TheHackmeister
commented
6 years ago Thanks for the feedback! You are 100% right about the installer needing some refactoring. I went to add some more to it, and had trouble figuring out where my additions needed to go.
What I've done:
- Split out the script into multiple files. install.sh loads all the files in installer/bash and then runs the main installation tasks. The tasks and general functions are broken out by what component is being accessed. installer/bash/vault.sh for example, has all the vault related code and installer/bash/host.sh contains all the modifications needed to the host machine, as well as commands to manipulate Docker.
- Right now, the general functions and actual install steps for a given component are all in one file, and I'm wondering if it makes sense to split them out further so that the actual install steps in a separate file.
- Created a couple functions (extract_from_json and create_volume) for tasks that were repeated.
- Transitioned to using a username and password generated by Vault's Rabbit MQ secrets backend for MQTT authentication. This is because I discovered that my plan of using TLS certs for MQTT authentication wasn't supported on the ESP8266.
- Configured Home Assistant to use those usernames and passwords.
- Added volume creation for ha_db and mqtt to allow for persistence as well as to avoid having to mount things from the host file system.
- Installer undoes previous installer's work. This allows me to run "sudo -E ./install.sh" and it will automatically bring down the old stack, and remove the old volumes. This helped speed up development a lot.
What's left:
- [ ] Change NodeRED's MQTT authentication to use username/password.
- [ ] Create flows to renew/regenerate MQTT usernames and passwords before they expire.
- [ ] A fair number of # TODO:'s scattered throughout the code. They are mostly moving from static wait times to continuing once some condition has been detected.
- [ ] Write up documentation.
This secures MQTT communication between NodeRED, Home Assistant, and Rabbit MQ. There will be more changes needed to communicate with ESPs, but that'll go in a different branch.