From 501abf4156ea921d620e2d727fd2937920116c98 Mon Sep 17 00:00:00 2001 From: Thomas Stokes Date: Thu, 21 Mar 2024 15:19:00 +0100 Subject: [PATCH 1/6] b5934: Add service unit --- .../etc/systemd/system/remove-welcome-conf.service | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 configuration/environments_scripts/central_reverse_proxy/files/etc/systemd/system/remove-welcome-conf.service diff --git a/configuration/environments_scripts/central_reverse_proxy/files/etc/systemd/system/remove-welcome-conf.service b/configuration/environments_scripts/central_reverse_proxy/files/etc/systemd/system/remove-welcome-conf.service new file mode 100644 index 00000000000..2524b856cc9 --- /dev/null +++ b/configuration/environments_scripts/central_reverse_proxy/files/etc/systemd/system/remove-welcome-conf.service @@ -0,0 +1,13 @@ +[Unit] +Description=Removes welcome.conf. +Requires=-.mount network-online.target +After=-.mount network-online.target +Before=httpd.service get-latest-httpd-conf.service +# Staring before means no "systemctl start httpd" is needed. +[Install] +RequiredBy=multi-user.target +WantedBy=httpd.service get-latest-httpd-conf.service +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=/bin/bash -c "cd /etc/httpd; if [[ -e conf.d/welcome.conf ]]; then rm -f conf.d/welcome.conf; fi" \ No newline at end of file From f5c6a9b83b7ad5512f56d274437617d54a634bff Mon Sep 17 00:00:00 2001 From: Thomas Stokes Date: Mon, 6 May 2024 12:23:28 +0000 Subject: [PATCH 2/6] Outline new key_vault inner workings. --- wiki/info/landscape/amazon-ec2.md | 33 +++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/wiki/info/landscape/amazon-ec2.md b/wiki/info/landscape/amazon-ec2.md index d3c6a899a51..a33c7fe0648 100644 --- a/wiki/info/landscape/amazon-ec2.md +++ b/wiki/info/landscape/amazon-ec2.md @@ -282,13 +282,15 @@ There is now a single point of truth for the various ssh and AWS keys, and possi The structure of the vault is important for the efficacy of the script and should appear as below. There is an explanation afterwards. ``` -key_vault +. ├── aws_credentials +│   ├── axel-central-reverse-proxy-credentials │   └── disposable-reverse-proxy-automation ├── central_reverse_proxy │   ├── httpdConf │   │   ├── aws -│   │   │   └── credentials -> ../../../aws_credentials/disposable-reverse-proxy-automation +│   │   │   └── credentials +│   │   │   └── disposable-reverse-proxy-automation -> ../../../../aws_credentials/disposable-reverse-proxy-automation │   │   └── ssh │   │   ├── authorized_keys │   │   │   ├── id_ed25519.pub@root@central_reverse_proxy -> ../../../root/ssh/id_ed25519.pub @@ -296,23 +298,46 @@ key_vault │   │   ├── id_ed25519 │   │   └── id_ed25519.pub │   ├── root +│   │   ├── aws +│   │   │   ├── config +│   │   │   │   └── axel +│   │   │   └── credentials +│   │   │   ├── axel-central-reverse-proxy-credentials -> ../../../../aws_credentials/axel-central-reverse-proxy-credentials +│   │   │   └── disposable-reverse-proxy-automation -> ../../../../aws_credentials/disposable-reverse-proxy-automation │   │   └── ssh │   │   ├── authorized_keys │   │   │   └── id_ed25519.pub@httpdConf@central_reverse_proxy -> ../../../httpdConf/ssh/id_ed25519.pub │   │   ├── id_ed25519 │   │   └── id_ed25519.pub +│   └── wiki +│   └── ssh +│   └── authorized_keys +│   └── id_ed25519.pub@root@reverse_proxy -> ../../../../reverse_proxy/root/ssh/id_ed25519.pub +├── README +... ``` + 1. So we have the aws_credentials directory, storing the credentials for specific AWS users. + 2. We also have directories named after the environment types (matching the directory names in GIT_HOME/configuration/environments_scripts). + 3. Nested within these, we have directories for each user that will require some keys, for the given environment type. + 4. For each user, we have optional directories "ssh" & "aws" (the naming is important). -5. The aws folder should contain only credentials files which are sym links to the aws_credentials folder. -6. If the setup_keys script is run, the contents of the aws folder will be copied, across to the respective .aws folder on the instance the script runs on, within the correct user's home directory. The config file will be created with the correct region. Although, it will *only* be the default profile. + +5. The aws folder can contain a config and credentials folder. The credentials folder contains sym links to aws_credentials, whilst the config folder contains config header and format. + +6. If the setup_keys script is run, the contents of the credentials and config folders are concatenated into the credentials and config file respectively, which are found in .aws home dir of the user that the folders are nested within. The region is automatically added and so shouldn't be defined in the config. Note, that the general idea is to use the "default" header and define access control for that instance type through AWS credentials, reducing the number of different profiles, as well as complexity of scripts. + 7. The ssh folder will contain the ssh keys of the user; they are named based on the type of the key. + 8. Furthermore, the folder will contain an authorized_keys directory, which holds references to the keys (elsewhere in the vault), which should be authorized to access the user. In the above example, the symbolic link named `id_ed25519.pub@httpdConf@central_reverse_proxy` means that the key referenced will be in the authorized keys for root, so the id_ed25519 key of the httpdConf user on the central reverse proxy will be able to access the root user. + 9. The name of these links doesn't matter, but by convention we will use the format used in the image above (`key_type@user@env_type`), using @ as a separator. + 10. The script will copy across the keys in the ssh folder (ignoring sym links or directories). + 11. The script will append every public key that is linked in the authorized_keys folder, to the authorized_keys file of the respective user. ### Creating a New Application Replica Set From 33e6690fe722ae94c840e9a9d7d7e226e957f4b7 Mon Sep 17 00:00:00 2001 From: Thomas Stokes Date: Mon, 6 May 2024 18:53:09 +0200 Subject: [PATCH 3/6] Switchover archive has max time now, as well as connect timeout. --- .../repo/usr/local/bin/switchoverArchive.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh b/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh index a18fcd3b644..56f4f2ab68f 100755 --- a/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh +++ b/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh @@ -98,11 +98,11 @@ setFailoverIfNotSet() { logger -t archive "begin check" # --fail option ensures that, if a server error is returned (ie. 5xx/4xx status code), then the status code (stored in $?) will be non zero. # -L follows redirects -curl -s -L --fail --connect-timeout ${TIMEOUT1_IN_SECONDS} "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null +curl -s -L --fail --connect-timeout ${TIMEOUT1_IN_SECONDS} --max-time 6 "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null if [[ $? -ne 0 ]] then logger -t archive "first check failed" - curl -s -L --fail --connect-timeout ${TIMEOUT2_IN_SECONDS} "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null + curl -s -L --fail --connect-timeout ${TIMEOUT2_IN_SECONDS} --max-time 6 "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null if [[ $? -ne 0 ]] then setFailoverIfNotSet From 59f8cd0fe4b27d9e9f11f71e5949eaee117904e9 Mon Sep 17 00:00:00 2001 From: Thomas Stokes Date: Mon, 6 May 2024 18:56:54 +0200 Subject: [PATCH 4/6] Utilise a constant. --- .../repo/usr/local/bin/switchoverArchive.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh b/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh index 56f4f2ab68f..fb027cbe263 100755 --- a/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh +++ b/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh @@ -28,6 +28,7 @@ TIME_CHECK_SECONDS=$((15*60)) # as we want to be confident the main archive is in fact "down" before switching. TIMEOUT1_IN_SECONDS=$2 TIMEOUT2_IN_SECONDS=$3 +MAXIMUM_TIMEOUT=6 CACHE_LOCATION="/var/cache/lastIncorrectMacroUnixTime" # The following line checks if all the strings in "search" are present at the beginning of their own line. Note: grep uses BRE by default, # so the plus symbol must be escaped to refer to "one or more" of the previous character. @@ -98,11 +99,11 @@ setFailoverIfNotSet() { logger -t archive "begin check" # --fail option ensures that, if a server error is returned (ie. 5xx/4xx status code), then the status code (stored in $?) will be non zero. # -L follows redirects -curl -s -L --fail --connect-timeout ${TIMEOUT1_IN_SECONDS} --max-time 6 "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null +curl -s -L --fail --connect-timeout ${TIMEOUT1_IN_SECONDS} --max-time "$MAXIMUM_TIMEOUT" "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null if [[ $? -ne 0 ]] then logger -t archive "first check failed" - curl -s -L --fail --connect-timeout ${TIMEOUT2_IN_SECONDS} --max-time 6 "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null + curl -s -L --fail --connect-timeout ${TIMEOUT2_IN_SECONDS} --max-time "$MAXIMUM_TIMEOUT" "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null if [[ $? -ne 0 ]] then setFailoverIfNotSet From 09b60022ce5e1a96426645338c3b30797cbb8ed2 Mon Sep 17 00:00:00 2001 From: Thomas Stokes Date: Mon, 6 May 2024 22:54:10 +0200 Subject: [PATCH 5/6] Return to 2 timeout model but with max timeout and no connect timeout. --- .../repo/usr/local/bin/switchoverArchive.sh | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh b/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh index fb027cbe263..a52073a7e8d 100755 --- a/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh +++ b/configuration/environments_scripts/repo/usr/local/bin/switchoverArchive.sh @@ -28,7 +28,6 @@ TIME_CHECK_SECONDS=$((15*60)) # as we want to be confident the main archive is in fact "down" before switching. TIMEOUT1_IN_SECONDS=$2 TIMEOUT2_IN_SECONDS=$3 -MAXIMUM_TIMEOUT=6 CACHE_LOCATION="/var/cache/lastIncorrectMacroUnixTime" # The following line checks if all the strings in "search" are present at the beginning of their own line. Note: grep uses BRE by default, # so the plus symbol must be escaped to refer to "one or more" of the previous character. @@ -99,11 +98,11 @@ setFailoverIfNotSet() { logger -t archive "begin check" # --fail option ensures that, if a server error is returned (ie. 5xx/4xx status code), then the status code (stored in $?) will be non zero. # -L follows redirects -curl -s -L --fail --connect-timeout ${TIMEOUT1_IN_SECONDS} --max-time "$MAXIMUM_TIMEOUT" "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null +curl -s -L --fail --max-time ${TIMEOUT1_IN_SECONDS} "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null if [[ $? -ne 0 ]] then logger -t archive "first check failed" - curl -s -L --fail --connect-timeout ${TIMEOUT2_IN_SECONDS} --max-time "$MAXIMUM_TIMEOUT" "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null + curl -s -L --fail --max-time ${TIMEOUT2_IN_SECONDS} "http://${archiveIp}:${ARCHIVE_PORT}/gwt/status" >> /dev/null if [[ $? -ne 0 ]] then setFailoverIfNotSet From 27f7df489752dd37e4874f491e684cd744278f5d Mon Sep 17 00:00:00 2001 From: Thomas Stokes Date: Mon, 6 May 2024 23:51:44 +0200 Subject: [PATCH 6/6] b5934: Remove old comments and wantedBy. --- .../files/etc/systemd/system/remove-welcome-conf.service | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/configuration/environments_scripts/central_reverse_proxy/files/etc/systemd/system/remove-welcome-conf.service b/configuration/environments_scripts/central_reverse_proxy/files/etc/systemd/system/remove-welcome-conf.service index 2524b856cc9..1900c57d2ef 100644 --- a/configuration/environments_scripts/central_reverse_proxy/files/etc/systemd/system/remove-welcome-conf.service +++ b/configuration/environments_scripts/central_reverse_proxy/files/etc/systemd/system/remove-welcome-conf.service @@ -3,11 +3,10 @@ Description=Removes welcome.conf. Requires=-.mount network-online.target After=-.mount network-online.target Before=httpd.service get-latest-httpd-conf.service -# Staring before means no "systemctl start httpd" is needed. [Install] RequiredBy=multi-user.target -WantedBy=httpd.service get-latest-httpd-conf.service +WantedBy=httpd.service [Service] Type=oneshot RemainAfterExit=true -ExecStart=/bin/bash -c "cd /etc/httpd; if [[ -e conf.d/welcome.conf ]]; then rm -f conf.d/welcome.conf; fi" \ No newline at end of file +ExecStart=/bin/bash -c "cd /etc/httpd; [[ -e conf.d/welcome.conf ]] && rm -f conf.d/welcome.conf" \ No newline at end of file