Skip to content

Commit 1ed9e59

Browse files
erwindonerwindon
authored
Merge pull request #743 from intekhab1025/feature/SSL-TLS-sample-implementation
2 parents 60e400e + 15f73ec commit 1ed9e59

File tree

5 files changed

+200
-2
lines changed

5 files changed

+200
-2
lines changed

‎docker/build-and-upload.sh‎

100644100755
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ cd dockerfiles
44
set -e
55
tag=3007.4
66
docker build -f dockerfile-saltmaster --tag erwindon/saltgui-saltmaster:$tag --tag erwindon/saltgui-saltmaster:latest .
7+
docker build -f dockerfile-saltmaster-tls --tag erwindon/saltgui-saltmaster-tls:$tag --tag erwindon/saltgui-saltmaster-tls:latest .
78
docker build -f dockerfile-saltminion-ubuntu --tag erwindon/saltgui-saltminion-ubuntu:$tag --tag erwindon/saltgui-saltminion-ubuntu:latest .
89
docker build -f dockerfile-saltminion-debian --tag erwindon/saltgui-saltminion-debian:$tag --tag erwindon/saltgui-saltminion-debian:latest .
910
docker build -f dockerfile-saltminion-centos --tag erwindon/saltgui-saltminion-centos:$tag --tag erwindon/saltgui-saltminion-centos:latest .
@@ -12,6 +13,7 @@ docker images | awk '/^<none>/ {print $3;}' | xargs --no-run-if-empty docker rmi
1213
for t in $tag latest; do
1314
# this needs "docker login"
1415
docker push erwindon/saltgui-saltmaster:$t
16+
docker push erwindon/saltgui-saltmaster-tls:$t
1517
docker push erwindon/saltgui-saltminion-ubuntu:$t
1618
docker push erwindon/saltgui-saltminion-debian:$t
1719
docker push erwindon/saltgui-saltminion-centos:$t

‎docker/conf/master-tls‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# /etc/salt/master
2+
3+
file_roots:
4+
base:
5+
- /srv/salt/
6+
7+
pillar_roots:
8+
base:
9+
- /srv/pillar
10+
11+
external_auth:
12+
pam:
13+
salt:
14+
- .*
15+
- '@runner'
16+
- '@wheel'
17+
- '@jobs'
18+
19+
rest_cherrypy:
20+
port: 3334
21+
host: 0.0.0.0
22+
disable_ssl: false
23+
ssl_crt: /etc/ssl/saltgui/server.crt
24+
ssl_key: /etc/ssl/saltgui/server.key
25+
app: /saltgui/index.html
26+
static: /saltgui/static
27+
static_path: /static
28+
29+
netapi_enable_clients:
30+
- local
31+
- local_async
32+
- runner
33+
- wheel
34+
35+
saltgui_templates:
36+
template1:
37+
description: First template
38+
target: "*"
39+
command: test.fib num=10
40+
template2:
41+
description: Second template
42+
targettype: glob
43+
target: "*ubuntu*"
44+
command: test.version
45+
template3:
46+
description: Empty template
47+
template4:
48+
description: Fourth template
49+
targettype: compound
50+
target: "G@os:Ubuntu"
51+
command: test.version

‎docker/docker-compose-tls.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
version: '3'
2+
services:
3+
saltmaster-local:
4+
image: erwindon/saltgui-saltmaster-tls:3007.4
5+
hostname: saltmaster-local
6+
ports:
7+
- 4505:4505
8+
- 4506:4506
9+
- 3334:3334
10+
volumes:
11+
- ./srv/:/srv/
12+
- ./conf/master-tls:/etc/salt/master
13+
- ../saltgui:/saltgui
14+
- ssl_certs:/etc/ssl/saltgui
15+
16+
saltminion-ubuntu:
17+
image: erwindon/saltgui-saltminion-ubuntu:3007.4
18+
hostname: saltminion-ubuntu
19+
depends_on:
20+
- saltmaster-local
21+
restart: on-failure
22+
23+
saltminion-debian:
24+
image: erwindon/saltgui-saltminion-debian:3007.4
25+
hostname: saltminion-debian
26+
depends_on:
27+
- saltmaster-local
28+
restart: on-failure
29+
30+
saltminion-centos:
31+
image: erwindon/saltgui-saltminion-centos:3007.4
32+
hostname: saltminion-centos
33+
depends_on:
34+
- saltmaster-local
35+
restart: on-failure
36+
37+
volumes:
38+
ssl_certs:

‎docker/dockerfiles/dockerfile-saltmaster-tls‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
FROM ubuntu:24.04
2+
3+
LABEL maintainer="Erwin Dondorp <[email protected]>"
4+
LABEL name=salt-master-tls
5+
LABEL project="SaltGUI testing with TLS"
6+
LABEL version=3007.4
7+
8+
ENV SALT_VERSION=3007.4
9+
ENV DEBIAN_FRONTEND=noninteractive
10+
11+
# make download possible, make encrypted password generation possible
12+
RUN apt-get update
13+
RUN apt-get install --yes --no-install-recommends curl openssl adduser
14+
15+
# add a user for the frontend salt:salt
16+
RUN adduser salt
17+
RUN usermod -s /bin/bash -p "$(openssl passwd -1 salt)" salt
18+
19+
# install salt-master with salt-api
20+
# not using repo, so must explicitly do all packages
21+
RUN curl -k -L -o salt-common_${SALT_VERSION}.deb https://packages.broadcom.com/artifactory/saltproject-deb/pool/salt-common_${SALT_VERSION}_amd64.deb
22+
RUN curl -k -L -o salt-api_${SALT_VERSION}.deb https://packages.broadcom.com/artifactory/saltproject-deb/pool/salt-api_${SALT_VERSION}_amd64.deb
23+
RUN curl -k -L -o salt-master_${SALT_VERSION}.deb https://packages.broadcom.com/artifactory/saltproject-deb/pool/salt-master_${SALT_VERSION}_amd64.deb
24+
RUN apt install --yes --no-install-recommends ./salt-common_${SALT_VERSION}.deb ./salt-master_${SALT_VERSION}.deb ./salt-api_${SALT_VERSION}.deb
25+
26+
# install supervisor
27+
# because we need to run salt-master and salt-api
28+
RUN apt-get install --yes --no-install-recommends supervisor
29+
30+
# cleanup temporary files
31+
RUN rm -rf /var/lib/apt/lists/* *.deb \
32+
&& apt-get --yes autoremove \
33+
&& apt-get clean
34+
35+
# Create SSL directory and generate self-signed certificates
36+
RUN mkdir -p /etc/ssl/saltgui
37+
38+
# Generate SSL certificates using a single RUN command
39+
RUN cd /etc/ssl/saltgui && \
40+
openssl genrsa -out server.key 2048 && \
41+
openssl req -new -key server.key -out server.csr -subj "/C=US/ST=State/L=City/O=Organization/OU=OrgUnit/CN=saltgui" && \
42+
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt && \
43+
chmod 600 server.key && \
44+
chmod 644 server.crt && \
45+
rm server.csr && \
46+
echo "SSL certificates generated successfully"
47+
48+
# copy supervisord configuration
49+
COPY ./conf/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
50+
51+
# some volume configuration for the saltmaster
52+
VOLUME ["/pki", "/var/cache/salt", "/var/log/salt", "/etc/ssl/saltgui"]
53+
EXPOSE 3334 4505 4506
54+
55+
# define main container command
56+
# explicitly mentioning the (default) configuration file saves a warning
57+
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

‎docs/README.md‎

Lines changed: 52 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
SaltGUI is an open source web interface for managing a SaltStack server and its minions. Built using vanilla ES6 and implemented as a wrapper around the rest_cherrypy server a.k.a. salt-api.
44

5+
**Security Note**: For production deployments, TLS encryption is strongly recommended. See [TLS Configuration](#tls-configuration) for complete setup instructions.
6+
57
The version tagged `release` is the latest released version. The version `master` should be fine, but it may contain changes that are not yet in these release-notes.
68

79
See [SaltGUI documentation](https://erwindon.github.io/SaltGUI/) for the complete documentation.
@@ -92,7 +94,9 @@ rest_cherrypy:
9294
- Replace each of the `/srv/saltgui` in the above config with the actual `saltgui` directory from the GIT repository. Alternatively, you can create a soft-link /src/saltgui that points to the actual saltgui directory.
9395
- To successfully use `salt-api` with a default PAM setup, if may be needed to grant read access on `/etc/shadow` to the `salt` user. This is best done using `sudo usermod --append --groups shadow salt`.
9496
- Restart everything with ``pkill salt-master && pkill salt-api && salt-master -d && salt-api -d``
95-
- You should be good to go. If you have any problems, open a GitHub issue. As always, SSL is recommended wherever possible but setup is beyond the scope of this guide.
97+
- You should be good to go. If you have any problems, open a GitHub issue.
98+
99+
**For TLS configuration**, see the dedicated [TLS Configuration](#tls-configuration) section below for comprehensive setup instructions including enterprise best practices.
96100

97101
**Note: With this configuration, the user has access to all salt modules available, maybe this is not what you want**
98102

@@ -582,13 +586,59 @@ Note that the main page of SaltGUI is then located at `/app/`. When you want `/a
582586
583587

584588
## Development environment with Docker
585-
To make life a bit easier for testing SaltGUI or setting up a local development environment you can use the provided docker-compose setup in this repository to run a saltmaster with three minions, including SaltGUI:
589+
To make life a bit easier for testing SaltGUI or setting up a local development environment, you can use the provided docker-compose setups in this repository:
590+
591+
**For basic testing (HTTP):**
586592
```
587593
cd docker
588594
docker-compose up
589595
```
590596
Then browse to [http://localhost:3333/](http://localhost:3333/), you can login with `salt:salt`.
591597

598+
**For TLS testing:**
599+
```
600+
cd docker
601+
docker-compose -f docker-compose-tls.yml up
602+
```
603+
Then browse to [https://localhost:3334/](https://localhost:3334/), you can login with `salt:salt`.
604+
605+
606+
## TLS-enabled Docker Environment
607+
For production use or testing with TLS encryption, you can use the TLS-enabled Docker configuration:
608+
609+
```bash
610+
cd docker
611+
docker-compose -f docker-compose-tls.yml up
612+
```
613+
614+
This will start:
615+
- A SaltGUI master with TLS enabled on port 3334
616+
- Three minions (Ubuntu, Debian, CentOS)
617+
- Self-signed SSL certificates (automatically generated)
618+
619+
**Connecting to TLS-enabled SaltGUI:**
620+
- Browse to [https://localhost:3334/](https://localhost:3334/)
621+
- You will see a security warning about the self-signed certificate
622+
- Accept the certificate to proceed (for testing purposes)
623+
- Login with `salt:salt`
624+
625+
**Important Notes for TLS Setup:**
626+
- The TLS configuration uses self-signed certificates generated during the Docker build
627+
- For production use, replace the self-signed certificates with proper CA-signed certificates
628+
- You can mount your own certificates by modifying the `ssl_certs` volume in `docker-compose-tls.yml`
629+
- The TLS master configuration is located in `docker/conf/master-tls`
630+
631+
**Custom SSL Certificates:**
632+
To use your own SSL certificates, place them in a directory and mount it to the container:
633+
```yaml
634+
volumes:
635+
- /path/to/your/certs:/etc/ssl/saltgui
636+
```
637+
638+
Your certificate directory should contain:
639+
- `server.crt` - SSL certificate file
640+
- `server.key` - Private key file
641+
592642

593643
## Testing
594644
We provide some functional tests and unit tests. They use the docker setup to run the functional tests. You will also need [yarn](https://yarnpkg.com) and [node.js](https://nodejs.org/en/) to run them. When you have docker, yarn and node.js installed, you can run the tests from the root of the repository like this:

0 commit comments

Comments
 (0)