Data-Portal

Docker image for City's data portal prototype.

Setting up

Drawing heavily on these instructions, as well as the accompanying docker compose file.

Also, the work done by OpenUp on SA's National Treasury CKAN.

NB The below config is strictly for development purposes, and is horribly insecure.

Docker

Deploys everything to one host that needs Docker installed. On the plus side, very simple, on the minus, as reliable as that one host.

1. Run the script bash bin/run_ckan.sh - see the script for the args
2. CKAN should be accessible at :8001
3. Remove everything: bash bin/rm_ckan.sh

Customising for Production

Working notes on what has to be done to prepare this install for production deployment:

• Change location of all mounted volumes to somewhere other than /tmp.
• Change Access and Secret key for Minio when spinning up container, and also in the CKAN config file.
• Setup an Nginx SSL/TLS termination point:
  • generate self-signed SSL/TLS cert (openssl req -x509 -newkey rsa:4096 -keyout ckan_key.pem -out ckan_cert.pem -days 3650 -nodes).
  • use certbot to generate properly signed certificates for our subdomains (you'll need to register these somehow):
  • sudo certbot certonly --standalone -d <FQDN e.g. data.demo.com>
  • Creates certificate at /etc/letsencrypt/live/<FQDN>/cert.pem
  • Creates key at /etc/letsencrypt/live/<FQDN>/privkey.pem
  • Set up NGINX config with proxy rules to pass traffic from port 443 to port 5000 (the one that CKAN is on). See config directory for example config.
  • Create the NGINX reverse proxy: docker run -d --restart always -v <path to letsencrypt certs e.g. /etc/letsencrypt>:/etc/nginx/certs:z -v <Path to NGINX config>:/etc/nginx/conf.d/default.conf --network ckan --name ckan-proxy -p 443:443 -p 80:80 nginx

Kubernetes Deployment

Deploys to a kubernetes cluster. Gives you the reliability guarantees of your k8s cluster, but has more moving parts.

1. Run the script bash bin/deploy.sh - see the script for the args
2. CKAN should be accessible on https://datascience.capetown.gov.za/ckan-test

Customising for Production

• Should change namespace values in various YAML specs and configs to use something other than ckan
• Use non-default values for various passwords