
||||||
|
zone: "{{ dns_root }}"
|
||||||
|
type: "CNAME"
|
||||||
|
|
||||||
|
record: "@"
|
||||||
|
value: "{{ node_primary }}"
|
||||||
|
## Cloudflare allows CNAME on @ via CNAME-flattening
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Set DNS CNAME Records => Stacks
|
||||||
|
####################
|
||||||
|
- name: "Set DNS CNAME => Stack: auth"
|
||||||
|
cloudflare_dns:
|
||||||
|
api_token: "{{ cloudflare_dns_token }}"
|
||||||
|
|
||||||
|
zone: "{{ dns_root }}"
|
||||||
|
type: "CNAME"
|
||||||
|
|
||||||
|
record: "auth"
|
||||||
|
value: "@"
|
||||||
|
|
||||||
|
- name: "Set DNS CNAME => Stack: site-support"
|
||||||
|
cloudflare_dns:
|
||||||
|
api_token: "{{ cloudflare_dns_token }}"
|
||||||
|
|
||||||
|
zone: "{{ dns_root }}"
|
||||||
|
type: "CNAME"
|
||||||
|
|
||||||
|
record: "pysupport"
|
||||||
|
value: "@"
|
||||||
|
|
@ -0,0 +1,132 @@
|
||||||
|
- hosts: swarm
|
||||||
|
become: "true"
|
||||||
|
tasks:
|
||||||
|
####################
|
||||||
|
# - Tuning - Traefik
|
||||||
|
# -- Traefik serving QUIC can be bottlenecked by a too-low UDP buffer.
|
||||||
|
# -- This increases both send & receive from ~200KB to 2.5MB.
|
||||||
|
####################
|
||||||
|
- name: "Set net.core.rmem_max = 2500000"
|
||||||
|
sysctl:
|
||||||
|
state: "present"
|
||||||
|
name: "net.core.rmem_max"
|
||||||
|
value: "2500000"
|
||||||
|
reload: "yes"
|
||||||
|
|
||||||
|
- name: "Set net.core.wmem_max = 2500000"
|
||||||
|
sysctl:
|
||||||
|
state: "present"
|
||||||
|
name: "net.core.rmem_max"
|
||||||
|
value: "2500000"
|
||||||
|
reload: "yes"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Docker - Install
|
||||||
|
####################
|
||||||
|
- name: "Download Docker Apt Key"
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: "https://download.docker.com/linux/debian/gpg"
|
||||||
|
dest: "/etc/apt/trusted.gpg.d/docker.asc"
|
||||||
|
checksum: "sha256:1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570"
|
||||||
|
owner: "root"
|
||||||
|
group: "root"
|
||||||
|
mode: "644"
|
||||||
|
|
||||||
|
- name: "Add Docker Apt Repository"
|
||||||
|
apt_repository:
|
||||||
|
state: "present"
|
||||||
|
repo: "deb https://download.docker.com/linux/debian bullseye stable"
|
||||||
|
filename: "docker"
|
||||||
|
|
||||||
|
- name: "Install Docker CE"
|
||||||
|
apt:
|
||||||
|
state: "present"
|
||||||
|
name: "docker-ce"
|
||||||
|
|
||||||
|
- name: "Install python3-docker"
|
||||||
|
apt:
|
||||||
|
state: "present"
|
||||||
|
name: "python3-docker"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Docker Plugin - rclone
|
||||||
|
####################
|
||||||
|
- name: "Install fuse"
|
||||||
|
apt:
|
||||||
|
state: "present"
|
||||||
|
name: "fuse"
|
||||||
|
|
||||||
|
- name: "Create rclone Config Path"
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "/var/lib/docker-plugins/rclone/config"
|
||||||
|
state: directory
|
||||||
|
mode: "0750"
|
||||||
|
|
||||||
|
- name: "Create rclone Cache Path"
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "/var/lib/docker-plugins/rclone/cache"
|
||||||
|
state: directory
|
||||||
|
mode: "0750"
|
||||||
|
|
||||||
|
- name: "Disable the rclone Docker Plugin"
|
||||||
|
community.docker.docker_plugin:
|
||||||
|
state: "disable"
|
||||||
|
alias: "rclone"
|
||||||
|
plugin_name: "rclone/docker-volume-rclone:amd64"
|
||||||
|
|
||||||
|
- name: "Install rclone Docker Plugin"
|
||||||
|
community.docker.docker_plugin:
|
||||||
|
state: "present"
|
||||||
|
alias: "rclone"
|
||||||
|
plugin_name: "rclone/docker-volume-rclone:amd64"
|
||||||
|
plugin_options:
|
||||||
|
args: "-v --allow-other"
|
||||||
|
|
||||||
|
- name: "Enable the rclone Docker Plugin"
|
||||||
|
community.docker.docker_plugin:
|
||||||
|
state: "enable"
|
||||||
|
alias: "rclone"
|
||||||
|
plugin_name: "rclone/docker-volume-rclone:amd64"
|
||||||
|
plugin_options:
|
||||||
|
args: "-v --allow-other"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Docker - Swarm Init
|
||||||
|
####################
|
||||||
|
- hosts: leader
|
||||||
|
become: "true"
|
||||||
|
tasks:
|
||||||
|
- name: "Initialize Docker Swarm Leader"
|
||||||
|
community.docker.docker_swarm:
|
||||||
|
state: "present"
|
||||||
|
advertise_addr: "{{ wg0_ip }}"
|
||||||
|
listen_addr: "{{ wg0_ip }}:2377"
|
||||||
|
|
||||||
|
- name: "Collect Swarm Info"
|
||||||
|
community.docker.docker_swarm_info:
|
||||||
|
register: swarm_info
|
||||||
|
|
||||||
|
- name: "Retrieve Join Tokens"
|
||||||
|
set_fact:
|
||||||
|
swarm_manager_token: "{{ swarm_info.swarm_facts['JoinTokens']['Manager'] }}"
|
||||||
|
swarm_worker_token: "{{ swarm_info.swarm_facts['JoinTokens']['Worker'] }}"
|
||||||
|
|
||||||
|
- name: "Install jsondiff & pyyaml (stack-deploy deps)"
|
||||||
|
apt:
|
||||||
|
state: "present"
|
||||||
|
name:
|
||||||
|
- "python3-jsondiff"
|
||||||
|
- "python3-yaml"
|
||||||
|
|
||||||
|
# SKIP Manager
|
||||||
|
# - Currently, there is only one manager == leader. So there's no point.
|
||||||
|
|
||||||
|
- hosts: worker
|
||||||
|
become: "true"
|
||||||
|
tasks:
|
||||||
|
- name: "Initialize Docker Swarm Workers"
|
||||||
|
community.docker.docker_swarm:
|
||||||
|
state: "join"
|
||||||
|
advertise_addr: "{{ wg0_ip }}"
|
||||||
|
join_token: "{{ hostvars[groups['leader'][0]]['swarm_worker_token'] }}"
|
||||||
|
remote_addrs: [ "{{ hostvars[groups['leader'][0]]['wg0_ip'] }}:2377" ]
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
- hosts: swarm
|
||||||
|
become: "true"
|
||||||
|
tasks:
|
||||||
|
####################
|
||||||
|
# - Tuning - Dev
|
||||||
|
####################
|
||||||
|
- name: "Install Terminfo for Kitty"
|
||||||
|
ansible.builtin.apt:
|
||||||
|
state: "present"
|
||||||
|
name: "kitty-terminfo"
|
||||||
|
|
@ -0,0 +1,43 @@
|
||||||
|
- hosts: wg0
|
||||||
|
become: "true"
|
||||||
|
tasks:
|
||||||
|
####################
|
||||||
|
# - Wireguard
|
||||||
|
####################
|
||||||
|
- name: "Install Wireguard Tools"
|
||||||
|
ansible.builtin.apt:
|
||||||
|
state: "present"
|
||||||
|
name: "wireguard"
|
||||||
|
|
||||||
|
- name: "systemd-networkd: Install wg0 Device"
|
||||||
|
template:
|
||||||
|
src: "./templates/99-wg0.netdev"
|
||||||
|
dest: "/etc/systemd/network/99-wg0.netdev"
|
||||||
|
owner: "root"
|
||||||
|
group: "systemd-network"
|
||||||
|
mode: "0640"
|
||||||
|
|
||||||
|
- name: "systemd-networkd: Install wg0 Network"
|
||||||
|
template:
|
||||||
|
src: "./templates/99-wg0.network"
|
||||||
|
dest: "/etc/systemd/network/99-wg0.network"
|
||||||
|
owner: "root"
|
||||||
|
group: "systemd-network"
|
||||||
|
mode: "0640"
|
||||||
|
|
||||||
|
- name: "Restart systemd-networkd"
|
||||||
|
systemd:
|
||||||
|
name: "systemd-networkd.service"
|
||||||
|
state: "restarted"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Wireguard - Enable Packet Forwarding
|
||||||
|
####################
|
||||||
|
- name: "Set net.ipv4.ip_forward = 1"
|
||||||
|
sysctl:
|
||||||
|
state: "present"
|
||||||
|
name: "net.ipv4.ip_forward"
|
||||||
|
value: "1"
|
||||||
|
reload: "yes"
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
[NetDev]
|
||||||
|
Name=wg0
|
||||||
|
Kind=wireguard
|
||||||
|
Description=WireGuard tunnel wg0
|
||||||
|
|
||||||
|
[WireGuard]
|
||||||
|
ListenPort=51871
|
||||||
|
PrivateKey={{ wg_private_key }}
|
||||||
|
|
||||||
|
{% for item in groups['wg0'] %}
|
||||||
|
{% if item != inventory_hostname %}
|
||||||
|
[WireGuardPeer]
|
||||||
|
PublicKey={{ hostvars[item]['wg_public_key'] }}
|
||||||
|
PresharedKey={{ hostvars[item]['wg_psk_' ~ inventory_hostname] }}
|
||||||
|
AllowedIPs={{ hostvars[item]['wg0_ip'] }}/32
|
||||||
|
Endpoint={{ item }}:51871
|
||||||
|
|
||||||
|
{% endif %}
|
||||||
|
{% endfor %}
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
[Match]
|
||||||
|
Name=wg0
|
||||||
|
|
||||||
|
[Network]
|
||||||
|
Address={{ wg0_ip }}/24
|
||||||
|
|
@ -0,0 +1,155 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -e ## Exit if Problems
|
||||||
|
set -u ## Fail on Undefined Variable
|
||||||
|
|
||||||
|
SCRIPT_PATH="$(dirname "$(readlink -f "$0")")"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Constants
|
||||||
|
####################
|
||||||
|
PLAYBOOKS_PATH="$SCRIPT_PATH/playbooks"
|
||||||
|
|
||||||
|
INVENTORY="$SCRIPT_PATH/inventory.yml"
|
||||||
|
|
||||||
|
PLAYBOOK_HOSTS="$PLAYBOOKS_PATH/playbook.hosts.yml"
|
||||||
|
PLAYBOOK_WG0="$PLAYBOOKS_PATH/playbook.wg0.yml"
|
||||||
|
PLAYBOOK_SWARM="$PLAYBOOKS_PATH/playbook.swarm.yml"
|
||||||
|
|
||||||
|
PLAYBOOK_STACK_CLEANUP="$SCRIPT_PATH/stacks/cleanup/playbook.yml"
|
||||||
|
PLAYBOOK_STACK_MESH="$SCRIPT_PATH/stacks/mesh/playbook.yml"
|
||||||
|
PLAYBOOK_STACK_SITE_SUPPORT="$SCRIPT_PATH/stacks/site-support/playbook.yml"
|
||||||
|
|
||||||
|
help() {
|
||||||
|
less -R << EOF
|
||||||
|
This script manages the deployment using ansible.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
./run.sh [COMMAND]
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Utilities
|
||||||
|
####################
|
||||||
|
cmd_exists() {
|
||||||
|
if type -P "$1" &> /dev/null || [ -x "$1" ]; then
|
||||||
|
echo true
|
||||||
|
else
|
||||||
|
echo false
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
pkg_installed() {
|
||||||
|
if [ $(dpkg-query -W -f='${Status}' "$1" 2>/dev/null | grep -c "ok installed") -eq 0 ]; then
|
||||||
|
echo false
|
||||||
|
else
|
||||||
|
echo true
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Check Preconditions
|
||||||
|
####################
|
||||||
|
if [[ $(whoami) == root ]]; then
|
||||||
|
echo "Please don't run as root."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
case $(cat /etc/debian_version | cut -d . -f 1) in
|
||||||
|
"11")
|
||||||
|
echo "Detected Debian 11 (Supported)..."
|
||||||
|
;;
|
||||||
|
"12")
|
||||||
|
echo "Detected Debian 12 (Supported)..."
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Could not detect a supported OS. Refer to manual for more."
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
if [[ $(cmd_exists ansible) != true ]]; then
|
||||||
|
echo "This script requires ansible. Press ENTER to install and continue..."
|
||||||
|
sudo apt install ansible
|
||||||
|
|
||||||
|
echo "This script requires latest community.docker module. Press ENTER to install and continue..."
|
||||||
|
ansible-galaxy collection install community.docker
|
||||||
|
fi
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Actions
|
||||||
|
####################
|
||||||
|
action_hosts() {
|
||||||
|
ansible-playbook \
|
||||||
|
--inventory "$INVENTORY" \
|
||||||
|
"$PLAYBOOK_HOSTS"
|
||||||
|
}
|
||||||
|
action_wg0() {
|
||||||
|
ansible-playbook \
|
||||||
|
--inventory "$INVENTORY" \
|
||||||
|
"$PLAYBOOK_WG0"
|
||||||
|
}
|
||||||
|
action_swarm() {
|
||||||
|
ansible-playbook \
|
||||||
|
--inventory "$INVENTORY" \
|
||||||
|
"$PLAYBOOK_SWARM"
|
||||||
|
}
|
||||||
|
|
||||||
|
action_stack_cleanup() {
|
||||||
|
ansible-playbook \
|
||||||
|
--inventory "$INVENTORY" \
|
||||||
|
"$PLAYBOOK_STACK_CLEANUP"
|
||||||
|
}
|
||||||
|
action_stack_mesh() {
|
||||||
|
ansible-playbook \
|
||||||
|
--inventory "$INVENTORY" \
|
||||||
|
"$PLAYBOOK_STACK_MESH"
|
||||||
|
}
|
||||||
|
action_stack_site_support() {
|
||||||
|
ansible-playbook \
|
||||||
|
--inventory "$INVENTORY" \
|
||||||
|
"$PLAYBOOK_STACK_SITE_SUPPORT"
|
||||||
|
}
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Check Dependencies
|
||||||
|
####################
|
||||||
|
case $1 in
|
||||||
|
sync)
|
||||||
|
action_hosts
|
||||||
|
action_wg0
|
||||||
|
action_swarm
|
||||||
|
|
||||||
|
action_stack_cleanup
|
||||||
|
action_stack_mesh
|
||||||
|
action_stack_site_support
|
||||||
|
;;
|
||||||
|
|
||||||
|
sync-hosts)
|
||||||
|
action_hosts
|
||||||
|
;;
|
||||||
|
sync-wg0)
|
||||||
|
action_wg0
|
||||||
|
;;
|
||||||
|
sync-swarm)
|
||||||
|
action_swarm
|
||||||
|
;;
|
||||||
|
|
||||||
|
sync-stack-cleanup)
|
||||||
|
action_stack_cleanup
|
||||||
|
;;
|
||||||
|
sync-stack-mesh)
|
||||||
|
action_stack_mesh
|
||||||
|
;;
|
||||||
|
sync-stack-site-support)
|
||||||
|
action_stack_site_support
|
||||||
|
;;
|
||||||
|
|
||||||
|
# sync-role)
|
||||||
|
# ansible-playbook \
|
||||||
|
# --inventory "$INVENTORY" \
|
||||||
|
# --tags "$2" \
|
||||||
|
# "$PLAYBOOK"
|
||||||
|
# ;;
|
||||||
|
|
||||||
|
esac
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
auth
|
||||||
|
chat
|
||||||
|
git
|
||||||
|
s3
|
||||||
|
updater
|
||||||
|
uptime
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# TODO
|
||||||
|
- [ ] Security
|
||||||
|
|
@ -0,0 +1,31 @@
|
||||||
|
# Security
|
||||||
|
Here follows an explanation of security practices taken into account.
|
||||||
|
|
||||||
|
Refer to https://docs.docker.com/compose/compose-file/compose-file-v3/ for explanations of individual points.
|
||||||
|
|
||||||
|
## Rootness
|
||||||
|
**The container process runs as `root`**.
|
||||||
|
|
||||||
|
Due to the deterministic, static nature of the container process, this is not an issue.
|
||||||
|
|
||||||
|
## Port Exposure
|
||||||
|
The container exposes no ports.
|
||||||
|
|
||||||
|
## Volume Access
|
||||||
|
**The container process has `docker.sock` access**.
|
||||||
|
|
||||||
|
Due to the deterministic, static nature of the container process, this is not an issue.
|
||||||
|
|
||||||
|
## Resource Limits
|
||||||
|
The service employs CPU/Memory usage limits in the `deploy` section.
|
||||||
|
|
||||||
|
This helps prevent any issues with the container process from crashing the entire host.
|
||||||
|
|
||||||
|
## Capabilities
|
||||||
|
All capabilities are dropped with `--cap_drop ALL`.
|
||||||
|
|
||||||
|
No capabilities need to be added back, so none are.
|
||||||
|
|
||||||
|
## Special Note: latest
|
||||||
|
Hosts are presumed to be kept up-to-date via the official `docker-ce` package.
|
||||||
|
Thus, uniquely, using `latest` tag in this container is warranted.
|
||||||
|
|
@ -0,0 +1,37 @@
|
||||||
|
version: "3.8"
|
||||||
|
|
||||||
|
services:
|
||||||
|
docker-cleanup:
|
||||||
|
image: docker.io/docker:latest
|
||||||
|
cap_drop:
|
||||||
|
- ALL
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
|
||||||
|
entrypoint: []
|
||||||
|
command:
|
||||||
|
- "sh"
|
||||||
|
- "-euc"
|
||||||
|
- |
|
||||||
|
while true; do
|
||||||
|
docker image prune --all --force
|
||||||
|
docker system prune --all --force --volumes
|
||||||
|
|
||||||
|
sleep 86400
|
||||||
|
## 1 day, in seconds
|
||||||
|
done
|
||||||
|
|
||||||
|
deploy:
|
||||||
|
mode: global
|
||||||
|
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: "1G"
|
||||||
|
|
||||||
|
restart_policy:
|
||||||
|
condition: on-failure
|
||||||
|
delay: 5s
|
||||||
|
max_attempts: 3
|
||||||
|
window: 120s
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
- hosts: leader
|
||||||
|
become: "true"
|
||||||
|
vars:
|
||||||
|
stack_name: "cleanup"
|
||||||
|
tasks:
|
||||||
|
####################
|
||||||
|
# - Stack Deployment
|
||||||
|
####################
|
||||||
|
- name: "Upload Stack to /tmp"
|
||||||
|
template:
|
||||||
|
src: "./docker-compose.yml"
|
||||||
|
dest: "/tmp/{{ stack_name }}.yml"
|
||||||
|
owner: "root"
|
||||||
|
group: "root"
|
||||||
|
mode: "0640"
|
||||||
|
|
||||||
|
- name: "Deploy Stack: {{ stack_name }}"
|
||||||
|
community.docker.docker_stack:
|
||||||
|
state: "present"
|
||||||
|
prune: "true"
|
||||||
|
name: "{{ stack_name }}"
|
||||||
|
compose:
|
||||||
|
- "/tmp/{{ stack_name }}.yml"
|
||||||
|
|
||||||
|
- name: "Delete /tmp Stack"
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "/tmp/{{ stack_name }}.yml"
|
||||||
|
state: "absent"
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# TODO
|
||||||
|
- [ ] Configure Services per-Stack
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
[http.routers.site-support__site-support]
|
||||||
|
rule = "Host(`pysupport.timesigned.com`)"
|
||||||
|
entryPoints = ["websecure", "web"]
|
||||||
|
service = "site-support__site-support"
|
||||||
|
|
||||||
|
[[http.services.site-support__site-support.loadBalancer.servers]]
|
||||||
|
url = "http://site-support:8787"
|
||||||
|
|
||||||
|
[http.routers.site-support__site-support.tls]
|
||||||
|
certResolver = "letsencrypt"
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
####################
|
||||||
|
# - Default Middlewares
|
||||||
|
####################
|
||||||
|
[http.middlewares.default.chain]
|
||||||
|
middlewares = [
|
||||||
|
"default-security-headers",
|
||||||
|
]
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Middleware: Default Security Headers
|
||||||
|
####################
|
||||||
|
[http.middlewares.default-security-headers.headers]
|
||||||
|
browserXssFilter = true # X-XSS-Protection=1; mode=block
|
||||||
|
contentTypeNosniff = true # X-Content-Type-Options=nosniff
|
||||||
|
forceSTSHeader = true # Add STS even when using HTTP.
|
||||||
|
frameDeny = true # X-Frame-Options=deny
|
||||||
|
referrerPolicy = "strict-origin-when-cross-origin"
|
||||||
|
sslRedirect = true # Allow only https requests
|
||||||
|
stsIncludeSubdomains = true # Add includeSubdomains to STS header
|
||||||
|
stsPreload = true # Add preload flag appended to STS header
|
||||||
|
stsSeconds = 63072000 # Set max-age of STS header (2 years)
|
||||||
|
|
@ -0,0 +1,63 @@
|
||||||
|
####################
|
||||||
|
# - Global Config
|
||||||
|
####################
|
||||||
|
[global]
|
||||||
|
checkNewVersion = false
|
||||||
|
sendAnonymousUsage = false
|
||||||
|
|
||||||
|
[experimental]
|
||||||
|
http3 = true
|
||||||
|
|
||||||
|
[api]
|
||||||
|
dashboard = false
|
||||||
|
insecure = false
|
||||||
|
debug = false
|
||||||
|
disabledashboardad = true
|
||||||
|
|
||||||
|
[log]
|
||||||
|
level = "DEBUG"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Certificate Resolvers
|
||||||
|
# * https://doc.traefik.io/traefik/https/acme/#certificate-resolvers
|
||||||
|
####################
|
||||||
|
[certificatesResolvers.letsencrypt.acme]
|
||||||
|
email = "{{ email_letsencrypt }}"
|
||||||
|
storage = "/data-certs/acme.json"
|
||||||
|
#caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
|
||||||
|
|
||||||
|
[certificatesResolvers.letsencrypt.acme.tlsChallenge]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Entry Points
|
||||||
|
####################
|
||||||
|
#[entryPoints.ssh]
|
||||||
|
#address = ":22"
|
||||||
|
|
||||||
|
|
||||||
|
[entryPoints.websecure]
|
||||||
|
address = ":443"
|
||||||
|
http3.advertisedPort = 443
|
||||||
|
|
||||||
|
|
||||||
|
[entryPoints.web]
|
||||||
|
address = ":80"
|
||||||
|
|
||||||
|
[entryPoints.web.http.redirections.entryPoint]
|
||||||
|
to = "websecure"
|
||||||
|
scheme = "https"
|
||||||
|
permanent = true
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Providers
|
||||||
|
####################
|
||||||
|
[providers.file]
|
||||||
|
directory = "/data-providers"
|
||||||
|
watch = false
|
||||||
|
debugLogGeneratedTemplate = true
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
####################
|
||||||
|
# - TLS Defaults
|
||||||
|
# * See https://doc.traefik.io/traefik/https/tls/
|
||||||
|
# * Adapted from https://ssl-config.mozilla.org
|
||||||
|
####################
|
||||||
|
[tls.options.default]
|
||||||
|
minVersion = "VersionTLS12"
|
||||||
|
sniStrict = true
|
||||||
|
cipherSuites = [
|
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
||||||
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
||||||
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
||||||
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
|
||||||
|
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
|
||||||
|
]
|
||||||
|
|
@ -0,0 +1,89 @@
|
||||||
|
version: "3.8"
|
||||||
|
|
||||||
|
services:
|
||||||
|
traefik:
|
||||||
|
image: traefik:v2.10
|
||||||
|
user: "5000:5000"
|
||||||
|
|
||||||
|
configs:
|
||||||
|
- source: mesh__traefik_static.toml
|
||||||
|
target: /etc/traefik/traefik.toml
|
||||||
|
uid: "5000"
|
||||||
|
gid: "5000"
|
||||||
|
|
||||||
|
- source: mesh__traefik_tls.toml
|
||||||
|
target: /etc/traefik/dynamic/tls.toml
|
||||||
|
uid: "5000"
|
||||||
|
gid: "5000"
|
||||||
|
|
||||||
|
- source: mesh__traefik_default_middlewares.toml
|
||||||
|
target: /etc/traefik/dynamic/default_middlewares.toml
|
||||||
|
uid: "5000"
|
||||||
|
gid: "5000"
|
||||||
|
|
||||||
|
- source: mesh__stack_site-support.toml
|
||||||
|
target: /data-providers/site-support.toml
|
||||||
|
uid: "5000"
|
||||||
|
gid: "5000"
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
- /etc/timezone:/etc/timezone:ro
|
||||||
|
|
||||||
|
- mesh__traefik_certs:/data-certs
|
||||||
|
|
||||||
|
ports:
|
||||||
|
## HTTP
|
||||||
|
- target: 80
|
||||||
|
published: 80
|
||||||
|
protocol: tcp
|
||||||
|
mode: host
|
||||||
|
|
||||||
|
## HTTPS
|
||||||
|
- target: 443
|
||||||
|
published: 443
|
||||||
|
protocol: tcp
|
||||||
|
mode: host
|
||||||
|
|
||||||
|
deploy:
|
||||||
|
mode: replicated
|
||||||
|
replicas: 1
|
||||||
|
|
||||||
|
update_config:
|
||||||
|
parallelism: 1
|
||||||
|
delay: 10s
|
||||||
|
order: stop-first
|
||||||
|
|
||||||
|
restart_policy:
|
||||||
|
condition: on-failure
|
||||||
|
delay: 10s
|
||||||
|
max_attempts: 3
|
||||||
|
window: 120s
|
||||||
|
|
||||||
|
placement:
|
||||||
|
constraints:
|
||||||
|
- node.role == manager
|
||||||
|
|
||||||
|
networks:
|
||||||
|
- mesh_public
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Resources
|
||||||
|
####################
|
||||||
|
configs:
|
||||||
|
mesh__traefik_static.toml:
|
||||||
|
external: true
|
||||||
|
mesh__traefik_tls.toml:
|
||||||
|
external: true
|
||||||
|
mesh__traefik_default_middlewares.toml:
|
||||||
|
external: true
|
||||||
|
mesh__stack_site-support.toml:
|
||||||
|
external: true
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
mesh__traefik_certs:
|
||||||
|
external: true
|
||||||
|
|
||||||
|
networks:
|
||||||
|
mesh_public:
|
||||||
|
external: true
|
||||||
|
|
@ -0,0 +1,120 @@
|
||||||
|
####################
|
||||||
|
# - Stop the Stack
|
||||||
|
####################
|
||||||
|
- hosts: leader
|
||||||
|
become: "true"
|
||||||
|
vars:
|
||||||
|
stack_name: "mesh"
|
||||||
|
tasks:
|
||||||
|
- name: "Stop Stack: {{ stack_name }}"
|
||||||
|
community.docker.docker_stack:
|
||||||
|
state: "absent"
|
||||||
|
absent_retries: 15
|
||||||
|
name: "{{ stack_name }}"
|
||||||
|
|
||||||
|
- name: "Pause to Let Stack Stop"
|
||||||
|
pause:
|
||||||
|
seconds: 5
|
||||||
|
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Volume Creation
|
||||||
|
####################
|
||||||
|
- hosts: swarm
|
||||||
|
become: "true"
|
||||||
|
vars:
|
||||||
|
cloudflare_b0__access_key_id: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/r2/mesh__traefik_certs/access_key_id') }}"
|
||||||
|
cloudflare_b0__secret_access_key: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/r2/mesh__traefik_certs/secret_access_key') }}"
|
||||||
|
cloudflare_b0__endpoint: "{{ lookup('community.general.passwordstore', 'work/dtu/python-support/r2/mesh__traefik_certs/endpoint') }}"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: "Unmount Volume: mesh__traefik_certs"
|
||||||
|
community.docker.docker_volume:
|
||||||
|
state: "absent"
|
||||||
|
name: "mesh__traefik_certs"
|
||||||
|
driver: "rclone"
|
||||||
|
|
||||||
|
- name: "Pause to Let Volume Unmount"
|
||||||
|
pause:
|
||||||
|
seconds: 5
|
||||||
|
|
||||||
|
- name: "Mount Volume: mesh__traefik_certs"
|
||||||
|
community.docker.docker_volume:
|
||||||
|
state: "present"
|
||||||
|
name: "mesh__traefik_certs"
|
||||||
|
driver: "rclone"
|
||||||
|
driver_options:
|
||||||
|
remote: ":s3:mesh--traefik-certs"
|
||||||
|
uid: "5000"
|
||||||
|
gid: "5000"
|
||||||
|
s3_provider: "Cloudflare"
|
||||||
|
s3_access_key_id: "{{ cloudflare_b0__access_key_id }}"
|
||||||
|
s3_secret_access_key: "{{ cloudflare_b0__secret_access_key }}"
|
||||||
|
s3_region: "auto"
|
||||||
|
s3_endpoint: "{{ cloudflare_b0__endpoint }}"
|
||||||
|
s3_acl: "private"
|
||||||
|
vfs_cache_mode: "full"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Deployment
|
||||||
|
####################
|
||||||
|
- hosts: leader
|
||||||
|
become: "true"
|
||||||
|
vars:
|
||||||
|
email_letsencrypt: "s174509@dtu.dk"
|
||||||
|
|
||||||
|
stack_name: "mesh"
|
||||||
|
stack_configs:
|
||||||
|
- "mesh__traefik_static.toml"
|
||||||
|
- "mesh__traefik_tls.toml"
|
||||||
|
- "mesh__traefik_default_middlewares.toml"
|
||||||
|
- "mesh__stack_site-support.toml"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
####################
|
||||||
|
# - Network Creation
|
||||||
|
####################
|
||||||
|
- name: "Create Network: mesh_public"
|
||||||
|
community.docker.docker_network:
|
||||||
|
state: "present"
|
||||||
|
name: "mesh_public"
|
||||||
|
driver: "overlay"
|
||||||
|
scope: "swarm"
|
||||||
|
attachable: true
|
||||||
|
appends: true
|
||||||
|
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Configs Creation
|
||||||
|
####################
|
||||||
|
- name: "Create Docker Configs"
|
||||||
|
community.docker.docker_config:
|
||||||
|
state: "present"
|
||||||
|
name: "{{ item }}"
|
||||||
|
data: "{{ lookup('template', './configs/' ~ item) | b64encode }}"
|
||||||
|
data_is_b64: "true"
|
||||||
|
with_items: "{{ stack_configs }}"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Stack Deployment
|
||||||
|
####################
|
||||||
|
- name: "Upload Stack to /tmp"
|
||||||
|
template:
|
||||||
|
src: "./docker-compose.yml"
|
||||||
|
dest: "/tmp/{{ stack_name }}.yml"
|
||||||
|
owner: "root"
|
||||||
|
group: "root"
|
||||||
|
mode: "0640"
|
||||||
|
|
||||||
|
- name: "Deploy Stack: {{ stack_name }}"
|
||||||
|
community.docker.docker_stack:
|
||||||
|
state: "present"
|
||||||
|
prune: "true"
|
||||||
|
name: "{{ stack_name }}"
|
||||||
|
compose:
|
||||||
|
- "/tmp/{{ stack_name }}.yml"
|
||||||
|
|
||||||
|
- name: "Delete /tmp Stack"
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "/tmp/{{ stack_name }}.yml"
|
||||||
|
state: "absent"
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
# TODO
|
||||||
|
- [ ] Test
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Introduction
|
||||||
|
This is stack deploys the `python-support` website.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Monitoring
|
||||||
|
Check for:
|
||||||
|
- Expired security.txt
|
||||||
|
|
||||||
|
Consider checking for:
|
||||||
|
- Revoked security.txt key
|
||||||
|
- Tag update (with alert to the server webhook)
|
||||||
|
|
@ -0,0 +1,47 @@
|
||||||
|
# Security
|
||||||
|
Here follows an explanation of security practices taken into account.
|
||||||
|
|
||||||
|
Refer to https://docs.docker.com/compose/compose-file/compose-file-v3/ for explanations of individual points.
|
||||||
|
|
||||||
|
## Rootness
|
||||||
|
The container process runs as `5000:5000`.
|
||||||
|
No processes are run as root within the container.
|
||||||
|
|
||||||
|
## Port Exposure
|
||||||
|
The container participates in the private `mesh_public` overlay network.
|
||||||
|
This allows the reverse proxy, Traefik, to route traffic via. internal DNS.
|
||||||
|
|
||||||
|
This traffic is unencrypted HTTP.
|
||||||
|
Thus, **the overlay network must be run on a trusted (L3) network**.
|
||||||
|
|
||||||
|
## Volume Access
|
||||||
|
Only `localtime` and `timezone` are mounted (read-only).
|
||||||
|
|
||||||
|
All files to be served are either baked into the container image, or mounted with `docker config`.
|
||||||
|
|
||||||
|
## Resource Limits
|
||||||
|
The service employs CPU/Memory usage limits in the `deploy` section.
|
||||||
|
|
||||||
|
This helps prevent a DDoS attack from crashing the entire host.
|
||||||
|
|
||||||
|
## Capabilities
|
||||||
|
All capabilities are dropped with `--cap_drop ALL`.
|
||||||
|
|
||||||
|
No capabilities need to be added back, so none are.
|
||||||
|
|
||||||
|
## security.txt
|
||||||
|
*See https://securitytxt.org/ for RFC + generator.*
|
||||||
|
|
||||||
|
This stack comes with a `security.txt` generator in `scripts__security_txt`, which:
|
||||||
|
- Templates mail contact, expiry, GPG public key link, and canonical path.
|
||||||
|
- Signs the file with the GPG private key referenced in the link.
|
||||||
|
|
||||||
|
To use it, first adjust the following block in `gen.py`:
|
||||||
|
```python
|
||||||
|
MAILTO =
|
||||||
|
EXPIRY =
|
||||||
|
MAILTO_PGP_FINGERPRINT =
|
||||||
|
DEPLOY_DOMAIN =
|
||||||
|
```
|
||||||
|
|
||||||
|
Then, run `./gen.py` from any working directory. Remember to review the generated file, and update `docker config`.
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
-----BEGIN PGP SIGNED MESSAGE-----
|
||||||
|
Hash: SHA512
|
||||||
|
|
||||||
|
Contact: mailto:s174509@dtu.dk
|
||||||
|
Expires: 2024-08-01T00:00:00
|
||||||
|
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/E3B345EFFF5B3994BC1D12603D01BE95F3EFFEB9
|
||||||
|
Preferred-Languages: en, dk
|
||||||
|
Canonical: https://timesigned.com/.well-known/security.txt
|
||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
iQIzBAEBCgAdFiEEG10i+uTnDBwXTs3FrZAcsPNwFDQFAmTUpRcACgkQrZAcsPNw
|
||||||
|
FDRt9g/9GnqvAVUCBEZYtv+WwizxRe1iZF5ABIHytnymqsgjNjoF0uBxCZzR7MFZ
|
||||||
|
z7yP/ChmaS9g14DOSAUs5I3si3mF1pcHgS0/auGMB84xg2p3Jn1ZmUIU2mPppEqw
|
||||||
|
PvIju6hM5dSEgZap8iwxUis7bIqdtV+PeYfZdzRkXyVnBSCNpbK9VHX5enyMX7MD
|
||||||
|
Is7PzQorn3MwytmhxOkYZ4XRxFd2OUtMm8QDQuSZjPSCEtXykH5Y6ITn1nCuJYQw
|
||||||
|
Nz9wyE4bNnzdZMVFWzDdwICDHoWzQO3SCvyDbxKlDnY+AN2/6pzKvPo+C3iMpNdo
|
||||||
|
MG+BuXVKc2ZwOj4+g6Srk9sM0flMy83HHOTYFXLx2M7guaa/+WaJK7GiKjaQUQJk
|
||||||
|
fV/toxLEpmZONbGFQQR9wXvwA6iIee08A2Le9gmGdD2T/OUrTOVXemqd9tvhfDPn
|
||||||
|
RserBgHnnFO7+ucIFjtqwhMmh3iXLg+x/cZyvt25Gke9WhwPu9oEEMLmP/M2N7XC
|
||||||
|
TGopbg7GbDoZNY/BEz0Fh49DNYef8kemFc/qEFBV0XbVZRqIH0+zBrrs6z9LdSy+
|
||||||
|
soB4yooK7dBa3Sxx01jYwv6o5yaKcBbxeNIx3Xf8awLONspr5RMELOSPSECAERs+
|
||||||
|
GHYcpHSvBMzrdaz+uW9tHgKUAK9URDO8DOQphltZpg1ldTFIrZA=
|
||||||
|
=XXVW
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
|
|
@ -0,0 +1,60 @@
|
||||||
|
version: "3.8"
|
||||||
|
|
||||||
|
services:
|
||||||
|
site-support:
|
||||||
|
image: git.sofus.io/so-rose/site-support:0
|
||||||
|
user: "5020:5020"
|
||||||
|
cap_drop:
|
||||||
|
- ALL
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
- /etc/timezone:/etc/timezone:ro
|
||||||
|
|
||||||
|
configs:
|
||||||
|
- source: site-support__security.txt
|
||||||
|
target: /public/.well-known/security.txt
|
||||||
|
uid: "5020"
|
||||||
|
gid: "5020"
|
||||||
|
|
||||||
|
environment:
|
||||||
|
SERVER_PORT: "8787"
|
||||||
|
SERVER_REDIRECT_TRAILING_SLASH: "true"
|
||||||
|
|
||||||
|
SERVER_LOG_LEVEL: "info"
|
||||||
|
SERVER_LOG_REMOTE_ADDRESS: "false"
|
||||||
|
|
||||||
|
SERVER_THREADS_MULTIPLIER: "0" ## Use # CPUs
|
||||||
|
|
||||||
|
SERVER_SECURITY_HEADERS: "true"
|
||||||
|
SERVER_DIRECTORY_LISTING: "false"
|
||||||
|
|
||||||
|
SERVER_CACHE_CONTROL_HEADERS: "false" ## change when stable?
|
||||||
|
SERVER_COMPRESSION: "true" ## reconsider for small ssg payload
|
||||||
|
SERVER_COMPRESSION_STATIC: "false" ## pre-compress? :)
|
||||||
|
|
||||||
|
deploy:
|
||||||
|
mode: replicated
|
||||||
|
replicas: 1
|
||||||
|
|
||||||
|
# resources:
|
||||||
|
# limits:
|
||||||
|
# cpus: "4.0"
|
||||||
|
# memory: "4G"
|
||||||
|
|
||||||
|
restart_policy:
|
||||||
|
condition: on-failure
|
||||||
|
delay: 5s
|
||||||
|
max_attempts: 3
|
||||||
|
window: 120s
|
||||||
|
|
||||||
|
networks:
|
||||||
|
- mesh_public
|
||||||
|
|
||||||
|
configs:
|
||||||
|
site-support__security.txt:
|
||||||
|
external: true
|
||||||
|
|
||||||
|
networks:
|
||||||
|
mesh_public:
|
||||||
|
external: true
|
||||||
|
|
@ -0,0 +1,66 @@
|
||||||
|
####################
|
||||||
|
# - Deployment
|
||||||
|
####################
|
||||||
|
- hosts: leader
|
||||||
|
become: "true"
|
||||||
|
vars:
|
||||||
|
stack_name: "site-support"
|
||||||
|
stack_configs:
|
||||||
|
- "site-support__security.txt"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
####################
|
||||||
|
# - Stop the Stack
|
||||||
|
####################
|
||||||
|
- name: "Stop Stack: {{ stack_name }}"
|
||||||
|
community.docker.docker_stack:
|
||||||
|
state: "absent"
|
||||||
|
absent_retries: 15
|
||||||
|
name: "{{ stack_name }}"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Network Creation
|
||||||
|
####################
|
||||||
|
- name: "Create Network: mesh_public"
|
||||||
|
community.docker.docker_network:
|
||||||
|
state: "present"
|
||||||
|
name: "mesh_public"
|
||||||
|
driver: "overlay"
|
||||||
|
scope: "swarm"
|
||||||
|
attachable: true
|
||||||
|
appends: true
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Config Creation
|
||||||
|
####################
|
||||||
|
- name: "Create Docker Configs"
|
||||||
|
community.docker.docker_config:
|
||||||
|
state: "present"
|
||||||
|
name: "{{ item }}"
|
||||||
|
data: "{{ lookup('template', './configs/' ~ item) | b64encode }}"
|
||||||
|
data_is_b64: "true"
|
||||||
|
with_items: "{{ stack_configs }}"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Stack Deployment
|
||||||
|
####################
|
||||||
|
- name: "Upload Stack to /tmp"
|
||||||
|
template:
|
||||||
|
src: "./docker-compose.yml"
|
||||||
|
dest: "/tmp/{{ stack_name }}.yml"
|
||||||
|
owner: "root"
|
||||||
|
group: "root"
|
||||||
|
mode: "0640"
|
||||||
|
|
||||||
|
- name: "Deploy Stack: {{ stack_name }}"
|
||||||
|
community.docker.docker_stack:
|
||||||
|
state: "present"
|
||||||
|
prune: "true"
|
||||||
|
name: "{{ stack_name }}"
|
||||||
|
compose:
|
||||||
|
- "/tmp/{{ stack_name }}.yml"
|
||||||
|
|
||||||
|
- name: "Delete /tmp Stack"
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "/tmp/{{ stack_name }}.yml"
|
||||||
|
state: "absent"
|
||||||
|
|
@ -0,0 +1,126 @@
|
||||||
|
#!/usr/bin/python3
|
||||||
|
# Copyright (C) 2023 Sofus Albert Høgsbro Rose
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||||
|
"""This script templates and signs a `security.txt` file.
|
||||||
|
|
||||||
|
Note that:
|
||||||
|
- This script presumes that `gpg` is installed.
|
||||||
|
- This script presumes that the private key of the configued fingerprint is available to use with `gpg --clearsign`.
|
||||||
|
- The keyserver is hardcoded to `keys.openpgp.org`.
|
||||||
|
|
||||||
|
To use, first adjust the following configuration block:
|
||||||
|
```python
|
||||||
|
MAILTO =
|
||||||
|
EXPIRY =
|
||||||
|
MAILTO_PGP_FINGERPRINT =
|
||||||
|
DEPLOY_DOMAIN =
|
||||||
|
```
|
||||||
|
|
||||||
|
Then, just run `./gen.py`.
|
||||||
|
|
||||||
|
**REMEMBER TO REVIEW THE GENERATED FILE BEFORE DEPLOYMENT**.
|
||||||
|
"""
|
||||||
|
|
||||||
|
import os
|
||||||
|
import sys
|
||||||
|
if not all([
|
||||||
|
sys.version_info.major == 3,
|
||||||
|
sys.version_info.minor in [9, 10, 11, 12, 13],
|
||||||
|
]):
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
from pathlib import Path
|
||||||
|
import platform
|
||||||
|
import shutil
|
||||||
|
import subprocess
|
||||||
|
import contextlib
|
||||||
|
from datetime import datetime
|
||||||
|
from string import Template
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Configuration
|
||||||
|
####################
|
||||||
|
MAILTO = "s174509@dtu.dk"
|
||||||
|
EXPIRY = datetime(year = 2024, month = 8, day = 1).isoformat()
|
||||||
|
MAILTO_PGP_FINGERPRINT = "E3B345EFFF5B3994BC1D12603D01BE95F3EFFEB9"
|
||||||
|
DEPLOY_DOMAIN = "https://timesigned.com"
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Constants
|
||||||
|
####################
|
||||||
|
SCRIPT_PATH = Path(__file__).resolve().parent
|
||||||
|
PATH_SECURITY_TXT = (
|
||||||
|
SCRIPT_PATH.parent / "configs" / "site-support__security.txt"
|
||||||
|
)
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Utilities
|
||||||
|
####################
|
||||||
|
@contextlib.contextmanager
|
||||||
|
def cd_script_dir() -> None:
|
||||||
|
cwd_orig = Path.cwd()
|
||||||
|
|
||||||
|
os.chdir(SCRIPT_PATH)
|
||||||
|
try:
|
||||||
|
yield
|
||||||
|
finally:
|
||||||
|
os.chdir(cwd_orig)
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Actions
|
||||||
|
####################
|
||||||
|
def sign_security_txt() -> None:
|
||||||
|
if PATH_SECURITY_TXT.is_file():
|
||||||
|
PATH_SECURITY_TXT.unlink()
|
||||||
|
## Avoid platform-defined (os.rename()) shutil.move() to existing file.
|
||||||
|
|
||||||
|
with cd_script_dir():
|
||||||
|
# Template
|
||||||
|
with open("security.txt.unsigned.tmpl", "r") as f0:
|
||||||
|
with open("security.txt.unsigned", "w") as f1:
|
||||||
|
f1.write(
|
||||||
|
Template(
|
||||||
|
f0.read()
|
||||||
|
).substitute(
|
||||||
|
MAILTO = MAILTO,
|
||||||
|
EXPIRY = EXPIRY,
|
||||||
|
MAILTO_PGP_FINGERPRINT = MAILTO_PGP_FINGERPRINT,
|
||||||
|
DEPLOY_DOMAIN = DEPLOY_DOMAIN,
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
# Sign + Delete Templated
|
||||||
|
subprocess.run([
|
||||||
|
"gpg",
|
||||||
|
"--local-user", "E3B345EFFF5B3994BC1D12603D01BE95F3EFFEB9",
|
||||||
|
"--clearsign", "security.txt.unsigned",
|
||||||
|
])
|
||||||
|
Path("security.txt.unsigned").unlink()
|
||||||
|
|
||||||
|
# Move
|
||||||
|
shutil.move(
|
||||||
|
"security.txt.unsigned.asc",
|
||||||
|
PATH_SECURITY_TXT,
|
||||||
|
)
|
||||||
|
|
||||||
|
####################
|
||||||
|
# - Main
|
||||||
|
####################
|
||||||
|
if __name__ == "__main__":
|
||||||
|
sign_security_txt()
|
||||||
|
|
||||||
|
# `cat` the Installed File
|
||||||
|
with open(PATH_SECURITY_TXT, "r") as f:
|
||||||
|
print(f.read(), end = "")
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
Contact: mailto:$MAILTO
|
||||||
|
Expires: $EXPIRY
|
||||||
|
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/$MAILTO_PGP_FINGERPRINT
|
||||||
|
Preferred-Languages: en, dk
|
||||||
|
Canonical: $DEPLOY_DOMAIN/.well-known/security.txt
|
||||||
Loading…
Reference in New Issue