Skip to content

Commit 20f6a66

Browse files
ThibaultDacThibaultDac
committed
Add the base for the docker swarm
1 parent 93b296c commit 20f6a66

9 files changed

+305
-0
lines changed

‎README.md

+80
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,82 @@
11
# pyro-devops
2+
23
Deployment and infrastructure management
4+
5+
6+
7+
## Getting started
8+
9+
## Structure
10+
11+
The file docker-swarm.yml is used for the docker swarm
12+
The folder nginx is a demo for a image of a reverse proxy with nginx
13+
14+
### Prerequisites
15+
16+
17+
- Docker swarm
18+
19+
20+
21+
### Installation
22+
23+
https://docs.docker.com/get-docker/
24+
25+
https://docs.docker.com/engine/swarm/swarm-tutorial/create-swarm/
26+
27+
28+
## Security good practice
29+
https://docs.docker.com/engine/install/linux-postinstall/
30+
Log your infrastructure and your containers (portainer,...)
31+
Run your ssh/administration on a private network (with bastion + vpn)
32+
https://www.stackrox.com/post/2019/09/docker-security-101/
33+
AppArmor/ SELinux,failtoban, iptable, waf
34+
Check your SLA, IT Disastery Recovery process
35+
Vulnerability assessment and management (VAM)
36+
Identity and Access Management
37+
38+
## Usage
39+
40+
41+
42+
43+
Export the variables/secret in your env file (if you don't have a Vault)
44+
```
45+
export BUCKET_MEDIA_FOLDER=media
46+
...
47+
```
48+
49+
If needed build your images (for exemple the mynginx image in the folder nginx) and push it in the local registry
50+
51+
```
52+
docker run -d -p 5000:5000 --restart=always --name registry registry:2 #start the local registry
53+
54+
docker build -t pyro/mynginx .
55+
56+
docker image tag pyro/mynginx localhost:5000/mynginx
57+
58+
docker push localhost:5000/mynginx:latest
59+
60+
docker pull localhost:5000/mynginx
61+
```
62+
63+
and after deploy your docker swarm
64+
```
65+
66+
docker stack deploy -c docker-swarm.yml my_node
67+
68+
```
69+
70+
You can check that the service is running with
71+
72+
73+
74+
```
75+
76+
docker service ls
77+
78+
docker ps
79+
80+
docker service logs xxxxxx
81+
82+
```

‎docker-swarm.yml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
version: '3.7'
2+
3+
services:
4+
web:
5+
image: localhost:5000/myapp:latest #Todo change for have the offical pyro-api image on docker hub
6+
command: uvicorn app.main:app --reload --workers 1 --host 0.0.0.0 --port 5000 #if the port if edited, please inject a new nginx.conf config in the reverseproxy
7+
volumes:
8+
- ./src/:/usr/src/app/
9+
environment:
10+
- DATABASE_URL=postgresql://pyro_api:pyro_api@db/pyro_api_dev #todo fill here the real values from the vault/env
11+
- TEST_DATABASE_URL=postgresql://pyro_api_test:pyro_api_test@test_db/pyro_api_dev_test #todo fill here the real values from the vault/env
12+
- SUPERUSER_LOGIN=superuser #todo fill here the real values from the vault/env
13+
- SUPERUSER_PWD=superuser #todo fill here the real values from the vault/env
14+
- QARNOT_TOKEN=${QARNOT_TOKEN}
15+
- BUCKET_NAME=${BUCKET_NAME}
16+
- BUCKET_MEDIA_FOLDER=${BUCKET_MEDIA_FOLDER}
17+
deploy:
18+
resources: #todo increase the limit if needed
19+
limits:
20+
cpus: '0.60'
21+
memory: 100M
22+
reservations:
23+
cpus: '0.50'
24+
memory: 40M
25+
replicas: 15 # for some load balancing
26+
restart_policy:
27+
max_attempts: 3
28+
condition: on-failure
29+
update_config:
30+
parallelism: 3
31+
delay: 10s
32+
networks:
33+
- balance
34+
cap_drop:
35+
- ALL #limit the permission of the service
36+
db:
37+
image: postgres:12.1-alpine
38+
volumes:
39+
- postgres_data:/var/lib/postgresql/data/ #for data persistence
40+
environment:
41+
- POSTGRES_USER=pyro_api #todo fill here the real values from the vault/env
42+
- POSTGRES_PASSWORD=pyro_api #todo fill here the real values from the vault/env
43+
- POSTGRES_DB=pyro_api_dev #todo fill here the real values from the vault/env
44+
networks:
45+
- balance
46+
47+
proxytwo:
48+
image: localhost:5000/mynginx:latest #nginx with some security addition
49+
ports:
50+
- 80:6000 #todo use https (port 443) when the certificate is ready
51+
depends_on:
52+
- web
53+
deploy:
54+
placement:
55+
constraints: [node.role == manager]
56+
networks:
57+
- balance
58+
59+
networks:
60+
balance:
61+
driver: overlay
62+
63+
volumes:
64+
postgres_data:
65+
66+
67+
68+

‎nginx/Dockerfile

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
FROM nginx
2+
RUN rm /etc/nginx/conf.d/default.conf
3+
4+
COPY nginx.conf /etc/nginx/conf.d/default.conf
5+
COPY common.conf /etc/nginx/common.conf
6+
COPY common_location.conf /etc/nginx/common_location.conf
7+
COPY buffer.conf /etc/nginx/buffer.conf
8+
#USER root
9+
10+
11+
12+
## add permissions for nginx user
13+
#RUN chown -R nginx:nginx /var/cache/nginx && \
14+
# chown -R nginx:nginx /var/log/nginx && \
15+
# chown -R nginx:nginx /etc/nginx/conf.d
16+
#RUN touch /var/run/nginx.pid && \
17+
# chown -R nginx:nginx /var/run/nginx.pid
18+
ARG NGINX_MODULES=" \
19+
--with-http_ssl_module \
20+
--with-http_v2_module \
21+
--with-http_gzip_static_module \
22+
--with-http_stub_status_module \
23+
--with-file-aio \
24+
--with-threads \
25+
--with-pcre-jit \
26+
--without-http_ssi_module \
27+
--without-http_scgi_module \
28+
--without-http_uwsgi_module \
29+
--without-http_geo_module \
30+
--without-http_autoindex_module \
31+
--without-http_split_clients_module \
32+
--without-http_memcached_module \
33+
--without-http_empty_gif_module \
34+
--without-http_browser_module"
35+
#USER nginx
36+
#COPY nginx.conf /etc/nginx/conf.d/default.conf2
37+

‎nginx/buffer.conf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
client_body_buffer_size 1k;
2+
client_header_buffer_size 1k;
3+
client_max_body_size 1k;
4+
large_client_header_buffers 2 1k;

‎nginx/common.conf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
2+
add_header X-Frame-Options SAMEORIGIN;
3+
add_header X-Content-Type-Options nosniff;
4+
add_header X-XSS-Protection "1; mode=block";

‎nginx/common_location.conf

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
proxy_set_header X-Real-IP $remote_addr;
2+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
3+
proxy_set_header X-Forwarded-Proto $scheme;
4+
proxy_set_header Host $host;
5+
proxy_set_header X-Forwarded-Host $host;
6+
proxy_set_header X-Forwarded-Port $server_port;

‎nginx/nginx.conf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
upstream loadbalance {
2+
least_conn;
3+
server web:5000;
4+
}
5+
6+
server {
7+
server_name pyro.test;
8+
server_tokens off;
9+
listen 6000;
10+
include /etc/nginx/common.conf;
11+
include /etc/nginx/buffer.conf;
12+
#limit_conn_zone $binary_remote_addr zone=addr:5m; todo
13+
#limit_conn addr 1; todo
14+
#todo check all the methods in the api
15+
if ($request_method !~ ^(GET|HEAD|POST|DELETE)$) {
16+
return 444;
17+
}
18+
19+
#todo create the certificate and import it
20+
#include /etc/nginx/ssl.conf;for ssl
21+
#return 301 https://$host$request_uri;
22+
location / {
23+
proxy_pass http://loadbalance;
24+
include /etc/nginx/common_location.conf;
25+
}
26+
}

‎nginx/ssl.conf

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
2+
ssl_ecdh_curve secp384r1;
3+
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384 OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256";
4+
ssl_prefer_server_ciphers on;
5+
ssl_dhparam /etc/nginx/dhparams.pem;
6+
ssl_certificate /etc/ssl/private/fullchain.pem;
7+
ssl_certificate_key /etc/ssl/private/privkey.pem;
8+
ssl_session_timeout 10m;
9+
ssl_session_cache shared:SSL:10m;
10+
ssl_session_tickets off;
11+
ssl_stapling on;
12+
ssl_stapling_verify on;

‎nginx/sysctl.conf

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Avoid a smurf attack
2+
net.ipv4.icmp_echo_ignore_broadcasts = 1
3+
4+
# Turn on protection for bad icmp error messages
5+
net.ipv4.icmp_ignore_bogus_error_responses = 1
6+
7+
# Turn on syncookies for SYN flood attack protection
8+
net.ipv4.tcp_syncookies = 1
9+
10+
# Turn on and log spoofed, source routed, and redirect packets
11+
net.ipv4.conf.all.log_martians = 1
12+
net.ipv4.conf.default.log_martians = 1
13+
14+
# No source routed packets here
15+
net.ipv4.conf.all.accept_source_route = 0
16+
net.ipv4.conf.default.accept_source_route = 0
17+
18+
# Turn on reverse path filtering
19+
net.ipv4.conf.all.rp_filter = 1
20+
net.ipv4.conf.default.rp_filter = 1
21+
22+
# Make sure no one can alter the routing tables
23+
net.ipv4.conf.all.accept_redirects = 0
24+
net.ipv4.conf.default.accept_redirects = 0
25+
net.ipv4.conf.all.secure_redirects = 0
26+
net.ipv4.conf.default.secure_redirects = 0
27+
28+
# Don't act as a router
29+
net.ipv4.ip_forward = 0
30+
net.ipv4.conf.all.send_redirects = 0
31+
net.ipv4.conf.default.send_redirects = 0
32+
33+
34+
# Turn on execshild
35+
kernel.exec-shield = 1
36+
kernel.randomize_va_space = 1
37+
38+
# Tuen IPv6
39+
net.ipv6.conf.default.router_solicitations = 0
40+
net.ipv6.conf.default.accept_ra_rtr_pref = 0
41+
net.ipv6.conf.default.accept_ra_pinfo = 0
42+
net.ipv6.conf.default.accept_ra_defrtr = 0
43+
net.ipv6.conf.default.autoconf = 0
44+
net.ipv6.conf.default.dad_transmits = 0
45+
net.ipv6.conf.default.max_addresses = 1
46+
47+
# Optimization for port usefor LBs
48+
# Increase system file descriptor limit
49+
fs.file-max = 65535
50+
51+
# Allow for more PIDs (to reduce rollover problems); may break some programs 32768
52+
kernel.pid_max = 65536
53+
54+
# Increase system IP port limits
55+
net.ipv4.ip_local_port_range = 2000 65000
56+
57+
# Increase TCP max buffer size setable using setsockopt()
58+
net.ipv4.tcp_rmem = 4096 87380 8388608
59+
net.ipv4.tcp_wmem = 4096 87380 8388608
60+
61+
# Increase Linux auto tuning TCP buffer limits
62+
# min, default, and max number of bytes to use
63+
# set max to at least 4MB, or higher if you use very high BDP paths
64+
# Tcp Windows etc
65+
net.core.rmem_max = 8388608
66+
net.core.wmem_max = 8388608
67+
net.core.netdev_max_backlog = 5000
68+
net.ipv4.tcp_window_scaling = 1

0 commit comments

Comments
 (0)