Add nexus with ssl

This commit is contained in:
Amarpreet Minhas 2020-09-20 01:14:59 -04:00
parent 60a56bdc97
commit 70b6576e96
10 changed files with 143 additions and 106 deletions

View file

@ -3,7 +3,7 @@
main_dc_name: columbia main_dc_name: columbia
# consul # consul
consul_version: 1.8.3 consul_version: 1.8.4
consul_domain: masked.name consul_domain: masked.name
# vault # vault

View file

@ -1,3 +1,4 @@
--- ---
docker_registry_mnt: /mnt/raid/docker_registry nexus_storage: /opt/nexus
nexus_config_dir: /opt/nexus-config
... ...

View file

@ -9,7 +9,7 @@ fatman.minhas.io
ivyking.minhas.io ivyking.minhas.io
sedan.minhas.io sedan.minhas.io
[docker_registry] [nexus]
ivyking.minhas.io ivyking.minhas.io
[nomad_client] [nomad_client]

View file

@ -1,5 +0,0 @@
---
- hosts: docker_registry
roles:
- role: docker_registry
...

View file

@ -1,5 +1,5 @@
--- ---
- hosts: docker_registry:nomad_client - hosts: nexus:nomad_client
roles: roles:
- role: docker - role: docker
... ...

View file

@ -0,0 +1,5 @@
---
- hosts: nexus
roles:
- role: nexus
...

View file

@ -4,5 +4,5 @@
- import_playbook: vault-server.yml - import_playbook: vault-server.yml
- import_playbook: consul-client.yml - import_playbook: consul-client.yml
- import_playbook: nomad.yml - import_playbook: nomad.yml
- import_playbook: docker-registry.yml - import_playbook: nexus.yml
... ...

View file

@ -1,96 +0,0 @@
---
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/docker_registry.crt"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
- name: get cert
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
args:
executable: /bin/bash
environment:
VAULT_ADDR: http://ivyking.minhas.io:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/pki/{{ item.path }}"
mode: '{{ item.mode }}'
owner: root
group: root
when: cert_data.changed
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "certs/docker_registry.crt",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "keys/docker_registry.key",
mode: "0600"
}
- name: ensure python-docker is installed
apt:
name: python3-docker
state: present
- name: ensure docker registry ssl dir
file:
path: /etc/docker_registry/
state: directory
owner: root
group: root
mode: 0755
- name: ensure docker registry cert
file:
state: hard
src: /etc/pki/certs/docker_registry.crt
dest: /etc/docker_registry/docker_registry.crt
owner: root
group: root
mode: 0644
- name: ensure docker registry private key
file:
state: hard
src: /etc/pki/keys/docker_registry.key
dest: /etc/docker_registry/docker_registry.key
owner: root
group: root
mode: 0644
- name: ensure docker registry key and cert are available
file:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
state: hard
loop:
- { src: /etc/pki/certs/docker_registry.crt, dest: /etc/docker_registry/docker_registry.crt }
- { src: /etc/pki/keys/docker_registry.key, dest: /etc/docker_registry/docker_registry.key }
- name: run docker registry
docker_container:
name: registry
image: registry:2
env:
REGISTRY_HTTP_ADDR: 0.0.0.0:443
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker_registry.crt
REGISTRY_HTTP_TLS_KEY: /certs/docker_registry.key
REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/docker:data')['REGISTRY_HTTP_SECRET'] }}"
ports:
- "5000:443"
volumes:
- "{{ docker_registry_mnt }}:/var/lib/registry"
- "/etc/docker_registry:/certs"
restart_policy: always
...

View file

@ -0,0 +1,119 @@
---
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/nexus.crt"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
- name: get cert
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nexus.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
args:
executable: /bin/bash
environment:
VAULT_ADDR: http://ivyking.minhas.io:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/pki/{{ item.path }}"
mode: '{{ item.mode }}'
owner: root
group: root
when: cert_data.changed
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "certs/nexus.crt",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "keys/nexus.key",
mode: "0600"
}
- name: ensure python-docker is installed
apt:
name: python3-docker
state: present
- name: ensure nexus group exists
group:
name: nexus
state: present
gid: 200
- name: ensure nexus user exists
user:
name: nexus
group: nexus
uid: 200
create_home: False
- name: ensure nexus ssl dir exists
file:
path: /etc/nexus/
state: directory
owner: root
group: root
mode: 0755
- name: ensure nexus data dir exists
file:
path: "{{ nexus_storage }}"
state: directory
owner: nexus
group: nexus
mode: 0755
- name: ensure nexus data dir exists
file:
path: "{{ nexus_config_dir }}"
state: directory
owner: nexus
group: nexus
mode: 0755
- name: ensure nexus keystore dir exists
file:
path: "{{ nexus_config_dir }}/etc/ssl/"
state: directory
owner: nexus
group: nexus
mode: 0755
- name: ensure keystore exists
copy:
content: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['keystore'] | b64decode }}"
dest: "{{ nexus_config_dir }}/etc/ssl/keystore.jks"
owner: nexus
group: nexus
mode: 0700
- name: template nexus.properties
template:
src: templates/nexus.properties.j2
dest: "{{ nexus_storage }}/etc/nexus.properties"
- name: run nexus3
docker_container:
name: nexus
image: sonatype/nexus3
env:
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/nexus.crt
REGISTRY_HTTP_TLS_KEY: /certs/nexus.key
REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['REGISTRY_HTTP_SECRET'] }}"
ports:
- "8081:8081"
volumes:
- "{{ nexus_storage }}:/nexus-data"
- "{{ nexus_config_dir }}/etc/ssl:/opt/sonatype/nexus/etc/ssl/"
- /etc/nexus:/certs
restart_policy: always
...

View file

@ -0,0 +1,13 @@
# Jetty section
application-port-ssl=8081
application-port=8082
application-host=0.0.0.0
nexus-args=${jetty.etc}/jetty.xml,${jetty.etc}/jetty-https.xml,${jetty.etc}/jetty-requestlog.xml
ssl.etc=/opt/sonatype/nexus/etc/ssl/
# nexus-context-path=/${NEXUS_CONTEXT}
# Nexus section
# nexus-edition=nexus-pro-edition
# nexus-features=\
# nexus-pro-feature
# nexus.clustered=false