diff --git a/app/backup/secrets/backup/id_ed25519 b/app/backup/secrets/backup/id_ed25519 new file mode 100644 index 0000000..9d7fd46 --- /dev/null +++ b/app/backup/secrets/backup/id_ed25519 @@ -0,0 +1 @@ +USER_LONG Private ed25519 key of the container doing the backup diff --git a/app/backup/secrets/backup/id_ed25519.pub b/app/backup/secrets/backup/id_ed25519.pub new file mode 100644 index 0000000..0a2ab35 --- /dev/null +++ b/app/backup/secrets/backup/id_ed25519.pub @@ -0,0 +1 @@ +USER Public ed25519 key of the container doing the backup (this key must be in authorized_keys on the backup target host) diff --git a/app/backup/secrets/backup/target_ssh_dir b/app/backup/secrets/backup/target_ssh_dir new file mode 100644 index 0000000..3b2a4da --- /dev/null +++ b/app/backup/secrets/backup/target_ssh_dir @@ -0,0 +1 @@ +USER Directory where to store backups on target host diff --git a/app/backup/secrets/backup/target_ssh_fingerprint b/app/backup/secrets/backup/target_ssh_fingerprint new file mode 100644 index 0000000..608f3ec --- /dev/null +++ b/app/backup/secrets/backup/target_ssh_fingerprint @@ -0,0 +1 @@ +USER SSH fingerprint of the target machine (format: copy here the corresponding line from your known_hosts file) diff --git a/app/backup/secrets/backup/target_ssh_host b/app/backup/secrets/backup/target_ssh_host new file mode 100644 index 0000000..6268f87 --- /dev/null +++ b/app/backup/secrets/backup/target_ssh_host @@ -0,0 +1 @@ +USER Hostname of the backup target host diff --git a/app/backup/secrets/backup/target_ssh_port b/app/backup/secrets/backup/target_ssh_port new file mode 100644 index 0000000..309dd38 --- /dev/null +++ b/app/backup/secrets/backup/target_ssh_port @@ -0,0 +1 @@ +USER SSH port number to connect to the target host diff --git a/app/backup/secrets/backup/target_ssh_user b/app/backup/secrets/backup/target_ssh_user new file mode 100644 index 0000000..98b3046 --- /dev/null +++ b/app/backup/secrets/backup/target_ssh_user @@ -0,0 +1 @@ +USER SSH username to log in as on the target host diff --git a/app/docker-compose.yml b/app/docker-compose.yml index df7fee4..717e8ce 100644 --- a/app/docker-compose.yml +++ b/app/docker-compose.yml @@ -48,33 +48,35 @@ services: args: # https://github.com/jitsi/jitsi-meet PREFIXV: stable/jitsi-meet_ - VERSION: 5390 - image: superboum/amd64_jitsi_meet:v3 + VERSION: 5463 + image: superboum/amd64_jitsi_meet:v4 jitsi-conference-focus: build: context: ./jitsi/build/jitsi-conference-focus args: # https://github.com/jitsi/jicofo - PREFIXV: stable/jitsi-meet_ - VERSION: 5390 - image: superboum/amd64_jitsi_conference_focus:v6 + PREFIXV: jitsi-meet_ + VERSION: 5463 + image: superboum/amd64_jitsi_conference_focus:v7 jitsi-videobridge: build: context: ./jitsi/build/jitsi-videobridge args: # https://github.com/jitsi/jitsi-videobridge - PREFIXV: stable/jitsi-meet_ - VERSION: 5390 - image: superboum/amd64_jitsi_videobridge:v16 + PREFIXV: jitsi-meet_ + VERSION: 5463 + image: superboum/amd64_jitsi_videobridge:v17 jitsi-xmpp: build: context: ./jitsi/build/jitsi-xmpp args: - VERSION: 0.11.2-1 - image: superboum/amd64_jitsi_xmpp:v8 + PREFIXV: jitsi-meet_ + MEET_VERSION: 5463 + PROSODY_VERSION: 0.11.7-1~buster4 + image: superboum/amd64_jitsi_xmpp:v9 plume: build: diff --git a/app/garage/secrets/garage/garage-ca.crt b/app/garage/secrets/garage/garage-ca.crt new file mode 100644 index 0000000..8488ab6 --- /dev/null +++ b/app/garage/secrets/garage/garage-ca.crt @@ -0,0 +1 @@ +USER_LONG garage-ca.crt (generated with Garage's genkeys.sh script) diff --git a/app/garage/secrets/garage/garage-ca.key b/app/garage/secrets/garage/garage-ca.key new file mode 100644 index 0000000..ca3e90c --- /dev/null +++ b/app/garage/secrets/garage/garage-ca.key @@ -0,0 +1 @@ +USER_LONG garage-ca.key (generated with Garage's genkeys.sh script) diff --git a/app/garage/secrets/garage/garage.crt b/app/garage/secrets/garage/garage.crt new file mode 100644 index 0000000..6044ab8 --- /dev/null +++ b/app/garage/secrets/garage/garage.crt @@ -0,0 +1 @@ +USER_LONG garage.crt (generated with Garage's genkeys.sh script) diff --git a/app/garage/secrets/garage/garage.key b/app/garage/secrets/garage/garage.key new file mode 100644 index 0000000..db3cb0e --- /dev/null +++ b/app/garage/secrets/garage/garage.key @@ -0,0 +1 @@ +USER_LONG garage.key (generated with Garage's genkeys.sh script) diff --git a/app/im/secrets/chat/easybridge/as_token b/app/im/secrets/chat/easybridge/as_token new file mode 100644 index 0000000..5fa4e3c --- /dev/null +++ b/app/im/secrets/chat/easybridge/as_token @@ -0,0 +1 @@ +CMD openssl rand -hex 32 diff --git a/app/im/secrets/chat/easybridge/db_pass b/app/im/secrets/chat/easybridge/db_pass new file mode 100644 index 0000000..7e1f94b --- /dev/null +++ b/app/im/secrets/chat/easybridge/db_pass @@ -0,0 +1 @@ +SERVICE_PASSWORD easybridge diff --git a/app/im/secrets/chat/easybridge/db_user b/app/im/secrets/chat/easybridge/db_user new file mode 100644 index 0000000..436267c --- /dev/null +++ b/app/im/secrets/chat/easybridge/db_user @@ -0,0 +1 @@ +CONST easybridge diff --git a/app/im/secrets/chat/easybridge/hs_token b/app/im/secrets/chat/easybridge/hs_token new file mode 100644 index 0000000..5fa4e3c --- /dev/null +++ b/app/im/secrets/chat/easybridge/hs_token @@ -0,0 +1 @@ +CMD openssl rand -hex 32 diff --git a/app/im/secrets/chat/easybridge/web_session_key b/app/im/secrets/chat/easybridge/web_session_key new file mode 100644 index 0000000..614bed7 --- /dev/null +++ b/app/im/secrets/chat/easybridge/web_session_key @@ -0,0 +1,2 @@ +CMD openssl rand -hex 32 + diff --git a/app/im/secrets/chat/fb2mx/as_token b/app/im/secrets/chat/fb2mx/as_token index 20b76d4..5fa4e3c 100644 --- a/app/im/secrets/chat/fb2mx/as_token +++ b/app/im/secrets/chat/fb2mx/as_token @@ -1 +1 @@ -USER fb2mx API server token +CMD openssl rand -hex 32 diff --git a/app/im/secrets/chat/fb2mx/hs_token b/app/im/secrets/chat/fb2mx/hs_token index 8808f8f..5fa4e3c 100644 --- a/app/im/secrets/chat/fb2mx/hs_token +++ b/app/im/secrets/chat/fb2mx/hs_token @@ -1 +1 @@ -USER fb2mx homeserver token +CMD openssl rand -hex 32 diff --git a/app/im/secrets/chat/synapse/homeserver.signing.key b/app/im/secrets/chat/synapse/homeserver.signing.key new file mode 100644 index 0000000..099bd18 --- /dev/null +++ b/app/im/secrets/chat/synapse/homeserver.signing.key @@ -0,0 +1 @@ +USER Synapse homeserver ed25519 signing key diff --git a/app/im/secrets/chat/synapse/registration_shared_secret b/app/im/secrets/chat/synapse/registration_shared_secret index 395cccc..b82f191 100644 --- a/app/im/secrets/chat/synapse/registration_shared_secret +++ b/app/im/secrets/chat/synapse/registration_shared_secret @@ -1 +1 @@ -USER Shared secret for homeserver registrations (?) +CMD head -c 32 /dev/urandom | base64 diff --git a/app/jitsi/build/jitsi-conference-focus/Dockerfile b/app/jitsi/build/jitsi-conference-focus/Dockerfile index e2c459c..db50746 100644 --- a/app/jitsi/build/jitsi-conference-focus/Dockerfile +++ b/app/jitsi/build/jitsi-conference-focus/Dockerfile @@ -1,11 +1,10 @@ -FROM debian:buster AS builder +FROM fedora:33 AS builder + +RUN dnf install -y java-latest-openjdk-headless maven wget unzip ARG PREFIXV ARG VERSION -RUN apt-get update && \ - apt-get install -y openjdk-11-jdk maven wget unzip && \ - wget https://github.com/jitsi/jicofo/archive/${PREFIXV}${VERSION}.zip -O jicofo.zip - +RUN wget https://github.com/jitsi/jicofo/archive/${PREFIXV}${VERSION}.zip -O jicofo.zip RUN unzip jicofo.zip && \ mv jicofo*${VERSION} jicofo && \ cd jicofo && \ @@ -13,15 +12,12 @@ RUN unzip jicofo.zip && \ unzip target/jicofo-1.1-SNAPSHOT-archive.zip && \ mv jicofo-1.1-SNAPSHOT /srv/build -FROM debian:buster +FROM debian:bullseye RUN apt-get update && \ apt-get install -y openjdk-11-jre-headless ca-certificates -ENV JAVA_SYS_PROPS="-Dnet.java.sip.communicator.SC_HOME_DIR_LOCATION=/root -Dnet.java.sip.communicator.SC_HOME_DIR_NAME=.sip-communicator -Dnet.java.sip.communicator.SC_LOG_DIR_LOCATION=/var/log/jitsi" - -COPY --from=builder /srv/build /srv/jicofo -COPY jicofo /usr/local/bin/jicofo -COPY sip-communicator.properties /root/.sip-communicator/sip-communicator.properties +COPY --from=builder /srv/build /usr/share/jicofo +COPY jicofo /usr/local/bin CMD ["/usr/local/bin/jicofo"] diff --git a/app/jitsi/build/jitsi-conference-focus/jicofo b/app/jitsi/build/jitsi-conference-focus/jicofo index 2bc6e3f..2225e98 100755 --- a/app/jitsi/build/jitsi-conference-focus/jicofo +++ b/app/jitsi/build/jitsi-conference-focus/jicofo @@ -1,16 +1,13 @@ #!/bin/bash -cp ${JITSI_CERTS_FOLDER}/auth.jitsi.deuxfleurs.fr.crt /usr/local/share/ca-certificates/auth.jitsi.deuxfleurs.fr.crt update-ca-certificates -f -cat >> /etc/hosts <> /etc/hosts < /etc/prosody/conf.avail/jitsi.deuxfleurs.fr.cfg.lua < CMD (a secret that is generated by running this command) +CMD_ONCE +(same, but value is not changed when doing a regen) + CONST (the secret has a constant value set here) @@ -81,6 +84,7 @@ consul_server = consul.Consul() USER = "USER" USER_LONG = "USER_LONG" CMD = "CMD" +CMD_ONCE = "CMD_ONCE" CONST = "CONST" CONST_LONG = "CONST_LONG" SERVICE_DN = "SERVICE_DN" @@ -111,7 +115,7 @@ def read_secret(key, file_path): secret = {"type": stype, "key": key} if stype in [USER, USER_LONG]: secret["desc"] = " ".join(l0[1:]) - elif stype == CMD: + elif stype in [CMD, CMD_ONCE]: secret["cmd"] = " ".join(l0[1:]) elif stype == CONST: secret["value"] = " ".join(l0[1:]) @@ -154,6 +158,7 @@ def get_secrets_services(secrets): if svc not in services: services[svc] = { "dn": "cn=%s,%s"%(svc, SERVICE_DN_SUFFIX), + "desc": "(not provided)", "pass": None, "dn_at": [], "pass_at": [], @@ -292,7 +297,7 @@ def gen_secrets_base(secrets, regen): consul_server.kv.put(key, secret["value"]) print(bcolors.OKCYAN, "Value set.", bcolors.ENDC) - if secret["type"] == CMD: + if secret["type"] == CMD or (secret["type"] == CMD_ONCE and data is None): print("----") print(key) print("Executing command:", secret["cmd"]) diff --git a/op_guide/create_database/README.md b/op_guide/create_database/README.md index 7d49c97..fb3bdd9 100644 --- a/op_guide/create_database/README.md +++ b/op_guide/create_database/README.md @@ -8,6 +8,8 @@ Go to guichet.deuxfleurs.fr 4. Hash it with `slappasswd` 5. Add a `userpassword` entry with the hash +This step can also be done using the automated tool `secretmgr.py` in the app folder. + ## 2. Connect to postgres with the admin users ```bash diff --git a/op_guide/plume/README.md b/op_guide/plume/README.md index fa6084d..4a8bbac 100644 --- a/op_guide/plume/README.md +++ b/op_guide/plume/README.md @@ -1,3 +1,5 @@ +## Creating a new Plume user + 1. Bind nomad on your machine with SSH (check the README file at the root of this repo) 2. Go to http://127.0.0.1:4646 3. Select `plume` -> click `exec` button (top right) diff --git a/op_guide/postmortem/2020-01-20-changement-ip.md b/op_guide/postmortem/2020-01-20-changement-ip.md new file mode 100644 index 0000000..21856a9 --- /dev/null +++ b/op_guide/postmortem/2020-01-20-changement-ip.md @@ -0,0 +1,45 @@ +Le 20 janvier free a changé mon IP, un peu comme partout en France. +Ça concerne l'IPv4 et le préfixe IPv6. +Ici le bon vieux Bortzmoinsbien qui tweet : https://twitter.com/bortzmeyer/status/1351434290916155394 + +Max a update tout de suite l'IPv4 mais avec un TTL de 4h le temps de propagation est grand. +J'ai réduit les entrées sur les IP à 300 secondes, soit 5 minutes, le minimum chez Gandi, à voir si c'est une bonne idée. +Reste à update les IPv6, moins critiques pour le front facing mais utilisées pour le signaling en interne... + +## Le fameux signaling +Ça pose un gros problème avec Nomad (et en moindre mesure avec Consul). +En effet, Nomad utilise l'IPv6 pour communiquer, il faut donc changer les IPs de tous les noeuds. +Problème ! On peut pas faire la migration au fur et à mesure car, changeant d'IP, les noeuds ne seront plus en mesure de communiquer. +On n'a pas envie de supprimer le cluster et d'en créer un nouveau car ça voudrait dire tout redéployer ce qui est long également (tous les fichiers HCL pour Nomad, tout le KV pour consul). +On ne peut pas non plus la faire à la bourrin en stoppant tous les cluster, changer son IP, puis redémarrer. +Enfin si, Consul accepte mais pas Nomad, qui lui va chercher à communiquer avec les anciennes IP et n'arrivera jamais à un consensus. + +Au passage j'en ai profité pour changer le nom des noeuds car la dernière fois, Nomad n'avait PAS DU TOUT apprécié qu'un noeud ayant le même nom change d'IP. Ceci dit, si on utilise de facto le `peers.json` c'est peut être pas problématique. À tester. + +Du coup, après moult réflexions, la silver bullet c'est la fonction outage recovery de nomad (consul l'a aussi au besoin). +Elle est ici : https://learn.hashicorp.com/tutorials/consul/recovery-outage +En gros, il faut arrêter tous les nodes. +Ensuite créer un fichier à ce path : `/var/lib/nomad/server/raft/peers.json` +Ne vous laissez pas perturber par le fichier `peers.info` à côté, il ne faut pas le toucher. +Après la grande question c'est de savoir si le cluster est en Raft v2 ou Raft v3. +Bon ben nous on était en Raft v2. Si vous vous trompez, au redémarrage Nomad va crasher avec une sale erreur : + +``` +nomad: failed to start Raft: error="recovery failed to parse peers.json: json: cannot unmarshal string into Go value of type raft.configEntry" +``` + +(je me suis trompé bien sûr). +Voilà, après il ne vous reste plus qu'à redémarrer et suivre les logs, cherchez bien la ligne où il dit qu'il a trouvé le peers.json. + +## Les trucs à pas oublier + + - Reconfigurer le backend KV de traefik (à voir à utiliser des DNS plutôt du coup) + - Reconfigurer l'IPv4 publique annoncée à Jitsi + +## Ce qui reste à faire + + - Mettre à jour les entrées DNS IPv6, ce qui devrait créer : + - digitale.machine.deuxfleurs.fr + - datura.machine.deuxfleurs.fr + - drosera.machine.deuxfleurs.fr + - Mettre à jour l'instance garage sur io diff --git a/op_guide/update_matrix.md b/op_guide/update_matrix/README.md similarity index 100% rename from op_guide/update_matrix.md rename to op_guide/update_matrix/README.md diff --git a/os/config/production.yml b/os/config/production.yml index 64a7416..8870b52 100644 --- a/os/config/production.yml +++ b/os/config/production.yml @@ -1,46 +1,46 @@ cluster_nodes: hosts: - veterini: + datura: ansible_host: atuin.site.deuxfleurs.fr ansible_port: 110 ansible_become: true ipv4: 192.168.1.2 gatewayv4: 192.168.1.254 - ipv6: 2a01:e35:2fdc:dbe0::2 - gatewayv6: 2a01:e35:2fdc:dbe0::1 + ipv6: 2a01:e34:ec5c:dbe0::2 + gatewayv6: 2a01:e34:ec5c:dbe0::1 interface: eno1 dns_1: 212.27.40.240 dns_2: 212.27.40.241 ansible_python_interpreter: python3 - silicareux: + digitale: ansible_host: atuin.site.deuxfleurs.fr ansible_port: 111 ansible_become: true ipv4: 192.168.1.3 gatewayv4: 192.168.1.254 - ipv6: 2a01:e35:2fdc:dbe0::3 - gatewayv6: 2a01:e35:2fdc:dbe0::1 + ipv6: 2a01:e34:ec5c:dbe0::3 + gatewayv6: 2a01:e34:ec5c:dbe0::1 interface: eno1 dns_1: 212.27.40.240 dns_2: 212.27.40.241 ansible_python_interpreter: python3 - wonse: + drosera: ansible_host: atuin.site.deuxfleurs.fr ansible_port: 112 ansible_become: true ipv4: 192.168.1.4 gatewayv4: 192.168.1.254 - ipv6: 2a01:e35:2fdc:dbe0::4 - gatewayv6: 2a01:e35:2fdc:dbe0::1 + ipv6: 2a01:e34:ec5c:dbe0::4 + gatewayv6: 2a01:e34:ec5c:dbe0::1 interface: eno1 dns_1: 212.27.40.240 dns_2: 212.27.40.241 ansible_python_interpreter: python3 io: - ansible_host: pluton.site.deuxfleurs.fr + ansible_host: jupiter.site.deuxfleurs.fr ansible_port: 110 ansible_become: true ipv4: 192.168.1.2 diff --git a/os/config/roles/consul/tasks/main.yml b/os/config/roles/consul/tasks/main.yml index 994ecd7..340d4d7 100644 --- a/os/config/roles/consul/tasks/main.yml +++ b/os/config/roles/consul/tasks/main.yml @@ -1,6 +1,6 @@ - name: "Set consul version" set_fact: - consul_version: 1.9.0 + consul_version: 1.9.1 - name: "Download and install Consul for x86_64" unarchive: diff --git a/os/config/roles/nomad/tasks/main.yml b/os/config/roles/nomad/tasks/main.yml index 625d7b7..1ddedbe 100644 --- a/os/config/roles/nomad/tasks/main.yml +++ b/os/config/roles/nomad/tasks/main.yml @@ -1,6 +1,6 @@ - name: "Set nomad version" set_fact: - nomad_version: 1.0.1 + nomad_version: 1.0.2 - name: "Download and install Nomad for x86_64" unarchive: