diplonat/README.md

88 lines
2.9 KiB
Markdown
Raw Normal View History

2020-05-08 08:57:10 +00:00
Diplonat
========
2020-05-09 14:56:39 +00:00
## Feature set
2020-05-23 14:29:02 +00:00
* [X] (Re)Configure NAT via UPNP/IGD (prio: high)
2020-06-28 15:01:12 +00:00
* [X] (Re)Configure iptables (prio: low)
2020-05-09 14:57:33 +00:00
* [ ] (Re)Configure DNS via ??? (prio: low)
2020-05-09 14:56:39 +00:00
2020-05-22 09:34:12 +00:00
## Understand scope
* Reconfigure __local__ environment when provisionning a __cluster__ service
* Reconfigure host on demand according to service needs (Firewall)
* Reconfigure host local network according to service needs (Router NAT)
* Operate a global reconfiguration that associate the tuple (__local__ environment information, a __cluster__ service)
* Reconfigure an external service with local info (DNS with public IP returned by the router via IGD)
## Dependencies
The `reqwest` crate "will make use of system-native transport layer security to connect to HTTPS destinations". See [`reqwest`'s documentation](https://docs.rs/reqwest/0.9.18/reqwest/#tls) for more information.
2020-05-09 14:56:39 +00:00
## Operate
2020-06-28 15:01:12 +00:00
You need to add the following to your nomad config file :
```
client {
[...]
options {
docker.privileged.enabled = "true"
}
}
```
2020-05-08 08:57:10 +00:00
```bash
cargo build
2020-05-08 08:58:04 +00:00
consul agent -dev # in a separate terminal
2020-05-08 08:57:10 +00:00
2020-06-28 15:01:12 +00:00
# adapt following values to your configuration
2020-05-08 08:57:10 +00:00
export DIPLONAT_CONSUL_NODE_NAME="lheureduthe"
2021-08-26 14:16:15 +00:00
export DIPLONAT_FIREWALL_ENABLE="true"
export DIPLONAT_FIREWALL_REFRESH_TIME="300"
export DIPLONAT_IGD_ENABLE="true"
export DIPLONAT_IGD_PRIVATE_IP="192.168.0.18"
export DIPLONAT_IGD_REFRESH_TIME="60"
export DIPLONAT_IGD_EXPIRATION_TIME="300"
2020-05-21 15:51:30 +00:00
export RUST_LOG=debug
2020-05-08 08:57:10 +00:00
cargo run
```
2020-05-21 20:25:33 +00:00
2020-05-22 09:06:26 +00:00
## Design Guidelines
Diplonat is made of a set of Components.
Components communicate between them thanks to [tokio::sync::watch](https://docs.rs/tokio/0.2.21/tokio/sync/index.html#watch-channel) transferring copiable messages.
Each message must contain the whole state (and not a transition) as messages can be lost if a more recent message is received.
This choice has been made to limit bugs.
If you need to watch two actors and merge their content, you may use [tokio::sync::select](https://docs.rs/tokio/0.2.21/tokio/macro.select.html).
When you read a value from source 1, you must cache it to be able to merge it later when you read from source 2.
2020-05-21 20:25:33 +00:00
## About Consul Catalog
* We query the `/v1/catalog/node/<node>` endpoint
* We can watch it thanks to [Blocking Queries](https://www.consul.io/api/features/blocking.html)
eg:
```bash
curl -vvv http://127.0.0.1:8500/v1/catalog/node/lheureduthe
# returns X-Consul-Index: 15
curl -vvv http://127.0.0.1:8500/v1/catalog/node/lheureduthe?index=15
```
Each time you do the request, the whole list of services bound to the node is returned.
To test the Consul Catalog part, you can do:
```bash
consul agent -dev #in a separate terminal, if not already running
2020-05-22 14:27:43 +00:00
consul services register -name=fake_leet -tag="(diplonat (tcp_port 1337) (tcp_port 1338 1339))"
consul services register -name=fake_dns -tag="(diplonat (udp_port 53) (tcp_port 53))"
consul services register -name=fake_irc -tag="(diplonat (udp_port 6667 6666))"
2020-05-21 20:25:33 +00:00
consul services -id=example
```