Class: Terrafying::Components::OIDCVPN
- Inherits:
-
Terrafying::Context
- Object
- Terrafying::Context
- Terrafying::Components::OIDCVPN
- Defined in:
- lib/terrafying/components/vpn_oidc.rb
Instance Attribute Summary collapse
-
#cidr ⇒ Object
readonly
Returns the value of attribute cidr.
-
#ip_address ⇒ Object
readonly
Returns the value of attribute ip_address.
-
#name ⇒ Object
readonly
Returns the value of attribute name.
-
#service ⇒ Object
readonly
Returns the value of attribute service.
Class Method Summary collapse
Instance Method Summary collapse
-
#add_iptables_rules_service ⇒ Object
these iptables rules are needed in order to get VPN working.
- #allow_security_group_in(vpc, name: '') ⇒ Object
- #cert_checking_conf ⇒ Object
- #cert_checking_path ⇒ Object
- #cert_checking_service ⇒ Object
- #cert_checking_timer ⇒ Object
- #create_in ⇒ Object
- #egress_security_group ⇒ Object
- #ingress_security_group ⇒ Object
-
#initialize(vpc:, name:, ignition: true, ami: '', client_id:, issuer_url:, ca: nil, groups: [], cidr: '10.8.0.0/24', public: true, subnets: vpc.subnets.fetch(:public, []), static: false, route_all_traffic: false, route_dns_entries: [], units: [], tags: {}, service_options: {}, openvpn_image: 'quay.io/uswitch/openvpn:2.4.8') ⇒ OIDCVPN
constructor
A new instance of OIDCVPN.
- #openvpn_authz_service(ca, fqdn, route_all_traffic, route_dns_entry, groups, client_id, issuer_url) ⇒ Object
- #openvpn_conf ⇒ Object
- #openvpn_env ⇒ Object
-
#openvpn_ip_delay ⇒ Object
OpenVPN doesn’t wait long enough for the tun0 device to init github.com/kylemanna/docker-openvpn/issues/370.
- #openvpn_service ⇒ Object
- #pingable_by(*services) ⇒ Object
- #pingable_by_cidr(*cidrs) ⇒ Object
- #restart_openvpn_authz_service ⇒ Object
- #security_group ⇒ Object
- #used_by(*services) ⇒ Object
- #used_by_cidr(*cidrs) ⇒ Object
- #with_endpoint_service(*args) ⇒ Object
Constructor Details
#initialize(vpc:, name:, ignition: true, ami: '', client_id:, issuer_url:, ca: nil, groups: [], cidr: '10.8.0.0/24', public: true, subnets: vpc.subnets.fetch(:public, []), static: false, route_all_traffic: false, route_dns_entries: [], units: [], tags: {}, service_options: {}, openvpn_image: 'quay.io/uswitch/openvpn:2.4.8') ⇒ OIDCVPN
Returns a new instance of OIDCVPN.
35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 35 def initialize( vpc:, name:, ignition: true, ami: '', client_id:, issuer_url:, ca: nil, groups: [], cidr: '10.8.0.0/24', public: true, subnets: vpc.subnets.fetch(:public, []), static: false, route_all_traffic: false, route_dns_entries: [], units: [], tags: {}, service_options: {}, openvpn_image: 'quay.io/uswitch/openvpn:2.4.8' ) super() @vpc = vpc @name = name @ignition = ignition @ami = ami @client_id = client_id @issuer_url = issuer_url @ca = ca @groups = groups @cidr = cidr @zone = vpc.zone @fqdn = @zone.qualify(name) @public = public @subnets = subnets @static = static @route_all_traffic = route_all_traffic @route_dns_entries = route_dns_entries @units = units @tags = @service_options = @openvpn_image = openvpn_image end |
Instance Attribute Details
#cidr ⇒ Object (readonly)
Returns the value of attribute cidr.
29 30 31 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 29 def cidr @cidr end |
#ip_address ⇒ Object (readonly)
Returns the value of attribute ip_address.
29 30 31 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 29 def ip_address @ip_address end |
#name ⇒ Object (readonly)
Returns the value of attribute name.
29 30 31 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 29 def name @name end |
#service ⇒ Object (readonly)
Returns the value of attribute service.
29 30 31 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 29 def service @service end |
Class Method Details
.create_in(options) ⇒ Object
31 32 33 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 31 def self.create_in() new(**).tap(&:create_in) end |
Instance Method Details
#add_iptables_rules_service ⇒ Object
these iptables rules are needed in order to get VPN working
254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 254 def add_iptables_rules_service { name: 'add-iptables-rules.service', enabled: false, contents: <<~ADD_IPTABLES_RULE [Install] WantedBy=multi-user.target [Unit] Description=Add Iptables rules [Service] Type=oneshot ExecStartPre=/sbin/iptables -A FORWARD -i tun+ -j ACCEPT ExecStart=/sbin/iptables -A FORWARD -o tun+ -j ACCEPT ADD_IPTABLES_RULE } end |
#allow_security_group_in(vpc, name: '') ⇒ Object
136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 136 def allow_security_group_in(vpc, name: '') name = "allow-#{@vpc.name}-vpn".downcase if name.empty? ingress_rules = [ { from_port: 0, to_port: 0, protocol: -1, security_groups: [@service.egress_security_group], ipv6_cidr_blocks: nil, prefix_list_ids: nil, cidr_blocks: nil, self: nil, description: nil, } ] if @public ingress_rules << { from_port: 0, to_port: 0, protocol: -1, cidr_blocks: ["#{@ip_address}/32"], ipv6_cidr_blocks: nil, prefix_list_ids: nil, security_groups: nil, self: nil, description: nil } end resource :aws_security_group, tf_safe("#{name}-#{vpc.name}"), name: name, vpc_id: vpc.id, ingress: ingress_rules end |
#cert_checking_conf ⇒ Object
173 174 175 176 177 178 179 180 181 182 183 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 173 def cert_checking_conf { path: '/opt/cert_checking.yml', mode: '0644', contents: <<~CERT_CHECKING_CONF casource: #{@ca.source} caname: #{@ca.name} fqdn: #{@fqdn} CERT_CHECKING_CONF } end |
#cert_checking_path ⇒ Object
221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 221 def cert_checking_path { name: 'cert_checking.path', contents: <<~CERT_CHECKING_PATH [Unit] Description=Monitor the file for changes [Path] PathChanged=/etc/ssl/#{@ca.name}/#{@fqdn}/cert Unit=restart-openvpn-authz.service [Install] WantedBy=multi-user.target CERT_CHECKING_PATH } end |
#cert_checking_service ⇒ Object
201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 201 def cert_checking_service { name: 'cert_checking.service', enabled: false, contents: <<~CERT_CHECKING_SERVICE [Install] WantedBy=multi-user.target [Unit] Description=cert_checking [Service] Type=oneshot ExecStartPre=-/usr/bin/docker rm -f cert_checking ExecStart=/usr/bin/docker run --name cert_checking \ -e AWS_REGION=#{aws.region} \ -v /etc/ssl/#{@ca.name}:/etc/ssl/#{@ca.name} \ -v /opt/cert_checking.yml:/cert_checking.yml quay.io/uswitch/cert-downloader:v1.0 CERT_CHECKING_SERVICE } end |
#cert_checking_timer ⇒ Object
185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 185 def cert_checking_timer { name: 'cert_checking.timer', contents: <<~CERT_CHECKING_TIMER [Unit] Description=Certificate Checking Service Timer [Timer] OnCalendar=*-*-* 00:00:00 Unit=cert_checking.service [Install] WantedBy=multi-user.target CERT_CHECKING_TIMER } end |
#create_in ⇒ Object
78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 78 def create_in units = [ openvpn_service, add_iptables_rules_service, openvpn_authz_service(@ca, @fqdn, @route_all_traffic, @route_dns_entries, @groups, @client_id, @issuer_url), ] files = [ openvpn_conf, openvpn_env, openvpn_ip_delay, ] if @ca units += [cert_checking_service, cert_checking_path, cert_checking_timer,restart_openvpn_authz_service] files << cert_checking_conf end keypairs = [] keypairs.push(@ca.create_keypair_in(self, @fqdn, zone: @zone)) if @ca instances = [{}] if @static subnet = @subnets.first instances = [{ subnet: subnet, ip_address: subnet.ip_addresses.first }] end @service = add! Service.create_in( @vpc, @name, { ignition: @ignition, eip: @public, public: @public, ports: [22, 443, { number: 1194, type: 'udp' }], tags:@tags, ami:@ami, units: units + @units, files: files, keypairs: keypairs, subnets: @subnets, instances: instances, iam_policy_statements: [ { Effect: 'Allow', Action: [ 'ec2:DescribeRouteTables' ], Resource: [ '*' ] } ] }.merge(@service_options) ) @ip_address = @service.instance_set.instances.first.ip_address end |
#egress_security_group ⇒ Object
389 390 391 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 389 def egress_security_group @service.egress_security_group end |
#ingress_security_group ⇒ Object
385 386 387 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 385 def ingress_security_group @service.ingress_security_group end |
#openvpn_authz_service(ca, fqdn, route_all_traffic, route_dns_entry, groups, client_id, issuer_url) ⇒ Object
284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 284 def openvpn_authz_service(ca, fqdn, route_all_traffic, route_dns_entry, groups, client_id, issuer_url) optional_arguments = [] optional_volumes = [] optional_arguments << '--route-all' if route_all_traffic optional_arguments += groups.map { |group| "--oidc-allowed-groups \"#{group}\"" } optional_arguments += route_dns_entry.map { |entry| "--route-dns-entries #{entry}" } optional_arguments << "--tls-cert-file /etc/ssl/#{ca.name}/#{fqdn}/cert" if ca optional_arguments << "--tls-key-file /etc/ssl/#{ca.name}/#{fqdn}/key" if ca optional_volumes << "/etc/ssl/#{ca.name}:/etc/ssl/#{ca.name}" if ca Ignition.container_unit( 'openvpn-authz', 'quay.io/uswitch/openvpn-authz:2.2', volumes: optional_volumes + [ '/etc/ssl/openvpn:/etc/ssl/openvpn', '/var/openvpn-authz:/var/openvpn-authz' ], environment_variables: [ "AWS_REGION=#{aws.region}" ], ports: ['443'], arguments: optional_arguments + [ "--http-address https://0.0.0.0:443", "--fqdn #{fqdn}", '--cache /var/openvpn-authz', "--oidc-client-id \"#{client_id}\"", "--oidc-issuer-url \"#{issuer_url}\"", '/etc/ssl/openvpn' ] ) end |
#openvpn_conf ⇒ Object
316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 316 def openvpn_conf { path: '/etc/openvpn/openvpn.conf', mode: '0644', contents: <<~EOF server #{cidr_to_split_address(@cidr)} verb 3 iproute /etc/openvpn/ovpn_ip.sh key /etc/ssl/openvpn/server/key ca /etc/ssl/openvpn/ca/cert cert /etc/ssl/openvpn/server/cert dh /etc/ssl/openvpn/dh.pem tls-auth /etc/ssl/openvpn/ta.key cipher AES-256-CBC auth SHA512 tls-version-min 1.2 key-direction 0 keepalive 10 60 persist-key persist-tun proto udp # Rely on Docker to do port mapping, internally always 1194 port 1194 dev tun0 status /tmp/openvpn-status.log user nobody group nogroup EOF } end |
#openvpn_env ⇒ Object
353 354 355 356 357 358 359 360 361 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 353 def openvpn_env { path: '/etc/openvpn/ovpn_env.sh', mode: '0644', contents: <<~EOF declare -x OVPN_SERVER=#{@cidr} EOF } end |
#openvpn_ip_delay ⇒ Object
OpenVPN doesn’t wait long enough for the tun0 device to init github.com/kylemanna/docker-openvpn/issues/370
365 366 367 368 369 370 371 372 373 374 375 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 365 def openvpn_ip_delay { path: '/etc/openvpn/ovpn_ip.sh', mode: '0755', contents: <<~IP_SCRIPT #!/usr/bin/env bash sleep 0.1 /sbin/ip $* IP_SCRIPT } end |
#openvpn_service ⇒ Object
271 272 273 274 275 276 277 278 279 280 281 282 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 271 def openvpn_service Ignition.container_unit( 'openvpn', @openvpn_image, host_networking: true, privileged: true, volumes: [ '/etc/ssl/openvpn:/etc/ssl/openvpn:ro', '/etc/openvpn:/etc/openvpn' ], required_units: ['docker.service', 'network-online.target', 'openvpn-authz.service', 'add-iptables-rules.service'] ) end |
#pingable_by(*services) ⇒ Object
393 394 395 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 393 def pingable_by(*services) @service.pingable_by(*services) end |
#pingable_by_cidr(*cidrs) ⇒ Object
401 402 403 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 401 def pingable_by_cidr(*cidrs) @service.pingable_by_cidr(*cidrs) end |
#restart_openvpn_authz_service ⇒ Object
237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 237 def restart_openvpn_authz_service { name: 'restart-openvpn-authz.service', enabled: false, contents: <<~RESTART_OPENVPN_AUTHZ [Install] WantedBy=multi-user.target [Unit] Description=restart openvpn-authz service [Service] Type=oneshot ExecStart=/usr/bin/systemctl restart openvpn-authz.service RESTART_OPENVPN_AUTHZ } end |
#security_group ⇒ Object
381 382 383 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 381 def security_group @service.security_group end |
#used_by(*services) ⇒ Object
397 398 399 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 397 def used_by(*services) @service.used_by(*services) end |
#used_by_cidr(*cidrs) ⇒ Object
405 406 407 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 405 def used_by_cidr(*cidrs) @service.used_by_cidr(*cidrs) end |
#with_endpoint_service(*args) ⇒ Object
377 378 379 |
# File 'lib/terrafying/components/vpn_oidc.rb', line 377 def with_endpoint_service(*args) @service.with_endpoint_service(*args) end |