Skip to content

Commit 56077bb

Browse files
author
Dimy Jeannot
committed
fix: working on infrastructure with Pulumi
1 parent ab538b4 commit 56077bb

File tree

15 files changed

+420
-36
lines changed

15 files changed

+420
-36
lines changed

‎apps/clients/public/cli/v2alpha/oeco/docs/flow.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ sequenceDiagram
7373
7474
```
7575

76-
## Traffic Flow Across Mesh
76+
## Traffic Flow Across Meshes
7777
Once client connection to mesh is established, all traffic no longer goes through edge-router (Ideally it does, revisit this)
7878

7979
Now, .mesh urls are now available. For example: system.api.organization.mesh/v2alpha/connector

‎infrastructure/apps/workloads/private/edge/v2alpha/edge-router/communication-edge-router.tar.gz‎

3.61 MB
Binary file not shown.

‎infrastructure/apps/workloads/private/edge/v2alpha/edge-router/main.go‎

Lines changed: 64 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,86 @@
11
package main
22

33
import (
4+
"libs/private/go/infrastructure/v2alpha"
5+
sdkv2alphalib "libs/public/go/sdk/v2alpha"
6+
47
"github.com/pulumi/pulumi-fastly/sdk/v8/go/fastly"
58
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
6-
"libs/private/go/infrastructure/v2alpha"
79
)
810

911
func main() {
10-
1112
bounds := []sdkv2alphalib.Binding{}
1213

1314
infrastructure := infrastructurev2alphalib.NewInfrastructure(bounds)
1415

15-
//config := infrastructure.Config
16-
//name := infrastructurev2alphalib.ShortenString(config.App.EnvironmentName+"-"+config.App.Name, 63)
16+
// cnf := infrastructure.Config
17+
// name := infrastructurev2alphalib.ShortenString(cnf.App.EnvironmentName+"-"+cnf.App.Name, 63)
18+
19+
// Create Config Store
20+
// Create DNS Records
21+
// Create
1722

1823
infrastructure.Run(func(ctx *pulumi.Context) error {
24+
//exampleConfigstore, err := fastly.NewConfigstore(ctx, "config", &fastly.ConfigstoreArgs{
25+
// Name: pulumi.String("config"),
26+
//})
27+
//if err != nil {
28+
// return err
29+
//}
30+
31+
// name := "api.system." + cnf.App.EnvironmentName + ".oeco.cloud"
32+
name := "api.system.dev-1.oeco.cloud"
1933

20-
_, err := fastly.NewServiceVcl(ctx, "myservice", &fastly.ServiceVclArgs{
21-
Name: pulumi.String("myawesometestservice"),
34+
exampleConfigstore, err := fastly.NewConfigstore(ctx, "example", &fastly.ConfigstoreArgs{
35+
Name: pulumi.String("my_config_store"),
2236
})
2337
if err != nil {
2438
return err
2539
}
26-
return nil
2740

41+
pkg, err := fastly.GetPackageHash(ctx, &fastly.GetPackageHashArgs{
42+
Filename: pulumi.StringRef("communication-edge-router.tar.gz"),
43+
}, nil)
44+
if err != nil {
45+
return err
46+
}
47+
48+
_, err = fastly.NewServiceCompute(ctx, name, &fastly.ServiceComputeArgs{
49+
Name: pulumi.String(name + "1"),
50+
// Activate: pulumi.Bool(true),
51+
// Comment: pulumi.String("Communication System Edge Router"),
52+
Domains: fastly.ServiceComputeDomainArray{
53+
&fastly.ServiceComputeDomainArgs{
54+
Name: pulumi.String(name),
55+
},
56+
},
57+
Package: &fastly.ServiceComputePackageArgs{
58+
Filename: pulumi.String("communication-edge-router.tar.gz"),
59+
SourceCodeHash: pulumi.String(pkg.Hash),
60+
},
61+
ResourceLinks: fastly.ServiceComputeResourceLinkArray{
62+
&fastly.ServiceComputeResourceLinkArgs{
63+
Name: pulumi.String("my_resource_link"),
64+
ResourceId: exampleConfigstore.ID(),
65+
},
66+
},
67+
ForceDestroy: pulumi.Bool(true),
68+
//ProductEnablement: &fastly.ServiceComputeProductEnablementArgs{
69+
// Fanout: pulumi.Bool(true),
70+
// Websockets: pulumi.Bool(true),
71+
//},
72+
//ResourceLinks: fastly.ServiceComputeResourceLinkArray{
73+
// &fastly.ServiceComputeResourceLinkArgs{
74+
// Name: pulumi.String("string"),
75+
// ResourceId: pulumi.String("string"),
76+
// LinkId: pulumi.String("string"),
77+
// },
78+
//},
79+
//VersionComment: pulumi.String("Managed with Pulumi: Organization: " + ctx.Organization() + "; Project: " + ctx.Project() + "; Stack: " + ctx.Stack()),
80+
})
81+
if err != nil {
82+
return err
83+
}
84+
return nil
2885
})
2986
}

‎infrastructure/apps/workloads/private/edge/v2alpha/edge-router/spec.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
app:
2+
name: 'edge-v2alpha-edge-router'
3+
version: 'v2.0.0'
4+
environmentName: 'local-1'
5+
environmentType: 'local'

‎infrastructure/apps/workloads/private/event/v2alpha/event-multiplexer/README.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,17 @@
11
# Allow port 6477 and 4222 on this server as it actually listens on ports
22

3-
# Install Nebula client using TUN device
3+
- Install Nebula client using TUN device
4+
- Route all traffic through TUN device except for what is on port 6477
5+
- Bind port 4222 to TUN device
6+
- Bind port 6477 to eth0 device
7+
8+
run as nonroot
9+
10+
- Download binary
11+
- Untar
12+
- chmod +x
13+
copy spec.yaml
14+
- Mount block storagedrive and backup drive
415

516
# Allow Fastly to connect via mTLS
617

‎infrastructure/apps/workloads/public/mesh/v2alpha/lighthouse/Pulumi.dev-1.yaml‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎infrastructure/apps/workloads/public/mesh/v2alpha/lighthouse/Pulumi.lighthouse.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{environment: [workloads-public-mesh-v2alpha-lighthouse/lighthouse], config: {'workloads-public-mesh-v2alpha-lighthouse:publicKey': ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVJUmm/xu38+qrMM3aMEWYI3oNNKVTn0+vF656S5RbTzlf4ZCBKqtX4qb1hDqsmgbYxZ0m8cRM0IrOnpQ6gAbQs7ddsDtSnzTekx9uvX/9z8hBklKRr93pLgT+yp5z2sQaHQ97TVfZjyeC+2utSnpWd12zHhIGd1R8QaROkjY9ho6CHnW1SEdSuY7Wh+Ye6Ho5fMtf3zBpjg3jFnWxagEBrj6tJber8EFh9Ge+dVXQAwkjql8yOpKrumq0NlJXZo5zs4ulkkh7ibT0Z4dQDea5ZTe7Sq6CM3YdsVgBrgVY4N+QRWZEfaSIU/GHht3q4sx+ZBPK5ObAqjXiIooT3X8j dimy@jeannotfamily.com, 'workloads-public-mesh-v2alpha-lighthouse:caCrt': "-----BEGIN NEBULA CERTIFICATE-----\nCkYKFE9wZW4gRWNvc3lzdGVtcywgSW5jKJXh5bsGMJXI6soGOiBPBg+axf0/kr+2\nJFR5zoIprGzUMux1e4Xn8r2LNXtb4UABEkB3XmbVDDYyBQJP9yDz23O7tGCBpmQg\n+SjO6MZf61dHcywoKHcsoI7hJGAH45pxMLSjdqrgizpUBa/fQ8eJhY0E\n-----END NEBULA CERTIFICATE-----", 'workloads-public-mesh-v2alpha-lighthouse:hostCrt': "-----BEGIN NEBULA CERTIFICATE-----\nCn0KH2xvY2FsLTEtbWVzaC12MmFscGhhLWxpZ2h0aG91c2USCoHIoYUMgP7//w8o\nyuHluwYwlMjqygY6IFje4h+K3O69JE0f7uVNlM+08XwKFMYqDiZ8QHLrW3M3SiBt\n2p/vFggWouJBA7f+BaoZGCNpuwpzek4eVuLSEeR/whJApDqwoYs43/iuIQbjEKGh\nrqZXM99yFdD9twC4Y10PTuON6liEUlmBIXYqmW5nnuQvYpinosBpwaQR1Tdaa7tx\nAw==\n-----END NEBULA CERTIFICATE-----", 'workloads-public-mesh-v2alpha-lighthouse:hostKey': "-----BEGIN NEBULA X25519 PRIVATE KEY-----\nfUpncxjrNYaBDR/lhDOUtbMqw4qIW1zbBwKGaB764yo=\n-----END NEBULA X25519 PRIVATE KEY-----"}}

‎infrastructure/apps/workloads/public/mesh/v2alpha/lighthouse/Pulumi.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
name: workloads-private-event-v2alpha-event-multiplexer
2-
description: An event multiplexer
1+
name: workloads-public-mesh-v2alpha-lighthouse
2+
description: A lighthouse
33
runtime: go

‎infrastructure/apps/workloads/public/mesh/v2alpha/lighthouse/README.md‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,32 @@ Copy over
55
- server.crt
66
- server.key
77

8+
create new nonroot user
9+
10+
run everything as nonroot
811

912
mv ca.crt /etc/nebula/ca.crt
1013
mv server.crt /etc/nebula/host.crt
11-
mv server.key /etc/nebula/host.key
14+
mv server.key /etc/nebula/host.key
15+
16+
download and untar lighthouse.tar.gz
17+
chmod +x lighthouse
18+
add script to run on startup
19+
20+
21+
Open firewall 4242/udp
22+
23+
pulumi config set version
24+
cat /path/to/id.pub | pulumi config set publicKey
25+
cat /path/to/ca.crt | pulumi config set caCrt
26+
27+
28+
./nebula-cert ca -name "Open Ecosystems, Inc"
29+
./nebula-cert sign -name "local-1-mesh-v2alpha-lighthouse" -ip "192.168.100.1/24"
30+
./nebula-cert sign -name "local-1-event-v2alpha-event-multiplexer" -ip "192.168.100.5/24" -groups "multiplexers,ssh"
31+
32+
cat ca.crt | pulumi config set caCrt
33+
cat local-1-mesh-v2alpha-lighthouse.crt | pulumi config set hostCrt
34+
cat local-1-mesh-v2alpha-lighthouse.key | pulumi config set hostKey
35+
36+
./nebula-cert sign -name "configuration-v2alpha-configuration" -ip "192.168.100.9/24" -groups "connectors"

‎infrastructure/apps/workloads/public/mesh/v2alpha/lighthouse/cloud-config.txt‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
#cloud-config
2+
package_update: true
3+
package_upgrade: true
4+
users:
5+
- default
6+
- name: notroot
7+
groups:
8+
- sudo
9+
sudo:
10+
- ALL=(ALL) NOPASSWD:ALL
11+
shell: /bin/bash
12+
lock_passwd: true
13+
ssh_authorized_keys:
14+
- %s
15+
16+
write_files:
17+
- path: /etc/motd
18+
content: |
19+
Welcome to your Lighthouse!
20+
- path: /etc/nebula/ca.crt
21+
content: |
22+
%s
23+
- path: /etc/nebula/host.crt
24+
content: |
25+
%s
26+
- path: /etc/nebula/host.key
27+
content: |
28+
%s
29+
30+
runcmd:
31+
- curl -L https://github.com/openecosystems/ecosystem/releases/download/apps-workloads-public-mesh-v2alpha-lighthouse%2Fdevel/apps-workloads-public-mesh-v2alpha-lighthouse_%s_Linux_x86_64.tar.gz | tar zx --strip-components=1 --directory /opt
32+
- chmod +x /opt/app
33+
34+
35+
#cloud-config
36+
package_update: true
37+
package_upgrade: true
38+
users:
39+
- default
40+
- name: notroot
41+
groups:
42+
- sudo
43+
sudo:
44+
- ALL=(ALL) NOPASSWD:ALL
45+
shell: /bin/bash
46+
lock_passwd: true
47+
ssh_authorized_keys:
48+
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVJUmm/xu38+qrMM3aMEWYI3oNNKVTn0+vF656S5RbTzlf4ZCBKqtX4qb1hDqsmgbYxZ0m8cRM0IrOnpQ6gAbQs7ddsDtSnzTekx9uvX/9z8hBklKRr93pLgT+yp5z2sQaHQ97TVfZjyeC+2utSnpWd12zHhIGd1R8QaROkjY9ho6CHnW1SEdSuY7Wh+Ye6Ho5fMtf3zBpjg3jFnWxagEBrj6tJber8EFh9Ge+dVXQAwkjql8yOpKrumq0NlJXZo5zs4ulkkh7ibT0Z4dQDea5ZTe7Sq6CM3YdsVgBrgVY4N+QRWZEfaSIU/GHht3q4sx+ZBPK5ObAqjXiIooT3X8j dimy@jeannotfamily.com
49+
write_files:
50+
- path: /etc/motd
51+
content: |
52+
Welcome to your Lighthouse!
53+
- content: |
54+
[Unit]
55+
Description=Lighthouse Service
56+
ConditionPathExists=/opt/app
57+
After=network.target
58+
[Service]
59+
Type=simple
60+
User=notroot
61+
Group=notroot
62+
LimitNOFILE=1024
63+
Restart=on-failure
64+
RestartSec=10
65+
startLimitIntervalSec=60
66+
WorkingDirectory=/opt
67+
ExecStart=/opt/app
68+
# make sure log directory exists and owned by syslog
69+
PermissionsStartOnly=true
70+
ExecStartPre=/bin/mkdir -p /var/log/app
71+
ExecStartPre=/bin/chown syslog:adm /var/log/app
72+
ExecStartPre=/bin/chmod 755 /var/log/app
73+
SyslogIdentifier=app
74+
[Install]
75+
WantedBy=multi-user.target
76+
path: /lib/systemd/system/lighthouse.service
77+
permissions: '0755'
78+
defer: true
79+
- path: /etc/nebula/ca.crt
80+
content: |
81+
-----BEGIN NEBULA CERTIFICATE-----
82+
CkYKFE9wZW4gRWNvc3lzdGVtcywgSW5jKJXh5bsGMJXI6soGOiBPBg+axf0/kr+2
83+
JFR5zoIprGzUMux1e4Xn8r2LNXtb4UABEkB3XmbVDDYyBQJP9yDz23O7tGCBpmQg
84+
+SjO6MZf61dHcywoKHcsoI7hJGAH45pxMLSjdqrgizpUBa/fQ8eJhY0E
85+
-----END NEBULA CERTIFICATE-----
86+
- path: /etc/nebula/host.crt
87+
content: |
88+
-----BEGIN NEBULA CERTIFICATE-----
89+
Cn0KH2xvY2FsLTEtbWVzaC12MmFscGhhLWxpZ2h0aG91c2USCoHIoYUMgP7//w8o
90+
yuHluwYwlMjqygY6IFje4h+K3O69JE0f7uVNlM+08XwKFMYqDiZ8QHLrW3M3SiBt
91+
2p/vFggWouJBA7f+BaoZGCNpuwpzek4eVuLSEeR/whJApDqwoYs43/iuIQbjEKGh
92+
rqZXM99yFdD9twC4Y10PTuON6liEUlmBIXYqmW5nnuQvYpinosBpwaQR1Tdaa7tx
93+
Aw==
94+
-----END NEBULA CERTIFICATE-----
95+
- path: /etc/nebula/host.key
96+
content: |
97+
-----BEGIN NEBULA X25519 PRIVATE KEY-----
98+
fUpncxjrNYaBDR/lhDOUtbMqw4qIW1zbBwKGaB764yo=
99+
-----END NEBULA X25519 PRIVATE KEY-----
100+
runcmd:
101+
- sed -i '/PermitRootLogin/d' /etc/ssh/sshd_config
102+
- echo "PermitRootLogin no" >> /etc/ssh/sshd_config
103+
- systemctl restart sshd
104+
- curl -L https://github.com/openecosystems/ecosystem/releases/download/apps-workloads-public-mesh-v2alpha-lighthouse/devel/apps-workloads-public-mesh-v2alpha-lighthouse_0.33.1-devel_Linux_x86_64.tar.gz | tar zx --strip-components=1 --directory /opt
105+
- chmod +x /opt/app
106+
- systemctl enable lighthouse.service
107+
- systemctl start lighthouse.service

0 commit comments

Comments
 (0)