Page MenuHomeDevCentral
Files F56968130

No OneTemporary
Actions

View Options

diff --git a/pillar/credentials/vault.sls b/pillar/credentials/vault.sls
index efe0489..5649bc7 100644
--- a/pillar/credentials/vault.sls
+++ b/pillar/credentials/vault.sls
@@ -1,258 +1,259 @@
# -------------------------------------------------------------
# Salt configuration for Nasqueron servers
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Project: Nasqueron
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
# -------------------------------------------------------------
# Vault configuration
#
# :: vault_policies_path: path on vault server where to store policies
#
# :: vault_policies_source: path to fetch policies from
# if starting by salt://, from salt files server
#
# :: vault_mount_paths: translates secrets paths in policies paths
#
# Generally, Vault paths are the same for policies and data access.
#
# For kv secrets engine, version 2, writing and reading versions
# of a kv value are prefixed with the data/ path.
#
# credentials.build_policies_by_node will use this dictionary
# to be able to rewrite secrets paths in data paths.
#
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
vault_policies_path: /srv/policies/vault
vault_policies_source: /srv/policies/vault
vault_mount_paths:
ops/secrets: ops/data/secrets
ops/privacy: ops/data/privacy
apps: apps/data
# -------------------------------------------------------------
# Vault policies to deploy as-is, ie without templating.
#
# Entries of vault_policies must match a .hcl file in
# roles/vault/policies/files folder.
#
# If you need a template, create a new pillar entry instead
# and add the parsing logic either:
# - directly to roles/vault/policies/
#
# - through _modules/credentials.py for policies to apply
# to Salt nodes, like e.g. vault_secrets_by_role
#
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
vault_policies:
- admin
- salt-primary
- sentry
+ - vault_bootstrap
- viperserv
# -------------------------------------------------------------
# Vault policies for Salt
#
# Declare the extra policies each nodes need.
#
# In adition of those extra policies, the vault_secrets_by_role
# will be parsed for the keys.
#
# IMPORTANT: as grains['roles'] can be modified by the node,
# roles are extracted directly from the pillar.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
vault_extra_policies_by_role:
salt-primary:
- salt-primary
# -------------------------------------------------------------
# Vault secrets by role
#
# Paths of the keys the specified role needs access to.
#
# Avoid * notation as this namespace is shared between Vault
# and the applications. As such, only secrets the Salt nodes
# needs in a state they need to deploy should be listed here.
#
# Use %%node%% as variable for node name.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
vault_secrets_by_role:
devserver:
- ops/secrets/nasqueron/notifications/notifications-cli/%%node%%
- ops/secrets/nasqueron/deploy/deploy_keys/alken-orin
- ops/secrets/nasqueron/deploy/deploy_keys/by_repo/bitbucket/dereckson/www
- ops/secrets/nasqueron/deploy/deploy_keys/by_repo/bitbucket/ewosp/www
- ops/secrets/nasqueron/deploy/deploy_keys/by_repo/github/wolfplex/api-www
opensearch:
- ops/secrets/nasqueron.opensearch.infra-logs.internal_users.admin
- ops/secrets/nasqueron.opensearch.infra-logs.internal_users.dashboards
paas-docker-prod:
#
# Personal data or personally identifiable information (PII)
# related to Nasqueron Operations SIG members.
#
- ops/privacy/ops-cidr
#
# Credentials used by Nasqueron services
# Format: ops/secrets/nasqueron/service/<...>
#
- ops/secrets/nasqueron/airflow/admin_account
- ops/secrets/nasqueron/airflow/fernet
- ops/secrets/nasqueron/airflow/sentry
- ops/secrets/dbserver/cluster-A/users/airflow
- ops/secrets/nasqueron/etherpad/mysql
- ops/secrets/nasqueron/etherpad/users/dereckson
- ops/secrets/nasqueron/penpot/github
- ops/secrets/nasqueron/penpot/postgresql
- ops/secrets/nasqueron/penpot/secret_key
- ops/secrets/nasqueron/rabbitmq/white-rabbit/erlang-cookie
- ops/secrets/nasqueron/rabbitmq/white-rabbit/root
- ops/secrets/nasqueron/sentry/geoipupdate
#
# Credentials used by Nasqueron services
# Format: ops/secrets/nasqueron.<service>.<type>
#
- ops/secrets/nasqueron.acquisitariat.mysql
- ops/secrets/nasqueron.auth-grove.mysql
- ops/secrets/nasqueron.cachet.app_key
- ops/secrets/nasqueron.cachet.mysql
- ops/secrets/nasqueron.etherpad.api
- ops/secrets/nasqueron.notifications.broker
- ops/secrets/nasqueron.notifications.mailgun
- ops/secrets/nasqueron.notifications.sentry
- ops/secrets/nasqueron.notifications.credentials_github_nasqueron
- ops/secrets/nasqueron.notifications.credentials_github_wolfplex
- ops/secrets/nasqueron.notifications.credentials_github_keruald
- ops/secrets/nasqueron.notifications.credentials_github_trustspace
- ops/secrets/nasqueron.notifications.credentials_github_eglide
- ops/secrets/nasqueron.notifications.credentials_phabricator_nasqueron
- apps/notifications-center/dockerhub/notifications
- apps/notifications-center/dockerhub/auth-grove
- ops/secrets/nasqueron.pixelfed.app_key
- ops/secrets/nasqueron.pixelfed.mailgun
- ops/secrets/nasqueron.pixelfed.mysql
- ops/secrets/nasqueron.sentry.app_key
- ops/secrets/nasqueron.sentry.postgresql
- ops/secrets/nasqueron.sentry.vault
#
# Credentials used by Nasqueron members private services
# Format: <username>.<service>.<type>
#
- ops/secrets/dereckson.phabricator.mysql
#
# Credentials used by projects hosted by Nasqueron
# Format: <project name>.<service>.<type>
#
- ops/secrets/espacewin.phpbb.mysql_root
- ops/secrets/wolfplex.phabricator.mailgun
- ops/secrets/wolfplex.phabricator.mysql
- ops/secrets/zed.phabricator.mysql
- ops/secrets/zed.phabricator.sendgrid
paas-docker-dev:
#
# Credentials used by Nasqueron services
# Format: ops/secrets/nasqueron/service/<...>
#
- ops/secrets/nasqueron/airflow/admin_account
- ops/secrets/nasqueron/airflow/fernet
- ops/secrets/nasqueron/airflow/sentry
- ops/secrets/dbserver/cluster-A/users/airflow
- ops/secrets/nasqueron/rabbitmq/orange-rabbit/erlang-cookie
- ops/secrets/nasqueron/rabbitmq/orange-rabbit/root
- ops/secrets/nasqueron/rabbitmq/orange-rabbit/notifications
- ops/secrets/nasqueron.notifications.sentry
#
# Credentials used by projects hosted by Nasqueron
# Format: <project name>.<service>.<type>
#
- ops/secrets/espacewin.bugzilla.mysql
- ops/secrets/espacewin.bugzilla.mysql_root
saas-mediawiki:
- ops/secrets/dbserver/cluster-B/users/saas-mediawiki
- ops/secrets/nasqueron/mediawiki/secret_key
saas-wordpress:
- ops/secrets/dbserver/cluster-B/users/dereckson_blog
- ops/secrets/dereckson/wordpress/secrets
viperserv:
- ops/secrets/nasqueron.viperserv.vault
webserver-alkane:
- ops/secrets/dbserver/cluster-B/users/dereckson_www
- ops/secrets/dbserver/cluster-B/users/zed
- ops/secrets/zed/hypership/secret_key
#
# Wolfplex credentials
#
- ops/secrets/nasqueron.etherpad.api
webserver-legacy:
#
# Wolfplex credentials
#
- ops/secrets/nasqueron.etherpad.api
# -------------------------------------------------------------
# Vault secrets by dbserver cluster
#
# Paths of the keys the specified role needs access to.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
vault_secrets_by_dbserver_cluster:
# Main PostgreSQL cluster
A:
- ops/secrets/dbserver/cluster-A/users/*
# Main MariaDB cluster - Alkane PaaS, ViperServ
B:
- ops/secrets/dbserver/cluster-B/users/*
diff --git a/roles/vault/bootstrap/files/vault-initialize.sh b/roles/vault/bootstrap/files/vault-initialize.sh
new file mode 100755
index 0000000..a78823a
--- /dev/null
+++ b/roles/vault/bootstrap/files/vault-initialize.sh
@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# -------------------------------------------------------------
+# Vault initialize script
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# Description: Recreate the engines and configure them.
+#
+# Should be run only once for the cluster
+# for disaster recovery purpose if the storage
+# back-end can't be restored.
+#
+# Will issue a new root CA certificate.
+#
+# Dependencies: bash is used as shebang to allow >() process
+# execution, undefined in POSIX sh.
+# To sync with: roles/vault/policies/files/vault_bootstrap.hcl
+# Source file: roles/vault/vault/files/vault-initialize.sh
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+set -e
+
+PREFIX_PKI=pki_
+DOMAIN=nasqueron.drake
+CERTS_PATH=/usr/local/share/certs
+PUBLIC_URL=https://api.nasqueron.org/infra/security/pki
+
+VAULT_CERTS_PATH=/usr/local/etc/certificates/vault
+
+# -------------------------------------------------------------
+# PKI :: root CA
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+CA_ROOT_NAME=root
+CA_ROOT_PATH=$PREFIX_PKI$CA_ROOT_NAME
+
+vault secrets enable -path=$CA_ROOT_PATH pki
+vault secrets tune -max-lease-ttl=87600h
+
+vault write -field=certificate $CA_ROOT_PATH/root/generate/internal \
+ common_name=$DOMAIN \
+ ttl=87600h > $CERTS_PATH/nasqueron-vault-ca.crt
+
+vault write $CA_ROOT_PATH/config/urls \
+ issuing_certificates="$PUBLIC_URL/$CA_ROOT_NAME/ca" \
+ crl_distribution_points="$PUBLIC_URL/$CA_ROOT_NAME/crl"
+
+
+# -------------------------------------------------------------
+# PKI :: intermediate CA for Vault own certificates
+#
+# Intermediate certificate is signed by the root CA one.
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+CA_VAULT_NAME=vault
+CA_VAULT_PATH=$PREFIX_PKI$CA_VAULT_NAME
+
+vault secrets enable -path=$CA_VAULT_PATH pki
+vault secrets tune -max-lease-ttl=2160h "$CA_VAULT"
+
+CSR=$(mktemp /tmp/csr.XXXX)
+vault write -format=json $CA_VAULT_PATH/intermediate/generate/internal \
+ common_name="$DOMAIN Intermediate Authority" \
+ | jq -r '.data.csr' > "$CSR"
+vault write -format=json $CA_ROOT_PATH/root/sign-intermediate csr=@"$CSR" \
+ format=pem_bundle ttl="2160h" \
+ | jq -r '.data.certificate' > $CERTS_PATH/nasqueron-vault-intermediate.crt
+rm "$CSR"
+
+vault write $CA_VAULT_PATH/intermediate/set-signed \
+ certificate=@$CERTS_PATH/nasqueron-vault-intermediate.crt
+
+vault write $CA_VAULT_PATH/config/urls \
+ issuing_certificates="$PUBLIC_URL/$CA_VAULT_NAME/ca" \
+ crl_distribution_points="$PUBLIC_URL/$CA_VAULT_NAME/crl"
+
+vault write $CA_VAULT_PATH/roles/nasqueron-drake \
+ allowed_domains="nasqueron.drake" \
+ allow_subdomains=true \
+ max_ttl="2160h"
+
+# -------------------------------------------------------------
+# Vault configuration artifacts
+#
+# :: TLS certificate generated by intermediate PKI
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+mkdir -p $VAULT_CERTS_PATH
+
+vault write -format=json $CA_VAULT_PATH/issue/nasqueron-drake \
+ common_name="complector.nasqueron.drake" ttl="2160h" \
+ ip_sans="127.0.0.1,172.27.27.7" | tee \
+ >(jq -r .data.certificate > $VAULT_CERTS_PATH/certificate.pem) \
+ >(jq -r .data.issuing_ca > $VAULT_CERTS_PATH/ca.pem) \
+ >(jq -r .data.private_key > $VAULT_CERTS_PATH/private.key)
+
+cat $VAULT_CERTS_PATH/certificate.pem $VAULT_CERTS_PATH/ca.pem > $VAULT_CERTS_PATH/fullchain.pem
diff --git a/roles/vault/bootstrap/init.sls b/roles/vault/bootstrap/init.sls
new file mode 100644
index 0000000..bfadd77
--- /dev/null
+++ b/roles/vault/bootstrap/init.sls
@@ -0,0 +1,33 @@
+# -------------------------------------------------------------
+# Salt — Vault
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+# , ,
+# / \/ \
+# (/ //_ \_
+# .-._ \|| . \
+# \ '-._ _,:__.-"/---\_ \
+# ______/___ '. .--------------------'~-'--.)__( , )\ \
+# `'--.___ _\ / | HERE BE DRAGONS. ,' \)|\ `\|
+# /_.-' _\ \ _:,_ " || (
+# .'__ _.' \'-/,`-~` This unit is only intended |/
+# '. ___.> /=,| for disaster recovery plan B. |
+# / .-'/_ ) | Plan A is to restore storage. |
+# snd )' ( /(/ '---------------------------------'
+# \\ "
+# '=='
+
+vault_bootstrap_dependencies:
+ pkg.installed:
+ - jq
+
+/usr/local/bin/vault-initialize:
+ file.managed:
+ - source: salt://roles/vault/bootstrap/files/vault-initialize.sh
+ - mode: 755
+
+# As Salt doesn't have a token for the Vault installation,
+# we can't run this script. Run it with a root token or
+# a token with the "vault_bootstrap" policy.
diff --git a/roles/vault/init.sls b/roles/vault/init.sls
index 1fa85cf..2e431fb 100644
--- a/roles/vault/init.sls
+++ b/roles/vault/init.sls
@@ -1,12 +1,22 @@
# -------------------------------------------------------------
# Salt — Vault
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Project: Nasqueron
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
include:
- .vault
# Depends of Vault installed
- .policies
+
+# -------------------------------------------------------------
+# Disaster recovery process
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+# The bootstrap unit can be run once for the whole cluster
+# if you wish to regerate the Vault configuration from scratch
+# instead of restoring the storage back-end.
+#
+# As such, .bootstrap should NOT be included in the includes list.
diff --git a/roles/vault/policies/files/vault_bootstrap.hcl b/roles/vault/policies/files/vault_bootstrap.hcl
new file mode 100644
index 0000000..cca39d2
--- /dev/null
+++ b/roles/vault/policies/files/vault_bootstrap.hcl
@@ -0,0 +1,34 @@
+# -------------------------------------------------------------
+# Vault configuration - Policy to run DRP bootstrap script
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# Source file: roles/vault/vault/files/vault_boostrap.hcl
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+# -------------------------------------------------------------
+# Secrets engine management
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+path "sys/mounts/*" {
+ capabilities = [ "create", "read", "update", "delete", "list" ]
+}
+
+path "sys/mounts" {
+ capabilities = [ "read", "list" ]
+}
+
+# -------------------------------------------------------------
+# PKI
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+path "pki*" {
+ capabilities = [ "create", "read", "update", "delete", "list", "sudo" ]
+}

File Metadata

Mime Type
text/x-diff
Expires
Sat, Nov 14, 00:51 (1 d, 21 h ago)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4258202
Default Alt Text
(16 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator