Skip to content

Commit 892cd42

Browse files
fcv-iteratorItfcv-iteratorIt
committed
Merge branch 'stage' for release v1.4.0
2 parents 559bfbc + 6ebb6af commit 892cd42

File tree

11 files changed

+376
-2
lines changed

11 files changed

+376
-2
lines changed

‎.gitignore‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,6 @@
1-
.idea/
1+
.idea/
2+
ca.crt
3+
ca.key
4+
server.crt
5+
server.key
6+
server.csr

‎configuration/mosquitto-broker-os2iot/mosquitto-os2iot.conf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
auth_plugin /home/mosquitto-go-auth/go-auth.so
2+
listener 8885
3+
4+
cafile /etc/mosquitto/ca_certificates/ca.crt
5+
keyfile /etc/mosquitto/certs/server.key
6+
certfile /etc/mosquitto/certs/server.crt
7+
tls_version tlsv1.3
8+
9+
auth_opt_backends postgres
10+
11+
auth_opt_pg_host **INSERT HOSTNAME**
12+
auth_opt_pg_port **INSERT PORT**
13+
auth_opt_pg_user **INSERT USER**
14+
auth_opt_pg_password **INSERT PASSWORD**
15+
auth_opt_pg_dbname **INSERT DBNAME**
16+
auth_opt_pg_userquery SELECT mqttpasswordhash FROM iot_device WHERE mqttUsername = $1 limit 1
17+
auth_opt_pg_superquery SELECT COUNT(*) FROM iot_device WHERE (mqttusername = $1 AND permissions = 'superUser')
18+
auth_opt_pg_aclquery SELECT mqttTopicName FROM iot_device WHERE (mqttUsername = $1 AND permissions = 'write') OR (9 = $2 AND mqttUsername = $1)
19+
20+
auth_opt_pg_sslmode verify-ca
21+
auth_opt_hasher pbkdf2
22+
23+
auth_opt_hasher_salt_size 16
24+
auth_opt_hasher_iterations 1000
25+
auth_opt_hasher_keylen 32
26+
auth_opt_hasher_algorithm sha512
27+
28+
auth_opt_retry_count 5
29+
auth_opt_pg_connect_tries 5
30+
31+
listener 8884
32+
require_certificate true
33+
use_identity_as_username true
34+
35+
auth_opt_backends postgres
36+
37+
auth_opt_pg_host **INSERT HOSTNAME**
38+
auth_opt_pg_port **INSERT PORT**
39+
auth_opt_pg_user **INSERT USER**
40+
auth_opt_pg_password **INSERT PASSWORD**
41+
auth_opt_pg_dbname **INSERT DBNAME**
42+
auth_opt_pg_userquery SELECT mqttpasswordhash FROM iot_device WHERE mqttUsername = $1 limit 1
43+
auth_opt_pg_superquery SELECT COUNT(*) FROM iot_device WHERE (mqttusername = $1 AND permissions = 'superUser')
44+
auth_opt_pg_aclquery SELECT mqttTopicName FROM iot_device WHERE (mqttUsername = $1 AND permissions = 'write') OR (9 = $2 AND mqttUsername = $1)
45+
46+
auth_opt_pg_sslmode verify-ca
47+
48+
cafile /etc/mosquitto/ca_certificates/ca.crt
49+
keyfile /etc/mosquitto/certs/server.key
50+
certfile /etc/mosquitto/certs/server.crt
51+
tls_version tlsv1.3

‎docker-compose.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,13 @@ services:
9595
EMAIL_USER: [email protected] # Change this for sending emails with OS2iot
9696
EMAIL_PASS: some-login-pass # Change this for sending emails with OS2iot
9797
EMAIL_FROM: [email protected] # Change this for sending emails with OS2iot
98+
MQTT_BROKER_HOSTNAME: # Change this to the public ip/hostname of the mqtt broker
99+
ENCRYPTION_SYMMETRIC_KEY: # Change this to the symmetric key generated
100+
CA_KEY_PASSWORD: # Change this to the password of the generated CA certificate key
101+
MQTT_SUPER_USER_PASSWORD: # Change this to the password for the internal super user.
102+
volumes:
103+
- ./configuration/mosquitto-broker-os2iot/ca.crt:/tmp/os2iot/backend/dist/resources/ca.crt
104+
- ./configuration/mosquitto-broker-os2iot/ca.key:/tmp/os2iot/backend/dist/resources/ca.key
98105

99106
os2iot-postgresql:
100107
restart: always
@@ -142,6 +149,21 @@ services:
142149
depends_on:
143150
- os2iot-zookeeper
144151

152+
mosquitto-os2iot:
153+
image: os2iot-mosquitto
154+
ports:
155+
- 8884:8884
156+
- 8885:8885
157+
build:
158+
context: "./mosquitto-broker"
159+
dockerfile: "Dockerfile"
160+
volumes:
161+
- ./configuration/mosquitto-broker-os2iot/ca.crt:/etc/mosquitto/ca_certificates/ca.crt
162+
- ./configuration/mosquitto-broker-os2iot/ca.key:/etc/mosquitto/ca_certificates/ca.key
163+
- ./configuration/mosquitto-broker-os2iot/server.key:/etc/mosquitto/certs/server.key
164+
- ./configuration/mosquitto-broker-os2iot/server.crt:/etc/mosquitto/certs/server.crt
165+
- ./configuration/mosquitto-broker-os2iot/mosquitto-os2iot.conf:/etc/mosquitto/conf.d/go-auth.conf
166+
145167
volumes:
146168
pg-data:
147169
postgresqldata:

‎helm/charts/mosquitto-os2iot/Chart.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: v2
2+
name: mosquitto-os2iot
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
version: 0.1.2
18+
19+
# This is the version number of the application being deployed. This version number should be
20+
# incremented each time you make changes to the application.
21+
appVersion: 1.16.1

‎helm/charts/mosquitto-os2iot/templates/configmap.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: {{ $.Chart.Name }}-configmap
5+
data:
6+
go-auth.conf: |
7+
auth_plugin /home/mosquitto-go-auth/go-auth.so
8+
listener 8885
9+
10+
cafile /etc/mosquitto/ca_certificates/ca.crt
11+
keyfile /etc/mosquitto/certs/server.key
12+
certfile /etc/mosquitto/certs/server.crt
13+
tls_version tlsv1.3
14+
15+
auth_opt_backends postgres
16+
17+
auth_opt_pg_host {{ .Values.deployment.env.DATABASE_HOST }}
18+
auth_opt_pg_port {{ .Values.deployment.env.DATABASE_PORT }}
19+
auth_opt_pg_user {{ .Values.deployment.env.DATABASE_USERNAME }}
20+
auth_opt_pg_password {{ .Values.deployment.env.DATABASE_PASSWORD }}
21+
auth_opt_pg_dbname {{ .Values.deployment.env.DATABASE_NAME }}
22+
auth_opt_pg_userquery SELECT mqttPassword FROM iot_device WHERE mqttUsername = $1 limit 1
23+
auth_opt_pg_superquery SELECT COUNT(*) FROM iot_device WHERE (mqttusername = $1 AND permissions = 'superUser')
24+
auth_opt_pg_aclquery SELECT mqttTopicName FROM iot_device WHERE (mqttUsername = $1 AND permissions = 'write') OR (9 = $2 AND mqttUsername = $1)
25+
26+
auth_opt_pg_sslmode verify-ca
27+
auth_opt_hasher pbkdf2
28+
29+
auth_opt_hasher_salt_size 16
30+
auth_opt_hasher_iterations 1000
31+
auth_opt_hasher_keylen 32
32+
auth_opt_hasher_algorithm sha512
33+
34+
auth_opt_retry_count 5
35+
auth_opt_pg_connect_tries 5
36+
37+
listener 8884
38+
require_certificate true
39+
use_identity_as_username true
40+
41+
auth_opt_backends postgres
42+
43+
auth_opt_pg_host {{ .Values.deployment.env.DATABASE_HOST }}
44+
auth_opt_pg_port {{ .Values.deployment.env.DATABASE_PORT }}
45+
auth_opt_pg_user {{ .Values.deployment.env.DATABASE_USERNAME }}
46+
auth_opt_pg_password {{ .Values.deployment.env.DATABASE_PASSWORD }}
47+
auth_opt_pg_dbname {{ .Values.deployment.env.DATABASE_NAME }}
48+
auth_opt_pg_userquery SELECT mqttPassword FROM iot_device WHERE mqttUsername = $1 limit 1
49+
auth_opt_pg_superquery SELECT COUNT(*) FROM iot_device WHERE (mqttusername = $1 AND permissions = 'superUser')
50+
auth_opt_pg_aclquery SELECT mqttTopicName FROM iot_device WHERE (mqttUsername = $1 AND permissions = 'write') OR (9 = $2 AND mqttUsername = $1)
51+
52+
auth_opt_pg_sslmode verify-ca
53+
54+
cafile /etc/mosquitto/ca_certificates/ca.crt
55+
keyfile /etc/mosquitto/certs/server.key
56+
certfile /etc/mosquitto/certs/server.crt
57+
tls_version tlsv1.3

‎helm/charts/mosquitto-os2iot/templates/deployment.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
kind: Deployment
2+
apiVersion: apps/v1
3+
metadata:
4+
name: {{ $.Chart.Name }}
5+
labels:
6+
helm.sh/chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
7+
app.kubernetes.io/name: {{ $.Chart.Name }}
8+
app.kubernetes.io/instance: {{ $.Chart.Name }}-{{ .Values.DOCKER_IMAGE_TAG }}
9+
app.kubernetes.io/managed-by: {{ .Release.Service }}
10+
spec:
11+
replicas: {{ .Values.REPLICAS }}
12+
selector:
13+
matchLabels:
14+
app: {{ $.Chart.Name }}
15+
strategy:
16+
rollingUpdate:
17+
maxSurge: 1
18+
maxUnavailable: 0
19+
type: RollingUpdate
20+
revisionHistoryLimit: {{ .Values.REVISION_HISTORY_LIMIT }}
21+
template:
22+
metadata:
23+
labels:
24+
app: {{ $.Chart.Name }}
25+
version: "{{ $.Chart.Name }}-{{ .Values.DOCKER_IMAGE_TAG }}"
26+
spec:
27+
containers:
28+
- name: {{ $.Chart.Name }}
29+
image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
30+
imagePullPolicy: {{ .Values.deployment.image.pullPolicy }}
31+
ports:
32+
- name: mos-cert
33+
containerPort: 8884
34+
protocol: TCP
35+
- name: mos-userpass
36+
containerPort: 8885
37+
protocol: TCP
38+
resources:
39+
limits:
40+
cpu: 150m
41+
memory: 512Mi
42+
requests:
43+
cpu: 5m
44+
memory: 128Mi
45+
volumeMounts:
46+
- name: {{ $.Chart.Name }}-configmap
47+
mountPath: /etc/mosquitto/conf.d/go-auth.conf
48+
subPath: go-auth.conf
49+
- name: secret-ca-crt
50+
mountPath: /etc/mosquitto/ca_certificates
51+
readOnly: true
52+
- name: secret-server-key
53+
mountPath: /etc/mosquitto/certs
54+
readOnly: true
55+
volumes:
56+
- name: "{{ $.Chart.Name }}-configmap"
57+
configMap:
58+
name: "{{ $.Chart.Name }}-configmap"
59+
- name: secret-ca-crt
60+
secret:
61+
secretName: ca-keys
62+
- name: secret-server-key
63+
secret:
64+
secretName: server-keys
65+
restartPolicy: Always

‎helm/charts/mosquitto-os2iot/templates/service.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
kind: Service
2+
apiVersion: v1
3+
metadata:
4+
name: {{ $.Chart.Name }}-svc
5+
labels:
6+
app: {{ $.Chart.Name }}
7+
spec:
8+
type: ClusterIP
9+
ports:
10+
- name: mosquitto-os2iot
11+
port: 8884
12+
targetPort: 8884
13+
protocol: TCP
14+
- name: mosquitto-os2iot
15+
port: 8885
16+
targetPort: 8885
17+
protocol: TCP
18+
selector:
19+
app: {{ $.Chart.Name }}

‎helm/charts/mosquitto-os2iot/templates/virtualservice.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: networking.istio.io/v1alpha3
2+
kind: VirtualService
3+
metadata:
4+
name: "{{ $.Chart.Name }}-virtualservice"
5+
spec:
6+
hosts:
7+
- {{ .Values.INGRESS_ADDRESS | default (printf "%s-%s.%s" .Release.Namespace $.Chart.Name .Values.global.DOMAIN_NAME)}}
8+
gateways:
9+
- istio-system/istio-ingressgateway
10+
http:
11+
- name: {{ $.Chart.Name }}
12+
route:
13+
- destination:
14+
port:
15+
number: 8884
16+
number: 8885
17+
host: "{{ $.Chart.Name }}-svc"

‎helm/charts/mosquitto-os2iot/values.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Default values for aodb.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
# Registry the image comes from
6+
# CONTAINER_REGISTRY: postgres
7+
8+
# Image that needs to be used.
9+
DOCKER_IMAGE_NAME: mosquitto-os2iot
10+
11+
DOCKER_IMAGE_PULL_POLICY: IfNotPresent
12+
13+
# How many replicas of the pod?
14+
REPLICAS: 1
15+
16+
# How much revision history should be stored? (can clog up etcd)
17+
REVISION_HISTORY_LIMIT: 3
18+
19+
deployment:
20+
env:
21+
"DATABASE_HOST": ""
22+
"DATABASE_PORT": ""
23+
"DATABASE_USERNAME": ""
24+
"DATABASE_PASSWORD": ""
25+
"DATABASE_NAME": ""

‎helm/charts/os2iot-backend/templates/deployment.yaml‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,4 +80,26 @@ spec:
8080
- name: EMAIL_PASS
8181
value: some-login-pass
8282
- name: EMAIL_FROM
83-
value: [email protected]
83+
value: [email protected]
84+
- name: MQTT_SUPER_USER_PASSWORD
85+
value: some-super-user-password
86+
- name: MQTT_BROKER_HOSTNAME
87+
value: some-mqtt-broker-hostname
88+
- name: ENCRYPTION_SYMMETRIC_KEY
89+
value: some-encryption-symmetric-key
90+
- name: CA_KEY_PASSWORD
91+
value: some-ca-key-password
92+
volumeMounts:
93+
- name: secret-ca-crt
94+
mountPath: /tmp/os2iot/backend/resources
95+
readOnly: true
96+
volumes:
97+
- name: "{{ $.Chart.Name }}-configmap"
98+
configMap:
99+
name: "{{ $.Chart.Name }}-configmap"
100+
- name: secret-ca-crt
101+
secret:
102+
secretName: ca-keys
103+
restartPolicy: Always
104+
105+

0 commit comments

Comments
 (0)