mirror of
https://github.com/gravitl/netmaker.git
synced 2024-09-20 15:26:04 +08:00
- support EE
- config namespaces - write config after confirm - minor fixes
This commit is contained in:
Tobias Cudnik
parent
b085a61aa6
commit
7fa8ca2587
|
|
@ -1,66 +1,69 @@
|
|||
{
|
||||
# ZeroSSL account
|
||||
acme_ca https://acme.zerossl.com/v2/DV90
|
||||
email YOUR_EMAIL
|
||||
}
|
||||
|
||||
# Dashboard
|
||||
https://dashboard.NETMAKER_BASE_DOMAIN {
|
||||
# Apply basic security headers
|
||||
header {
|
||||
# Enable cross origin access to *.NETMAKER_BASE_DOMAIN
|
||||
Access-Control-Allow-Origin *.NETMAKER_BASE_DOMAIN
|
||||
# Enable HTTP Strict Transport Security (HSTS)
|
||||
Strict-Transport-Security "max-age=31536000;"
|
||||
# Enable cross-site filter (XSS) and tell browser to block detected attacks
|
||||
X-XSS-Protection "1; mode=block"
|
||||
# Disallow the site to be rendered within a frame on a foreign domain (clickjacking protection)
|
||||
X-Frame-Options "SAMEORIGIN"
|
||||
# Prevent search engines from indexing
|
||||
X-Robots-Tag "none"
|
||||
# Remove the server name
|
||||
-Server
|
||||
}
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
# Apply basic security headers
|
||||
header {
|
||||
# Enable cross origin access to *.NETMAKER_BASE_DOMAIN
|
||||
Access-Control-Allow-Origin *.NETMAKER_BASE_DOMAIN
|
||||
# Enable HTTP Strict Transport Security (HSTS)
|
||||
Strict-Transport-Security "max-age=31536000;"
|
||||
# Enable cross-site filter (XSS) and tell browser to block detected attacks
|
||||
X-XSS-Protection "1; mode=block"
|
||||
# Disallow the site to be rendered within a frame on a foreign domain (clickjacking protection)
|
||||
X-Frame-Options "SAMEORIGIN"
|
||||
# Prevent search engines from indexing
|
||||
X-Robots-Tag "none"
|
||||
# Remove the server name
|
||||
-Server
|
||||
}
|
||||
|
||||
reverse_proxy http://netmaker-ui
|
||||
reverse_proxy http://netmaker-ui
|
||||
}
|
||||
|
||||
# Netmaker Exporter
|
||||
https://netmaker-exporter.NETMAKER_BASE_DOMAIN {
|
||||
reverse_proxy http://netmaker-exporter:8085
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
reverse_proxy http://netmaker-exporter:8085
|
||||
}
|
||||
|
||||
# Prometheus
|
||||
https://prometheus.NETMAKER_BASE_DOMAIN {
|
||||
reverse_proxy http://prometheus:9090
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
reverse_proxy http://prometheus:9090
|
||||
}
|
||||
|
||||
# Grafana
|
||||
https://grafana.NETMAKER_BASE_DOMAIN {
|
||||
reverse_proxy http://grafana:3000
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
reverse_proxy http://grafana:3000
|
||||
}
|
||||
|
||||
# API
|
||||
https://api.NETMAKER_BASE_DOMAIN {
|
||||
reverse_proxy http://netmaker:8081
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
reverse_proxy http://netmaker:8081
|
||||
}
|
||||
|
||||
# STUN
|
||||
https://stun.NETMAKER_BASE_DOMAIN {
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
reverse_proxy netmaker:3478
|
||||
}
|
||||
|
||||
# TURN
|
||||
https://turn.NETMAKER_BASE_DOMAIN {
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
reverse_proxy host.docker.internal:3479
|
||||
}
|
||||
|
||||
# TURN API
|
||||
https://turnapi.NETMAKER_BASE_DOMAIN {
|
||||
reverse_proxy http://host.docker.internal:8089
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
reverse_proxy http://host.docker.internal:8089
|
||||
}
|
||||
|
||||
# MQ
|
||||
wss://broker.NETMAKER_BASE_DOMAIN {
|
||||
reverse_proxy ws://mq:8883
|
||||
tls /root/fullchain.pem /root/privkey.pem
|
||||
reverse_proxy ws://mq:8883
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
CONFIG_FILE=netmaker.env
|
||||
# TODO make sure this doesnt break, parse `certbot certificates` if yes
|
||||
CERT_DIR=/etc/letsencrypt/live/stun.$DOMAIN/
|
||||
CERT_DIR=/etc/letsencrypt/live/stun.$NM_DOMAIN/
|
||||
SCRIPT_DIR=$(dirname "$(realpath "$0")")
|
||||
|
||||
# get and check the config
|
||||
|
|
@ -11,7 +11,7 @@ if [ ! -f "$SCRIPT_DIR/$CONFIG_FILE" ]; then
|
|||
exit 1
|
||||
fi
|
||||
source "$SCRIPT_DIR/$CONFIG_FILE"
|
||||
if [[ -n "$DOMAIN" || -n "$EMAIL" ]]; then
|
||||
if [[ -n "$NM_DOMAIN" || -n "$NM_EMAIL" ]]; then
|
||||
echo "Config not valid"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -32,14 +32,14 @@ fi
|
|||
|
||||
# request certs
|
||||
./zerossl-bot.sh certonly --standalone \
|
||||
-m "$EMAIL" \
|
||||
-d "stun.$DOMAIN" \
|
||||
-d "broker.$DOMAIN" \
|
||||
-d "dashboard.$DOMAIN" \
|
||||
-d "turnapi.$DOMAIN" \
|
||||
-d "netmaker-exporter.$DOMAIN" \
|
||||
-d "grafana.$DOMAIN" \
|
||||
-d "prometheus.$DOMAIN"
|
||||
-m "$NM_EMAIL" \
|
||||
-d "stun.$NM_DOMAIN" \
|
||||
-d "broker.$NM_DOMAIN" \
|
||||
-d "dashboard.$NM_DOMAIN" \
|
||||
-d "turnapi.$NM_DOMAIN" \
|
||||
-d "netmaker-exporter.$NM_DOMAIN" \
|
||||
-d "grafana.$NM_DOMAIN" \
|
||||
-d "prometheus.$NM_DOMAIN"
|
||||
|
||||
# TODO fallback to letsencrypt
|
||||
|
||||
|
|
|
|||
|
|
@ -3,6 +3,7 @@
|
|||
CONFIG_FILE=netmaker.env
|
||||
# location of nm-quick.sh (usually `/root`)
|
||||
SCRIPT_DIR=$(dirname "$(realpath "$0")")
|
||||
CONFIG_PATH="$SCRIPT_DIR/$CONFIG_FILE"
|
||||
LATEST=$(curl -s https://api.github.com/repos/gravitl/netmaker/releases/latest | grep "tag_name" | cut -d : -f 2,3 | tr -d [:space:],\")
|
||||
|
||||
print_logo() { (
|
||||
|
|
@ -255,6 +256,23 @@ confirm() { (
|
|||
done
|
||||
) }
|
||||
|
||||
save_config() { (
|
||||
echo "Saving the config to $CONFIG_PATH"
|
||||
touch "$CONFIG_PATH"
|
||||
# email
|
||||
if grep -q "^NM_EMAIL=" "$CONFIG_PATH"; then
|
||||
sed -i "s/NM_EMAIL=.*/NM_EMAIL=$EMAIL/" "$CONFIG_PATH"
|
||||
else
|
||||
echo "NM_EMAIL=$EMAIL" >>"$CONFIG_PATH"
|
||||
fi
|
||||
# domain
|
||||
if grep -q "^NM_DOMAIN=" "$CONFIG_PATH"; then
|
||||
sed -i "s/NM_DOMAIN=.*/NM_DOMAIN=$NETMAKER_BASE_DOMAIN/" "$CONFIG_PATH"
|
||||
else
|
||||
echo "NM_DOMAIN=$NETMAKER_BASE_DOMAIN" >>"$CONFIG_PATH"
|
||||
fi
|
||||
)}
|
||||
|
||||
# local_install_setup - builds artifacts based on specified branch locally to use in install
|
||||
local_install_setup() { (
|
||||
rm -rf netmaker-tmp
|
||||
|
|
@ -304,7 +322,7 @@ install_dependencies() {
|
|||
update_cmd='yum update'
|
||||
install_cmd='yum install -y'
|
||||
elif [ -f /etc/arch-release ]; then
|
||||
dependecies="git wireguard-tools dnsutils jq docker.io certbot docker-compose"
|
||||
dependencies="git wireguard-tools dnsutils jq docker.io certbot docker-compose"
|
||||
update_cmd='pacman -Sy'
|
||||
install_cmd='pacman -S --noconfirm'
|
||||
elif [ "${OS}" = "FreeBSD" ]; then
|
||||
|
|
@ -437,14 +455,6 @@ set_install_vars() {
|
|||
done
|
||||
fi
|
||||
|
||||
# update the config
|
||||
touch $CONFIG_FILE
|
||||
if grep -q "^DOMAIN=" $CONFIG_FILE; then
|
||||
sed -i "s/DOMAIN=.*/DOMAIN=$NETMAKER_BASE_DOMAIN/" $CONFIG_FILE
|
||||
else
|
||||
echo "DOMAIN=$NETMAKER_BASE_DOMAIN" >>$CONFIG_FILE
|
||||
fi
|
||||
|
||||
wait_seconds 2
|
||||
|
||||
echo "-----------------------------------------------------"
|
||||
|
|
@ -454,7 +464,7 @@ set_install_vars() {
|
|||
echo " broker.$NETMAKER_BASE_DOMAIN"
|
||||
echo " stun.$NETMAKER_BASE_DOMAIN"
|
||||
echo " turn.$NETMAKER_BASE_DOMAIN"
|
||||
echo " turnapi.$NETMAKER_BASE_DOMAIN"
|
||||
echo " turnapi.$NETMAKER_BASE_DOMAIN"
|
||||
|
||||
if [ "$INSTALL_TYPE" = "ee" ]; then
|
||||
echo " prometheus.$NETMAKER_BASE_DOMAIN"
|
||||
|
|
@ -491,34 +501,29 @@ set_install_vars() {
|
|||
fi
|
||||
|
||||
# read the config file
|
||||
if [ -f $CONFIG_FILE ]; then
|
||||
source $CONFIG_FILE
|
||||
if [ -f "$CONFIG_PATH" ]; then
|
||||
source "$CONFIG_PATH"
|
||||
fi
|
||||
|
||||
unset GET_EMAIL
|
||||
unset RAND_EMAIL
|
||||
RAND_EMAIL="$(echo $RANDOM | md5sum | head -c 16)@email.com"
|
||||
# suggest the prev email or a random one
|
||||
EMAIL_SUGGESTED=${EMAIL:-$RAND_EMAIL}
|
||||
EMAIL_SUGGESTED=${NM_EMAIL:-$RAND_EMAIL}
|
||||
if [ -z $AUTO_BUILD ]; then
|
||||
read -p "Email Address for Domain Registration (click 'enter' to use $EMAIL_SUGGESTED): " GET_EMAIL
|
||||
fi
|
||||
if [ -z "$GET_EMAIL" ]; then
|
||||
# TODO detect when inheriting from the config
|
||||
echo "using rand email"
|
||||
if [ "$EMAIL" = "$NM_EMAIL" ]; then
|
||||
echo "using config email"
|
||||
else
|
||||
echo "using rand email"
|
||||
fi
|
||||
EMAIL="$EMAIL_SUGGESTED"
|
||||
else
|
||||
EMAIL="$GET_EMAIL"
|
||||
fi
|
||||
|
||||
# update the config
|
||||
touch $CONFIG_FILE
|
||||
if grep -q "^EMAIL=" $CONFIG_FILE; then
|
||||
sed -i "s/EMAIL=.*/EMAIL=$EMAIL/" $CONFIG_FILE
|
||||
else
|
||||
echo "EMAIL=$EMAIL" >>$CONFIG_FILE
|
||||
fi
|
||||
|
||||
wait_seconds 1
|
||||
|
||||
unset GET_MQ_USERNAME
|
||||
|
|
@ -576,7 +581,7 @@ set_install_vars() {
|
|||
read -p "TURN Username (click 'enter' to use 'netmaker'): " GET_TURN_USERNAME
|
||||
fi
|
||||
if [ -z "$GET_TURN_USERNAME" ]; then
|
||||
echo "using default username for mq"
|
||||
echo "using default username for TURN"
|
||||
TURN_USERNAME="netmaker"
|
||||
else
|
||||
TURN_USERNAME="$GET_TURN_USERNAME"
|
||||
|
|
@ -591,27 +596,27 @@ set_install_vars() {
|
|||
select domain_option in "Auto Generated Password" "Input Your Own Password"; do
|
||||
case $REPLY in
|
||||
1)
|
||||
echo "using random password for turn"
|
||||
break
|
||||
;;
|
||||
echo "using random password for turn"
|
||||
break
|
||||
;;
|
||||
2)
|
||||
while true; do
|
||||
echo "Enter your Password For TURN: "
|
||||
read -s GET_TURN_PASSWORD
|
||||
echo "Enter your password again to confirm: "
|
||||
read -s CONFIRM_TURN_PASSWORD
|
||||
if [ ${GET_TURN_PASSWORD} != ${CONFIRM_TURN_PASSWORD} ]; then
|
||||
echo "wrong password entered, try again..."
|
||||
continue
|
||||
fi
|
||||
TURN_PASSWORD="$GET_TURN_PASSWORD"
|
||||
echo "TURN Password Saved Successfully!!"
|
||||
echo "Enter your Password For TURN: "
|
||||
read -s GET_TURN_PASSWORD
|
||||
echo "Enter your password again to confirm: "
|
||||
read -s CONFIRM_TURN_PASSWORD
|
||||
if [ ${GET_TURN_PASSWORD} != ${CONFIRM_TURN_PASSWORD} ]; then
|
||||
echo "wrong password entered, try again..."
|
||||
continue
|
||||
fi
|
||||
TURN_PASSWORD="$GET_TURN_PASSWORD"
|
||||
echo "TURN Password Saved Successfully!!"
|
||||
break
|
||||
done
|
||||
break
|
||||
done
|
||||
break
|
||||
;;
|
||||
*) echo "invalid option $REPLY";;
|
||||
esac
|
||||
;;
|
||||
*) echo "invalid option $REPLY" ;;
|
||||
esac
|
||||
done
|
||||
fi
|
||||
|
||||
|
|
@ -633,6 +638,7 @@ set_install_vars() {
|
|||
|
||||
confirm
|
||||
|
||||
save_config
|
||||
}
|
||||
|
||||
# install_netmaker - sets the config files and starts docker-compose
|
||||
|
|
@ -652,13 +658,12 @@ install_netmaker() {
|
|||
if [ "$INSTALL_TYPE" = "ee" ]; then
|
||||
COMPOSE_URL="https://raw.githubusercontent.com/gravitl/netmaker/$BUILD_TAG/compose/docker-compose.ee.yml"
|
||||
CADDY_URL="https://raw.githubusercontent.com/gravitl/netmaker/$BUILD_TAG/docker/Caddyfile-EE"
|
||||
CERTS_URL="https://raw.githubusercontent.com/gravitl/netmaker/$BUILD_TAG/scripts/nm-certs.sh"
|
||||
fi
|
||||
if [ ! "$BUILD_TYPE" = "local" ]; then
|
||||
wget -qO /root/docker-compose.yml $COMPOSE_URL
|
||||
wget -qO /root/mosquitto.conf https://raw.githubusercontent.com/gravitl/netmaker/$BUILD_TAG/docker/mosquitto.conf
|
||||
wget -qO /root/Caddyfile $CADDY_URL
|
||||
wget -qO /root/nm-quick.sh $CERTS_URL
|
||||
wget -qO /root/nm-certs.sh $CERTS_URL
|
||||
wget -qO /root/wait.sh https://raw.githubusercontent.com/gravitl/netmaker/$BUILD_TAG/docker/wait.sh
|
||||
fi
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue