central-cli 0.6.3

data/lib/central/errors.rb

@@ -0,0 +1,10 @@
+module Central
+  module Errors
+    class StandardError < ::StandardError
+      def initialize(status, message)
+        @status = status
+        super(message)
+      end
+    end
+  end
+end

data/lib/central/machine/aws.rb

@@ -0,0 +1,14 @@
+begin
+  require 'aws-sdk'
+rescue LoadError
+  puts "It seems that you don't have gem for AWS API installed."
+  puts 'Install it using: gem install aws-sdk'
+  exit 1
+end
+
+require_relative 'random_name'
+require_relative 'cert_helper'
+require_relative 'aws/auth_provisioner'
+require_relative 'aws/master_provisioner'
+require_relative 'aws/node_provisioner'
+require_relative 'aws/node_destroyer'

data/lib/central/machine/aws/auth_provisioner.rb

@@ -0,0 +1,161 @@
+require 'fileutils'
+require 'erb'
+require 'open3'
+require 'shell-spinner'
+require_relative 'common'
+
+module Central
+  module Machine
+    module Aws
+      class AuthProvisioner
+        include RandomName
+        include Common
+        include Machine::CertHelper
+        attr_reader :ec2, :http_client, :region
+
+        # @param [String] access_key_id aws_access_key_id
+        # @param [String] secret_key aws_secret_access_key
+        # @param [String] region
+        def initialize(access_key_id, secret_key, region)
+          @ec2 = ::Aws::EC2::Resource.new(
+            region: region,
+            credentials: ::Aws::Credentials.new(access_key_id, secret_key)
+          )
+        end
+
+        # @param [Hash] opts
+        def run!(opts)
+          ssl_cert = nil
+          if opts[:ssl_cert]
+            unless File.exist?(File.expand_path(opts[:ssl_cert]))
+              abort('Invalid ssl cert')
+            end
+            ssl_cert = File.read(File.expand_path(opts[:ssl_cert]))
+          else
+            ShellSpinner 'Generating self-signed SSL certificate' do
+              ssl_cert = generate_self_signed_cert
+            end
+          end
+
+          ami = resolve_ami(region)
+          abort('No valid AMI found for region') unless ami
+          opts[:vpc] = default_vpc.vpc_id unless opts[:vpc]
+          subnet = if opts[:subnet].nil?
+                     default_subnet(opts[:vpc], region + opts[:zone])
+                   else
+                     ec2.subnet(opts[:subnet])
+                   end
+          userdata_vars = {
+            ssl_cert: ssl_cert,
+            version: opts[:version]
+          }
+
+          security_group = ensure_security_group(opts[:vpc])
+          name = generate_name
+          ec2_instance = ec2.create_instances(
+            image_id: ami,
+            min_count: 1,
+            max_count: 1,
+            instance_type: opts[:type],
+            security_group_ids: [security_group.group_id],
+            key_name: opts[:key_pair],
+            subnet_id: subnet.subnet_id,
+            user_data: Base64.encode64(user_data(userdata_vars)),
+            block_device_mappings: [
+              {
+                device_name: '/dev/xvda',
+                virtual_name: 'Root',
+                ebs: {
+                  volume_size: opts[:storage],
+                  volume_type: 'gp2'
+                }
+              }
+            ]
+          ).first
+          ec2_instance.create_tags(tags: [{ key: 'Name', value: name }])
+          ShellSpinner "Creating AWS instance #{name.colorize(:cyan)} " do
+            sleep 5 until ec2_instance.reload.state.name == 'running'
+          end
+          auth_url = "https://#{ec2_instance.public_ip_address}"
+          Excon.defaults[:ssl_verify_peer] = false
+          http_client = Excon.new(auth_url, connect_timeout: 10)
+          ShellSpinner "Waiting for #{name.colorize(:cyan)} to start" do
+            sleep 5 until master_running?(http_client)
+          end
+
+          puts 'Central Machine OAuth Agent is now running'
+        end
+
+        # @param [String] vpc_id
+        # @return [Aws::EC2::SecurityGroup]
+        def ensure_security_group(vpc_id)
+          group_name = 'central_machine_oauth'
+          sg = ec2.security_groups(
+            filters: [
+              { name: 'group-name', values: [group_name] },
+              { name: 'vpc-id', values: [vpc_id] }
+            ]
+          ).first
+          unless sg
+            ShellSpinner 'Creating AWS security group' do
+              sg = create_security_group(group_name, vpc_id)
+            end
+          end
+          sg
+        end
+
+        # creates security_group and authorizes default port ranges
+        #
+        # @param [String] name
+        # @param [String, NilClass] vpc_id
+        # @return Aws::EC2::SecurityGroup
+        def create_security_group(name, vpc_id = nil)
+          sg = ec2.create_security_group(
+            group_name: name,
+            description: 'Central Machine OAuth',
+            vpc_id: vpc_id)
+          sg.create_tags(tags: [
+                           { key: 'Name', value: name }
+                         ])
+          sg.authorize_ingress( # SSHD
+            ip_protocol: 'tcp',
+            from_port: 22,
+            to_port: 22,
+            cidr_ip: '24.7.32.100/32')
+          sg.authorize_ingress( # HTTPS
+            ip_protocol: 'tcp',
+            from_port: 443,
+            to_port: 443,
+            cidr_ip: '0.0.0.0/0')
+          sg
+        end
+
+        # @return [String]
+        def region
+          ec2.client.config.region
+        end
+
+        def user_data(vars)
+          cloudinit_template = File.join(__dir__, '/cloudinit_oauth.yml')
+          erb(File.read(cloudinit_template), vars)
+        end
+
+        def generate_name
+          "central-machine-oauth-#{super}-#{rand(1..99)}"
+        end
+
+        def master_running?(http_client)
+          http_client.get(path: '/v1/ping').status == 200
+        rescue
+          false
+        end
+
+        def erb(template, vars)
+          ERB.new(template).result(
+            OpenStruct.new(vars).instance_eval { binding }
+          )
+        end
+      end
+    end
+  end
+end

data/lib/central/machine/aws/cloudinit.yml

@@ -0,0 +1,71 @@
+#cloud-config
+hostname: <%= name %>
+write_files:
+  - path: /etc/central-agent.env
+    permissions: 0600
+    owner: root
+    content: |
+      CENTRAL_URI="<%= master_uri %>"
+      CENTRAL_TOKEN="<%= stack_token %>"
+      CENTRAL_PEER_INTERFACE=eth1
+      CENTRAL_VERSION=<%= version %>
+  - path: /etc/systemd/system/docker.service.d/50-central.conf
+    content: |
+        [Service]
+        Environment='DOCKER_OPTS=--insecure-registry="10.81.0.0/19" --bip="172.17.43.1/16"'
+  - path: /etc/sysctl.d/99-inotify.conf
+    owner: root
+    permissions: 0644
+    content: |
+      fs.inotify.max_user_instances = 8192
+coreos:
+  units:
+    - name: 00-eth.network
+      runtime: true
+      content: |
+        [Match]
+        Name=eth*
+        [Network]
+        DHCP=yes
+        DNS=172.17.43.1
+        DNS=<%= dns_server %>
+        DOMAINS=central.local
+        [DHCP]
+        UseDNS=false
+
+    - name: 10-weave.network
+      runtime: false
+      content: |
+        [Match]
+        Type=bridge
+        Name=weave*
+
+        [Network]
+    - name: central-agent.service
+      command: start
+      enable: true
+      content: |
+        [Unit]
+        Description=central-agent
+        After=network-online.target
+        After=docker.service
+        Description=Central Agent
+        Documentation=http://www.central.io/
+        Requires=network-online.target
+        Requires=docker.service
+
+        [Service]
+        Restart=always
+        RestartSec=5
+        EnvironmentFile=/etc/central-agent.env
+        ExecStartPre=-/usr/bin/docker stop central-agent
+        ExecStartPre=-/usr/bin/docker rm central-agent
+        ExecStartPre=/usr/bin/docker pull fishyard/agent:${CENTRAL_VERSION}
+        ExecStart=/usr/bin/docker run --name central-agent \
+            -e CENTRAL_URI=${CENTRAL_URI} \
+            -e CENTRAL_TOKEN=${CENTRAL_TOKEN} \
+            -e CENTRAL_PEER_INTERFACE=${CENTRAL_PEER_INTERFACE} \
+            -v=/var/run/docker.sock:/var/run/docker.sock \
+            -v=/etc/central-agent.env:/etc/central.env \
+            --net=host \
+            fishyard/agent:${CENTRAL_VERSION}

data/lib/central/machine/aws/cloudinit_master.yml

@@ -0,0 +1,118 @@
+#cloud-config
+write_files:
+  - path: /etc/central-server.env
+    permissions: 0600
+    owner: root
+    content: |
+      CENTRAL_VERSION=<%= version %>
+      CENTRAL_VAULT_KEY=<%= vault_secret %>
+      CENTRAL_VAULT_IV=<%= vault_iv %>
+      <% if ssl_cert %>SSL_CERT="/etc/central-server.pem"
+
+  - path: /etc/central-server.pem
+    permissions: 0600
+    owner: root
+    content: | <% ssl_cert.split(/\n/).each do |row| %>
+      <%= row %><% end %><% end %>
+  - path: /opt/bin/central-haproxy.sh
+    permissions: 0755
+    owner: root
+    content: |
+      #!/bin/sh
+      if [ -n "$SSL_CERT" ]; then
+        SSL_CERT=$(awk 1 ORS='\\n' $SSL_CERT)
+      else
+        SSL_CERT="**None**"
+      fi
+      /usr/bin/docker run --name=central-server-haproxy \
+        --link central-server-api:central-server-api \
+        -e SSL_CERT="$SSL_CERT" \
+        -p 80:80 -p 443:443 fishyard/haproxy:latest
+coreos:
+  units:
+<% unless mongodb_uri -%>
+    - name: central-server-mongo.service
+      command: start
+      enable: true
+      content: |
+        [Unit]
+        Description=central-server-mongo
+        After=network-online.target
+        After=docker.service
+        Description=Central Server MongoDB
+        Documentation=http://www.mongodb.org/
+        Requires=network-online.target
+        Requires=docker.service
+
+        [Service]
+        Restart=always
+        RestartSec=5
+        ExecStartPre=/usr/bin/docker pull mongo:3.0
+        ExecStartPre=-/usr/bin/docker create --name=central-server-mongo-data mongo:3.0
+        ExecStartPre=-/usr/bin/docker stop central-server-mongo
+        ExecStartPre=-/usr/bin/docker rm central-server-mongo
+        ExecStart=/usr/bin/docker run --name=central-server-mongo \
+            --volumes-from=central-server-mongo-data \
+            mongo:3.0 mongod --smallfiles
+<% end -%>
+    - name: central-server-api.service
+      command: start
+      enable: true
+      content: |
+        [Unit]
+        Description=central-server-api
+        After=network-online.target
+        After=docker.service
+        After=central-server-mongo.service
+        Description=Central Machine
+        Documentation=http://www.central.io/
+        Before=central-server-haproxy.service
+        Wants=central-server-haproxy.service
+        Requires=network-online.target
+        Requires=docker.service
+<% unless mongodb_uri -%>
+        Requires=central-server-mongo.service
+<% end %>
+
+        [Service]
+        Restart=always
+        RestartSec=5
+        EnvironmentFile=/etc/central-server.env
+        ExecStartPre=-/usr/bin/docker stop central-server-api
+        ExecStartPre=-/usr/bin/docker rm central-server-api
+        ExecStartPre=/usr/bin/docker pull fishyard/server:${CENTRAL_VERSION}
+        ExecStart=/usr/bin/docker run --name central-server-api \
+  <% if mongodb_uri -%>
+            -e MONGODB_URI=<%= mongodb_uri %> \
+  <% else -%>
+            --link central-server-mongo:mongodb \
+            -e MONGODB_URI=mongodb://mongodb:27017/central_server \
+  <% end -%>
+  <% if auth_server %>
+            -e AUTH_API_URL=<%= auth_server %> \
+  <% end -%>
+            -e VAULT_KEY=${CENTRAL_VAULT_KEY} -e VAULT_IV=${CENTRAL_VAULT_IV} \
+            fishyard/server:${CENTRAL_VERSION}
+
+    - name: central-server-haproxy.service
+      command: start
+      enable: true
+      content: |
+        [Unit]
+        Description=central-server-haproxy
+        After=network-online.target
+        After=docker.service
+        Description=Central Server HAProxy
+        Documentation=http://www.central.io/
+        Requires=network-online.target
+        Requires=docker.service
+        Requires=central-server-api.service
+
+        [Service]
+        Restart=always
+        RestartSec=5
+        EnvironmentFile=/etc/central-server.env
+        ExecStartPre=-/usr/bin/docker stop central-server-haproxy
+        ExecStartPre=-/usr/bin/docker rm central-server-haproxy
+        ExecStartPre=/usr/bin/docker pull fishyard/haproxy:latest
+        ExecStart=/opt/bin/central-haproxy.sh

data/lib/central/machine/aws/cloudinit_oauth.yml

@@ -0,0 +1,76 @@
+#cloud-config
+write_files:
+  - path: /etc/central-machine.env
+    permissions: 0600
+    owner: root
+    content: |
+      CENTRAL_VERSION=<%= version %>
+      <% if ssl_cert %>SSL_CERT="/etc/central-machine.pem"
+
+  - path: /etc/central-machine.pem
+    permissions: 0600
+    owner: root
+    content: | <% ssl_cert.split(/\n/).each do |row| %>
+      <%= row %><% end %><% end %>
+  - path: /opt/bin/central-haproxy.sh
+    permissions: 0755
+    owner: root
+    content: |
+      #!/bin/sh
+      if [ -n "$SSL_CERT" ]; then
+        SSL_CERT=$(awk 1 ORS='\\n' $SSL_CERT)
+      else
+        SSL_CERT="**None**"
+      fi
+      /usr/bin/docker run --name=central-machine-haproxy \
+        --link central-machine-auth \
+        -e SSL_CERT="$SSL_CERT" \
+        -e BACKENDS=central-machine-auth:5000 \
+        -p 80:80 -p 443:443 fishyard/haproxy:latest
+coreos:
+  units:
+    - name: central-machine-auth.service
+      command: start
+      enable: true
+      content: |
+        [Unit]
+        Description=central-machine-auth
+        After=network-online.target
+        After=docker.service
+        Description=Central Server oAuth
+        Documentation=http://www.central.io/
+        Requires=network-online.target
+        Requires=docker.service
+
+        [Service]
+        Restart=always
+        RestartSec=5
+        EnvironmentFile=/etc/central-machine.env
+        ExecStartPre=-/usr/bin/docker stop central-machine-auth
+        ExecStartPre=-/usr/bin/docker rm central-machine-auth
+        ExecStartPre=/usr/bin/docker pull fishyard/auth:${CENTRAL_VERSION}
+        ExecStart=/usr/bin/docker run --name central-machine-auth \
+            -e PORT=5000 -p 5000:5000 fishyard/auth:${CENTRAL_VERSION}
+
+    - name: central-machine-haproxy.service
+      command: start
+      enable: true
+      content: |
+        [Unit]
+        Description=central-machine-haproxy
+        After=network-online.target
+        After=docker.service
+        Description=Central Server HAProxy
+        Documentation=http://www.central.io/
+        Requires=network-online.target
+        Requires=docker.service
+        Requires=central-machine-auth.service
+
+        [Service]
+        Restart=always
+        RestartSec=5
+        EnvironmentFile=/etc/central-machine.env
+        ExecStartPre=-/usr/bin/docker stop central-machine-haproxy
+        ExecStartPre=-/usr/bin/docker rm central-machine-haproxy
+        ExecStartPre=/usr/bin/docker pull fishyard/haproxy:${CENTRAL_VERSION}
+        ExecStart=/opt/bin/central-haproxy.sh