-
Notifications
You must be signed in to change notification settings - Fork 154
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Initial commit * Replaced webapp with vm * Amended docker start commands * Amended firewall * Add nexus config to persistent volume * Add private dns zone * Corrected rg var * Added Nexus letsencrypt cert gen * Fixed linting * Changed terraform.lock.hcl to previous version * Removed leftover debug * Typo fix Co-authored-by: Stuart Leeks <[email protected]> * File path amend Co-authored-by: Stuart Leeks <[email protected]> * Fix for cloudapp DNS resolution errors * Docker running on Nexus VM * Documented Letsencrypt process * Permissions fix * Typo fix Co-authored-by: Stuart Leeks <[email protected]> * Typo fix Co-authored-by: Stuart Leeks <[email protected]> * Typo fix Co-authored-by: Stuart Leeks <[email protected]> * Formatting changes * Added reference to letsencrypt doc * Added new page reference * Moved password generation for nexus to tf * Write script to fs first before execution * Password reset finally working * Make config nexus script runnable from any dir * Added basic status info * Fix recursive file loop * Typo fix * Updated docs * renamed env file * Fix typo * Added new nexus fqdn to user resources * Add vnet link to workspaces * Bump versions * Removed nexus properties file * Updated execution permissions * Get cert in tf * Added az cli get cert * Amended prune job * Added msi id to login * Amended msi and exported cert pwd * Jetty configuration * Escape jetty vars * Password script fixes * Amended networking to use module * Use https in config script * Removed res proc location variable * Potential linting fix * Linting fixes * Linting directive positioning * Gitea version bump * Terraform format * Reorder linting to workaround superlinter bug with Terraform * Added nexus-cert to build and caching of letsencrypt * Adopted new shared service deploy method * Added cron job to renew nexus cert * Removed location references * And another * Removed location refs and added az cli * Fixed nexus-cert kv permissions * Corrected outputs directory * Fixed shared service deployment steps * Updated docs and removed renew prompt * version bump * Increase bundle versions * remote location from variables files * Removed shared service make * Removed docker prune * Bash headers * Layer clean * Reduce layer * Testing without kv role assignment * Removed kv role assignment * Adding firewall rule to allow letsencrypt from RP * Genericised cert service and added letsencrypt action * Fixed auth hook * Removed make commands * Certbot in bundle container * Tidied naming * Python base image * Generate action successful * Inject cert name to nexus bundle * Implemented app gateway start/stop * Separated cloudinit yaml into scripts * Fixed new line issue * Fixed bash casing * Added local nexus repo config * Added retry logic to config repos * gitea bump * Fixed status code * terraform linting * Added docs * Lint fix * Update docs/tre-developers/letsencrypt.md * Update docs/tre-admins/setup-instructions/configuring-shared-services.md * Update docs/tre-developers/letsencrypt.md * Update docs/tre-developers/letsencrypt.md * Update docs/tre-admins/setup-instructions/configuring-shared-services.md Co-authored-by: Marcus Robinson <[email protected]> * Fix firewall conflict * Added note to docs for cert kv conflicts * Renamed sonatype-nexus to nexus for new version * Added old nexus service code * Lint fix * Renamed folder to be obvious as the nexus-vm * Added docs for upgrade path * Added data.azurerm rg core * linting * bash linting * Require workspace of 0.2.14 or above * Moved new version notes to section below config steps * Removed give new cert name * RP cert permissions * tf format * Added required params for certs and nexus tempalte schema * Added cert import permissions * Added certs delete permission * App gateway az login * Version bumps * tf fmt * Added missing az cred params to certs * Add purge permission * Bump tf versions to 3.4.0 & set purge to false * Removed unsupported property from new provider * Moved nexus private zone to core * Amended location var * Amended zone location * Added upgrade flag for tf * Remove tf lock * Added new tf key * Added key into uninstall * Resolve firewall rule conflicts * Var reference fix * Fix for potential @ symbol in nexus admin password causing curl bug * Added nexus_version variable to user resources for back compat * Added docs for nexus_version * downgrade superlinter * revert superlinter to v4 * Remove lint aws plugin block * Use superlinter latest * Manually set tflint path Co-authored-by: oliver7598 <[email protected]> Co-authored-by: Stuart Leeks <[email protected]> Co-authored-by: Ross Smith <[email protected]> Co-authored-by: ross-p-smith <[email protected]> Co-authored-by: Jamie D <[email protected]> Co-authored-by: Stuart Leeks <[email protected]> Co-authored-by: marrobi <[email protected]>
- Loading branch information
8 people
authored
May 26, 2022
1 parent
7f5a5ac
commit 350d8a0
Showing
77 changed files
with
2,099 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -42,14 +42,17 @@ jobs: | |
| if: ${{ steps.filter.outputs.terraform == 'true' }} | ||
| run: | | ||
| find . -type d -name 'terraform' -not -path '*cnab*' -print0 \ | ||
| | xargs -0 -I{} sh -c 'echo "***** Validating: {} *****"; \ | ||
| | xargs -0 -I{} sh -c 'echo "***** Validating: {} *****"; \https://github.com/github/super-linter/issues/2433 | ||
| terraform -chdir={} init -backend=false; terraform -chdir={} validate' | ||
| - name: Lint code base | ||
| # the slim image is 2GB smaller and we don't use the extra stuff | ||
| # Moved this after the Terraform checks above due something similar to this issue: https://github.com/github/super-linter/issues/2433 | ||
| uses: github/super-linter/[email protected].2 | ||
| uses: github/super-linter/[email protected].3 | ||
| env: | ||
| # Until https://github.com/github/super-linter/commit/ec0662756da93f1e3aad4df049712df7d764d143 is released | ||
| # we need to set the correct plugin directory (which is incorrectly set to github/home/.tflint.d/plugins by default) | ||
| TFLINT_PLUGIN_DIR: "/root/.tflint.d/plugins" | ||
| VALIDATE_ALL_CODEBASE: false | ||
| DEFAULT_BRANCH: main | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
107 changes: 101 additions & 6 deletions
107
docs/tre-admins/setup-instructions/configuring-shared-services.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| # Letsencrypt | ||
|
|
||
| Certain components of the TRE require the aquisition of a certificate via Letsencrypt to ensure secure HTTPS connections. | ||
|
|
||
| In order to aquire these certificates, there must be a public facing endpoint which can be reached by Letsencrypt. | ||
|
|
||
| As TREs are secured environments with very few publicly facing points, additional resources are required to ensure the certificate can be provisioned for the correct domain. | ||
|
|
||
| The additional resources are as followed: | ||
|
|
||
| 1. Public IP provisioned in the same location as the web app that the certificate is intended for; this will also have a domain label which matches the web app name. | ||
| 1. Storage Account with a static web app. | ||
| 1. Application gateway to route traffic from the Public IP to the static web app | ||
|
|
||
| The following diagram illustrated the flow of data between the resources: | ||
|
|
||
| ```mermaid | ||
| flowchart RL | ||
| subgraph .dev Container | ||
| direction TB | ||
| A(letsencrypt process runs) | ||
| end | ||
| subgraph External | ||
| direction TB | ||
| B[letsencrypt authority] | ||
| end | ||
| subgraph TRE | ||
| subgraph Core VNet | ||
| C[Public IP <br/> Domain Label: < web-app-name > <br/> Endpoint: < web-app-name >.< location >.cloudapp.net] | ||
| subgraph Storage Account | ||
| D[SA Static Site] | ||
| end | ||
| end | ||
| subgraph VNet | ||
| E[Key Vault <br/> kv-< tre_id >] | ||
| subgraph VM | ||
| F[Web App] | ||
| end | ||
| G[Private DNS Zone < web-app-name >.< location >.cloudapp.net] | ||
| end | ||
| end | ||
| A --> |1. Request to | B | ||
| B --> |2. Attempts to hit | C | ||
| C --> |3. App Gateway routes | D | ||
| D --> |4. Responds | C | ||
| C --> |5. Responds | B | ||
| B --> |6. Acquires certificate | A | ||
| A --> |7. Stores Certificate | E | ||
| F --> |8. Pulls Certificate | E | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| # See https://docs.docker.com/engine/reference/builder/#dockerignore-file | ||
| # Put files here that you don't want copied into your bundle's invocation image | ||
| .gitignore | ||
| **/.terraform/* | ||
| **/.terraform.lock.hcl | ||
| **/*_backend.tf | ||
| Dockerfile.tmpl |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| .cnab/ | ||
| .terraform* |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| FROM python:3.8 | ||
|
|
||
| ARG BUNDLE_DIR | ||
|
|
||
| RUN apt-get update \ | ||
| && apt-get install -y ca-certificates \ | ||
| && apt-get clean -y && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # Install Azure CLI | ||
| RUN apt-get update \ | ||
| && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \ | ||
| && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \ | ||
| && AZ_REPO=$(lsb_release -cs) \ | ||
| && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \ | ||
| && apt-get update && apt-get -y install azure-cli \ | ||
| && apt-get clean -y && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # Install Certbot | ||
| RUN apt-get update && apt-get install -y python3 python3-venv libaugeas0 \ | ||
| && python3 -m venv /opt/certbot/ \ | ||
| && /opt/certbot/bin/pip install --no-cache-dir --upgrade pip \ | ||
| && /opt/certbot/bin/pip install --no-cache-dir certbot \ | ||
| && apt-get clean -y && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # Use the BUNDLE_DIR build argument to copy files into the bundle | ||
| COPY . $BUNDLE_DIR |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| { | ||
| "schemaVersion": "1.0.0-DRAFT", | ||
| "name": "base", | ||
| "created": "2021-06-04T13:37:29.5071039+03:00", | ||
| "modified": "2021-06-04T13:37:29.5071039+03:00", | ||
| "parameters": [ | ||
| { | ||
| "name": "tre_id", | ||
| "source": { | ||
| "env": "TRE_ID" | ||
| } | ||
| }, | ||
| { | ||
| "name": "azure_location", | ||
| "source": { | ||
| "env": "LOCATION" | ||
| } | ||
| }, | ||
| { | ||
| "name": "tfstate_container_name", | ||
| "source": { | ||
| "env": "TERRAFORM_STATE_CONTAINER_NAME" | ||
| } | ||
| }, | ||
| { | ||
| "name": "tfstate_resource_group_name", | ||
| "source": { | ||
| "env": "MGMT_RESOURCE_GROUP_NAME" | ||
| } | ||
| }, | ||
| { | ||
| "name": "tfstate_storage_account_name", | ||
| "source": { | ||
| "env": "MGMT_STORAGE_ACCOUNT_NAME" | ||
| } | ||
| } | ||
| ] | ||
| } |
Oops, something went wrong.