search

CactuseSecurity / firewall-orchestrator

Network Security data repository for automation, reporting and compliance of firewall rules
https://fwo.cactus.de
Apache License 2.0
33 stars 11 forks source link

installer: fully implement distributed installation #198

Open tpurschke opened 4 years ago

tpurschke commented 4 years ago
NilsPur commented 4 years ago

@tpurschke Done with auth server and api server adresse ?

tpurschke commented 4 years ago

no - not finished yet

tpurschke commented 1 year ago

even though the db is reachable remotely:

tim@devsrv4:~$ psql -d fworchdb -h 10.6.5.113 -U dbadmin
Password for user dbadmin: 
psql (13.8 (Debian 13.8-0+deb11u1), server 11.18 (Debian 11.18-0+deb10u1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.
fworchdb=#

currently distributed install fails with:

TASK [api : show hasura env for debugging] ***********************************************************************************************************************************************************************
ok: [devsrv3] => 
  hasura_env:
    HASURA_GRAPHQL_ADMIN_SECRET: not4production
    HASURA_GRAPHQL_CONSOLE_ASSETS_DIR: /srv/console-assets
    HASURA_GRAPHQL_CORS_DOMAIN: '*'
    HASURA_GRAPHQL_DATABASE_URL: postgres://dbadmin:maJhAJqOwwEHjanmVhwnRQCOGTrjCXYv@10.6.5.113:5432/fworchdb
    HASURA_GRAPHQL_ENABLED_LOG_TYPES: startup, http-log, websocket-log
    HASURA_GRAPHQL_ENABLE_CONSOLE: 'true'
    HASURA_GRAPHQL_ENABLE_TELEMETRY: 'false'
    HASURA_GRAPHQL_INFER_FUNCTION_PERMISSIONS: 'true'
    HASURA_GRAPHQL_JWT_SECRET: ' { "type": "RS256", "key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ILANCqxJZazBoskdWdx\nm0Rvyb6iYt1eiecep5eCHbq+Hmq4NJpJkIcLadzd2m/n0q0VkOAwrpN499RtZxZ4\nHKgheD9Z/uzrgIKDQFmnd9KygYjIAubQXxC/CFgv79CfG9+LIyKCu4oNXueoYJnS\nXjzV9NNBF05bVj2zZsJneZlujQKNt7xMXhFo7uWpbAx8qYP1n1RjBVTyIaKc4dDB\n90bNhpSBz/L3/09h4+r26xZloZRhzfMrplUWBVYyzH2g/b0VOjXS2Coe8HV10Rt8\nzecBrz/JYbf9HVY7g3sWTueyd5+XdCWkIbZy0A3yiO5jCltbZWl86BjzUsFwzS10\naQIDAQAB\n-----END PUBLIC KEY-----", "claims_namespace_path": "$" } '
    HASURA_GRAPHQL_LOG_LEVEL: info
    HASURA_GRAPHQL_V1_BOOLEAN_NULL_COLLAPSE: 'true'
    HTTPS_PROXY: ''
    HTTP_PROXY: http://admffm:3128
    http_proxy: http://admffm:3128
    https_proxy: ''

TASK [api : start hasura container ansible 2.10 and higher] ******************************************************************************************************************************************************
skipping: [devsrv3]

TASK [api : start hasura container pre ansible 2.10] *************************************************************************************************************************************************************
changed: [devsrv3]

TASK [api : show docker result] **********************************************************************************************************************************************************************************
ok: [devsrv3] => 
  docker_return:
    ansible_facts:
      docker_container:
        AppArmorProfile: docker-default
        Args:
        - -c
        - '"${HGE_BINARY}" serve'
        Config:
          AttachStderr: false
          AttachStdin: false
          AttachStdout: false
          Cmd:
          - /bin/sh
          - -c
          - '"${HGE_BINARY}" serve'
          Domainname: ''
          Entrypoint: null
          Env:
          - HASURA_GRAPHQL_DATABASE_URL=postgres://dbadmin:maJhAJqOwwEHjanmVhwnRQCOGTrjCXYv@10.6.5.113:5432/fworchdb
          - HASURA_GRAPHQL_ENABLE_CONSOLE=true
          - HASURA_GRAPHQL_ENABLE_TELEMETRY=false
          - HASURA_GRAPHQL_ADMIN_SECRET=not4production
          - HASURA_GRAPHQL_LOG_LEVEL=info
          - HASURA_GRAPHQL_ENABLED_LOG_TYPES=startup, http-log, websocket-log
          - HASURA_GRAPHQL_CONSOLE_ASSETS_DIR=/srv/console-assets
          - HASURA_GRAPHQL_V1_BOOLEAN_NULL_COLLAPSE=true
          - HASURA_GRAPHQL_CORS_DOMAIN=*
          - HASURA_GRAPHQL_INFER_FUNCTION_PERMISSIONS=true
          - 'HASURA_GRAPHQL_JWT_SECRET= { "type": "RS256", "key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ILANCqxJZazBoskdWdx\nm0Rvyb6iYt1eiecep5eCHbq+Hmq4NJpJkIcLadzd2m/n0q0VkOAwrpN499RtZxZ4\nHKgheD9Z/uzrgIKDQFmnd9KygYjIAubQXxC/CFgv79CfG9+LIyKCu4oNXueoYJnS\nXjzV9NNBF05bVj2zZsJneZlujQKNt7xMXhFo7uWpbAx8qYP1n1RjBVTyIaKc4dDB\n90bNhpSBz/L3/09h4+r26xZloZRhzfMrplUWBVYyzH2g/b0VOjXS2Coe8HV10Rt8\nzecBrz/JYbf9HVY7g3sWTueyd5+XdCWkIbZy0A3yiO5jCltbZWl86BjzUsFwzS10\naQIDAQAB\n-----END PUBLIC KEY-----", "claims_namespace_path": "$" } '
          - HTTP_PROXY=http://admffm:3128
          - HTTPS_PROXY=
          - http_proxy=http://admffm:3128
          - https_proxy=
          - PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
          - LANG=C.UTF-8
          - LC_ALL=C.UTF-8
          - HGE_BINARY=graphql-engine
          ExposedPorts:
            8080:8080/tcp: {}
          Hostname: devsrv3
          Image: hasura/graphql-engine:v2.15.2
          Labels: {}
          OnBuild: null
          OpenStdin: false
          StdinOnce: false
          Tty: false
          User: ''
          Volumes: null
          WorkingDir: ''
        Created: '2022-12-08T12:41:30.672586657Z'
        Driver: vfs
        ExecIDs: null
        GraphDriver:
          Data: null
          Name: vfs
        HostConfig:
          AutoRemove: false
          Binds: []
          BlkioDeviceReadBps: null
          BlkioDeviceReadIOps: null
          BlkioDeviceWriteBps: null
          BlkioDeviceWriteIOps: null
          BlkioWeight: 0
          BlkioWeightDevice: null
          CapAdd: null
          CapDrop: null
          Cgroup: ''
          CgroupParent: ''
          CgroupnsMode: host
          ConsoleSize:
          - 0
          - 0
          ContainerIDFile: ''
          CpuCount: 0
          CpuPercent: 0
          CpuPeriod: 0
          CpuQuota: 0
          CpuRealtimePeriod: 0
          CpuRealtimeRuntime: 0
          CpuShares: 0
          CpusetCpus: ''
          CpusetMems: ''
          DeviceCgroupRules: null
          DeviceRequests: null
          Devices: null
          Dns: null
          DnsOptions: null
          DnsSearch: null
          ExtraHosts: null
          GroupAdd: null
          IOMaximumBandwidth: 0
          IOMaximumIOps: 0
          Init: false
          IpcMode: private
          Isolation: ''
          KernelMemory: 0
          KernelMemoryTCP: 0
          Links: null
          LogConfig:
            Config:
              syslog-address: tcp://devsrv3:514
              syslog-facility: daemon
              tag: fworch-api
            Type: syslog
          MaskedPaths:
          - /proc/asound
          - /proc/acpi
          - /proc/kcore
          - /proc/keys
          - /proc/latency_stats
          - /proc/timer_list
          - /proc/timer_stats
          - /proc/sched_debug
          - /proc/scsi
          - /sys/firmware
          Memory: 0
          MemoryReservation: 0
          MemorySwap: 0
          MemorySwappiness: null
          NanoCpus: 0
          NetworkMode: host
          OomKillDisable: false
          OomScoreAdj: 0
          PidMode: ''
          PidsLimit: null
          PortBindings: null
          Privileged: false
          PublishAllPorts: false
          ReadonlyPaths:
          - /proc/bus
          - /proc/fs
          - /proc/irq
          - /proc/sys
          - /proc/sysrq-trigger
          ReadonlyRootfs: false
          RestartPolicy:
            MaximumRetryCount: 0
            Name: ''
          Runtime: runc
          SecurityOpt: null
          ShmSize: 67108864
          UTSMode: ''
          Ulimits: null
          UsernsMode: ''
          VolumeDriver: ''
          VolumesFrom: null
        HostnamePath: /var/lib/docker/containers/b8000cfeeda48d0b4e66b1d9d3e219f076def76ff3c65c13a2f8f73f705132a5/hostname
        HostsPath: /var/lib/docker/containers/b8000cfeeda48d0b4e66b1d9d3e219f076def76ff3c65c13a2f8f73f705132a5/hosts
        Id: b8000cfeeda48d0b4e66b1d9d3e219f076def76ff3c65c13a2f8f73f705132a5
        Image: sha256:dd664df7f552bf424450df81444915bf24ac167a98a1a05478e4c70075194779
        LogPath: ''
        MountLabel: ''
        Mounts: []
        Name: /fworch-api
        NetworkSettings:
          Bridge: ''
          EndpointID: ''
          Gateway: ''
          GlobalIPv6Address: ''
          GlobalIPv6PrefixLen: 0
          HairpinMode: false
          IPAddress: ''
          IPPrefixLen: 0
          IPv6Gateway: ''
          LinkLocalIPv6Address: ''
          LinkLocalIPv6PrefixLen: 0
          MacAddress: ''
          Networks:
            host:
              Aliases: null
              DriverOpts: null
              EndpointID: 371ecd09d778226869ac2dfca9e43353c0c3a5f11cddf8a85124b7462090266a
              Gateway: ''
              GlobalIPv6Address: ''
              GlobalIPv6PrefixLen: 0
              IPAMConfig: null
              IPAddress: ''
              IPPrefixLen: 0
              IPv6Gateway: ''
              Links: null
              MacAddress: ''
              NetworkID: 40bbd283fe4330d4588f96fd3b9f4c8a2e6a583a1f0d66cc0ce6aa251491d31c
          Ports: {}
          SandboxID: 3e4868cbcc68397024897a2fd7537c76be7d121327669042baf3027e10c143b4
          SandboxKey: /var/run/docker/netns/default
          SecondaryIPAddresses: null
          SecondaryIPv6Addresses: null
        Path: /bin/sh
        Platform: linux
        ProcessLabel: ''
        ResolvConfPath: /var/lib/docker/containers/b8000cfeeda48d0b4e66b1d9d3e219f076def76ff3c65c13a2f8f73f705132a5/resolv.conf
        RestartCount: 0
        State:
          Dead: false
          Error: ''
          ExitCode: 0
          FinishedAt: '0001-01-01T00:00:00Z'
          OOMKilled: false
          Paused: false
          Pid: 337511
          Restarting: false
          Running: true
          StartedAt: '2022-12-08T12:41:34.593612496Z'
          Status: running
    changed: true
    container:
      AppArmorProfile: docker-default
      Args:
      - -c
      - '"${HGE_BINARY}" serve'
      Config:
        AttachStderr: false
        AttachStdin: false
        AttachStdout: false
        Cmd:
        - /bin/sh
        - -c
        - '"${HGE_BINARY}" serve'
        Domainname: ''
        Entrypoint: null
        Env:
        - HASURA_GRAPHQL_DATABASE_URL=postgres://dbadmin:maJhAJqOwwEHjanmVhwnRQCOGTrjCXYv@10.6.5.113:5432/fworchdb
        - HASURA_GRAPHQL_ENABLE_CONSOLE=true
        - HASURA_GRAPHQL_ENABLE_TELEMETRY=false
        - HASURA_GRAPHQL_ADMIN_SECRET=not4production
        - HASURA_GRAPHQL_LOG_LEVEL=info
        - HASURA_GRAPHQL_ENABLED_LOG_TYPES=startup, http-log, websocket-log
        - HASURA_GRAPHQL_CONSOLE_ASSETS_DIR=/srv/console-assets
        - HASURA_GRAPHQL_V1_BOOLEAN_NULL_COLLAPSE=true
        - HASURA_GRAPHQL_CORS_DOMAIN=*
        - HASURA_GRAPHQL_INFER_FUNCTION_PERMISSIONS=true
        - 'HASURA_GRAPHQL_JWT_SECRET= { "type": "RS256", "key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ILANCqxJZazBoskdWdx\nm0Rvyb6iYt1eiecep5eCHbq+Hmq4NJpJkIcLadzd2m/n0q0VkOAwrpN499RtZxZ4\nHKgheD9Z/uzrgIKDQFmnd9KygYjIAubQXxC/CFgv79CfG9+LIyKCu4oNXueoYJnS\nXjzV9NNBF05bVj2zZsJneZlujQKNt7xMXhFo7uWpbAx8qYP1n1RjBVTyIaKc4dDB\n90bNhpSBz/L3/09h4+r26xZloZRhzfMrplUWBVYyzH2g/b0VOjXS2Coe8HV10Rt8\nzecBrz/JYbf9HVY7g3sWTueyd5+XdCWkIbZy0A3yiO5jCltbZWl86BjzUsFwzS10\naQIDAQAB\n-----END PUBLIC KEY-----", "claims_namespace_path": "$" } '
        - HTTP_PROXY=http://admffm:3128
        - HTTPS_PROXY=
        - http_proxy=http://admffm:3128
        - https_proxy=
        - PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
        - LANG=C.UTF-8
        - LC_ALL=C.UTF-8
        - HGE_BINARY=graphql-engine
        ExposedPorts:
          8080:8080/tcp: {}
        Hostname: devsrv3
        Image: hasura/graphql-engine:v2.15.2
        Labels: {}
        OnBuild: null
        OpenStdin: false
        StdinOnce: false
        Tty: false
        User: ''
        Volumes: null
        WorkingDir: ''
      Created: '2022-12-08T12:41:30.672586657Z'
      Driver: vfs
      ExecIDs: null
      GraphDriver:
        Data: null
        Name: vfs
      HostConfig:
        AutoRemove: false
        Binds: []
        BlkioDeviceReadBps: null
        BlkioDeviceReadIOps: null
        BlkioDeviceWriteBps: null
        BlkioDeviceWriteIOps: null
        BlkioWeight: 0
        BlkioWeightDevice: null
        CapAdd: null
        CapDrop: null
        Cgroup: ''
        CgroupParent: ''
        CgroupnsMode: host
        ConsoleSize:
        - 0
        - 0
        ContainerIDFile: ''
        CpuCount: 0
        CpuPercent: 0
        CpuPeriod: 0
        CpuQuota: 0
        CpuRealtimePeriod: 0
        CpuRealtimeRuntime: 0
        CpuShares: 0
        CpusetCpus: ''
        CpusetMems: ''
        DeviceCgroupRules: null
        DeviceRequests: null
        Devices: null
        Dns: null
        DnsOptions: null
        DnsSearch: null
        ExtraHosts: null
        GroupAdd: null
        IOMaximumBandwidth: 0
        IOMaximumIOps: 0
        Init: false
        IpcMode: private
        Isolation: ''
        KernelMemory: 0
        KernelMemoryTCP: 0
        Links: null
        LogConfig:
          Config:
            syslog-address: tcp://devsrv3:514
            syslog-facility: daemon
            tag: fworch-api
          Type: syslog
        MaskedPaths:
        - /proc/asound
        - /proc/acpi
        - /proc/kcore
        - /proc/keys
        - /proc/latency_stats
        - /proc/timer_list
        - /proc/timer_stats
        - /proc/sched_debug
        - /proc/scsi
        - /sys/firmware
        Memory: 0
        MemoryReservation: 0
        MemorySwap: 0
        MemorySwappiness: null
        NanoCpus: 0
        NetworkMode: host
        OomKillDisable: false
        OomScoreAdj: 0
        PidMode: ''
        PidsLimit: null
        PortBindings: null
        Privileged: false
        PublishAllPorts: false
        ReadonlyPaths:
        - /proc/bus
        - /proc/fs
        - /proc/irq
        - /proc/sys
        - /proc/sysrq-trigger
        ReadonlyRootfs: false
        RestartPolicy:
          MaximumRetryCount: 0
          Name: ''
        Runtime: runc
        SecurityOpt: null
        ShmSize: 67108864
        UTSMode: ''
        Ulimits: null
        UsernsMode: ''
        VolumeDriver: ''
        VolumesFrom: null
      HostnamePath: /var/lib/docker/containers/b8000cfeeda48d0b4e66b1d9d3e219f076def76ff3c65c13a2f8f73f705132a5/hostname
      HostsPath: /var/lib/docker/containers/b8000cfeeda48d0b4e66b1d9d3e219f076def76ff3c65c13a2f8f73f705132a5/hosts
      Id: b8000cfeeda48d0b4e66b1d9d3e219f076def76ff3c65c13a2f8f73f705132a5
      Image: sha256:dd664df7f552bf424450df81444915bf24ac167a98a1a05478e4c70075194779
      LogPath: ''
      MountLabel: ''
      Mounts: []
      Name: /fworch-api
      NetworkSettings:
        Bridge: ''
        EndpointID: ''
        Gateway: ''
        GlobalIPv6Address: ''
        GlobalIPv6PrefixLen: 0
        HairpinMode: false
        IPAddress: ''
        IPPrefixLen: 0
        IPv6Gateway: ''
        LinkLocalIPv6Address: ''
        LinkLocalIPv6PrefixLen: 0
        MacAddress: ''
        Networks:
          host:
            Aliases: null
            DriverOpts: null
            EndpointID: 371ecd09d778226869ac2dfca9e43353c0c3a5f11cddf8a85124b7462090266a
            Gateway: ''
            GlobalIPv6Address: ''
            GlobalIPv6PrefixLen: 0
            IPAMConfig: null
            IPAddress: ''
            IPPrefixLen: 0
            IPv6Gateway: ''
            Links: null
            MacAddress: ''
            NetworkID: 40bbd283fe4330d4588f96fd3b9f4c8a2e6a583a1f0d66cc0ce6aa251491d31c
        Ports: {}
        SandboxID: 3e4868cbcc68397024897a2fd7537c76be7d121327669042baf3027e10c143b4
        SandboxKey: /var/run/docker/netns/default
        SecondaryIPAddresses: null
        SecondaryIPv6Addresses: null
      Path: /bin/sh
      Platform: linux
      ProcessLabel: ''
      ResolvConfPath: /var/lib/docker/containers/b8000cfeeda48d0b4e66b1d9d3e219f076def76ff3c65c13a2f8f73f705132a5/resolv.conf
      RestartCount: 0
      State:
        Dead: false
        Error: ''
        ExitCode: 0
        FinishedAt: '0001-01-01T00:00:00Z'
        OOMKilled: false
        Paused: false
        Pid: 337511
        Restarting: false
        Running: true
        StartedAt: '2022-12-08T12:41:34.593612496Z'
        Status: running
    failed: false

TASK [api : Get info on container] *******************************************************************************************************************************************************************************
ok: [devsrv3]

TASK [api : Print the status of the container in case of problems only] ******************************************************************************************************************************************
skipping: [devsrv3]

TASK [api : copy hasura systemd service script] ******************************************************************************************************************************************************************
ok: [devsrv3]

TASK [api : make hasura docker container run at host startup] ****************************************************************************************************************************************************
ok: [devsrv3]

TASK [api : wait for hasura port to become available] ************************************************************************************************************************************************************
fatal: [devsrv3]: FAILED! => changed=false 
  elapsed: 25
  msg: Timeout when waiting for 127.0.0.1:8080

PLAY RECAP *******************************************************************************************************************************************************************************************************
devsrv3                    : ok=207  changed=88   unreachable=0    failed=1    skipped=96   rescued=0    ignored=0   
devsrv4                    : ok=28   changed=13   unreachable=0    failed=0    skipped=42   rescued=0    ignored=0   

real    7m40.294s
user    1m7.253s
sys 0m30.156s
tim@lxdffm:~/ansible-lxd/firewall-orchestrator-copy$