From 8a25da1ee9a897fdfde82ef37474f10202a6a9ab Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Wed, 10 Oct 2018 21:24:24 -0400 Subject: [PATCH] Reverse Proxy - The Big Commit --- salt/ca/files/signing_policies.conf | 13 ++++ salt/common/init.sls | 5 +- salt/common/nginx/nginx.conf.so-master | 91 ++++++++++++++++---------- salt/firewall/init.sls | 20 ++++++ salt/kibana/init.sls | 2 +- salt/ssl/init.sls | 14 ++++ 6 files changed, 107 insertions(+), 38 deletions(-) diff --git a/salt/ca/files/signing_policies.conf b/salt/ca/files/signing_policies.conf index 1e7998be6..02aa8cb20 100644 --- a/salt/ca/files/signing_policies.conf +++ b/salt/ca/files/signing_policies.conf @@ -25,3 +25,16 @@ x509_signing_policies: - authorityKeyIdentifier: keyid,issuer:always - days_valid: 3000 - copypath: /etc/pki/issued_certs/ + master: + - minions: '*' + - signing_private_key: /etc/pki/ca.key + - signing_cert: /etc/pki/ca.crt + - C: US + - ST: Utah + - L: Salt Lake City + - basicConstraints: "critical CA:false" + - keyUsage: "critical keyEncipherment" + - subjectKeyIdentifier: hash + - authorityKeyIdentifier: keyid,issuer:always + - days_valid: 3000 + - copypath: /etc/pki/issued_certs/ diff --git a/salt/common/init.sls b/salt/common/init.sls index 4b4ec3a62..577cdb1f5 100644 --- a/salt/common/init.sls +++ b/salt/common/init.sls @@ -112,7 +112,7 @@ nginxtmp: # Start the core docker so-core: docker_container.running: - - image: toosmooth/so-core:test2 + - image: toosmooth/so-core:techpreview - hostname: so-core - user: socore - binds: @@ -121,6 +121,9 @@ so-core: - /opt/so/log/nginx/:/var/log/nginx:rw - /opt/so/tmp/nginx/:/var/lib/nginx:rw - /opt/so/tmp/nginx/:/run:rw + - /etc/pki/master.crt:/etc/pki/nginx/server.crt:ro + - /etc/pki/master.key:/etc/pki/nginx/server.key:ro + - cap_add: NET_BIND_SERVICE - port_bindings: - 80:80 diff --git a/salt/common/nginx/nginx.conf.so-master b/salt/common/nginx/nginx.conf.so-master index 39688f3df..134d7a0c7 100644 --- a/salt/common/nginx/nginx.conf.so-master +++ b/salt/common/nginx/nginx.conf.so-master @@ -1,3 +1,4 @@ +{%- set masterip = salt['pillar.get']('master:mainip', '') %} # For more information on configuration, see: # * Official English Documentation: http://nginx.org/en/docs/ # * Official Russian Documentation: http://nginx.org/ru/docs/ @@ -35,16 +36,64 @@ http { # for more information. include /etc/nginx/conf.d/*.conf; - server { - listen 80 default_server; - listen [::]:80 default_server; - server_name _; - root /usr/share/nginx/html; + #server { + # listen 80 default_server; + # listen [::]:80 default_server; + # server_name _; + # root /opt/socore/html; + # index index.html; # Load configuration files for the default server block. - include /etc/nginx/default.d/*.conf; + #include /etc/nginx/default.d/*.conf; + + # location / { + # } + + # error_page 404 /404.html; + # location = /40x.html { + # } + + # error_page 500 502 503 504 /50x.html; + # location = /50x.html { + # } + #} + server { + listen 80 default_server; + server_name _; + return 301 https://$host$request_uri; + } + + +# Settings for a TLS enabled server. + + server { + listen 443 ssl http2 default_server; + #listen [::]:443 ssl http2 default_server; + server_name _; + root /opt/socore/html; + index index.html; + + ssl_certificate "/etc/pki/nginx/server.crt"; + ssl_certificate_key "/etc/pki/nginx/private/server.key"; + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 10m; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + # Load configuration files for the default server block. + #include /etc/nginx/default.d/*.conf; location / { + try_files $uri $uri.html index.html; + } + + location /app/kibana { + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_cache_bypass $http_upgrade; + proxy_pass http://{{ masterip }}:5601/; } error_page 404 /404.html; @@ -56,34 +105,4 @@ http { } } -# Settings for a TLS enabled server. -# -# server { -# listen 443 ssl http2 default_server; -# listen [::]:443 ssl http2 default_server; -# server_name _; -# root /usr/share/nginx/html; -# -# ssl_certificate "/etc/pki/nginx/server.crt"; -# ssl_certificate_key "/etc/pki/nginx/private/server.key"; -# ssl_session_cache shared:SSL:1m; -# ssl_session_timeout 10m; -# ssl_ciphers HIGH:!aNULL:!MD5; -# ssl_prefer_server_ciphers on; -# -# # Load configuration files for the default server block. -# include /etc/nginx/default.d/*.conf; -# -# location / { -# } -# -# error_page 404 /404.html; -# location = /40x.html { -# } -# -# error_page 500 502 503 504 /50x.html; -# location = /50x.html { -# } -# } - } diff --git a/salt/firewall/init.sls b/salt/firewall/init.sls index bfd43b36a..6b0a3737e 100644 --- a/salt/firewall/init.sls +++ b/salt/firewall/init.sls @@ -88,6 +88,15 @@ enable_docker_user_established: # Rules if you are a Master {% if grains['role'] == 'so-master' %} +#This should be more granular +iptables_allow_master_docker: + iptables.insert: + - table: filter + - chain: INPUT + - jump: ACCEPT + - source: 172.17.0.0/24 + - position: 1 + - save: True {% for ip in pillar.get('masterfw') %} # Allow Redis @@ -216,6 +225,17 @@ enable_storagenode_redis_6379_{{ip}}: - position: 1 - save: True +enable_storagenode_ES_9300_{{ip}}: + iptables.insert: + - table: filter + - chain: DOCKER-USER + - jump: ACCEPT + - proto: tcp + - source: {{ ip }} + - dport: 9300 + - position: 1 + - save: True + {% endfor %} # Allow Beats Endpoints to send their beats traffic diff --git a/salt/kibana/init.sls b/salt/kibana/init.sls index 2801fed7a..9095472bb 100644 --- a/salt/kibana/init.sls +++ b/salt/kibana/init.sls @@ -64,7 +64,7 @@ so-kibana: - user: kibana - environment: - KIBANA_DEFAULTAPPID=dashboard/94b52620-342a-11e7-9d52-4f090484f59e - - ELASTICSEARCH_HOST=172.17.0.7 + - ELASTICSEARCH_HOST={{ master }} - ELASTICSEARCH_PORT=9200 - MASTER={{ master }} - binds: diff --git a/salt/ssl/init.sls b/salt/ssl/init.sls index 8ce992418..b2c2d6b36 100644 --- a/salt/ssl/init.sls +++ b/salt/ssl/init.sls @@ -63,6 +63,20 @@ fbcrtlink: bits: 4096 backup: True +# Create a cert for the reverse proxy +/etc/pki/master.crt: + x509.certificate_managed: + - ca_server: {{ master }} + - signing_policy: master + - public_key: /etc/pki/master.key + - CN: {{ master }} + - days_remaining: 3000 + - backup: True + - managed_private_key: + name: /etc/pki/master.key + bits: 4096 + backup: True + {% endif %} {% if grains['role'] == 'so-SENSOR' %}